From: Greg Kroah-Hartman Date: Wed, 7 Mar 2007 00:46:44 +0000 (-0800) Subject: more 2.6.20 stable patches X-Git-Tag: v2.6.20.2~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a1cd50fd5b0c9dd711f337b2fcf3527f42f0ee65;p=thirdparty%2Fkernel%2Fstable-queue.git more 2.6.20 stable patches --- diff --git a/queue-2.6.20/avoid-using-nfsd-process-pools-on-smp-machines.patch b/queue-2.6.20/avoid-using-nfsd-process-pools-on-smp-machines.patch new file mode 100644 index 00000000000..17252f47c04 --- /dev/null +++ b/queue-2.6.20/avoid-using-nfsd-process-pools-on-smp-machines.patch @@ -0,0 +1,39 @@ +From stable-bounces@linux.kernel.org Mon Mar 5 22:14:01 2007 +From: NeilBrown +Date: Tue, 6 Mar 2007 17:11:29 +1100 +Subject: Avoid using nfsd process pools on SMP machines. +To: stable@kernel.org +Message-ID: <1070306061129.10623@suse.de> + +From: NeilBrown + + +process-pools have real benefits for NUMA, but on SMP +machines they only work if network interface interrupts +go to all CPUs (via round-robin or multiple nics). This is +not always the case, so disable the pools in this case until +a better solution is developped. + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + +diff .prev/net/sunrpc/svc.c ./net/sunrpc/svc.c +--- + net/sunrpc/svc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- linux-2.6.20.1.orig/net/sunrpc/svc.c ++++ linux-2.6.20.1/net/sunrpc/svc.c +@@ -79,7 +79,11 @@ svc_pool_map_choose_mode(void) + * x86_64 kernel on Xeons. In this case we + * want to divide the pools on cpu boundaries. + */ +- return SVC_POOL_PERCPU; ++ /* actually, unless your IRQs round-robin nicely, ++ * this turns out to be really bad, so just ++ * go GLOBAL for now until a better fix can be developped ++ */ ++ return SVC_POOL_GLOBAL; + } + + /* default: one global pool */ diff --git a/queue-2.6.20/ehci-turn-off-remote-wakeup-during-shutdown.patch b/queue-2.6.20/ehci-turn-off-remote-wakeup-during-shutdown.patch new file mode 100644 index 00000000000..1853a05d10e --- /dev/null +++ b/queue-2.6.20/ehci-turn-off-remote-wakeup-during-shutdown.patch @@ -0,0 +1,56 @@ +From stable-bounces@linux.kernel.org Tue Feb 13 11:54:29 2007 +From: Alan Stern +Date: Tue, 13 Feb 2007 14:53:06 -0500 (EST) +Subject: EHCI: turn off remote wakeup during shutdown +To: stable@kernel.org +Message-ID: + +From: Alan Stern + +This patch (as850b) disables remote wakeup (and everything else!) on +all EHCI ports when the shutdown() method is called. If remote wakeup +is left active then some systems will reboot instead of powering off. +This fixes Bugzilla #7828. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hcd.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- linux-2.6.20.1.orig/drivers/usb/host/ehci-hcd.c ++++ linux-2.6.20.1/drivers/usb/host/ehci-hcd.c +@@ -296,6 +296,18 @@ static void ehci_watchdog (unsigned long + spin_unlock_irqrestore (&ehci->lock, flags); + } + ++/* On some systems, leaving remote wakeup enabled prevents system shutdown. ++ * The firmware seems to think that powering off is a wakeup event! ++ * This routine turns off remote wakeup and everything else, on all ports. ++ */ ++static void ehci_turn_off_all_ports(struct ehci_hcd *ehci) ++{ ++ int port = HCS_N_PORTS(ehci->hcs_params); ++ ++ while (port--) ++ writel(PORT_RWC_BITS, &ehci->regs->port_status[port]); ++} ++ + /* ehci_shutdown kick in for silicon on any bus (not just pci, etc). + * This forcibly disables dma and IRQs, helping kexec and other cases + * where the next system software may expect clean state. +@@ -307,9 +319,13 @@ ehci_shutdown (struct usb_hcd *hcd) + + ehci = hcd_to_ehci (hcd); + (void) ehci_halt (ehci); ++ ehci_turn_off_all_ports(ehci); + + /* make BIOS/etc use companion controller during reboot */ + writel (0, &ehci->regs->configured_flag); ++ ++ /* unblock posted writes */ ++ readl(&ehci->regs->configured_flag); + } + + static void ehci_port_power (struct ehci_hcd *ehci, int is_on) diff --git a/queue-2.6.20/fix-allocation-failure-handling-in-multicast.patch b/queue-2.6.20/fix-allocation-failure-handling-in-multicast.patch new file mode 100644 index 00000000000..39fbd2ddfe2 --- /dev/null +++ b/queue-2.6.20/fix-allocation-failure-handling-in-multicast.patch @@ -0,0 +1,46 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 21:59:45 2007 +From: Alexey Dobriyan +Date: Tue, 06 Feb 2007 21:58:27 -0800 (PST) +Subject: Fix allocation failure handling in multicast +To: stable@kernel.org +Cc: bunk@stusta.de +Message-ID: <20070206.215827.124083972.davem@davemloft.net> + +From: Alexey Dobriyan + +[IPV4/IPV6] multicast: Check add_grhead() return value + +add_grhead() allocates memory with GFP_ATOMIC and in at least two places skb +from it passed to skb_put() without checking. + +Signed-off-by: Alexey Dobriyan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/igmp.c | 2 ++ + net/ipv6/mcast.