From: Greg Kroah-Hartman Date: Fri, 30 Mar 2007 21:11:55 +0000 (-0700) Subject: start 2.6.20.5 review cycle X-Git-Tag: v2.6.20.5~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7a46a62f4ee1bec1700c78cff18988202cc4d3d7;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.20.5 review cycle --- diff --git a/queue-2.6.20/cifs-allow-reset-of-file-to-attr_normal-when-archive-bit-not-set.patch b/review-2.6.20/cifs-allow-reset-of-file-to-attr_normal-when-archive-bit-not-set.patch similarity index 100% rename from queue-2.6.20/cifs-allow-reset-of-file-to-attr_normal-when-archive-bit-not-set.patch rename to review-2.6.20/cifs-allow-reset-of-file-to-attr_normal-when-archive-bit-not-set.patch diff --git a/queue-2.6.20/cifs-reset-mode-when-client-notices-that-attr_readonly-is-no-longer-set.patch b/review-2.6.20/cifs-reset-mode-when-client-notices-that-attr_readonly-is-no-longer-set.patch similarity index 100% rename from queue-2.6.20/cifs-reset-mode-when-client-notices-that-attr_readonly-is-no-longer-set.patch rename to review-2.6.20/cifs-reset-mode-when-client-notices-that-attr_readonly-is-no-longer-set.patch diff --git a/queue-2.6.20/crypto-api-scatterwalk_copychunks-fails-to-advance-through-scatterlist.patch b/review-2.6.20/crypto-api-scatterwalk_copychunks-fails-to-advance-through-scatterlist.patch similarity index 100% rename from queue-2.6.20/crypto-api-scatterwalk_copychunks-fails-to-advance-through-scatterlist.patch rename to review-2.6.20/crypto-api-scatterwalk_copychunks-fails-to-advance-through-scatterlist.patch diff --git a/queue-2.6.20/dccp-fix-exploitable-hole-in-dccp-socket-options.patch b/review-2.6.20/dccp-fix-exploitable-hole-in-dccp-socket-options.patch similarity index 100% rename from queue-2.6.20/dccp-fix-exploitable-hole-in-dccp-socket-options.patch rename to review-2.6.20/dccp-fix-exploitable-hole-in-dccp-socket-options.patch diff --git a/queue-2.6.20/dvb-core-fix-several-locking-related-problems.patch b/review-2.6.20/dvb-core-fix-several-locking-related-problems.patch similarity index 100% rename from queue-2.6.20/dvb-core-fix-several-locking-related-problems.patch rename to review-2.6.20/dvb-core-fix-several-locking-related-problems.patch diff --git a/queue-2.6.20/dvb-fix-nxt200x-rf-input-switching.patch b/review-2.6.20/dvb-fix-nxt200x-rf-input-switching.patch similarity index 100% rename from queue-2.6.20/dvb-fix-nxt200x-rf-input-switching.patch rename to review-2.6.20/dvb-fix-nxt200x-rf-input-switching.patch diff --git a/queue-2.6.20/dvb-isl6421-don-t-reference-freed-memory.patch b/review-2.6.20/dvb-isl6421-don-t-reference-freed-memory.patch similarity index 100% rename from queue-2.6.20/dvb-isl6421-don-t-reference-freed-memory.patch rename to review-2.6.20/dvb-isl6421-don-t-reference-freed-memory.patch diff --git a/queue-2.6.20/fix-decnet-endianness.patch b/review-2.6.20/fix-decnet-endianness.patch similarity index 100% rename from queue-2.6.20/fix-decnet-endianness.patch rename to review-2.6.20/fix-decnet-endianness.patch diff --git a/queue-2.6.20/generic_serial-fix-decoding-of-baud-rate.patch b/review-2.6.20/generic_serial-fix-decoding-of-baud-rate.patch similarity index 100% rename from queue-2.6.20/generic_serial-fix-decoding-of-baud-rate.patch rename to review-2.6.20/generic_serial-fix-decoding-of-baud-rate.patch diff --git a/queue-2.6.20/i2o-block-io-errors-on-i2o-disk.patch b/review-2.6.20/i2o-block-io-errors-on-i2o-disk.patch similarity index 100% rename from queue-2.6.20/i2o-block-io-errors-on-i2o-disk.patch rename to review-2.6.20/i2o-block-io-errors-on-i2o-disk.patch diff --git a/queue-2.6.20/ide-clear-bmdma-status-in-ide_intr-for-ichx-controllers.patch b/review-2.6.20/ide-clear-bmdma-status-in-ide_intr-for-ichx-controllers.patch similarity index 100% rename from queue-2.6.20/ide-clear-bmdma-status-in-ide_intr-for-ichx-controllers.patch rename to review-2.6.20/ide-clear-bmdma-status-in-ide_intr-for-ichx-controllers.patch diff --git a/queue-2.6.20/ide-remove-clearing-bmdma-status-from-cdrom_decode_status.patch b/review-2.6.20/ide-remove-clearing-bmdma-status-from-cdrom_decode_status.patch similarity index 100% rename from queue-2.6.20/ide-remove-clearing-bmdma-status-from-cdrom_decode_status.patch rename to review-2.6.20/ide-remove-clearing-bmdma-status-from-cdrom_decode_status.patch diff --git a/queue-2.6.20/ide-revert-ide-fix-drive-side-80c-cable-check-take-2-for-now.patch b/review-2.6.20/ide-revert-ide-fix-drive-side-80c-cable-check-take-2-for-now.patch similarity index 100% rename from queue-2.6.20/ide-revert-ide-fix-drive-side-80c-cable-check-take-2-for-now.patch rename to review-2.6.20/ide-revert-ide-fix-drive-side-80c-cable-check-take-2-for-now.patch diff --git a/queue-2.6.20/ieee1394-dv1394-fix-cardbus-card-ejection.patch b/review-2.6.20/ieee1394-dv1394-fix-cardbus-card-ejection.patch similarity index 100% rename from queue-2.6.20/ieee1394-dv1394-fix-cardbus-card-ejection.patch rename to review-2.6.20/ieee1394-dv1394-fix-cardbus-card-ejection.patch diff --git a/queue-2.6.20/ipv6-fix-ipv6-round-robin-locking.patch b/review-2.6.20/ipv6-fix-ipv6-round-robin-locking.patch similarity index 100% rename from queue-2.6.20/ipv6-fix-ipv6-round-robin-locking.patch rename to review-2.6.20/ipv6-fix-ipv6-round-robin-locking.patch diff --git a/queue-2.6.20/jmicron-make-ide-jmicron-driver-play-nice-with-libata-ones.patch b/review-2.6.20/jmicron-make-ide-jmicron-driver-play-nice-with-libata-ones.patch similarity index 100% rename from queue-2.6.20/jmicron-make-ide-jmicron-driver-play-nice-with-libata-ones.patch rename to review-2.6.20/jmicron-make-ide-jmicron-driver-play-nice-with-libata-ones.patch diff --git a/queue-2.6.20/libata-bugfix-hdio_drive_task.patch b/review-2.6.20/libata-bugfix-hdio_drive_task.patch similarity index 100% rename from queue-2.6.20/libata-bugfix-hdio_drive_task.patch rename to review-2.6.20/libata-bugfix-hdio_drive_task.patch diff --git a/queue-2.6.20/libata-clear-tf-before-identifying.patch b/review-2.6.20/libata-clear-tf-before-identifying.patch similarity index 100% rename from queue-2.6.20/libata-clear-tf-before-identifying.patch rename to review-2.6.20/libata-clear-tf-before-identifying.patch diff --git a/queue-2.6.20/libata-sata_mv-don-t-touch-reserved-bits-in-edma-config-register.patch b/review-2.6.20/libata-sata_mv-don-t-touch-reserved-bits-in-edma-config-register.patch similarity index 100% rename from queue-2.6.20/libata-sata_mv-don-t-touch-reserved-bits-in-edma-config-register.patch rename to review-2.6.20/libata-sata_mv-don-t-touch-reserved-bits-in-edma-config-register.patch diff --git a/queue-2.6.20/libata-sata_mv-fix-50xx-irq-mask.patch b/review-2.6.20/libata-sata_mv-fix-50xx-irq-mask.patch similarity index 100% rename from queue-2.6.20/libata-sata_mv-fix-50xx-irq-mask.patch rename to review-2.6.20/libata-sata_mv-fix-50xx-irq-mask.patch diff --git a/review-2.6.20/mbox b/review-2.6.20/mbox new file mode 100644 index 00000000000..b1a4bcc7dac --- /dev/null +++ b/review-2.6.20/mbox @@ -0,0 +1,3883 @@ +From gregkh@mini.kroah.org Fri Mar 30 14:00:58 2007 +Message-Id: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/37] 2.6.20-stable review +Status: RO +Content-Length: 717 +Lines: 17 + +This is the start of the stable review cycle for the 2.6.20.5 release. +There are 37 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Tuesday, April 3, 00:00:00 UTC. Anything +received after that time might be too late. + +thanks, + +greg k-h + +From gregkh@mini.kroah.org Fri Mar 30 14:00:58 2007 +Message-Id: <20070330210058.231774624@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Albert Lee , + Sergei Shtylyov , + Adam Hawks , + Bartlomiej Zolnierkiewicz +Subject: [patch 01/37] ide: clear bmdma status in ide_intr() for ICHx controllers (revised #4) +Content-Disposition: inline; filename=ide-clear-bmdma-status-in-ide_intr-for-ichx-controllers.patch +Content-Length: 6099 +Lines: 194 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Albert Lee + +ide: clear bmdma status in ide_intr() for ICHx controllers (revised #4) + +patch 1/2 (revised): +- Fix drive->waiting_for_dma to work with CDB-intr devices. +- Do the dma status clearing in ide_intr() and add a new + hwif->ide_dma_clear_irq for Intel ICHx controllers. + +Revised per Alan, Sergei and Bart's advice. + +Patch against 2.6.20-rc6. Tested ok on my ICH4 and pdc20275 adapters. +Please review/apply, thanks. + +Signed-off-by: Albert Lee +Cc: Sergei Shtylyov +Cc: Alan Cox +Cc: Adam Hawks +Cc: Chuck Ebbert +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-cd.c | 8 ++++++ + drivers/ide/ide-io.c | 11 ++++++++ + drivers/ide/ide.c | 1 + drivers/ide/pci/piix.c | 63 +++++++++++++++++++++++++++++++++++++------------ + include/linux/ide.h | 1 + 5 files changed, 69 insertions(+), 15 deletions(-) + +--- a/drivers/ide/ide-cd.c ++++ b/drivers/ide/ide-cd.c +@@ -930,6 +930,10 @@ static ide_startstop_t cdrom_start_packe + HWIF(drive)->OUTB(drive->ctl, IDE_CONTROL_REG); + + if (CDROM_CONFIG_FLAGS (drive)->drq_interrupt) { ++ /* waiting for CDB interrupt, not DMA yet. */ ++ if (info->dma) ++ drive->waiting_for_dma = 0; ++ + /* packet command */ + ide_execute_command(drive, WIN_PACKETCMD, handler, ATAPI_WAIT_PC, cdrom_timer_expiry); + return ide_started; +@@ -972,6 +976,10 @@ static ide_startstop_t cdrom_transfer_pa + /* Check for errors. */ + if (cdrom_decode_status(drive, DRQ_STAT, NULL)) + return ide_stopped; ++ ++ /* Ok, next interrupt will be DMA interrupt. */ ++ if (info->dma) ++ drive->waiting_for_dma = 1; + } else { + /* Otherwise, we must wait for DRQ to get set. */ + if (ide_wait_stat(&startstop, drive, DRQ_STAT, +--- a/drivers/ide/ide-io.c ++++ b/drivers/ide/ide-io.c +@@ -1646,6 +1646,17 @@ irqreturn_t ide_intr (int irq, void *dev + del_timer(&hwgroup->timer); + spin_unlock(&ide_lock); + ++ /* Some controllers might set DMA INTR no matter DMA or PIO; ++ * bmdma status might need to be cleared even for ++ * PIO interrupts to prevent spurious/lost irq. ++ */ ++ if (hwif->ide_dma_clear_irq && !(drive->waiting_for_dma)) ++ /* ide_dma_end() needs bmdma status for error checking. ++ * So, skip clearing bmdma status here and leave it ++ * to ide_dma_end() if this is dma interrupt. ++ */ ++ hwif->ide_dma_clear_irq(drive); ++ + if (drive->unmask) + local_irq_enable_in_hardirq(); + /* service this interrupt, may set handler for next interrupt */ +--- a/drivers/ide/ide.c ++++ b/drivers/ide/ide.c +@@ -503,6 +503,7 @@ static void ide_hwif_restore(ide_hwif_t + hwif->ide_dma_on = tmp_hwif->ide_dma_on; + hwif->ide_dma_off_quietly = tmp_hwif->ide_dma_off_quietly; + hwif->ide_dma_test_irq = tmp_hwif->ide_dma_test_irq; ++ hwif->ide_dma_clear_irq = tmp_hwif->ide_dma_clear_irq; + hwif->ide_dma_host_on = tmp_hwif->ide_dma_host_on; + hwif->ide_dma_host_off = tmp_hwif->ide_dma_host_off; + hwif->ide_dma_lostirq = tmp_hwif->ide_dma_lostirq; +--- a/drivers/ide/pci/piix.c ++++ b/drivers/ide/pci/piix.c +@@ -411,17 +411,14 @@ fast_ata_pio: + } + + /** +- * init_chipset_piix - set up the PIIX chipset +- * @dev: PCI device to set up +- * @name: Name of the device ++ * piix_is_ichx - check if ICHx ++ * @dev: PCI device to check + * +- * Initialize the PCI device as required. For the PIIX this turns +- * out to be nice and simple ++ * returns 1 if ICHx, 0 otherwise. + */ +- +-static unsigned int __devinit init_chipset_piix (struct pci_dev *dev, const char *name) ++static int piix_is_ichx(struct pci_dev *dev) + { +- switch(dev->device) { ++ switch (dev->device) { + case PCI_DEVICE_ID_INTEL_82801EB_1: + case PCI_DEVICE_ID_INTEL_82801AA_1: + case PCI_DEVICE_ID_INTEL_82801AB_1: +@@ -439,19 +436,51 @@ static unsigned int __devinit init_chips + case PCI_DEVICE_ID_INTEL_ICH7_21: + case PCI_DEVICE_ID_INTEL_ESB2_18: + case PCI_DEVICE_ID_INTEL_ICH8_6: +- { +- unsigned int extra = 0; +- pci_read_config_dword(dev, 0x54, &extra); +- pci_write_config_dword(dev, 0x54, extra|0x400); +- } +- default: +- break; ++ return 1; + } + + return 0; + } + + /** ++ * init_chipset_piix - set up the PIIX chipset ++ * @dev: PCI device to set up ++ * @name: Name of the device ++ * ++ * Initialize the PCI device as required. For the PIIX this turns ++ * out to be nice and simple ++ */ ++ ++static unsigned int __devinit init_chipset_piix (struct pci_dev *dev, const char *name) ++{ ++ if (piix_is_ichx(dev)) { ++ unsigned int extra = 0; ++ pci_read_config_dword(dev, 0x54, &extra); ++ pci_write_config_dword(dev, 0x54, extra|0x400); ++ } ++ ++ return 0; ++} ++ ++/** ++ * piix_dma_clear_irq - clear BMDMA status ++ * @drive: IDE drive to clear ++ * ++ * Called from ide_intr() for PIO interrupts ++ * to clear BMDMA status as needed by ICHx ++ */ ++static void piix_dma_clear_irq(ide_drive_t *drive) ++{ ++ ide_hwif_t *hwif = HWIF(drive); ++ u8 dma_stat; ++ ++ /* clear the INTR & ERROR bits */ ++ dma_stat = hwif->INB(hwif->dma_status); ++ /* Should we force the bit as well ? */ ++ hwif->OUTB(dma_stat, hwif->dma_status); ++} ++ ++/** + * init_hwif_piix - fill in the hwif for the PIIX + * @hwif: IDE interface + * +@@ -487,6 +516,10 @@ static void __devinit init_hwif_piix(ide + if (!hwif->dma_base) + return; + ++ /* ICHx need to clear