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- linux-2.6.20.1.orig/net/ipv4/igmp.c ++++ linux-2.6.20.1/net/ipv4/igmp.c +@@ -455,6 +455,8 @@ static struct sk_buff *add_grec(struct s + skb = add_grhead(skb, pmc, type, &pgr); + first = 0; + } ++ if (!skb) ++ return NULL; + psrc = (__be32 *)skb_put(skb, sizeof(__be32)); + *psrc = psf->sf_inaddr; + scount++; stotal++; +--- linux-2.6.20.1.orig/net/ipv6/mcast.c ++++ linux-2.6.20.1/net/ipv6/mcast.c +@@ -1582,6 +1582,8 @@ static struct sk_buff *add_grec(struct s + skb = add_grhead(skb, pmc, type, &pgr); + first = 0; + } ++ if (!skb) ++ return NULL; + psrc = (struct in6_addr *)skb_put(skb, sizeof(*psrc)); + *psrc = psf->sf_addr; + scount++; stotal++; diff --git a/queue-2.6.20/fix-atm-initcall-ordering.patch b/queue-2.6.20/fix-atm-initcall-ordering.patch new file mode 100644 index 00000000000..ce2501cfcde --- /dev/null +++ b/queue-2.6.20/fix-atm-initcall-ordering.patch @@ -0,0 +1,46 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 21:57:59 2007 +From: Daniel Walker +Date: Tue, 06 Feb 2007 21:56:37 -0800 (PST) +Subject: Fix ATM initcall ordering. +To: stable@kernel.org +Cc: bunk@stusta.de +Message-ID: <20070206.215637.55835926.davem@davemloft.net> + +From: Daniel Walker + +[ATM]: Fix for crash in adummy_init() + +This was reported by Ingo Molnar here, + +http://lkml.org/lkml/2006/12/18/119 + +The problem is that adummy_init() depends on atm_init() , but adummy_init() +is called first. + +So I put atm_init() into subsys_initcall which seems appropriate, and it +will still get module_init() if it becomes a module. + +Interesting to note that you could crash your system here if you just load +the modules in the wrong order. + +Signed-off-by: Daniel Walker +Signed-off-by: Andrew Morton +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/atm/common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.20.1.orig/net/atm/common.c ++++ linux-2.6.20.1/net/atm/common.c +@@ -816,7 +816,8 @@ static void __exit atm_exit(void) + proto_unregister(&vcc_proto); + } + +-module_init(atm_init); ++subsys_initcall(atm_init); ++ + module_exit(atm_exit); + + MODULE_LICENSE("GPL"); diff --git a/queue-2.6.20/fix-compile-error-for-e500-core-based-processors.patch b/queue-2.6.20/fix-compile-error-for-e500-core-based-processors.patch new file mode 100644 index 00000000000..03a49f29bc0 --- /dev/null +++ b/queue-2.6.20/fix-compile-error-for-e500-core-based-processors.patch @@ -0,0 +1,40 @@ +From stable-bounces@linux.kernel.org Fri Feb 9 07:44:05 2007 +From: Rojhalat Ibrahim +Date: Fri, 9 Feb 2007 09:39:57 -0600 (CST) +Subject: Fix compile error for e500 core based processors +To: stable@kernel.org +Cc: imr@rtschenk.de, linux-kernel@vger.kernel.org, linuxppc-embedded@ozlabs.org +Message-ID: + +From: Rojhalat Ibrahim + +We get the following compiler error: + + CC arch/ppc/kernel/ppc_ksyms.o +arch/ppc/kernel/ppc_ksyms.c:275: error: '__mtdcr' undeclared here (not in a function) +arch/ppc/kernel/ppc_ksyms.c:275: warning: type defaults to 'int' in declaration of '__mtdcr' +arch/ppc/kernel/ppc_ksyms.c:276: error: '__mfdcr' undeclared here (not in a function) +arch/ppc/kernel/ppc_ksyms.c:276: warning: type defaults to 'int' in declaration of '__mfdcr' +make[1]: *** [arch/ppc/kernel/ppc_ksyms.o] Error 1 + +This is due to the EXPORT_SYMBOL for __mtdcr/__mfdcr not having the proper CONFIG protection + +Signed-off-by: Rojhalat Ibrahim +Signed-off-by: Kumar Gala +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ppc/kernel/ppc_ksyms.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.20.1.orig/arch/ppc/kernel/ppc_ksyms.c ++++ linux-2.6.20.1/arch/ppc/kernel/ppc_ksyms.c +@@ -270,7 +270,7 @@ EXPORT_SYMBOL(mmu_hash_lock); /* For MOL + extern long *intercept_table; + EXPORT_SYMBOL(intercept_table); + #endif /* CONFIG_PPC_STD_MMU */ +-#if defined(CONFIG_40x) || defined(CONFIG_BOOKE) ++#ifdef CONFIG_PPC_DCR_NATIVE + EXPORT_SYMBOL(__mtdcr); + EXPORT_SYMBOL(__mfdcr); + #endif diff --git a/queue-2.6.20/fix-null-pointer-dereference-in-appledisplay-driver.patch b/queue-2.6.20/fix-null-pointer-dereference-in-appledisplay-driver.patch new file mode 100644 index 00000000000..dfef3dbe31f --- /dev/null +++ b/queue-2.6.20/fix-null-pointer-dereference-in-appledisplay-driver.patch @@ -0,0 +1,36 @@ +From stable-bounces@linux.kernel.org Fri Feb 9 17:31:14 2007 +From: Michael Hanselmann +Date: Sat, 10 Feb 2007 01:18:23 +0100 +Subject: Fix null pointer dereference in appledisplay driver +To: linux-kernel@vger.kernel.org +Cc: len.brown@intel.com, akpm@linux-foundation.org, cappaberra@gmail.com +Message-ID: <20070210001823.GA3557@hansmi.ch> +Content-Disposition: inline + +From: Michael Hanselmann + +Commit 40b20c257a13c5a526ac540bc5e43d0fdf29792a by Len Brown introduced +a null pointer dereference in the appledisplay driver. This patch fixes +it. + +Signed-off-by: Michael Hanselmann +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/usb/misc/appledisplay.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.20.1.orig/drivers/usb/misc/appledisplay.c ++++ linux-2.6.20.1/drivers/usb/misc/appledisplay.c +@@ -281,8 +281,8 @@ static int appledisplay_probe(struct usb + /* Register backlight device */ + snprintf(bl_name, sizeof(bl_name), "appledisplay%d", + atomic_inc_return(&count_displays) - 1); +- pdata->bd = backlight_device_register(bl_name, NULL, NULL, +- &appledisplay_bl_data); ++ pdata->bd = backlight_device_register(bl_name, NULL, ++ pdata, &appledisplay_bl_data); + if (IS_ERR(pdata->bd)) { + err("appledisplay: Backlight registration failed"); + goto error; diff --git a/queue-2.6.20/fix-recently-introduced-problem-with-shutting-down-a-busy-nfs-server.patch b/queue-2.6.20/fix-recently-introduced-problem-with-shutting-down-a-busy-nfs-server.patch new file mode 100644 index 00000000000..50e109064a7 --- /dev/null +++ b/queue-2.6.20/fix-recently-introduced-problem-with-shutting-down-a-busy-nfs-server.patch @@ -0,0 +1,126 @@ +From stable-bounces@linux.kernel.org Mon Mar 5 22:14:11 2007 +From: NeilBrown +Date: Tue, 6 Mar 2007 17:11:33 +1100 +Subject: Fix recently introduced problem with shutting down a busy NFS server. +To: stable@kernel.org +Message-ID: <1070306061133.10640@suse.de> + +From: NeilBrown + + +When the last thread of nfsd exits, it shuts down all related sockets. +It currently uses svc_close_socket to do this, but that only is +immediately effective if the socket is not SK_BUSY. + +If the socket is busy - i.e. if a request has arrived that has not yet +been processes - svc_close_socket is not effective and the shutdown +process spins. + +So create a new svc_force_close_socket which removes the SK_BUSY flag +is set and then calls svc_close_socket. + +Also change some open-codes loops in svc_destroy to use +list_for_each_entry_safe. + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + + +--- + include/linux/sunrpc/svcsock.h | 2 +- + net/sunrpc/svc.c | 23 ++++++++++------------- + net/sunrpc/svcsock.c | 16 +++++++++++++++- + 3 files changed, 26 insertions(+), 15 deletions(-) + +--- linux-2.6.20.1.orig/include/linux/sunrpc/svcsock.h ++++ linux-2.6.20.1/include/linux/sunrpc/svcsock.h +@@ -63,7 +63,7 @@ struct svc_sock { + * Function prototypes. + */ + int svc_makesock(struct svc_serv *, int, unsigned short); +-void svc_close_socket(struct svc_sock *); ++void svc_force_close_socket(struct svc_sock *); + int svc_recv(struct svc_rqst *, long); + int svc_send(struct svc_rqst *); + void svc_drop(struct svc_rqst *); +--- linux-2.6.20.1.orig/net/sunrpc/svc.c ++++ linux-2.6.20.1/net/sunrpc/svc.c +@@ -371,6 +371,7 @@ void + svc_destroy(struct svc_serv *serv) + { + struct svc_sock *svsk; ++ struct svc_sock *tmp; + + dprintk("RPC: svc_destroy(%s, %d)\n", + serv->sv_program->pg_name, +@@ -386,22 +387,18 @@ svc_destroy(struct svc_serv *serv) + + del_timer_sync(&serv->sv_temptimer); + +- while (!list_empty(&serv->sv_tempsocks)) { +- svsk = list_entry(serv->sv_tempsocks.next, +- struct svc_sock, +- sk_list); +- svc_close_socket(svsk); +- } ++ list_for_each_entry_safe(svsk, tmp, &serv->sv_tempsocks, sk_list) ++ svc_force_close_socket(svsk); ++ + if (serv->sv_shutdown) + serv->sv_shutdown(serv); + +- while (!list_empty(&serv->sv_permsocks)) { +- svsk = list_entry(serv->sv_permsocks.next, +- struct svc_sock, +- sk_list); +- svc_close_socket(svsk); +- } +- ++ list_for_each_entry_safe(svsk, tmp, &serv->sv_permsocks, sk_list) ++ svc_force_close_socket(svsk); ++ ++ BUG_ON(!list_empty(&serv->sv_permsocks)); ++ BUG_ON(!list_empty(&serv->sv_tempsocks)); ++ + cache_clean_deferred(serv); + + /* Unregister service with the portmapper */ +--- linux-2.6.20.1.orig/net/sunrpc/svcsock.c ++++ linux-2.6.20.1/net/sunrpc/svcsock.c +@@ -80,6 +80,7 @@ static void svc_delete_socket(struct sv + static void svc_udp_data_ready(struct sock *, int); + static int svc_udp_recvfrom(struct svc_rqst *); + static int svc_udp_sendto(struct svc_rqst *); ++static void svc_close_socket(struct svc_sock *svsk); + + static struct svc_deferred_req *svc_deferred_dequeue(struct svc_sock *svsk); + static int svc_deferred_recv(struct svc_rqst *rqstp); +@@ -1668,7 +1669,7 @@ svc_delete_socket(struct svc_sock *svsk) + spin_unlock_bh(&serv->sv_lock); + } + +-void svc_close_socket(struct svc_sock *svsk) ++static void svc_close_socket(struct svc_sock *svsk) + { + set_bit(SK_CLOSE, &svsk->sk_flags); + if (test_and_set_bit(SK_BUSY, &svsk->sk_flags)) +@@ -1681,6 +1682,19 @@ void svc_close_socket(struct svc_sock *s + svc_sock_put(svsk); + } + ++void svc_force_close_socket(struct svc_sock *svsk) ++{ ++ set_bit(SK_CLOSE, &svsk->sk_flags); ++ if (test_bit(SK_BUSY, &svsk->sk_flags)) { ++ /* Waiting to be processed, but no threads left, ++ * So just remove it from the waiting list ++ */ ++ list_del_init(&svsk->sk_ready); ++ clear_bit(SK_BUSY, &svsk->sk_flags); ++ } ++ svc_close_socket(svsk); ++} ++ + /* + * Make a socket for nfsd and lockd + */ diff --git a/queue-2.6.20/fix-tcp-fin-handling.patch b/queue-2.6.20/fix-tcp-fin-handling.patch new file mode 100644 index 00000000000..cc1703bde9d --- /dev/null +++ b/queue-2.6.20/fix-tcp-fin-handling.patch @@ -0,0 +1,35 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 21:58:49 2007 +From: John Heffner +Date: Tue, 06 Feb 2007 21:57:34 -0800 (PST) +Subject: Fix TCP FIN handling +To: stable@kernel.org +Cc: bunk@stusta.de +Message-ID: <20070206.215734.83621142.davem@davemloft.net> + +From: John Heffner + +We can accidently spit out a huge burst of packets with TSO +when the FIN back is piggybacked onto the final packet. + +[TCP]: Don't apply FIN exception to full TSO segments. + +Signed-off-by: John Heffner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_output.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.20.1.orig/net/ipv4/tcp_output.c ++++ linux-2.6.20.1/net/ipv4/tcp_output.c +@@ -965,7 +965,8 @@ static inline unsigned int tcp_cwnd_test + u32 in_flight, cwnd; + + /* Don't be strict about the congestion window for the final FIN. */ +- if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN) ++ if ((TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN) && ++ tcp_skb_pcount(skb) == 1) + return 1; + + in_flight = tcp_packets_in_flight(tp); diff --git a/queue-2.6.20/ieee1394-fix-host-device-registering-when-nodemgr-disabled.patch b/queue-2.6.20/ieee1394-fix-host-device-registering-when-nodemgr-disabled.patch new file mode 100644 index 00000000000..d84c03ba953 --- /dev/null +++ b/queue-2.6.20/ieee1394-fix-host-device-registering-when-nodemgr-disabled.patch @@ -0,0 +1,74 @@ +From stable-bounces@linux.kernel.org Fri Feb 9 15:46:19 2007 +From: Stefan Richter +Date: Sat, 10 Feb 2007 00:44:44 +0100 (CET) +Subject: ieee1394: fix host device registering when nodemgr disabled +To: stable@kernel.org +Cc: linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org +Message-ID: +Content-Disposition: INLINE + +From: Stefan Richter + +Since my commit 8252bbb1363b7fe963a3eb6f8a36da619a6f5a65 in 2.6.20-rc1, +host devices have a dummy driver attached. Alas the driver was not +registered before use if ieee1394 was loaded with disable_nodemgr=1. + +This resulted in non-functional FireWire drivers or kernel lockup. +http://bugzilla.kernel.org/show_bug.cgi?id=7942 + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ieee1394/nodemgr.