the bmdma status for all interrupts */ ++ if (piix_is_ichx(hwif->pci_dev)) ++ hwif->ide_dma_clear_irq = &piix_dma_clear_irq; ++ + hwif->atapi_dma = 1; + hwif->ultra_mask = 0x3f; + hwif->mwdma_mask = 0x06; +--- a/include/linux/ide.h ++++ b/include/linux/ide.h +@@ -727,6 +727,7 @@ typedef struct hwif_s { + int (*ide_dma_on)(ide_drive_t *drive); + int (*ide_dma_off_quietly)(ide_drive_t *drive); + int (*ide_dma_test_irq)(ide_drive_t *drive); ++ void (*ide_dma_clear_irq)(ide_drive_t *drive); + int (*ide_dma_host_on)(ide_drive_t *drive); + int (*ide_dma_host_off)(ide_drive_t *drive); + int (*ide_dma_lostirq)(ide_drive_t *drive); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:58 2007 +Message-Id: <20070330210058.361989335@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Albert Lee , + Sergei Shtylyov , + "Adam W. Hawks" , + Bartlomiej Zolnierkiewicz +Subject: [patch 02/37] ide: remove clearing bmdma status from cdrom_decode_status() (rev #4) +Content-Disposition: inline; filename=ide-remove-clearing-bmdma-status-from-cdrom_decode_status.patch +Content-Length: 2436 +Lines: 70 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Albert Lee + +ide: remove clearing bmdma status from cdrom_decode_status() (rev #4) + +patch 2/2: + Remove clearing bmdma status from cdrom_decode_status() since ATA devices + might need it as well. + + (http://lkml.org/lkml/2006/12/4/201 and http://lkml.org/lkml/2006/11/15/94) + +Signed-off-by: Albert Lee +Cc: Sergei Shtylyov +Cc: Alan Cox +Cc: "Adam W. Hawks" +Cc: Chuck Ebbert +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-cd.c | 7 ------- + drivers/ide/pci/piix.c | 4 ---- + include/linux/ide.h | 1 - + 3 files changed, 12 deletions(-) + +--- a/drivers/ide/ide-cd.c ++++ b/drivers/ide/ide-cd.c +@@ -687,15 +687,8 @@ static void ide_dump_status_no_sense(ide + static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int *stat_ret) + { + struct request *rq = HWGROUP(drive)->rq; +- ide_hwif_t *hwif = HWIF(drive); + int stat, err, sense_key; + +- /* We may have bogus DMA interrupts in PIO state here */ +- if (HWIF(drive)->dma_status && hwif->atapi_irq_bogon) { +- stat = hwif->INB(hwif->dma_status); +- /* Should we force the bit as well ? */ +- hwif->OUTB(stat, hwif->dma_status); +- } + /* Check for errors. */ + stat = HWIF(drive)->INB(IDE_STATUS_REG); + if (stat_ret) +--- a/drivers/ide/pci/piix.c ++++ b/drivers/ide/pci/piix.c +@@ -502,10 +502,6 @@ static void __devinit init_hwif_piix(ide + /* This is a painful system best to let it self tune for now */ + return; + } +- /* ESB2 appears to generate spurious DMA interrupts in PIO mode +- when in native mode */ +- if (hwif->pci_dev->device == PCI_DEVICE_ID_INTEL_ESB2_18) +- hwif->atapi_irq_bogon = 1; + + hwif->autodma = 0; + hwif->tuneproc = &piix_tune_drive; +--- a/include/linux/ide.h ++++ b/include/linux/ide.h +@@ -797,7 +797,6 @@ typedef struct hwif_s { + unsigned sg_mapped : 1; /* sg_table and sg_nents are ready */ + unsigned no_io_32bit : 1; /* 1 = can not do 32-bit IO ops */ + unsigned err_stops_fifo : 1; /* 1=data FIFO is cleared by an error */ +- unsigned atapi_irq_bogon : 1; /* Generates spurious DMA interrupts in PIO mode */ + + struct device gendev; + struct completion gendev_rel_comp; /* To deal with device release() */ + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:58 2007 +Message-Id: <20070330210058.489899963@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Robert Hancock , + Jeff Garzik +Subject: [patch 03/37] sata_nv: delay on switching between NCQ and non-NCQ commands +Content-Disposition: inline; filename=sata_nv-delay-on-switching-between-ncq-and-non-ncq-commands.patch +Content-Length: 1829 +Lines: 60 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Robert Hancock + +sata_nv: delay on switching between NCQ and non-NCQ commands + +This patch appears to solve some problems with commands timing out in +cases where an NCQ command is immediately followed by a non-NCQ command +(or possibly vice versa). This is a rather ugly solution, but until we +know more about why this is needed, this is about all we can do. + +[backport to 2.6.20 by Chuck Ebbert ] + +Signed-off-by: Robert Hancock +Cc: Chuck Ebbert +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/ata/sata_nv.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/ata/sata_nv.c ++++ b/drivers/ata/sata_nv.c +@@ -214,6 +214,7 @@ struct nv_adma_port_priv { + struct nv_adma_prd *aprd; + dma_addr_t aprd_dma; + u8 flags; ++ int last_issue_ncq; + }; + + #define NV_ADMA_CHECK_INTR(GCTL, PORT) ((GCTL) & ( 1 << (19 + (12 * (PORT))))) +@@ -1151,6 +1152,7 @@ static unsigned int nv_adma_qc_issue(str + { + struct nv_adma_port_priv *pp = qc->ap->private_data; + void __iomem *mmio = nv_adma_ctl_block(qc->ap); ++ int curr_ncq = (qc->tf.protocol == ATA_PROT_NCQ); + + VPRINTK("ENTER\n"); + +@@ -1166,6 +1168,14 @@ static unsigned int nv_adma_qc_issue(str + /* write append register, command tag in lower 8 bits + and (number of cpbs to append -1) in top 8 bits */ + wmb(); ++ ++ if(curr_ncq != pp->last_issue_ncq) { ++ /* Seems to need some delay before switching between NCQ and non-NCQ ++ commands, else we get command timeouts and such. */ ++ udelay(20); ++ pp->last_issue_ncq = curr_ncq; ++ } ++ + writew(qc->tag, mmio + NV_ADMA_APPEND); + + DPRINTK("Issued tag %u\n",qc->tag); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:58 2007 +Message-Id: <20070330210058.621688169@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + uml-devel , + Jeff Dike +Subject: [patch 04/37] UML - fix epoll +Content-Disposition: inline; filename=uml-fix-epoll.patch +Content-Length: 988 +Lines: 38 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Dike + +UML/x86_64 needs the same packing of struct epoll_event as x86_64. + +Signed-off-by: Jeff Dike +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/eventpoll.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/include/linux/eventpoll.h ++++ b/include/linux/eventpoll.h +@@ -31,12 +31,19 @@ + /* + * On x86-64 make the 64bit structure have the same alignment as the + * 32bit structure. This makes 32bit emulation easier. ++ * ++ * UML/x86_64 needs the same packing as x86_64 - UML + UML_X86 + ++ * 64_BIT adds up to UML/x86_64. + */ + #ifdef __x86_64__ + #define EPOLL_PACKED __attribute__((packed)) + #else ++#if defined(CONFIG_UML) && defined(CONFIG_UML_X86) && defined(CONFIG_64BIT) ++#define EPOLL_PACKED __attribute__((packed)) ++#else + #define EPOLL_PACKED + #endif ++#endif + + struct epoll_event { + __u32 events; + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:58 2007 +Message-Id: <20070330210058.749309913@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + uml-devel , + Jeff Dike +Subject: [patch 05/37] UML - host VDSO fix +Content-Disposition: inline; filename=uml-host-vdso-fix.patch +Content-Length: 1354 +Lines: 39 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Dike + +This fixes a problem seen by a number of people running UML on newer host +kernels. init would hang with an infinite segfault loop. + +It turns out that the host kernel was providing a AT_SYSINFO_EHDR of +0xffffe000, which faked UML into believing that the host VDSO page could be +reused. However, AT_SYSINFO pointed into the middle of the address space, and +was unmapped as a result. Because UML was providing AT_SYSINFO_EHDR and +AT_SYSINFO to its own processes, these would branch to nowhere when trying to +use the VDSO. + +The fix is to also check the location of AT_SYSINFO when deciding whether to +use the host's VDSO. + +Signed-off-by: Jeff Dike +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/os-Linux/elf_aux.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/um/os-Linux/elf_aux.c ++++ b/arch/um/os-Linux/elf_aux.c +@@ -40,6 +40,9 @@ __init void scan_elf_aux( char **envp) + switch ( auxv->a_type ) { + case AT_SYSINFO: + __kernel_vsyscall = auxv->a_un.a_val; ++ /* See if the page is under TASK_SIZE */ ++ if (__kernel_vsyscall < (unsigned long) envp) ++ __kernel_vsyscall = 0; + break; + case AT_SYSINFO_EHDR: + vsyscall_ehdr = auxv->a_un.a_val; + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:59 2007 +Message-Id: <20070330210058.883452213@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + , + uml-devel , + Jeff Dike +Subject: [patch 06/37] UML - Fix static linking +Content-Disposition: inline; filename=uml-fix-static-linking.patch +Content-Length: 846 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Dike + +During a static link, ld has started putting a .note section in the +.uml.setup.init section. This has the result that the UML setups +begin with 32 bytes of garbage and UML crashes immediately on boot. + +This patch creates a specific .note section for ld to drop this stuff +into. + +Signed-off-by: Jeff Dike +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-um/common.lds.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/asm-um/common.lds.S ++++ b/include/asm-um/common.lds.S +@@ -15,6 +15,7 @@ + PROVIDE (_unprotected_end = .); + + . = ALIGN(4096); ++ .note : { *(note.*) } + __start___ex_table = .; + __ex_table : { *(__ex_table) } + __stop___ex_table = .; + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:59 2007 +Message-Id: <20070330210059.010764119@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Davide Brini , + uml-devel , + Jeff Dike +Subject: [patch 07/37] UML - use correct register file size everywhere +Content-Disposition: inline; filename=uml-use-correct-register-file-size-everywhere.patch +Content-Length: 5092 +Lines: 146 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Dike + +This patch uses MAX_REG_NR consistently to refer to the register file +size. FRAME_SIZE isn't sufficient because on x86_64, it is smaller +than the ptrace register file size. MAX_REG_NR was introduced as a +consistent way to get the number of registers, but wasn't used +everywhere it should be. + +When this causes a problem, it makes PTRACE_SETREGS fail on x86_64 +because of a corrupted segment register value in the known-good +register file. The patch also adds a register dump at that point in +case there are any future problems here. + +Signed-off-by: Jeff Dike +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/include/sysdep-x86_64/ptrace.h | 4 ---- + arch/um/os-Linux/skas/mem.c | 10 +++++++--- + arch/um/os-Linux/skas/process.c | 6 +++--- + arch/um/os-Linux/sys-i386/registers.c | 5 +++-- + arch/um/os-Linux/sys-x86_64/registers.c | 4 ++-- + 5 files changed, 15 insertions(+), 14 deletions(-) + +--- a/arch/um/include/sysdep-x86_64/ptrace.h ++++ b/arch/um/include/sysdep-x86_64/ptrace.h +@@ -104,10 +104,6 @@ union uml_pt_regs { + #endif + #ifdef UML_CONFIG_MODE_SKAS + struct skas_regs { +- /* x86_64 ptrace uses sizeof(user_regs_struct) as its register +- * file size, while i386 uses FRAME_SIZE. Therefore, we need +- * to use UM_FRAME_SIZE here instead of HOST_FRAME_SIZE. +- */ + unsigned long regs[MAX_REG_NR]; + unsigned long fp[HOST_FP_SIZE]; + struct faultinfo faultinfo; +--- a/arch/um/os-Linux/skas/mem.c ++++ b/arch/um/os-Linux/skas/mem.c +@@ -48,7 +48,7 @@ int multi_op_count = 0; + static inline long do_syscall_stub(struct mm_id * mm_idp, void **addr) + { + unsigned long regs[MAX_REG_NR]; +- int n; ++ int n, i; + long ret, offset; + unsigned long * data; + unsigned long * syscall; +@@ -66,9 +66,13 @@ static inline long do_syscall_stub(struc + (unsigned long) &__syscall_stub_start); + + n = ptrace_setregs(pid, regs); +- if(n < 0) ++ if(n < 0){ ++ printk("Registers - \n"); ++ for(i = 0; i < MAX_REG_NR; i++) ++ printk("\t%d\t0x%lx\n", i, regs[i]); + panic("do_syscall_stub : PTRACE_SETREGS failed, errno = %d\n", +- n); ++ -n); ++ } + + wait_stub_done(pid, 0, "do_syscall_stub"); + +--- a/arch/um/os-Linux/skas/process.c ++++ b/arch/um/os-Linux/skas/process.c +@@ -67,7 +67,7 @@ void wait_stub_done(int pid, int sig, ch + + if((n < 0) || !WIFSTOPPED(status) || + (WSTOPSIG(status) != SIGUSR1 && WSTOPSIG(status) != SIGTRAP)){ +- unsigned long regs[HOST_FRAME_SIZE]; ++ unsigned long regs[MAX_REG_NR]; + + if(ptrace(PTRACE_GETREGS, pid, 0, regs) < 0) + printk("Failed to get registers from stub, " +@@ -76,7 +76,7 @@ void wait_stub_done(int pid, int sig, ch + int i; + + printk("Stub registers -\n"); +- for(i = 0; i < HOST_FRAME_SIZE; i++) ++ for(i = 0; i < ARRAY_SIZE(regs); i++) + printk("\t%d - %lx\n", i, regs[i]); + } + panic("%s : failed to wait for SIGUSR1/SIGTRAP, " +@@ -328,7 +328,7 @@ void userspace(union uml_pt_regs *regs) + int copy_context_skas0(unsigned long new_stack, int pid) + { + int err; +- unsigned long regs[HOST_FRAME_SIZE]; ++ unsigned long regs[MAX_REG_NR]; + unsigned long fp_regs[HOST_FP_SIZE]; + unsigned long current_stack = current_stub_stack(); + struct stub_data *data = (struct stub_data *) current_stack; +--- a/arch/um/os-Linux/sys-i386/registers.c ++++ b/arch/um/os-Linux/sys-i386/registers.c +@@ -15,7 +15,7 @@ + + /* These are set once at boot time and not changed thereafter */ + +-static unsigned long exec_regs[HOST_FRAME_SIZE]; ++static unsigned long exec_regs[MAX_REG_NR]; + static unsigned long exec_fp_regs[HOST_FP_SIZE]; + static unsigned long