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +--- linux-2.6.20.1.orig/drivers/ieee1394/nodemgr.c ++++ linux-2.6.20.1/drivers/ieee1394/nodemgr.c +@@ -274,7 +274,6 @@ static struct device_driver nodemgr_mid_ + struct device nodemgr_dev_template_host = { + .bus = &ieee1394_bus_type, + .release = nodemgr_release_host, +- .driver = &nodemgr_mid_layer_driver, + }; + + +@@ -1889,22 +1888,31 @@ int init_ieee1394_nodemgr(void) + + error = class_register(&nodemgr_ne_class); + if (error) +- return error; +- ++ goto fail_ne; + error = class_register(&nodemgr_ud_class); +- if (error) { +- class_unregister(&nodemgr_ne_class); +- return error; +- } ++ if (error) ++ goto fail_ud; + error = driver_register(&nodemgr_mid_layer_driver); ++ if (error) ++ goto fail_ml; ++ /* This driver is not used if nodemgr is off (disable_nodemgr=1). */ ++ nodemgr_dev_template_host.driver = &nodemgr_mid_layer_driver; ++ + hpsb_register_highlevel(&nodemgr_highlevel); + return 0; ++ ++fail_ml: ++ class_unregister(&nodemgr_ud_class); ++fail_ud: ++ class_unregister(&nodemgr_ne_class); ++fail_ne: ++ return error; + } + + void cleanup_ieee1394_nodemgr(void) + { + hpsb_unregister_highlevel(&nodemgr_highlevel); +- ++ driver_unregister(&nodemgr_mid_layer_driver); + class_unregister(&nodemgr_ud_class); + class_unregister(&nodemgr_ne_class); + } diff --git a/queue-2.6.20/ieee1394-video1394-dma-fix.patch b/queue-2.6.20/ieee1394-video1394-dma-fix.patch new file mode 100644 index 00000000000..0eb46e2bcd6 --- /dev/null +++ b/queue-2.6.20/ieee1394-video1394-dma-fix.patch @@ -0,0 +1,55 @@ +From stable-bounces@linux.kernel.org Fri Feb 9 15:42:53 2007 +From: David Moore +Date: Sat, 10 Feb 2007 00:41:28 +0100 (CET) +Subject: ieee1394: video1394: DMA fix +To: stable@kernel.org +Cc: linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org +Message-ID: +Content-Disposition: INLINE + +From: David Moore + +This together with the phys_to_virt fix in lib/swiotlb.c::swiotlb_sync_sg +fixes video1394 DMA on machines with DMA bounce buffers, especially Intel +x86-64 machines with > 3GB RAM. + +Signed-off-by: Stefan Richter +Signed-off-by: David Moore +Tested-by: Nicolas Turro +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ieee1394/video1394.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- linux-2.6.20.1.orig/drivers/ieee1394/video1394.c ++++ linux-2.6.20.1/drivers/ieee1394/video1394.c +@@ -489,6 +489,9 @@ static void wakeup_dma_ir_ctx(unsigned l + reset_ir_status(d, i); + d->buffer_status[d->buffer_prg_assignment[i]] = VIDEO1394_BUFFER_READY; + do_gettimeofday(&d->buffer_time[d->buffer_prg_assignment[i]]); ++ dma_region_sync_for_cpu(&d->dma, ++ d->buffer_prg_assignment[i] * d->buf_size, ++ d->buf_size); + } + } + +@@ -1096,6 +1099,8 @@ static long video1394_ioctl(struct file + DBGMSG(ohci->host->id, "Starting iso transmit DMA ctx=%d", + d->ctx); + put_timestamp(ohci, d, d->last_buffer); ++ dma_region_sync_for_device(&d->dma, ++ v.buffer * d->buf_size, d->buf_size); + + /* Tell the controller where the first program is */ + reg_write(ohci, d->cmdPtr, +@@ -1111,6 +1116,9 @@ static long video1394_ioctl(struct file + "Waking up iso transmit dma ctx=%d", + d->ctx); + put_timestamp(ohci, d, d->last_buffer); ++ dma_region_sync_for_device(&d->dma, ++ v.buffer * d->buf_size, d->buf_size); ++ + reg_write(ohci, d->ctrlSet, 0x1000); + } + } diff --git a/queue-2.6.20/ipv6-hashtables-use-appropriate-seed-for-caluculating-ehash-index.patch b/queue-2.6.20/ipv6-hashtables-use-appropriate-seed-for-caluculating-ehash-index.patch new file mode 100644 index 00000000000..3cda2191e2e --- /dev/null +++ b/queue-2.6.20/ipv6-hashtables-use-appropriate-seed-for-caluculating-ehash-index.patch @@ -0,0 +1,36 @@ +From stable-bounces@linux.kernel.org Mon Feb 12 16:50:02 2007 +From: YOSHIFUJI Hideaki +Date: Tue, 13 Feb 2007 09:48:41 +0900 (JST) +Subject: IPV6: HASHTABLES: Use appropriate seed for caluculating ehash index. +To: davem@davemloft.net +Cc: yoshfuji@linux-ipv6.org, netdev@vger.kernel.org, handat@pm.nttdata.co.jp, stable@kernel.org +Message-ID: <20070213.094841.17517365.yoshfuji@linux-ipv6.org> + +From: YOSHIFUJI Hideaki + +Tetsuo Handa told me that connect(2) with TCPv6 +socket almost always took a few minutes to return when we did not have any +ports available in the range of net.ipv4.ip_local_port_range. + +The reason was that we used incorrect seed for calculating index of +hash when we check established sockets in __inet6_check_established(). + +Signed-off-by: YOSHIFUJI Hideaki +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/inet6_hashtables.