exec_fpx_regs[HOST_XFP_SIZE]; + static int have_fpx_regs = 1; +@@ -101,6 +101,7 @@ void init_registers(int pid) + { + int err; + ++ memset(exec_regs, 0, sizeof(exec_regs)); + err = ptrace(PTRACE_GETREGS, pid, 0, exec_regs); + if(err) + panic("check_ptrace : PTRACE_GETREGS failed, errno = %d", +@@ -124,7 +125,7 @@ void init_registers(int pid) + + void get_safe_registers(unsigned long *regs, unsigned long *fp_regs) + { +- memcpy(regs, exec_regs, HOST_FRAME_SIZE * sizeof(unsigned long)); ++ memcpy(regs, exec_regs, sizeof(exec_regs)); + if(fp_regs != NULL) + memcpy(fp_regs, exec_fp_regs, + HOST_FP_SIZE * sizeof(unsigned long)); +--- a/arch/um/os-Linux/sys-x86_64/registers.c ++++ b/arch/um/os-Linux/sys-x86_64/registers.c +@@ -14,7 +14,7 @@ + + /* These are set once at boot time and not changed thereafter */ + +-static unsigned long exec_regs[HOST_FRAME_SIZE]; ++static unsigned long exec_regs[MAX_REG_NR]; + static unsigned long exec_fp_regs[HOST_FP_SIZE]; + + void init_thread_registers(union uml_pt_regs *to) +@@ -72,7 +72,7 @@ void init_registers(int pid) + + void get_safe_registers(unsigned long *regs, unsigned long *fp_regs) + { +- memcpy(regs, exec_regs, HOST_FRAME_SIZE * sizeof(unsigned long)); ++ memcpy(regs, exec_regs, sizeof(exec_regs)); + if(fp_regs != NULL) + memcpy(fp_regs, exec_fp_regs, + HOST_FP_SIZE * sizeof(unsigned long)); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:59 2007 +Message-Id: <20070330210059.150904527@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Dike , + Paolo Blaisorblade Giarrusso +Subject: [patch 08/37] uml: fix unreasonably long udelay +Content-Disposition: inline; filename=uml-fix-unreasonably-long-udelay.patch +Content-Length: 2356 +Lines: 89 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: "Paolo 'Blaisorblade' Giarrusso" + +Currently we have a confused udelay implementation. + +* __const_udelay does not accept usecs but xloops in i386 and x86_64 +* our implementation requires usecs as arg +* it gets a xloops count when called by asm/arch/delay.h + +Bugs related to this (extremely long shutdown times) where reported by some +x86_64 users, especially using Device Mapper. + +To hit this bug, a compile-time constant time parameter must be passed - that's +why UML seems to work most times. +Fix this with a simple udelay implementation. + +Signed-off-by: Paolo 'Blaisorblade' Giarrusso +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/sys-i386/delay.c | 11 ----------- + arch/um/sys-x86_64/delay.c | 11 ----------- + include/asm-um/delay.h | 17 ++++++++++++++--- + 3 files changed, 14 insertions(+), 25 deletions(-) + +--- a/arch/um/sys-i386/delay.c ++++ b/arch/um/sys-i386/delay.c +@@ -27,14 +27,3 @@ void __udelay(unsigned long usecs) + } + + EXPORT_SYMBOL(__udelay); +- +-void __const_udelay(unsigned long usecs) +-{ +- int i, n; +- +- n = (loops_per_jiffy * HZ * usecs) / MILLION; +- for(i=0;i 20000) ? \ ++ __bad_udelay() : __udelay(n)) ++ ++/* It appears that ndelay is not used at all for UML, and has never been ++ * implemented. */ ++extern void __unimplemented_ndelay(void); ++#define ndelay(n) __unimplemented_ndelay() ++ + #endif + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:59 2007 +Message-Id: <20070330210059.270027113@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stefan Richter +Subject: [patch 09/37] ieee1394: dv1394: fix CardBus card ejection +Content-Disposition: inline; filename=ieee1394-dv1394-fix-cardbus-card-ejection.patch +Content-Length: 1610 +Lines: 53 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stefan Richter + +Fix NULL pointer dereference on hot ejection of a FireWire card while +dv1394 was loaded. http://bugzilla.kernel.org/show_bug.cgi?id=7121 +I did not test card ejection with open /dev/dv1394 files yet. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ieee1394/dv1394.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/drivers/ieee1394/dv1394.c ++++ b/drivers/ieee1394/dv1394.c +@@ -2267,11 +2267,7 @@ static void dv1394_remove_host (struct h + { + struct video_card *video; + unsigned long flags; +- int id = host->id; +- +- /* We only work with the OHCI-1394 driver */ +- if (strcmp(host->driver->name, OHCI1394_DRIVER_NAME)) +- return; ++ int id = host->id, found_ohci_card = 0; + + /* find the corresponding video_cards */ + do { +@@ -2284,6 +2280,7 @@ static void dv1394_remove_host (struct h + if ((tmp_vid->id >> 2) == id) { + list_del(&tmp_vid->list); + video = tmp_vid; ++ found_ohci_card = 1; + break; + } + } +@@ -2293,8 +2290,9 @@ static void dv1394_remove_host (struct h + dv1394_un_init(video); + } while (video != NULL); + +- class_device_destroy(hpsb_protocol_class, +- MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_DV1394 * 16 + (id<<2))); ++ if (found_ohci_card) ++ class_device_destroy(hpsb_protocol_class, MKDEV(IEEE1394_MAJOR, ++ IEEE1394_MINOR_BLOCK_DV1394 * 16 + (id << 2))); + } + + static void dv1394_add_host (struct hpsb_host *host) + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:59 2007 +Message-Id: <20070330210059.398070728@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Patrick McHardy , + "David S. Miller" +Subject: [patch 10/37] NET: Fix packet classidier NULL pointer OOPS +Content-Disposition: inline; filename=net-fix-packet-classidier-null-pointer-oops.patch +Content-Length: 1376 +Lines: 56 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +[NET_SCHED]: cls_basic: fix NULL pointer dereference + +cls_basic doesn't allocate tp->root before it is linked into the +active classifier list, resulting in a NULL pointer dereference +when packets hit the classifier before its ->change function is +called. + +Reported by Chris Madden + +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/cls_basic.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +--- a/net/sched/cls_basic.c ++++ b/net/sched/cls_basic.c +@@ -82,6 +82,13 @@ static void basic_put(struct tcf_proto * + + static int basic_init(struct tcf_proto *tp) + { ++ struct basic_head *head; ++ ++ head = kzalloc(sizeof(*head), GFP_KERNEL); ++ if (head == NULL) ++ return -ENOBUFS; ++ INIT_LIST_HEAD(&head->flist); ++ tp->root = head; + return 0; + } + +@@ -177,15 +184,6 @@ static int basic_change(struct tcf_proto + } + + err = -ENOBUFS; +- if (head == NULL) { +- head = kzalloc(sizeof(*head), GFP_KERNEL); +- if (head == NULL) +- goto errout; +- +- INIT_LIST_HEAD(&head->flist); +- tp->root = head; +- } +- + f = kzalloc(sizeof(*f), GFP_KERNEL); + if (f == NULL) + goto errout; + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:59 2007 +Message-Id: <20070330210059.530254542@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Patrick McHardy , + "David S. Miller" +Subject: [patch 11/37] NET_SCHED: Fix ingress qdisc locking. +Content-Disposition: inline; filename=net_sched-fix-ingress-qdisc-locking.patch +Content-Length: 961 +Lines: 35 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +[NET_SCHED]: Fix ingress locking + +Ingress queueing uses a seperate lock for serializing enqueue operations, +but fails to properly protect itself against concurrent changes to the +qdisc tree. Use queue_lock for now since the real fix it quite intrusive. + +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller + +--- + net/core/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1750,10 +1750,10 @@ static int ing_filter(struct sk_buff *sk + + skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_INGRESS); + +- spin_lock(&dev->ingress_lock); ++ spin_lock(&dev->queue_lock); + if ((q = dev->qdisc_ingress) != NULL) + result = q->enqueue(skb, q); +- spin_unlock(&dev->ingress_lock); ++ spin_unlock(&dev->queue_lock); + + } + + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:59 2007 +Message-Id: <20070330210059.663390219@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "David S. Miller" +Subject: [patch 12/37] IPV6: Fix ipv6 round-robin locking. +Content-Disposition: inline; filename=ipv6-fix-ipv6-round-robin-locking.patch +Content-Length: 6567 +Lines: 229 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Miller + +[IPV6]: Fix routing round-robin locking. + +As per RFC2461, section 6.3.6, item #2, when no routers on the +matching list are known to be reachable or probably reachable we +do round robin on those available routes so that we make sure +to probe as many of them as possible to detect when one becomes +reachable faster. + +Each routing table has a rwlock protecting the tree and the linked +list of routes at each leaf. The round robin code executes during +lookup and thus with the rwlock taken as a reader. A small local +spinlock tries to provide protection but this does not work at all +for two reasons: + +1) The round-robin list manipulation, as coded, goes like this (with + read lock held): + + walk routes finding head and tail + + spin_lock(); + rotate list using head and tail + spin_unlock(); + + While one thread is rotating the list, another thread can + end up with stale values of head and tail and then proceed + to corrupt the list when it gets the lock. This ends up causing + the OOPS in fib6_add() later onthat many people have been hitting. + +2) All the other code paths that run with the rwlock held as + a reader do not expect the list to change on them, they + expect it to remain completely fixed while they hold the + lock in that way. + +So, simply stated, it is impossible to implement this correctly using +a manipulation of the list without violating the rwlock locking +semantics. + +Reimplement using a per-fib6_node round-robin pointer. This way we +don't need to manipulate the list at all, and since the round-robin +pointer can only ever point to real existing entries we don't need +to perform any locking on the changing of the round-robin pointer +itself. We only need to reset the round-robin pointer to NULL when +the entry it is pointing to is removed. + +The idea is from Thomas Graf and it is very similar to how this +was implemented before the advanced router selection code when in. + +Signed-off-by: David S. Miller + +--- + include/net/ip6_fib.h | 1 + net/ipv6/ip6_fib.c | 8 ++++ + net/ipv6/route.c | 97 ++++++++++++++++++++++++++++++-------------------- + 3 files changed, 68 insertions(+), 38 deletions(-) + +--- a/include/net/ip6_fib.h ++++ b/include/net/ip6_fib.h +@@ -58,6 +58,7 @@ struct fib6_node + __u16 fn_bit; /* bit key */ + __u16 fn_flags; + __u32 fn_sernum; ++ struct rt6_info *rr_ptr; + }; + + #ifndef CONFIG_IPV6_SUBTREES +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -659,6 +659,10 @@ static int fib6_add_rt2node(struct fib6_ + ins = &iter->u.next; + } + ++ /* Reset round-robin state, if necessary */ ++ if (ins == &fn->leaf) ++ fn->rr_ptr = NULL; ++ + /* + * insert node + */ +@@ -1110,6 +1114,10 @@ static void fib6_del_route(struct fib6_n + rt6_stats.fib_rt_entries--; + rt6_stats.fib_discarded_routes++; + ++ /* Reset round-robin state, if necessary */ ++ if (fn->rr_ptr == rt) ++ fn->rr_ptr = NULL; ++ + /* Adjust walkers */ + read_lock(&fib6_walker_lock); + FOR_WALKERS(w) { +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -354,55 +354,76 @@ static int rt6_score_route(struct rt6_in + return m; + } + +-static struct rt6_info *rt6_select(struct rt6_info **head, int oif, +- int strict) ++static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict, ++ int *mpri, struct rt6_info *match) + { +- struct rt6_info *match = NULL, *last = NULL; +- struct rt6_info *rt, *rt0 = *head; +- u32 metric; ++ int m; ++ ++ if (rt6_check_expired(rt)) ++ goto out; ++ ++ m = rt6_score_route(rt, oif, strict); ++ if (m < 0) ++ goto out; ++ ++ if (m > *mpri) { ++ if (strict & RT6_LOOKUP_F_REACHABLE) ++ rt6_probe(match); ++ *mpri = m; ++ match = rt; ++ } else if (strict & RT6_LOOKUP_F_REACHABLE) { ++ rt6_probe(rt); ++ } ++ ++out: ++ return match; ++} ++ ++static struct rt6_info *find_rr_leaf(struct fib6_node *fn, ++ struct rt6_info *rr_head, ++ u32 metric, int oif, int strict) ++{ ++ struct rt6_info *rt, *match; + int mpri = -1; + +- RT6_TRACE("%s(head=%p(*head=%p), oif=%d)\n", +- __FUNCTION__, head, head ? *head : NULL, oif); ++ match = NULL; ++ for (rt = rr_head; rt && rt->rt6i_metric == metric; ++ rt = rt->u.next) ++ match = find_match(rt, oif, strict, &mpri, match); ++ for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric; ++ rt = rt->u.next) ++ match = find_match(rt, oif, strict, &mpri, match); + +- for (rt = rt0, metric = rt0->rt6i_metric; +- rt && rt->rt6i_metric == metric && (!last || rt != rt0); +- rt = rt->u.next) { +- int m; ++ return match; ++} + +- if (rt6_check_expired(rt)) +- continue; ++static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict) ++{ ++ struct rt6_info *match, *rt0; + +- last = rt; ++ RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n", ++ __FUNCTION__, fn->leaf, oif); + +- m = rt6_score_route(rt, oif, strict); +- if (m < 0) +- continue; ++ rt0 = fn->rr_ptr; ++ if (!rt0) ++ fn->rr_ptr = rt0 = fn->leaf; + +- if (m > mpri) { +- if (strict & RT6_LOOKUP_F_REACHABLE) +- rt6_probe(match); +- match = rt; +- mpri = m; +- } else if (strict & RT6_LOOKUP_F_REACHABLE) { +- rt6_probe(rt); +- } +- } ++ match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict); + + if (!match && +- (strict & RT6_LOOKUP_F_REACHABLE) && +- last && last != rt0) { ++ (strict & RT6_LOOKUP_F_REACHABLE)) { ++ struct rt6_info *next = rt0->u.next; ++ + /* no entries matched; do round-robin */ +- static DEFINE_SPINLOCK(lock); +- spin_lock(&lock); +- *head = rt0->u.next; +- rt0->u.next = last->u.next; +- last->u.next = rt0; +- spin_unlock(&lock); ++ if (!next || next->rt6i_metric != rt0->rt6i_metric) ++ next = fn->leaf; ++ ++ if (next != rt0) ++ fn->rr_ptr = next; + } + +- RT6_TRACE("%s() => %p, score=%d\n", +- __FUNCTION__, match, mpri); ++ RT6_TRACE("%s() => %p\n", ++ __FUNCTION__, match); + + return (match ? match : &ip6_null_entry); + } +@@ -648,7 +669,7 @@ restart_2: + fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src); + + restart: +- rt = rt6_select(&fn->leaf, fl->iif, strict | reachable); ++ rt = rt6_select(fn, fl->iif, strict | reachable); + BACKTRACK(&fl->fl6_src); + if (rt == &ip6_null_entry || + rt->rt6i_flags & RTF_CACHE) +@@ -743,7 +764,7 @@ restart_2: + fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src); + + restart: +- rt = rt6_select(&fn->leaf, fl->oif, strict | reachable); ++ rt = rt6_select(fn, fl->oif, strict | reachable); + BACKTRACK(&fl->fl6_src); + if (rt == &ip6_null_entry || + rt->rt6i_flags & RTF_CACHE) + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:00:59 2007 +Message-Id: <20070330210059.792934409@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "G. Liakhovetski" , + Paul Mackerras , + "David S. Miller" +Subject: [patch 13/37] PPP: Fix PPP skb leak +Content-Disposition: inline; filename=ppp-fix-ppp-skb-leak.patch +Content-Length: 732 +Lines: 30 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: G. Liakhovetski + +[PPP]: Don't leak an sk_buff on interface destruction. + +Signed-off-by: G. Liakhovetski +Acked-by: Paul Mackerras +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ppp_generic.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ppp_generic.c ++++ b/drivers/net/ppp_generic.c +@@ -2544,6 +2544,9 @@ static void ppp_destroy_interface(struct + ppp->active_filter = NULL; + #endif /* CONFIG_PPP_FILTER */ + ++ if (ppp->xmit_pending) ++ kfree_skb(ppp->xmit_pending); ++ + kfree(ppp); + } + + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:00 2007 +Message-Id: <20070330210059.918339236@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Arnaldo Carvalho de Melo , + "David S. Miller" +Subject: [patch 14/37] DCCP: Fix exploitable hole in DCCP socket options +Content-Disposition: inline; filename=dccp-fix-exploitable-hole-in-dccp-socket-options.patch +Content-Length: 1356 +Lines: 48 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Arnaldo Carvalho de Melo + +[DCCP] getsockopt: Fix DCCP_SOCKOPT_[SEND,RECV]_CSCOV + +We were only checking if there was enough space to put the int, but +left len as specified by the (malicious) user, sigh, fix it by setting +len to sizeof(val) and transfering just one int worth of data, the one +asked for. + +Also check for negative len values. + +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/dccp/proto.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -575,7 +575,7 @@ static int do_dccp_getsockopt(struct soc + if (get_user(len, optlen)) + return -EFAULT; + +- if (len < sizeof(int)) ++ if (len < (int)sizeof(int)) + return -EINVAL; + + dp = dccp_sk(sk); +@@ -589,9 +589,11 @@ static int do_dccp_getsockopt(struct soc + (__be32 __user *)optval, optlen); + case DCCP_SOCKOPT_SEND_CSCOV: + val = dp->dccps_pcslen; ++ len = sizeof(val); + break; + case DCCP_SOCKOPT_RECV_CSCOV: + val = dp->dccps_pcrlen; ++ len = sizeof(val); + break; + case 128 ... 191: + return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname, + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:00 2007 +Message-Id: <20070330210100.047818609@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "David S. Miller" +Subject: [patch 15/37] VIDEO: Fix FFB DAC revision probing +Content-Disposition: inline; filename=video-fix-ffb-dac-revision-probing.patch +Content-Length: 6160 +Lines: 192 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Miller + +[VIDEO] ffb: Fix two DAC handling bugs. + +The determination of whether the DAC has inverted cursor logic is +broken, import the version checks the X.org driver uses to fix this. + +Next, when we change the timing generator, borrow code from X.org that +does 10 NOP reads of the timing generator register afterwards to make +sure the video-enable transition occurs cleanly. + +Finally, use macros for the DAC registers and fields in order to +provide documentation for the next person who reads this code. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/ffb.c | 84 +++++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 60 insertions(+), 24 deletions(-) + +--- a/drivers/video/ffb.c ++++ b/drivers/video/ffb.c +@@ -336,14 +336,30 @@ struct ffb_dac { + u32 value2; + }; + ++#define FFB_DAC_UCTRL 0x1001 /* User Control */ ++#define FFB_DAC_UCTRL_MANREV 0x00000f00 /* 4-bit Manufacturing Revision */ ++#define FFB_DAC_UCTRL_MANREV_SHIFT 8 ++#define FFB_DAC_TGEN 0x6000 /* Timing Generator */ ++#define FFB_DAC_TGEN_VIDE 0x00000001 /* Video Enable */ ++#define FFB_DAC_DID 0x8000 /* Device Identification */ ++#define FFB_DAC_DID_PNUM 0x0ffff000 /* Device Part Number */ ++#define FFB_DAC_DID_PNUM_SHIFT 12 ++#define FFB_DAC_DID_REV 0xf0000000 /* Device Revision */ ++#define FFB_DAC_DID_REV_SHIFT 28 ++ ++#define FFB_DAC_CUR_CTRL 0x100 ++#define FFB_DAC_CUR_CTRL_P0 0x00000001 ++#define FFB_DAC_CUR_CTRL_P1 0x00000002 ++ + struct ffb_par { + spinlock_t lock; + struct ffb_fbc __iomem *fbc; + struct ffb_dac __iomem *dac; + + u32 flags; +-#define FFB_FLAG_AFB 0x00000001 +-#define FFB_FLAG_BLANKED 0x00000002 ++#define FFB_FLAG_AFB 0x00000001 /* AFB m3 or m6 */ ++#define FFB_FLAG_BLANKED 0x00000002 /* screen is blanked */ ++#define FFB_FLAG_INVCURSOR 0x00000004 /* DAC has inverted cursor logic */ + + u32 fg_cache __attribute__((aligned (8))); + u32 bg_cache; +@@ -354,7 +370,6 @@ struct ffb_par { + unsigned long physbase; + unsigned long fbsize; + +- int dac_rev; + int board_type; + }; + +@@ -426,11 +441,12 @@ static void ffb_switch_from_graph(struct + FFBWait(par); + + /* Disable cursor. */ +- upa_writel(0x100, &dac->type2); +- if (par->dac_rev <= 2) ++ upa_writel(FFB_DAC_CUR_CTRL, &dac->type2); ++ if (par->flags & FFB_FLAG_INVCURSOR) + upa_writel(0, &dac->value2); + else +- upa_writel(3, &dac->value2); ++ upa_writel((FFB_DAC_CUR_CTRL_P0 | ++ FFB_DAC_CUR_CTRL_P1), &dac->value2); + + spin_unlock_irqrestore(&par->lock, flags); + } +@@ -664,18 +680,18 @@ ffb_blank(int blank, struct fb_info *inf + struct ffb_par *par = (struct ffb_par *) info->par; + struct ffb_dac __iomem *dac = par->dac; + unsigned long flags; +- u32 tmp; ++ u32 val; ++ int i; + + spin_lock_irqsave(&par->lock, flags); + + FFBWait(par); + ++ upa_writel(FFB_DAC_TGEN, &dac->type); ++ val = upa_readl(&dac->value); + switch (blank) { + case FB_BLANK_UNBLANK: /* Unblanking */ +- upa_writel(0x6000, &dac->type); +- tmp = (upa_readl(&dac->value) | 0x1); +- upa_writel(0x6000, &dac->type); +- upa_writel(tmp, &dac->value); ++ val |= FFB_DAC_TGEN_VIDE; + par->flags &= ~FFB_FLAG_BLANKED; + break; + +@@ -683,13 +699,16 @@ ffb_blank(int blank, struct fb_info *inf + case FB_BLANK_VSYNC_SUSPEND: /* VESA blank (vsync off) */ + case FB_BLANK_HSYNC_SUSPEND: /* VESA blank (hsync off) */ + case FB_BLANK_POWERDOWN: /* Poweroff */ +- upa_writel(0x6000, &dac->type); +- tmp = (upa_readl(&dac->value) & ~0x1); +- upa_writel(0x6000, &dac->type); +- upa_writel(tmp, &dac->value); ++ val &= ~FFB_DAC_TGEN_VIDE; + par->flags |= FFB_FLAG_BLANKED; + break; + } ++ upa_writel(FFB_DAC_TGEN, &dac->type); ++ upa_writel(val, &dac->value); ++ for (i = 0; i < 10; i++) { ++ upa_writel(FFB_DAC_TGEN, &dac->type); ++ upa_readl(&dac->value); ++ } + + spin_unlock_irqrestore(&par->lock, flags); + +@@ -894,6 +913,7 @@ static int ffb_init_one(struct of_device + struct ffb_dac __iomem *dac; + struct all_info *all; + int err; ++ u32 dac_pnum, dac_rev, dac_mrev; + + all = kzalloc(sizeof(*all), GFP_KERNEL); + if (!all) +@@ -948,17 +968,31 @@ static int ffb_init_one(struct of_device + if ((upa_readl(&fbc->ucsr) & FFB_UCSR_ALL_ERRORS) != 0) + upa_writel(FFB_UCSR_ALL_ERRORS, &fbc->ucsr); + +- ffb_switch_from_graph(&all->par); +- + dac = all->par.dac; +- upa_writel(0x8000, &dac->type); +- all->par.dac_rev = upa_readl(&dac->value) >> 0x1c; ++ upa_writel(FFB_DAC_DID, &dac->type); ++ dac_pnum = upa_readl(&dac->value); ++ dac_rev = (dac_pnum & FFB_DAC_DID_REV) >> FFB_DAC_DID_REV_SHIFT; ++ dac_pnum = (dac_pnum & FFB_DAC_DID_PNUM) >> FFB_DAC_DID_PNUM_SHIFT; ++ ++ upa_writel(FFB_DAC_UCTRL, &dac->type); ++ dac_mrev = upa_readl(&dac->value); ++ dac_mrev = (dac_mrev & FFB_DAC_UCTRL_MANREV) >> ++ FFB_DAC_UCTRL_MANREV_SHIFT; + + /* Elite3D has different DAC revision numbering, and no DAC revisions +- * have the reversed meaning of cursor enable. ++ * have the reversed meaning of cursor enable. Otherwise, Pacifica 1 ++ * ramdacs with manufacturing revision less than 3 have inverted ++ * cursor logic. We identify Pacifica 1 as not Pacifica 2, the ++ * latter having a part number value of 0x236e. + */ +- if (all->par.flags & FFB_FLAG_AFB) +- all->par.dac_rev = 10; ++ if ((all->par.flags & FFB_FLAG_AFB) || dac_pnum == 0x236e) { ++ all->par.flags &= ~FFB_FLAG_INVCURSOR; ++ } else { ++ if (dac_mrev < 3) ++ all->par.flags |= FFB_FLAG_INVCURSOR; ++ } ++ ++ ffb_switch_from_graph(&all->par); + + /* Unblank it just to be sure. When there are multiple + * FFB/AFB cards in the system, or it is not the OBP +@@ -993,10 +1027,12 @@ static int ffb_init_one(struct of_device + + dev_set_drvdata(&op->dev, all); + +- printk("%s: %s at %016lx, type %d, DAC revision %d\n", ++ printk("%s: %s at %016lx, type %d, " ++ "DAC pnum[%x] rev[%d] manuf_rev[%d]\n", + dp->full_name, + ((all->par.flags & FFB_FLAG_AFB) ? "AFB" : "FFB"), +- all->par.physbase, all->par.board_type, all->par.dac_rev); ++ all->par.physbase, all->par.board_type, ++ dac_pnum, dac_rev, dac_mrev); + + return 0; + } + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:00 2007 +Message-Id: <20070330210100.175995210@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Alexey Dobriyan , + "David S. Miller" +Subject: [patch 16/37] NET: Fix sock_attach_fd() failure in sys_accept() +Content-Disposition: inline; filename=net-fix-sock_attach_fd-failure-in-sys_accept.patch +Content-Length: 1133 +Lines: 45 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexey Dobriyan + +[NET]: Correct accept(2) recovery after sock_attach_fd() + +* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL +* bail out to out_fd label, doing fput()/__fput() on new file +* but __fput() assumes valid ->f_dentry and dereferences it + +Signed-off-by: Alexey Dobriyan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/socket.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/net/socket.c ++++ b/net/socket.c +@@ -1368,7 +1368,7 @@ asmlinkage long sys_accept(int fd, struc + + err = sock_attach_fd(newsock, newfile); + if (err < 0) +- goto out_fd; ++ goto out_fd_simple; + + err = security_socket_accept(sock, newsock); + if (err) +@@ -1401,6 +1401,11 @@ out_put: + fput_light(sock->file, fput_needed); + out: + return err; ++out_fd_simple: ++ sock_release(newsock); ++ put_filp(newfile); ++ put_unused_fd(newfd); ++ goto out_put; + out_fd: + fput(newfile); + put_unused_fd(newfd); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:00 2007 +Message-Id: <20070330210100.310566365@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Mikael Pettersson , + "David S. Miller" +Subject: [patch 17/37] SPARC: Fix sparc builds with gcc-4.2.x +Content-Disposition: inline; filename=sparc-fix-sparc-builds-with-gcc-4.2.x.patch +Content-Length: 2509 +Lines: 56 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mikael Pettersson + +[SPARC]: sparc64 gcc-4.2.0 20070317 -Werror failure + +Compiling 2.6.21-rc5 with gcc-4.2.0 20070317 (prerelease) +for sparc64 fails as follows: + + gcc -Wp,-MD,arch/sparc64/kernel/.time.o.d -nostdinc -isystem /home/mikpe/pkgs/linux-sparc64/gcc-4.2.0/lib/gcc/sparc64-unknown-linux-gnu/4.2.0/include -D__KERNEL__ -Iinclude -include include/linux/autoconf.h -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -Os -m64 -pipe -mno-fpu -mcpu=ultrasparc -mcmodel=medlow -ffixed-g4 -ffixed-g5 -fcall-used-g7 -Wno-sign-compare -Wa,--undeclared-regs -fomit-frame-pointer -fno-stack-protector -Wdeclaration-after-statement -Wno-pointer-sign -Werror -D"KBUILD_STR(s)=#s" -D"KBUILD_BASENAME=KBUILD_STR(time)" -D"KBUILD_MODNAME=KBUILD_STR(time)" -c -o arch/sparc64/kernel/time.o arch/sparc64/kernel/time.c +cc1: warnings being treated as errors +arch/sparc64/kernel/time.c: In function 'kick_start_clock': +arch/sparc64/kernel/time.c:559: warning: overflow in implicit constant conversion +make[1]: *** [arch/sparc64/kernel/time.o] Error 1 +make: *** [arch/sparc64/kernel] Error 2 + +gcc gets unhappy when the MSTK_SET macro's u8 __val variable +is updated with &= ~0xff (MSTK_YEAR_MASK). Making the constant +unsigned fixes the problem. + +[ I fixed up the sparc32 side as well -DaveM ] + +Signed-off-by: Mikael Pettersson +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-sparc/mostek.h | 2 +- + include/asm-sparc64/mostek.