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.20.1.orig/net/ipv6/inet6_hashtables.c ++++ linux-2.6.20.1/net/ipv6/inet6_hashtables.c +@@ -172,7 +172,7 @@ static int __inet6_check_established(str + const struct in6_addr *saddr = &np->daddr; + const int dif = sk->sk_bound_dev_if; + const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport); +- const unsigned int hash = inet6_ehashfn(daddr, inet->num, saddr, ++ const unsigned int hash = inet6_ehashfn(daddr, lport, saddr, + inet->dport); + struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash); + struct sock *sk2; diff --git a/queue-2.6.20/kconfig-fault_injection-can-be-selected-only-if-lockdep-is-enabled.patch b/queue-2.6.20/kconfig-fault_injection-can-be-selected-only-if-lockdep-is-enabled.patch new file mode 100644 index 00000000000..68938065987 --- /dev/null +++ b/queue-2.6.20/kconfig-fault_injection-can-be-selected-only-if-lockdep-is-enabled.patch @@ -0,0 +1,32 @@ +From stable-bounces@linux.kernel.org Mon Feb 12 10:54:21 2007 +From: "Paolo 'Blaisorblade' Giarrusso" +Date: Sat, 10 Feb 2007 17:45:37 +0100 +Subject: Kconfig: FAULT_INJECTION can be selected only if LOCKDEP is enabled. +To: Andrew Morton , stable@kernel.org +Cc: linux-kernel@vger.kernel.org +Message-ID: <11711259371905-git-send-email-blaisorblade@yahoo.it> + +From: "Paolo 'Blaisorblade' Giarrusso" + +There is no prompt for STACKTRACE, so it is enabled only when 'select'ed. +FAULT_INJECTION depends on it, while LOCKDEP selects it. So FAULT_INJECTION +becomes visible in Kconfig only when LOCKDEP is enabled. + +Signed-off-by: Paolo 'Blaisorblade' Giarrusso +Signed-off-by: Greg Kroah-Hartman + +--- + lib/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.20.1.orig/lib/Kconfig.debug ++++ linux-2.6.20.1/lib/Kconfig.debug +@@ -400,7 +400,7 @@ config LKDTM + config FAULT_INJECTION + bool "Fault-injection framework" + depends on DEBUG_KERNEL +- depends on STACKTRACE ++ select STACKTRACE + select FRAME_POINTER + help + Provide fault-injection framework. diff --git a/queue-2.6.20/md-avoid-possible-bug_on-in-md-bitmap-handling.patch b/queue-2.6.20/md-avoid-possible-bug_on-in-md-bitmap-handling.patch new file mode 100644 index 00000000000..6163f901ce7 --- /dev/null +++ b/queue-2.6.20/md-avoid-possible-bug_on-in-md-bitmap-handling.patch @@ -0,0 +1,101 @@ +From stable-bounces@linux.kernel.org Wed Feb 7 14:30:28 2007 +From: Neil Brown +Date: Thu, 8 Feb 2007 09:28:28 +1100 +Subject: md: Avoid possible BUG_ON in md bitmap handling. +To: akpm@linux-foundation.org +Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org +Message-ID: <17866.21132.606116.583062@notabene.brown> + +From: Neil Brown + +md/bitmap tracks how many active write requests are pending on blocks +associated with each bit in the bitmap, so that it knows when it can +clear the bit (when count hits zero). + +The counter has 14 bits of space, so if there are ever more than 16383, +we cannot cope. + +Currently the code just calles BUG_ON as "all" drivers have request queue +limits much smaller than this. + +However is seems that some don't. Apparently some multipath configurations +can allow more than 16383 concurrent write requests. + +So, in this unlikely situation, instead of calling BUG_ON we now wait +for the count to drop down a bit. This requires a new wait_queue_head, +some waiting code, and a wakeup call. + +Tested by limiting the counter to 20 instead of 16383 (writes go a lot slower +in that case...). + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + +diff .prev/drivers/md/bitmap.c ./drivers/md/bitmap.c +--- + drivers/md/bitmap.c | 22 +++++++++++++++++++++- + include/linux/raid/bitmap.h | 1 + + 2 files changed, 22 insertions(+), 1 deletion(-) + +--- linux-2.6.20.1.orig/drivers/md/bitmap.c ++++ linux-2.6.20.1/drivers/md/bitmap.c +@@ -1160,6 +1160,22 @@ int bitmap_startwrite(struct bitmap *bit + return 0; + } + ++ if (unlikely((*bmc & COUNTER_MAX) == COUNTER_MAX)) { ++ DEFINE_WAIT(__wait); ++ /* note that it is safe to do the prepare_to_wait ++ * after the test as long as we do it before dropping ++ * the spinlock. ++ */ ++ prepare_to_wait(&bitmap->overflow_wait, &__wait, ++ TASK_UNINTERRUPTIBLE); ++ spin_unlock_irq(&bitmap->lock); ++ bitmap->mddev->queue ++ ->unplug_fn(bitmap->mddev->queue); ++ schedule(); ++ finish_wait(&bitmap->overflow_wait, &__wait); ++ continue; ++ } ++ + switch(*bmc) { + case 0: + bitmap_file_set_bit(bitmap, offset); +@@ -1169,7 +1185,7 @@ int bitmap_startwrite(struct bitmap *bit + case 1: + *bmc = 2; + } +- BUG_ON((*bmc & COUNTER_MAX) == COUNTER_MAX); ++ + (*bmc)++; + + spin_unlock_irq(&bitmap->lock); +@@ -1207,6 +1223,9 @@ void bitmap_endwrite(struct bitmap *bitm + if (!success && ! (*bmc & NEEDED_MASK)) + *bmc |= NEEDED_MASK; + ++ if ((*bmc & COUNTER_MAX) == COUNTER_MAX) ++ wake_up(&bitmap->overflow_wait); ++ + (*bmc)--; + if (*bmc <= 2) { + set_page_attr(bitmap, +@@ -1431,6 +1450,7 @@ int bitmap_create(mddev_t *mddev) + spin_lock_init(&bitmap->lock); + atomic_set(&bitmap->pending_writes, 0); + init_waitqueue_head(&bitmap->write_wait); ++ init_waitqueue_head(&bitmap->overflow_wait); + + bitmap->mddev = mddev; + +--- linux-2.6.20.1.orig/include/linux/raid/bitmap.h ++++ linux-2.6.20.1/include/linux/raid/bitmap.h +@@ -247,6 +247,7 @@ struct bitmap { + + atomic_t pending_writes; /* pending writes to the bitmap file */ + wait_queue_head_t write_wait; ++ wait_queue_head_t overflow_wait; + + }; + diff --git a/queue-2.6.20/mtd-fatal-regression-in-drivers-mtd-redboot.c-in-2.6.20.patch b/queue-2.6.20/mtd-fatal-regression-in-drivers-mtd-redboot.c-in-2.6.20.patch new file mode 100644 index 00000000000..559391cdc12 --- /dev/null +++ b/queue-2.6.20/mtd-fatal-regression-in-drivers-mtd-redboot.c-in-2.6.20.patch @@ -0,0 +1,66 @@ +From stable-bounces@linux.kernel.org Mon Feb 12 15:27:53 2007 +From: David Woodhouse +Date: Tue, 13 Feb 2007 09:56:22 +1030 +Subject: MTD: Fatal regression in drivers/mtd/redboot.c in 2.6.20 +To: stable@kernel.org +Cc: Andrew Morton , David Woodhouse , Martin Michlmayr , Yoshinori Sato +Message-ID: <45D0F79E.7010104@whitby.id.au> + +From: David Woodhouse + +[MTD] Fix regression in RedBoot partition scanning + +This fixes a regression introduced by the attempt to handle RedBoot FIS +tables which are smaller than an eraseblock, in commit +0b47d654089c5ce3f2ea26a4485db9bcead1e515 + +It moves the recalculation of the number of slots in the table to the +correct place, and improves the heuristic for when we think we need to +byte-swap what we read from the flash. + +Signed-off-by: David Woodhouse +Cc: Rod Whitby +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/redboot.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- linux-2.6.20.1.orig/drivers/mtd/redboot.c ++++ linux-2.6.20.1/drivers/mtd/redboot.c +@@ -94,8 +94,19 @@ static int parse_redboot_partitions(stru + * (NOTE: this is 'size' not 'data_length'; size is + * the full size of the entry.) + */ +- if (swab32(buf[i].size) == master->erasesize) { ++ ++ /* RedBoot can combine the FIS directory and ++ config partitions into a single eraseblock; ++ we assume wrong-endian if either the swapped ++ 'size' matches the eraseblock size precisely, ++ or if the swapped size actually fits in an ++ eraseblock while the unswapped size doesn't. */ ++ if (swab32(buf[i].size) == master->erasesize || ++ (buf[i].size > master->erasesize ++ && swab32(buf[i].size) < master->erasesize)) { + int j; ++ /* Update numslots based on actual FIS directory size */ ++ numslots = swab32(buf[i].size) / sizeof (struct fis_image_desc); + for (j = 0; j < numslots; ++j) { + + /* A single 0xff denotes a deleted entry. +@@ -120,11 +131,11 @@ static int parse_redboot_partitions(stru + swab32s(&buf[j].desc_cksum); + swab32s(&buf[j].file_cksum); + } ++ } else if (buf[i].size < master->erasesize) { ++ /* Update numslots based on actual FIS directory size */ ++ numslots = buf[i].size / sizeof(struct fis_image_desc); + } + break; +- } else { +- /* re-calculate of real numslots */ +- numslots = buf[i].size / sizeof(struct fis_image_desc); + } + } + if (i == numslots) { diff --git a/queue-2.6.20/series b/queue-2.6.20/series index 777f580176a..8b02dc75e83 100644 --- a/queue-2.6.20/series +++ b/queue-2.6.20/series @@ -16,3 +16,19 @@ usb-audio-fixes-1.patch usb-audio-fixes-2.patch hda-intel-don-t-try-to-probe-invalid-codecs.patch fix-various-bugs-with-aligned-reads-in-raid5.patch +fix-atm-initcall-ordering.patch +fix-tcp-fin-handling.patch +fix-allocation-failure-handling-in-multicast.patch +md-avoid-possible-bug_on-in-md-bitmap-handling.patch +fix-compile-error-for-e500-core-based-processors.patch +ieee1394-video1394-dma-fix.patch +ieee1394-fix-host-device-registering-when-nodemgr-disabled.patch +fix-null-pointer-dereference-in-appledisplay-driver.patch +usb-hid-fix-usb-vendor-and-product-ids-endianness-for-usb-hid-devices.patch +kconfig-fault_injection-can-be-selected-only-if-lockdep-is-enabled.patch +mtd-fatal-regression-in-drivers-mtd-redboot.c-in-2.6.20.patch +ipv6-hashtables-use-appropriate-seed-for-caluculating-ehash-index.patch +ehci-turn-off-remote-wakeup-during-shutdown.patch +avoid-using-nfsd-process-pools-on-smp-machines.patch +fix-recently-introduced-problem-with-shutting-down-a-busy-nfs-server.patch +uhci-fix-port-resume-problem.patch diff --git a/queue-2.6.20/uhci-fix-port-resume-problem.patch b/queue-2.6.20/uhci-fix-port-resume-problem.patch new file mode 100644 index 00000000000..8d9a85ba394 --- /dev/null +++ b/queue-2.6.20/uhci-fix-port-resume-problem.patch @@ -0,0 +1,65 @@ +From stable-bounces@linux.kernel.org Mon Feb 26 14:17:37 2007 +From: Alan Stern +Date: Mon, 26 Feb 2007 17:16:06 -0500 (EST) +Subject: UHCI: fix port resume problem +To: Greg KH , +Cc: Guilherme Salgado , USB development list +Message-ID: + +From: Alan Stern + +This patch (as863) fixes a problem encountered sometimes when resuming +a port on a UHCI controller. The hardware may turn off the +Resume-Detect bit before turning off the Suspend bit, leading usbcore +to think that the port is still suspended and the resume has failed. +The patch makes uhci_finish_suspend() wait until both bits are safely +off. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/uhci-hub.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- linux-2.6.20.1.orig/drivers/usb/host/uhci-hub.c ++++ linux-2.6.20.1/drivers/usb/host/uhci-hub.c +@@ -33,6 +33,9 @@ static __u8 root_hub_hub_des[] = + /* status change bits: nonzero writes will clear */ + #define RWC_BITS (USBPORTSC_OCC | USBPORTSC_PEC | USBPORTSC_CSC) + ++/* suspend/resume bits: port suspended or port resuming */ ++#define SUSPEND_BITS (USBPORTSC_SUSP | USBPORTSC_RD) ++ + /* A port that either is connected or has a changed-bit set will prevent + * us from AUTO_STOPPING. + */ +@@ -96,8 +99,8 @@ static void uhci_finish_suspend(struct u + int status; + int i; + +- if (inw(port_addr) & (USBPORTSC_SUSP | USBPORTSC_RD)) { +- CLR_RH_PORTSTAT(USBPORTSC_SUSP | USBPORTSC_RD); ++ if (inw(port_addr) & SUSPEND_BITS) { ++ CLR_RH_PORTSTAT(SUSPEND_BITS); + if (test_bit(port, &uhci->resuming_ports)) + set_bit(port, &uhci->port_c_suspend); + +@@ -107,7 +110,7 @@ static void uhci_finish_suspend(struct u + * Experiments show that some controllers take longer, so + * we'll poll for completion. */ + for (i = 0; i < 10; ++i) { +- if (!(inw(port_addr) & USBPORTSC_RD)) ++ if (!(inw(port_addr) & SUSPEND_BITS)) + break; + udelay(1); + } +@@ -289,7 +292,7 @@ static int uhci_hub_control(struct usb_h + wPortStatus |= USB_PORT_STAT_CONNECTION; + if (status & USBPORTSC_PE) { + wPortStatus |= USB_PORT_STAT_ENABLE; +- if (status & (USBPORTSC_SUSP | USBPORTSC_RD)) ++ if (status & SUSPEND_BITS) + wPortStatus |= USB_PORT_STAT_SUSPEND; + } + if (status & USBPORTSC_OC) diff --git a/queue-2.6.20/usb-hid-fix-usb-vendor-and-product-ids-endianness-for-usb-hid-devices.patch b/queue-2.6.20/usb-hid-fix-usb-vendor-and-product-ids-endianness-for-usb-hid-devices.patch new file mode 100644 index 00000000000..9f2c4cf4124 --- /dev/null +++ b/queue-2.6.20/usb-hid-fix-usb-vendor-and-product-ids-endianness-for-usb-hid-devices.patch @@ -0,0 +1,38 @@ +From stable-bounces@linux.kernel.org Sun Feb 11 09:28:13 2007 +From: Julien BLACHE +Date: Sun, 11 Feb 2007 18:27:09 +0100 (CET) +Subject: USB HID: Fix USB vendor and product IDs endianness for USB HID devices +To: stable@kernel.org +Cc: Julien BLACHE +Message-ID: + +From: Julien BLACHE + +[PATCH] USB HID: Fix USB vendor and product IDs endianness for USB HID devices + +The USB vendor and product IDs are not byteswapped appropriately, and +thus come out in the wrong endianness when fetched through the evdev +using ioctl() on big endian platforms. + +Signed-off-by: Julien BLACHE +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/usb/input/hid-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.20.1.orig/drivers/usb/input/hid-core.c ++++ linux-2.6.20.1/drivers/usb/input/hid-core.c +@@ -1212,8 +1212,8 @@ static struct hid_device *usb_hid_config + le16_to_cpu(dev->descriptor.idProduct)); + + hid->bus = BUS_USB; +- hid->vendor = dev->descriptor.idVendor; +- hid->product = dev->descriptor.idProduct; ++ hid->vendor = le16_to_cpu(dev->descriptor.idVendor); ++ hid->product = le16_to_cpu(dev->descriptor.idProduct); + + usb_make_path(dev, hid->phys, sizeof(hid->phys)); + strlcat(hid->phys, "/input", sizeof(hid->phys));