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/include/asm-sparc/mostek.h ++++ b/include/asm-sparc/mostek.h +@@ -87,7 +87,7 @@ extern void __iomem *mstk48t02_regs; + #define MSTK_DOW_MASK 0x07 + #define MSTK_DOM_MASK 0x3f + #define MSTK_MONTH_MASK 0x1f +-#define MSTK_YEAR_MASK 0xff ++#define MSTK_YEAR_MASK 0xffU + + /* Binary coded decimal conversion macros. */ + #define MSTK_REGVAL_TO_DECIMAL(x) (((x) & 0x0F) + 0x0A * ((x) >> 0x04)) +--- a/include/asm-sparc64/mostek.h ++++ b/include/asm-sparc64/mostek.h +@@ -89,7 +89,7 @@ extern void __iomem *mstk48t02_regs; + #define MSTK_DOW_MASK 0x07 + #define MSTK_DOM_MASK 0x3f + #define MSTK_MONTH_MASK 0x1f +-#define MSTK_YEAR_MASK 0xff ++#define MSTK_YEAR_MASK 0xffU + + /* Binary coded decimal conversion macros. */ + #define MSTK_REGVAL_TO_DECIMAL(x) (((x) & 0x0F) + 0x0A * ((x) >> 0x04)) + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:00 2007 +Message-Id: <20070330210100.438167156@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Al Viro +Subject: [patch 18/37] Fix decnet endianness +Content-Disposition: inline; filename=fix-decnet-endianness.patch +Content-Length: 1529 +Lines: 58 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Al Viro + +[PATCH] FRA_{DST,SRC} are le16 for decnet + +Signed-off-by: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/decnet/dn_rules.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/net/decnet/dn_rules.c ++++ b/net/decnet/dn_rules.c +@@ -151,10 +151,10 @@ static int dn_fib_rule_configure(struct + } + + if (tb[FRA_SRC]) +- r->src = nla_get_u16(tb[FRA_SRC]); ++ r->src = nla_get_le16(tb[FRA_SRC]); + + if (tb[FRA_DST]) +- r->dst = nla_get_u16(tb[FRA_DST]); ++ r->dst = nla_get_le16(tb[FRA_DST]); + + r->src_len = frh->src_len; + r->srcmask = dnet_make_mask(r->src_len); +@@ -176,10 +176,10 @@ static int dn_fib_rule_compare(struct fi + if (frh->dst_len && (r->dst_len != frh->dst_len)) + return 0; + +- if (tb[FRA_SRC] && (r->src != nla_get_u16(tb[FRA_SRC]))) ++ if (tb[FRA_SRC] && (r->src != nla_get_le16(tb[FRA_SRC]))) + return 0; + +- if (tb[FRA_DST] && (r->dst != nla_get_u16(tb[FRA_DST]))) ++ if (tb[FRA_DST] && (r->dst != nla_get_le16(tb[FRA_DST]))) + return 0; + + return 1; +@@ -214,9 +214,9 @@ static int dn_fib_rule_fill(struct fib_r + frh->tos = 0; + + if (r->dst_len) +- NLA_PUT_U16(skb, FRA_DST, r->dst); ++ NLA_PUT_LE16(skb, FRA_DST, r->dst); + if (r->src_len) +- NLA_PUT_U16(skb, FRA_SRC, r->src); ++ NLA_PUT_LE16(skb, FRA_SRC, r->src); + + return 0; + + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:00 2007 +Message-Id: <20070330210100.564731429@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Thomas Graf , + Patrick McHardy , + "David S. Miller" +Subject: [patch 19/37] NET: Fix FIB rules compatability +Content-Disposition: inline; filename=net-fix-fib-rules-compatability.patch +Content-Length: 7820 +Lines: 268 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Graf + +[NET]: Fix fib_rules compatibility breakage + +Based upon a patch from Patrick McHardy. + +The fib_rules netlink attribute policy introduced in 2.6.19 broke +userspace compatibilty. When specifying a rule with "from all" +or "to all", iproute adds a zero byte long netlink attribute, +but the policy requires all addresses to have a size equal to +sizeof(struct in_addr)/sizeof(struct in6_addr), resulting in a +validation error. + +Check attribute length of FRA_SRC/FRA_DST in the generic framework +by letting the family specific rules implementation provide the +length of an address. Report an error if address length is non +zero but no address attribute is provided. Fix actual bug by +checking address length for non-zero instead of relying on +availability of attribute. + +Signed-off-by: Thomas Graf +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/fib_rules.h | 1 + + net/core/fib_rules.c | 30 ++++++++++++++++++++++++++++++ + net/decnet/dn_rules.c | 13 ++++++------- + net/ipv4/fib_rules.c | 14 ++++++-------- + net/ipv6/fib6_rules.c | 14 +++++--------- + 5 files changed, 48 insertions(+), 24 deletions(-) + +--- a/include/net/fib_rules.h ++++ b/include/net/fib_rules.h +@@ -34,6 +34,7 @@ struct fib_rules_ops + int family; + struct list_head list; + int rule_size; ++ int addr_size; + + int (*action)(struct fib_rule *, + struct flowi *, int, +--- a/net/core/fib_rules.c ++++ b/net/core/fib_rules.c +@@ -152,6 +152,28 @@ out: + + EXPORT_SYMBOL_GPL(fib_rules_lookup); + ++static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb, ++ struct fib_rules_ops *ops) ++{ ++ int err = -EINVAL; ++ ++ if (frh->src_len) ++ if (tb[FRA_SRC] == NULL || ++ frh->src_len > (ops->addr_size * 8) || ++ nla_len(tb[FRA_SRC]) != ops->addr_size) ++ goto errout; ++ ++ if (frh->dst_len) ++ if (tb[FRA_DST] == NULL || ++ frh->dst_len > (ops->addr_size * 8) || ++ nla_len(tb[FRA_DST]) != ops->addr_size) ++ goto errout; ++ ++ err = 0; ++errout: ++ return err; ++} ++ + int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg) + { + struct fib_rule_hdr *frh = nlmsg_data(nlh); +@@ -173,6 +195,10 @@ int fib_nl_newrule(struct sk_buff *skb, + if (err < 0) + goto errout; + ++ err = validate_rulemsg(frh, tb, ops); ++ if (err < 0) ++ goto errout; ++ + rule = kzalloc(ops->rule_size, GFP_KERNEL); + if (rule == NULL) { + err = -ENOMEM; +@@ -260,6 +286,10 @@ int fib_nl_delrule(struct sk_buff *skb, + if (err < 0) + goto errout; + ++ err = validate_rulemsg(frh, tb, ops); ++ if (err < 0) ++ goto errout; ++ + list_for_each_entry(rule, ops->rules_list, list) { + if (frh->action && (frh->action != rule->action)) + continue; +--- a/net/decnet/dn_rules.c ++++ b/net/decnet/dn_rules.c +@@ -109,8 +109,6 @@ errout: + + static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = { + FRA_GENERIC_POLICY, +- [FRA_SRC] = { .type = NLA_U16 }, +- [FRA_DST] = { .type = NLA_U16 }, + }; + + static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags) +@@ -133,7 +131,7 @@ static int dn_fib_rule_configure(struct + int err = -EINVAL; + struct dn_fib_rule *r = (struct dn_fib_rule *)rule; + +- if (frh->src_len > 16 || frh->dst_len > 16 || frh->tos) ++ if (frh->tos) + goto errout; + + if (rule->table == RT_TABLE_UNSPEC) { +@@ -150,10 +148,10 @@ static int dn_fib_rule_configure(struct + } + } + +- if (tb[FRA_SRC]) ++ if (frh->src_len) + r->src = nla_get_le16(tb[FRA_SRC]); + +- if (tb[FRA_DST]) ++ if (frh->dst_len) + r->dst = nla_get_le16(tb[FRA_DST]); + + r->src_len = frh->src_len; +@@ -176,10 +174,10 @@ static int dn_fib_rule_compare(struct fi + if (frh->dst_len && (r->dst_len != frh->dst_len)) + return 0; + +- if (tb[FRA_SRC] && (r->src != nla_get_le16(tb[FRA_SRC]))) ++ if (frh->src_len && (r->src != nla_get_le16(tb[FRA_SRC]))) + return 0; + +- if (tb[FRA_DST] && (r->dst != nla_get_le16(tb[FRA_DST]))) ++ if (frh->dst_len && (r->dst != nla_get_le16(tb[FRA_DST]))) + return 0; + + return 1; +@@ -249,6 +247,7 @@ int dn_fib_dump_rules(struct sk_buff *sk + static struct fib_rules_ops dn_fib_rules_ops = { + .family = AF_DECnet, + .rule_size = sizeof(struct dn_fib_rule), ++ .addr_size = sizeof(u16), + .action = dn_fib_rule_action, + .match = dn_fib_rule_match, + .configure = dn_fib_rule_configure, +--- a/net/ipv4/fib_rules.c ++++ b/net/ipv4/fib_rules.c +@@ -171,8 +171,6 @@ static struct fib_table *fib_empty_table + + static struct nla_policy fib4_rule_policy[FRA_MAX+1] __read_mostly = { + FRA_GENERIC_POLICY, +- [FRA_SRC] = { .type = NLA_U32 }, +- [FRA_DST] = { .type = NLA_U32 }, + [FRA_FLOW] = { .type = NLA_U32 }, + }; + +@@ -183,8 +181,7 @@ static int fib4_rule_configure(struct fi + int err = -EINVAL; + struct fib4_rule *rule4 = (struct fib4_rule *) rule; + +- if (frh->src_len > 32 || frh->dst_len > 32 || +- (frh->tos & ~IPTOS_TOS_MASK)) ++ if (frh->tos & ~IPTOS_TOS_MASK) + goto errout; + + if (rule->table == RT_TABLE_UNSPEC) { +@@ -201,10 +198,10 @@ static int fib4_rule_configure(struct fi + } + } + +- if (tb[FRA_SRC]) ++ if (frh->src_len) + rule4->src = nla_get_be32(tb[FRA_SRC]); + +- if (tb[FRA_DST]) ++ if (frh->dst_len) + rule4->dst = nla_get_be32(tb[FRA_DST]); + + #ifdef CONFIG_NET_CLS_ROUTE +@@ -242,10 +239,10 @@ static int fib4_rule_compare(struct fib_ + return 0; + #endif + +- if (tb[FRA_SRC] && (rule4->src != nla_get_be32(tb[FRA_SRC]))) ++ if (frh->src_len && (rule4->src != nla_get_be32(tb[FRA_SRC]))) + return 0; + +- if (tb[FRA_DST] && (rule4->dst != nla_get_be32(tb[FRA_DST]))) ++ if (frh->dst_len && (rule4->dst != nla_get_be32(tb[FRA_DST]))) + return 0; + + return 1; +@@ -309,6 +306,7 @@ static size_t fib4_rule_nlmsg_payload(st + static struct fib_rules_ops fib4_rules_ops = { + .family = AF_INET, + .rule_size = sizeof(struct fib4_rule), ++ .addr_size = sizeof(u32), + .action = fib4_rule_action, + .match = fib4_rule_match, + .configure = fib4_rule_configure, +--- a/net/ipv6/fib6_rules.c ++++ b/net/ipv6/fib6_rules.c +@@ -131,8 +131,6 @@ static int fib6_rule_match(struct fib_ru + + static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = { + FRA_GENERIC_POLICY, +- [FRA_SRC] = { .len = sizeof(struct in6_addr) }, +- [FRA_DST] = { .len = sizeof(struct in6_addr) }, + }; + + static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb, +@@ -142,9 +140,6 @@ static int fib6_rule_configure(struct fi + int err = -EINVAL; + struct fib6_rule *rule6 = (struct fib6_rule *) rule; + +- if (frh->src_len > 128 || frh->dst_len > 128) +- goto errout; +- + if (rule->action == FR_ACT_TO_TBL) { + if (rule->table == RT6_TABLE_UNSPEC) + goto errout; +@@ -155,11 +150,11 @@ static int fib6_rule_configure(struct fi + } + } + +- if (tb[FRA_SRC]) ++ if (frh->src_len) + nla_memcpy(&rule6->src.addr, tb[FRA_SRC], + sizeof(struct in6_addr)); + +- if (tb[FRA_DST]) ++ if (frh->dst_len) + nla_memcpy(&rule6->dst.addr, tb[FRA_DST], + sizeof(struct in6_addr)); + +@@ -186,11 +181,11 @@ static int fib6_rule_compare(struct fib_ + if (frh->tos && (rule6->tclass != frh->tos)) + return 0; + +- if (tb[FRA_SRC] && ++ if (frh->src_len && + nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr))) + return 0; + +- if (tb[FRA_DST] && ++ if (frh->dst_len && + nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr))) + return 0; + +@@ -240,6 +235,7 @@ static size_t fib6_rule_nlmsg_payload(st + static struct fib_rules_ops fib6_rules_ops = { + .family = AF_INET6, + .rule_size = sizeof(struct fib6_rule), ++ .addr_size = sizeof(struct in6_addr), + .action = fib6_rule_action, + .match = fib6_rule_match, + .configure = fib6_rule_configure, + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:00 2007 +Message-Id: <20070330210100.693732215@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 20/37] DVB: fix nxt200x rf input switching +Content-Disposition: inline; filename=dvb-fix-nxt200x-rf-input-switching.patch +Content-Length: 1314 +Lines: 43 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +DVB: fix nxt200x rf input switching + +After dvb tuner refactoring, the pll buffer has been altered such that +the pll address is now stored in buf[0]. Instead of sending buf to +set_pll_input, we should send buf+1. + +(cherry picked from commit f5ae29e284b328e0976789d5c199bbbe80e4b005) + +Signed-off-by: Michael Krufky +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/nxt200x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb/frontends/nxt200x.c ++++ b/drivers/media/dvb/frontends/nxt200x.c +@@ -562,7 +562,7 @@ static int nxt200x_setup_frontend_parame + + /* set input */ + if (state->config->set_pll_input) +- state->config->set_pll_input(buf, 1); ++ state->config->set_pll_input(buf+1, 1); + break; + case VSB_8: + /* Set non-punctured clock for VSB */ +@@ -571,7 +571,7 @@ static int nxt200x_setup_frontend_parame + + /* set input */ + if (state->config->set_pll_input) +- state->config->set_pll_input(buf, 0); ++ state->config->set_pll_input(buf+1, 0); + break; + default: + return -EINVAL; + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:00 2007 +Message-Id: <20070330210100.830553254@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 13:59:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trent Piepho , + Mauro Carvalho Chehab +Subject: [patch 21/37] V4L: radio: Fix error in Kbuild file +Content-Disposition: inline; filename=v4l-radio-fix-error-in-kbuild-file.patch +Content-Length: 1031 +Lines: 36 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Trent Piepho + +V4L: radio: Fix error in Kbuild file + +All the radio drivers need video_dev, but they were depending on +VIDEO_DEV!=n. That meant that one could try to compile the driver into +the kernel when VIDEO_DEV=m, which will not work. If video_dev is a +module, then the radio drivers must be modules too. + +(cherry picked from commit b10fece583fdfdb3d2f29b0da3896ec58b8fe122) + +Signed-off-by: Trent Piepho +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/radio/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/radio/Kconfig ++++ b/drivers/media/radio/Kconfig +@@ -3,7 +3,7 @@ + # + + menu "Radio Adapters" +- depends on VIDEO_DEV!=n ++ depends on VIDEO_DEV + + config RADIO_CADET + tristate "ADS Cadet AM/FM Tuner" + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:01 2007 +Message-Id: <20070330210100.951754183@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mauro Carvalho Chehab +Subject: [patch 22/37] V4L: Fix SECAM handling on saa7115 +Content-Disposition: inline; filename=v4l-fix-secam-handling-on-saa7115.patch +Content-Length: 876 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mauro Carvalho Chehab + +V4L: Fix SECAM handling on saa7115 + +(cherry picked from commit a9aaec4e83e687d23b78b38e331bbd6a10b96380) + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/saa7115.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/saa7115.c ++++ b/drivers/media/video/saa7115.c +@@ -960,7 +960,7 @@ static void saa711x_set_v4lstd(struct i2 + reg |= 0x10; + } else if (std == V4L2_STD_NTSC_M_JP) { + reg |= 0x40; +- } else if (std == V4L2_STD_SECAM) { ++ } else if (std & V4L2_STD_SECAM) { + reg |= 0x50; + } + saa711x_write(client, R_0E_CHROMA_CNTL_1, reg); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:01 2007 +Message-Id: <20070330210101.102084303@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [patch 23/37] V4L: msp_attach must return 0 if no msp3400 was found. +Content-Disposition: inline; filename=v4l-msp_attach-must-return-0-if-no-msp3400-was-found.patch +Content-Length: 1355 +Lines: 44 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Hans Verkuil + +V4L: msp_attach must return 0 if no msp3400 was found. + +Returning -1 causes the probe to stop, but it should just continue +instead. This patch fixes an annoying 'i2c_adapter i2c-7: Client +creation failed at 0x44 (-1)' kernel message that appeared in 2.6.20 + +(cherry picked from commit 3284b4e077cb2322754ea7455b8f8af7ce3777b8) + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/msp3400-driver.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/video/msp3400-driver.c ++++ b/drivers/media/video/msp3400-driver.c +@@ -825,7 +825,7 @@ static int msp_attach(struct i2c_adapter + if (msp_reset(client) == -1) { + v4l_dbg(1, msp_debug, client, "msp3400 not found\n"); + kfree(client); +- return -1; ++ return 0; + } + + state = kmalloc(sizeof(*state), GFP_KERNEL); +@@ -859,7 +859,7 @@ static int msp_attach(struct i2c_adapter + v4l_dbg(1, msp_debug, client, "not an msp3400 (cannot read chip version)\n"); + kfree(state); + kfree(client); +- return -1; ++ return 0; + } + + msp_set_audio(client); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:01 2007 +Message-Id: <20070330210101.208620895@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Viehweger , + Mauro Carvalho Chehab +Subject: [patch 24/37] DVB: isl6421: dont reference freed memory +Content-Disposition: inline; filename=dvb-isl6421-don-t-reference-freed-memory.patch +Content-Length: 950 +Lines: 32 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thomas Viehweger + +DVB: isl6421: don't reference freed memory + +After freeing a block there should be no reference to this block. + +(cherry picked from commit 09d4895488d4df5c58b739573846f514ceabc911) + +Signed-off-by: Thomas Viehweger +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/isl6421.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/dvb/frontends/isl6421.c ++++ b/drivers/media/dvb/frontends/isl6421.c +@@ -122,6 +122,7 @@ struct dvb_frontend *isl6421_attach(stru + /* detect if it is present or not */ + if (isl6421_set_voltage(fe, SEC_VOLTAGE_OFF)) { + kfree(isl6421); ++ fe->sec_priv = NULL; + return NULL; + } + + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:01 2007 +Message-Id: <20070330210101.329278141@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Simon Arlott , + Johannes Stezenbach , + Mauro Carvalho Chehab +Subject: [patch 25/37] dvb-core: fix several locking related problems +Content-Disposition: inline; filename=dvb-core-fix-several-locking-related-problems.patch +Content-Length: 5538 +Lines: 167 + + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Simon Arlott + +dvb-core: fix several locking related problems + +Fix several instances of dvb-core functions using mutex_lock_interruptible +and returning -ERESTARTSYS where the calling function will either never +retry or never check the return value. + +These cause a race condition with dvb_dmxdev_filter_free and +dvb_dvr_release, both of which are filesystem release functions whose +return value is ignored and will never be retried. When this happens it +becomes impossible to open dvr0 again (-EBUSY) since it has not been +released properly. + +(cherry picked from commit c278850206fd9df0bb62a72ca0b277fe20c5a452) + +Signed-off-by: Simon Arlott +Signed-off-by: Andrew Morton +Acked-By: Johannes Stezenbach +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-core/dmxdev.c | 12 +++--------- + drivers/media/dvb/dvb-core/dvb_demux.c | 21 +++++++-------------- + drivers/media/dvb/dvb-core/dvbdev.c | 9 +++------ + 3 files changed, 13 insertions(+), 29 deletions(-) + +--- a/drivers/media/dvb/dvb-core/dmxdev.c ++++ b/drivers/media/dvb/dvb-core/dmxdev.c +@@ -181,8 +181,7 @@ static int dvb_dvr_release(struct inode + struct dvb_device *dvbdev = file->private_data; + struct dmxdev *dmxdev = dvbdev->priv; + +- if (mutex_lock_interruptible(&dmxdev->mutex)) +- return -ERESTARTSYS; ++ mutex_lock(&dmxdev->mutex); + + if ((file->f_flags & O_ACCMODE) == O_WRONLY) { + dmxdev->demux->disconnect_frontend(dmxdev->demux); +@@ -674,13 +673,8 @@ static int dvb_demux_open(struct inode * + static int dvb_dmxdev_filter_free(struct dmxdev *dmxdev, + struct dmxdev_filter *dmxdevfilter) + { +- if (mutex_lock_interruptible(&dmxdev->mutex)) +- return -ERESTARTSYS; +- +- if (mutex_lock_interruptible(&dmxdevfilter->mutex)) { +- mutex_unlock(&dmxdev->mutex); +- return -ERESTARTSYS; +- } ++ mutex_lock(&dmxdev->mutex); ++ mutex_lock(&dmxdevfilter->mutex); + + dvb_dmxdev_filter_stop(dmxdevfilter); + dvb_dmxdev_filter_reset(dmxdevfilter); +--- a/drivers/media/dvb/dvb-core/dvb_demux.c ++++ b/drivers/media/dvb/dvb-core/dvb_demux.c +@@ -673,8 +673,7 @@ static int dmx_ts_feed_stop_filtering(st + struct dvb_demux *demux = feed->demux; + int ret; + +- if (mutex_lock_interruptible(&demux->mutex)) +- return -ERESTARTSYS; ++ mutex_lock(&demux->mutex); + + if (feed->state < DMX_STATE_GO) { + mutex_unlock(&demux->mutex); +@@ -748,8 +747,7 @@ static int dvbdmx_release_ts_feed(struct + struct dvb_demux *demux = (struct dvb_demux *)dmx; + struct dvb_demux_feed *feed = (struct dvb_demux_feed *)ts_feed; + +- if (mutex_lock_interruptible(&demux->mutex)) +- return -ERESTARTSYS; ++ mutex_lock(&demux->mutex); + + if (feed->state == DMX_STATE_FREE) { + mutex_unlock(&demux->mutex); +@@ -916,8 +914,7 @@ static int dmx_section_feed_stop_filteri + struct dvb_demux *dvbdmx = dvbdmxfeed->demux; + int ret; + +- if (mutex_lock_interruptible(&dvbdmx->mutex)) +- return -ERESTARTSYS; ++ mutex_lock(&dvbdmx->mutex); + + if (!dvbdmx->stop_feed) { + mutex_unlock(&dvbdmx->mutex); +@@ -942,8 +939,7 @@ static int dmx_section_feed_release_filt + struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed; + struct dvb_demux *dvbdmx = dvbdmxfeed->demux; + +- if (mutex_lock_interruptible(&dvbdmx->mutex)) +- return -ERESTARTSYS; ++ mutex_lock(&dvbdmx->mutex); + + if (dvbdmxfilter->feed != dvbdmxfeed) { + mutex_unlock(&dvbdmx->mutex); +@@ -1016,8 +1012,7 @@ static int dvbdmx_release_section_feed(s + struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed; + struct dvb_demux *dvbdmx = (struct dvb_demux *)demux; + +- if (mutex_lock_interruptible(&dvbdmx->mutex)) +- return -ERESTARTSYS; ++ mutex_lock(&dvbdmx->mutex); + + if (dvbdmxfeed->state == DMX_STATE_FREE) { + mutex_unlock(&dvbdmx->mutex); +@@ -1126,8 +1121,7 @@ static int dvbdmx_connect_frontend(struc + if (demux->frontend) + return -EINVAL; + +- if (mutex_lock_interruptible(&dvbdemux->mutex)) +- return -ERESTARTSYS; ++ mutex_lock(&dvbdemux->mutex); + + demux->frontend = frontend; + mutex_unlock(&dvbdemux->mutex); +@@ -1138,8 +1132,7 @@ static int dvbdmx_disconnect_frontend(st + { + struct dvb_demux *dvbdemux = (struct dvb_demux *)demux; + +- if (mutex_lock_interruptible(&dvbdemux->mutex)) +- return -ERESTARTSYS; ++ mutex_lock(&dvbdemux->mutex); + + demux->frontend = NULL; + mutex_unlock(&dvbdemux->mutex); +--- a/drivers/media/dvb/dvb-core/dvbdev.c ++++ b/drivers/media/dvb/dvb-core/dvbdev.c +@@ -204,8 +204,7 @@ int dvb_register_device(struct dvb_adapt + + int id; + +- if (mutex_lock_interruptible(&dvbdev_register_lock)) +- return -ERESTARTSYS; ++ mutex_lock(&dvbdev_register_lock); + + if ((id = dvbdev_get_free_id (adap, type)) < 0) { + mutex_unlock(&dvbdev_register_lock); +@@ -295,8 +294,7 @@ int dvb_register_adapter(struct dvb_adap + { + int num; + +- if (mutex_lock_interruptible(&dvbdev_register_lock)) +- return -ERESTARTSYS; ++ mutex_lock(&dvbdev_register_lock); + + if ((num = dvbdev_get_free_adapter_num ()) < 0) { + mutex_unlock(&dvbdev_register_lock); +@@ -324,8 +322,7 @@ EXPORT_SYMBOL(dvb_register_adapter); + + int dvb_unregister_adapter(struct dvb_adapter *adap) + { +- if (mutex_lock_interruptible(&dvbdev_register_lock)) +- return -ERESTARTSYS; ++ mutex_lock(&dvbdev_register_lock); + list_del (&adap->list_head); + mutex_unlock(&dvbdev_register_lock); + return 0; + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:01 2007 +Message-Id: <20070330210101.458433707@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Hunold , + Oliver Endriss , + Mauro Carvalho Chehab +Subject: [patch 26/37] V4L: saa7146: Fix allocation of clipping memory +Content-Disposition: inline; filename=v4l-saa7146-fix-allocation-of-clipping-memory.patch +Content-Length: 1336 +Lines: 41 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Oliver Endriss + +V4L: saa7146: Fix allocation of clipping memory + +Olaf Hering pointed out that SAA7146_CLIPPING_MEM would become +very large for PAGE_SIZE > 4K. + +In fact, the number of clipping windows is limited to 16, +and calculate_clipping_registers_rect() does not use more +than 256 bytes. SAA7146_CLIPPING_MEM adjusted accordingly. + +(cherry picked from commit 7a7cd1920969dd9da4e0d99aab573b3eba24c799) + +Thanks-to: Olaf Hering +Acked-by: Michael Hunold +Signed-off-by: Oliver Endriss +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + include/media/saa7146_vv.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/media/saa7146_vv.h ++++ b/include/media/saa7146_vv.h +@@ -239,7 +239,8 @@ void saa7146_res_free(struct saa7146_fh + #define SAA7146_HPS_SYNC_PORT_B 0x01 + + /* some memory sizes */ +-#define SAA7146_CLIPPING_MEM (14*PAGE_SIZE) ++/* max. 16 clipping rectangles */ ++#define SAA7146_CLIPPING_MEM (16 * 4 * sizeof(u32)) + + /* some defines for the various clipping-modes */ + #define SAA7146_CLIPPING_RECT 0x4 + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:01 2007 +Message-Id: <20070330210101.639788084@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik , + justin@jmicron.com, + Bartlomiej Zolnierkiewicz +Subject: [patch 27/37] jmicron: make ide jmicron driver play nice with libata ones +Content-Disposition: inline; filename=jmicron-make-ide-jmicron-driver-play-nice-with-libata-ones.patch +Content-Length: 2742 +Lines: 71 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +jmicron: make ide jmicron driver play nice with libata ones + +When libata is configured, the device is configured such that SATA and +PATA ports live in separate functions with different programming +interfaces. pata_jmicron and ide jmicron drivers can drive only the +PATA part. + +This patch makes jmicron match PCI class code such that it doesn't +attach itself to the SATA part preventing the proper ahci driver from +attaching. + +This change is suggested by Bartlomiej. + +Signed-off-by: Tejun Heo +Cc: Jeff Garzik +Cc: justin@jmicron.com +Cc: Chuck Ebbert +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/ide/pci/jmicron.c | 29 ++++++++++++++++++++++++----- + 1 file changed, 24 insertions(+), 5 deletions(-) + +--- a/drivers/ide/pci/jmicron.c ++++ b/drivers/ide/pci/jmicron.c +@@ -240,12 +240,31 @@ static int __devinit jmicron_init_one(st + return 0; + } + ++/* If libata is configured, jmicron PCI quirk will configure it such ++ * that the SATA ports are in AHCI function while the PATA ports are ++ * in a separate IDE function. In such cases, match device class and ++ * attach only to IDE. If libata isn't configured, keep the old ++ * behavior for backward compatibility. ++ */ ++#if defined(CONFIG_ATA) || defined(CONFIG_ATA_MODULE) ++#define JMB_CLASS PCI_CLASS_STORAGE_IDE << 8 ++#define JMB_CLASS_MASK 0xffff00 ++#else ++#define JMB_CLASS 0 ++#define JMB_CLASS_MASK 0 ++#endif ++ + static struct pci_device_id jmicron_pci_tbl[] = { +- { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, +- { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1}, +- { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2}, +- { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3}, +- { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4}, ++ { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, ++ PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 0}, ++ { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, ++ PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 1}, ++ { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, ++ PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 2}, ++ { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, ++ PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 3}, ++ { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, ++ PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 4}, + { 0, }, + }; + + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:01 2007 +Message-Id: <20070330210101.714408064@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Vasily Averin , + Markus Lidel , + Jens Axboe +Subject: [patch 28/37] i2o: block IO errors on i2o disk +Content-Disposition: inline; filename=i2o-block-io-errors-on-i2o-disk.patch +Content-Length: 2289 +Lines: 70 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Vasily Averin + +[PATCH] i2o: block IO errors on i2o disk + +I2O subsystem has been broken in mainstream several months ago (after +2.6.18). Commit 4aff5e2333c9a1609662f2091f55c3f6fffdad36 from Jens +Axboe split struct request ->flags into two parts: cmd_type and +cmd_flags. + +In i2o layer this patch has replaced flag REQ_SPECIAL by the according +cmd_type. However i2o has used REQ_SPECIAL not as command type but as +driver-specific flag for the debug purposes. As result all i2o requests +have type "special" now, are not processed to the hardware and fail with +I/O error: + + i2o/hda:<3>Buffer I/O error on device i2o/hda, logical block 0 + Buffer I/O error on device i2o/hda, logical block 0 + Buffer I/O error on device i2o/hda, logical block 0 + unable to read partition table + block-osm: device added (TID: 207): i2o/hda + +The following patch removes the extra debug checks without any drawbacks and +restores the normal driver's work. + +Signed-off-by: Vasily Averin +Acked-by: Markus Lidel +Cc: Jens Axboe +From: Chuck Ebbert +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/message/i2o/i2o_block.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +--- a/drivers/message/i2o/i2o_block.c ++++ b/drivers/message/i2o/i2o_block.c +@@ -390,13 +390,6 @@ static int i2o_block_prep_req_fn(struct + return BLKPREP_KILL; + } + +- /* request is already processed by us, so return */ +- if (blk_special_request(req)) { +- osm_debug("REQ_SPECIAL already set!\n"); +- req->cmd_flags |= REQ_DONTPREP; +- return BLKPREP_OK; +- } +- + /* connect the i2o_block_request to the request */ + if (!req->special) { + ireq = i2o_block_request_alloc(); +@@ -408,11 +401,8 @@ static int i2o_block_prep_req_fn(struct + ireq->i2o_blk_dev = i2o_blk_dev; + req->special = ireq; + ireq->req = req; +- } else +- ireq = req->special; +- ++ } + /* do not come back here */ +- req->cmd_type = REQ_TYPE_SPECIAL; + req->cmd_flags |= REQ_DONTPREP; + + return BLKPREP_OK; + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:01 2007 +Message-Id: <20070330210101.870305480@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bartlomiej Zolnierkiewicz +Subject: [patch 29/37] ide: revert "ide: fix drive side 80c cable check, take 2" for now +Content-Disposition: inline; filename=ide-revert-ide-fix-drive-side-80c-cable-check-take-2-for-now.patch +Content-Length: 2088 +Lines: 60 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bartlomiej Zolnierkiewicz + +[PATCH] ide: revert "ide: fix drive side 80c cable check, take 2" for now + +"ide: fix drive side 80c cable check, take 2" patch from Tejun Heo (commit +fab59375b9543f84d1714f7dd00f5d11e531bd3e) fixed 80c bit test (bit13 of word93) +but we also need to fix master/slave IDENTIFY order (slave device should be +probed first in order to make it release PDIAG- signal) and we should also +check for pre-ATA3 slave devices (which may not release PDIAG- signal). + +Unfortunately the fact that IDE driver doesn't reset devices itself helps +only a bit as it seems that some BIOS-es reset ATA devices after programming +the chipset, some BIOS-es can be set to not probe/configure selected devices, +there may be no BIOS in case of add-on cards etc. + +Since we are quite late in the release cycle and the required changes will +affect a lot of systems just revert the fix for now. + +[ Please also see libata commit f31f0cc2f0b7527072d94d02da332d9bb8d7d94c. ] + +Cc: Chuck Ebbert +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-iops.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/ide/ide-iops.c ++++ b/drivers/ide/ide-iops.c +@@ -598,6 +598,9 @@ u8 eighty_ninty_three (ide_drive_t *driv + if(HWIF(drive)->udma_four == 0) + return 0; + ++ printk(KERN_INFO "%s: hw_config=%04x\n", ++ drive->name, drive->id->hw_config); ++ + /* Check for SATA but only if we are ATA5 or higher */ + if (drive->id->hw_config == 0 && (drive->id->major_rev_num & 0x7FE0)) + return 1; +@@ -607,8 +610,14 @@ u8 eighty_ninty_three (ide_drive_t *driv + if(!(drive->id->hw_config & 0x4000)) + return 0; + #endif /* CONFIG_IDEDMA_IVB */ ++/* ++ * FIXME: enable this after fixing master/slave IDENTIFY order, ++ * also ignore the result if the slave device is pre-ATA3 one ++ */ ++#if 0 + if (!(drive->id->hw_config & 0x2000)) + return 0; ++#endif + return 1; + } + + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:02 2007 +Message-Id: <20070330210101.971005449@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Prasad Potluri , + Shirish Pargaonkar , + Steve French +Subject: [patch 30/37] CIFS: Allow reset of file to ATTR_NORMAL when archive bit not set +Content-Disposition: inline; filename=cifs-allow-reset-of-file-to-attr_normal-when-archive-bit-not-set.patch +Content-Length: 2486 +Lines: 74 + + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Steve French + +[CIFS] Allow reset of file to ATTR_NORMAL when archive bit not set + +When a file had a dos attribute of 0x1 (readonly - but dos attribute +of archive was not set) - doing chmod 0777 or equivalent would +try to set a dos attribute of 0 (which some servers ignore) +rather than ATTR_NORMAL (0x20) which most servers accept. +Does not affect servers which support the CIFS Unix Extensions. + +[: removed changelog part of patch] + +Cc: Chuck Ebbert +Acked-by: Prasad Potluri +Acked-by: Shirish Pargaonkar +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + + +--- + fs/cifs/inode.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1133,6 +1133,7 @@ int cifs_setattr(struct dentry *direntry + struct cifsFileInfo *open_file = NULL; + FILE_BASIC_INFO time_buf; + int set_time = FALSE; ++ int set_dosattr = FALSE; + __u64 mode = 0xFFFFFFFFFFFFFFFFULL; + __u64 uid = 0xFFFFFFFFFFFFFFFFULL; + __u64 gid = 0xFFFFFFFFFFFFFFFFULL; +@@ -1269,15 +1270,23 @@ int cifs_setattr(struct dentry *direntry + else if (attrs->ia_valid & ATTR_MODE) { + rc = 0; + if ((mode & S_IWUGO) == 0) /* not writeable */ { +- if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0) ++ if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0) { ++ set_dosattr = TRUE; + time_buf.Attributes = + cpu_to_le32(cifsInode->cifsAttrs | + ATTR_READONLY); ++ } + } else if ((mode & S_IWUGO) == S_IWUGO) { +- if (cifsInode->cifsAttrs & ATTR_READONLY) ++ if (cifsInode->cifsAttrs & ATTR_READONLY) { ++ set_dosattr = TRUE; + time_buf.Attributes = + cpu_to_le32(cifsInode->cifsAttrs & + (~ATTR_READONLY)); ++ /* Windows ignores set to zero */ ++ if(time_buf.Attributes == 0) ++ time_buf.Attributes |= ++ cpu_to_le32(ATTR_NORMAL); ++ } + } + /* BB to be implemented - + via Windows security descriptors or streams */ +@@ -1315,7 +1324,7 @@ int cifs_setattr(struct dentry *direntry + } else + time_buf.ChangeTime = 0; + +- if (set_time || time_buf.Attributes) { ++ if (set_time || set_dosattr) { + time_buf.CreationTime = 0; /* do not change */ + /* In the future we should experiment - try setting timestamps + via Handle (SetFileInfo) instead of by path */ + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:02 2007 +Message-Id: <20070330210102.098679718@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Tyso , + Jeff Layton , + Steve French +Subject: [patch 31/37] CIFS: reset mode when client notices that ATTR_READONLY is no longer set +Content-Disposition: inline; filename=cifs-reset-mode-when-client-notices-that-attr_readonly-is-no-longer-set.patch +Content-Length: 1731 +Lines: 51 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Tyson + +[CIFS] reset mode when client notices that ATTR_READONLY is no longer set + +[: removed changelog part of patch] + +Cc: Chuck Ebbert +Signed-off-by: Alan Tyso +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + + +--- + fs/cifs/inode.c | 6 ++++++ + fs/cifs/readdir.c | 4 ++++ + 2 files changed, 10 insertions(+) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -488,6 +488,12 @@ int cifs_get_inode_info(struct inode **p + mode e.g. 555 */ + if (cifsInfo->cifsAttrs & ATTR_READONLY) + inode->i_mode &= ~(S_IWUGO); ++ else if ((inode->i_mode & S_IWUGO) == 0) ++ /* the ATTR_READONLY flag may have been */ ++ /* changed on server -- set any w bits */ ++ /* allowed by mnt_file_mode */ ++ inode->i_mode |= (S_IWUGO & ++ cifs_sb->mnt_file_mode); + /* BB add code here - + validate if device or weird share or device type? */ + } +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -215,6 +215,10 @@ static void fill_in_inode(struct inode * + tmp_inode->i_mode |= S_IFREG; + if (attr & ATTR_READONLY) + tmp_inode->i_mode &= ~(S_IWUGO); ++ else if ((tmp_inode->i_mode & S_IWUGO) == 0) ++ /* the ATTR_READONLY flag may have been changed on */ ++ /* server -- set any w bits allowed by mnt_file_mode */ ++ tmp_inode->i_mode |= (S_IWUGO & cifs_sb->mnt_file_mode); + } /* could add code here - to validate if device or weird share type? */ + + /* can not fill in nlink here as in qpathinfo version and Unx search */ + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:02 2007 +Message-Id: <20070330210102.230935055@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "J. Bruce Fields" , + Herbert Xu +Subject: [patch 32/37] CRYPTO: api: scatterwalk_copychunks() fails to advance through scatterlist +Content-Disposition: inline; filename=crypto-api-scatterwalk_copychunks-fails-to-advance-through-scatterlist.patch +Content-Length: 1894 +Lines: 61 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: J. Bruce Fields + +[CRYPTO] api: scatterwalk_copychunks() fails to advance through scatterlist + +In the loop in scatterwalk_copychunks(), if walk->offset is zero, +then scatterwalk_pagedone rounds that up to the nearest page boundary: + + walk->offset += PAGE_SIZE - 1; + walk->offset &= PAGE_MASK; + +which is a no-op in this case, so we don't advance to the next element +of the scatterlist array: + + if (walk->offset >= walk->sg->offset + walk->sg->length) + scatterwalk_start(walk, sg_next(walk->sg)); + +and we end up copying the same data twice. + +It appears that other callers of scatterwalk_{page}done first advance +walk->offset, so I believe that's the correct thing to do here. + +This caused a bug in NFS when run with krb5p security, which would +cause some writes to fail with permissions errors--for example, writes +of less than 8 bytes (the des blocksize) at the start of a file. + +A git-bisect shows the bug was originally introduced by +5c64097aa0f6dc4f27718ef47ca9a12538d62860, first in 2.6.19-rc1. + +Cc: Chuck Ebbert +Signed-off-by: J. Bruce Fields +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/scatterwalk.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/crypto/scatterwalk.c ++++ b/crypto/scatterwalk.c +@@ -91,6 +91,8 @@ void scatterwalk_copychunks(void *buf, s + memcpy_dir(buf, vaddr, len_this_page, out); + scatterwalk_unmap(vaddr, out); + ++ scatterwalk_advance(walk, nbytes); ++ + if (nbytes == len_this_page) + break; + +@@ -99,7 +101,5 @@ void scatterwalk_copychunks(void *buf, s + + scatterwalk_pagedone(walk, out, 1); + } +- +- scatterwalk_advance(walk, nbytes); + } + EXPORT_SYMBOL_GPL(scatterwalk_copychunks); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:02 2007 +Message-Id: <20070330210102.359042090@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Art Haas , + Mark Lord , + Jeff Garzik +Subject: [patch 33/37] libata: clear TF before IDENTIFYing +Content-Disposition: inline; filename=libata-clear-tf-before-identifying.patch +Content-Length: 1460 +Lines: 47 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +libata: clear TF before IDENTIFYing + +Some devices chock if Feature is not clear when IDENTIFY is issued. +Set ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE for IDENTIFY such that whole +TF is cleared when reading ID data. + +Kudos to Art Haas for testing various futile patches over several +months and Mark Lord for pointing out the fix. + +Signed-off-by: Tejun Heo +Cc: Art Haas +Cc: Mark Lord +Cc: Chuck Ebbert +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -1478,7 +1478,16 @@ int ata_dev_read_id(struct ata_device *d + } + + tf.protocol = ATA_PROT_PIO; +- tf.flags |= ATA_TFLAG_POLLING; /* for polling presence detection */ ++ ++ /* Some devices choke if TF registers contain garbage. Make ++ * sure those are properly initialized. ++ */ ++ tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; ++ ++ /* Device presence detection is unreliable on some ++ * controllers. Always poll IDENTIFY if available. ++ */ ++ tf.flags |= ATA_TFLAG_POLLING; + + err_mask = ata_exec_internal(dev, &tf, NULL, DMA_FROM_DEVICE, + id, sizeof(id[0]) * ATA_ID_WORDS); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:02 2007 +Message-Id: <20070330210102.486847389@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Lord , + Jeff Garzik +Subject: [patch 34/37] libata bugfix: HDIO_DRIVE_TASK +Content-Disposition: inline; filename=libata-bugfix-hdio_drive_task.patch +Content-Length: 1524 +Lines: 49 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mark Lord + +libata bugfix: HDIO_DRIVE_TASK + +I was trying to use HDIO_DRIVE_TASK for something today, +and discovered that the libata implementation does not copy +over the upper four LBA bits from args[6]. + +This is serious, as any tools using this ioctl would have their +commands applied to the wrong sectors on the drive, possibly resulting +in disk corruption. + +Ideally, newer apps should use SG_IO/ATA_16 directly, +avoiding this bug. But with libata poised to displace drivers/ide, +better compatibility here is a must. + +This patch fixes libata to use the upper four LBA bits passed +in from the ioctl. + +The original drivers/ide implementation copies over all bits +except for the master/slave select bit. With this patch, +libata will copy only the four high-order LBA bits, +just in case there are assumptions elsewhere in libata (?). + +Signed-off-by: Mark Lord +Cc: Chuck Ebbert +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/ata/libata-scsi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -295,6 +295,7 @@ int ata_task_ioctl(struct scsi_device *s + scsi_cmd[8] = args[3]; + scsi_cmd[10] = args[4]; + scsi_cmd[12] = args[5]; ++ scsi_cmd[13] = args[6] & 0x0f; + scsi_cmd[14] = args[0]; + + /* Good values for timeout and retries? Values below + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:02 2007 +Message-Id: <20070330210102.618928670@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Garzik +Subject: [patch 35/37] libata: sata_mv: dont touch reserved bits in EDMA config register +Content-Disposition: inline; filename=libata-sata_mv-don-t-touch-reserved-bits-in-edma-config-register.patch +Content-Length: 2107 +Lines: 62 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Garzik + +[libata] sata_mv: don't touch reserved bits in EDMA config register + +The code in mv_edma_cfg() reflected its 60xx origins, by doing things +[slightly] incorrectly on the older 50xx and newer 6042/7042 chips. + +Clean up the EDMA configuration setup such that, each chip family +carefully initializes its own EDMA setup. + +Cc: Chuck Ebbert +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/ata/sata_mv.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -843,23 +843,27 @@ static void mv_edma_cfg(struct mv_host_p + u32 cfg = readl(port_mmio + EDMA_CFG_OFS); + + /* set up non-NCQ EDMA configuration */ +- cfg &= ~0x1f; /* clear queue depth */ +- cfg &= ~EDMA_CFG_NCQ; /* clear NCQ mode */ + cfg &= ~(1 << 9); /* disable equeue */ + +- if (IS_GEN_I(hpriv)) ++ if (IS_GEN_I(hpriv)) { ++ cfg &= ~0x1f; /* clear queue depth */ + cfg |= (1 << 8); /* enab config burst size mask */ ++ } + +- else if (IS_GEN_II(hpriv)) ++ else if (IS_GEN_II(hpriv)) { ++ cfg &= ~0x1f; /* clear queue depth */ + cfg |= EDMA_CFG_RD_BRST_EXT | EDMA_CFG_WR_BUFF_LEN; ++ cfg &= ~(EDMA_CFG_NCQ | EDMA_CFG_NCQ_GO_ON_ERR); /* clear NCQ */ ++ } + + else if (IS_GEN_IIE(hpriv)) { +- cfg |= (1 << 23); /* dis RX PM port mask */ +- cfg &= ~(1 << 16); /* dis FIS-based switching (for now) */ ++ cfg |= (1 << 23); /* do not mask PM field in rx'd FIS */ ++ cfg |= (1 << 22); /* enab 4-entry host queue cache */ + cfg &= ~(1 << 19); /* dis 128-entry queue (for now?) */ + cfg |= (1 << 18); /* enab early completion */ +- cfg |= (1 << 17); /* enab host q cache */ +- cfg |= (1 << 22); /* enab cutthrough */ ++ cfg |= (1 << 17); /* enab cut-through (dis stor&forwrd) */ ++ cfg &= ~(1 << 16); /* dis FIS-based switching (for now) */ ++ cfg &= ~(EDMA_CFG_NCQ | EDMA_CFG_NCQ_GO_ON_ERR); /* clear NCQ */ + } + + writelfl(cfg, port_mmio + EDMA_CFG_OFS); + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:02 2007 +Message-Id: <20070330210102.752506893@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Garzik +Subject: [patch 36/37] libata: sata_mv: Fix 50xx irq mask +Content-Disposition: inline; filename=libata-sata_mv-fix-50xx-irq-mask.patch +Content-Length: 1993 +Lines: 61 + + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Garzik + +[libata] sata_mv: Fix 50xx irq mask + +IRQ mask bits assumed a 60xx or newer generation chip, which is very +wrong for the 50xx series. Luckily both generations shared the per-port +interrupt mask bits, leaving only the "misc chip features" bits to be +completely mismatched. + +Fix 50xx by ensuring we only program bits that exist. + +Cc: Chuck Ebbert +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/ata/sata_mv.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -139,14 +139,19 @@ enum { + PCI_ERR = (1 << 18), + TRAN_LO_DONE = (1 << 19), /* 6xxx: IRQ coalescing */ + TRAN_HI_DONE = (1 << 20), /* 6xxx: IRQ coalescing */ ++ PORTS_0_3_COAL_DONE = (1 << 8), ++ PORTS_4_7_COAL_DONE = (1 << 17), + PORTS_0_7_COAL_DONE = (1 << 21), /* 6xxx: IRQ coalescing */ + GPIO_INT = (1 << 22), + SELF_INT = (1 << 23), + TWSI_INT = (1 << 24), + HC_MAIN_RSVD = (0x7f << 25), /* bits 31-25 */ ++ HC_MAIN_RSVD_5 = (0x1fff << 19), /* bits 31-19 */ + HC_MAIN_MASKED_IRQS = (TRAN_LO_DONE | TRAN_HI_DONE | + PORTS_0_7_COAL_DONE | GPIO_INT | TWSI_INT | + HC_MAIN_RSVD), ++ HC_MAIN_MASKED_IRQS_5 = (PORTS_0_3_COAL_DONE | PORTS_4_7_COAL_DONE | ++ HC_MAIN_RSVD_5), + + /* SATAHC registers */ + HC_CFG_OFS = 0, +@@ -2287,7 +2292,11 @@ static int mv_init_host(struct pci_dev * + + /* and unmask interrupt generation for host regs */ + writelfl(PCI_UNMASK_ALL_IRQS, mmio + PCI_IRQ_MASK_OFS); +- writelfl(~HC_MAIN_MASKED_IRQS, mmio + HC_MAIN_IRQ_MASK_OFS); ++ ++ if (IS_50XX(hpriv)) ++ writelfl(~HC_MAIN_MASKED_IRQS_5, mmio + HC_MAIN_IRQ_MASK_OFS); ++ else ++ writelfl(~HC_MAIN_MASKED_IRQS, mmio + HC_MAIN_IRQ_MASK_OFS); + + VPRINTK("HC MAIN IRQ cause/mask=0x%08x/0x%08x " + "PCI int cause/mask=0x%08x/0x%08x\n", + +-- + +From gregkh@mini.kroah.org Fri Mar 30 14:01:02 2007 +Message-Id: <20070330210102.877133634@mini.kroah.org> +References: <20070330205938.984247529@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Fri, 30 Mar 2007 14:00:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + dsd@gentoo.org, + rmk@arm.linux.org.uk +Subject: [patch 37/37] generic_serial: fix decoding of baud rate +Content-Disposition: inline; filename=generic_serial-fix-decoding-of-baud-rate.patch +Content-Length: 1545 +Lines: 48 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Daniel Drake + +Commit d720bc4b8fc5d6d179ef094908d4fbb5e436ffad partially removed a private +implementation of baud speed decoding. However it doesn't seem to be +complete: after the speed is decoded, it is still being used as an index to +a local speed table (array overrun, no doubt). + +This was found by Graham Murray who noticed it caused a 2.6.19 regression +with the SX driver: https://bugs.gentoo.org/170554 + +Signed-off-by: Daniel Drake +Acked-by: Alan Cox +Cc: Russell King +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/generic_serial.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/drivers/char/generic_serial.c ++++ b/drivers/char/generic_serial.c +@@ -711,12 +711,6 @@ void gs_close(struct tty_struct * tty, s + } + + +-static unsigned int gs_baudrates[] = { +- 0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800, +- 9600, 19200, 38400, 57600, 115200, 230400, 460800, 921600 +-}; +- +- + void gs_set_termios (struct tty_struct * tty, + struct ktermios * old_termios) + { +@@ -772,7 +766,6 @@ void gs_set_termios (struct tty_struct * + + baudrate = tty_get_baud_rate(tty); + +- baudrate = gs_baudrates[baudrate]; + if ((tiosp->c_cflag & CBAUD) == B38400) { + if ( (port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI) + baudrate = 57600; + +-- + diff --git a/queue-2.6.20/net-fix-fib-rules-compatability.patch b/review-2.6.20/net-fix-fib-rules-compatability.patch similarity index 100% rename from queue-2.6.20/net-fix-fib-rules-compatability.patch rename to review-2.6.20/net-fix-fib-rules-compatability.patch diff --git a/queue-2.6.20/net-fix-packet-classidier-null-pointer-oops.patch b/review-2.6.20/net-fix-packet-classidier-null-pointer-oops.patch similarity index 100% rename from queue-2.6.20/net-fix-packet-classidier-null-pointer-oops.patch rename to review-2.6.20/net-fix-packet-classidier-null-pointer-oops.patch diff --git a/queue-2.6.20/net-fix-sock_attach_fd-failure-in-sys_accept.patch b/review-2.6.20/net-fix-sock_attach_fd-failure-in-sys_accept.patch similarity index 100% rename from queue-2.6.20/net-fix-sock_attach_fd-failure-in-sys_accept.patch rename to review-2.6.20/net-fix-sock_attach_fd-failure-in-sys_accept.patch diff --git a/queue-2.6.20/net_sched-fix-ingress-qdisc-locking.patch b/review-2.6.20/net_sched-fix-ingress-qdisc-locking.patch similarity index 100% rename from queue-2.6.20/net_sched-fix-ingress-qdisc-locking.patch rename to review-2.6.20/net_sched-fix-ingress-qdisc-locking.patch diff --git a/queue-2.6.20/ppp-fix-ppp-skb-leak.patch b/review-2.6.20/ppp-fix-ppp-skb-leak.patch similarity index 100% rename from queue-2.6.20/ppp-fix-ppp-skb-leak.patch rename to review-2.6.20/ppp-fix-ppp-skb-leak.patch diff --git a/queue-2.6.20/sata_nv-delay-on-switching-between-ncq-and-non-ncq-commands.patch b/review-2.6.20/sata_nv-delay-on-switching-between-ncq-and-non-ncq-commands.patch similarity index 100% rename from queue-2.6.20/sata_nv-delay-on-switching-between-ncq-and-non-ncq-commands.patch rename to review-2.6.20/sata_nv-delay-on-switching-between-ncq-and-non-ncq-commands.patch diff --git a/queue-2.6.20/series b/review-2.6.20/series similarity index 100% rename from queue-2.6.20/series rename to review-2.6.20/series diff --git a/queue-2.6.20/sparc-fix-sparc-builds-with-gcc-4.2.x.patch b/review-2.6.20/sparc-fix-sparc-builds-with-gcc-4.2.x.patch similarity index 100% rename from queue-2.6.20/sparc-fix-sparc-builds-with-gcc-4.2.x.patch rename to review-2.6.20/sparc-fix-sparc-builds-with-gcc-4.2.x.patch diff --git a/queue-2.6.20/uml-fix-epoll.patch b/review-2.6.20/uml-fix-epoll.patch similarity index 100% rename from queue-2.6.20/uml-fix-epoll.patch rename to review-2.6.20/uml-fix-epoll.patch diff --git a/queue-2.6.20/uml-fix-static-linking.patch b/review-2.6.20/uml-fix-static-linking.patch similarity index 100% rename from queue-2.6.20/uml-fix-static-linking.patch rename to review-2.6.20/uml-fix-static-linking.patch diff --git a/queue-2.6.20/uml-fix-unreasonably-long-udelay.patch b/review-2.6.20/uml-fix-unreasonably-long-udelay.patch similarity index 100% rename from queue-2.6.20/uml-fix-unreasonably-long-udelay.patch rename to review-2.6.20/uml-fix-unreasonably-long-udelay.patch diff --git a/queue-2.6.20/uml-host-vdso-fix.patch b/review-2.6.20/uml-host-vdso-fix.patch similarity index 100% rename from queue-2.6.20/uml-host-vdso-fix.patch rename to review-2.6.20/uml-host-vdso-fix.patch diff --git a/queue-2.6.20/uml-use-correct-register-file-size-everywhere.patch b/review-2.6.20/uml-use-correct-register-file-size-everywhere.patch similarity index 100% rename from queue-2.6.20/uml-use-correct-register-file-size-everywhere.patch rename to review-2.6.20/uml-use-correct-register-file-size-everywhere.patch diff --git a/queue-2.6.20/v4l-fix-secam-handling-on-saa7115.patch b/review-2.6.20/v4l-fix-secam-handling-on-saa7115.patch similarity index 100% rename from queue-2.6.20/v4l-fix-secam-handling-on-saa7115.patch rename to review-2.6.20/v4l-fix-secam-handling-on-saa7115.patch diff --git a/queue-2.6.20/v4l-msp_attach-must-return-0-if-no-msp3400-was-found.patch b/review-2.6.20/v4l-msp_attach-must-return-0-if-no-msp3400-was-found.patch similarity index 100% rename from queue-2.6.20/v4l-msp_attach-must-return-0-if-no-msp3400-was-found.patch rename to review-2.6.20/v4l-msp_attach-must-return-0-if-no-msp3400-was-found.patch diff --git a/queue-2.6.20/v4l-radio-fix-error-in-kbuild-file.patch b/review-2.6.20/v4l-radio-fix-error-in-kbuild-file.patch similarity index 100% rename from queue-2.6.20/v4l-radio-fix-error-in-kbuild-file.patch rename to review-2.6.20/v4l-radio-fix-error-in-kbuild-file.patch diff --git a/queue-2.6.20/v4l-saa7146-fix-allocation-of-clipping-memory.patch b/review-2.6.20/v4l-saa7146-fix-allocation-of-clipping-memory.patch similarity index 100% rename from queue-2.6.20/v4l-saa7146-fix-allocation-of-clipping-memory.patch rename to review-2.6.20/v4l-saa7146-fix-allocation-of-clipping-memory.patch diff --git a/queue-2.6.20/video-fix-ffb-dac-revision-probing.patch b/review-2.6.20/video-fix-ffb-dac-revision-probing.patch similarity index 100% rename from queue-2.6.20/video-fix-ffb-dac-revision-probing.patch rename to review-2.6.20/video-fix-ffb-dac-revision-probing.patch