From: Greg Kroah-Hartman Date: Mon, 30 Oct 2006 22:59:47 +0000 (-0800) Subject: more patches added to queue X-Git-Tag: v2.6.18.2~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bd61309940fd929a04c03d52c0d25b8455346bc2;p=thirdparty%2Fkernel%2Fstable-queue.git more patches added to queue --- diff --git a/queue-2.6.18/alsa-fix-re-use-of-va_list.patch b/queue-2.6.18/alsa-fix-re-use-of-va_list.patch new file mode 100644 index 00000000000..b129afadbf6 --- /dev/null +++ b/queue-2.6.18/alsa-fix-re-use-of-va_list.patch @@ -0,0 +1,38 @@ +From stable-bounces@linux.kernel.org Tue Oct 24 05:56:29 2006 +Date: Tue, 24 Oct 2006 14:55:46 +0200 +Message-ID: +From: Takashi Iwai +To: stable@kernel.org +MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") +Subject: ALSA: Fix re-use of va_list +Content-Type: text/plain; charset="us-ascii" + +From: Takashi Iwai + +[PATCH] ALSA: Fix re-use of va_list + +The va_list is designed to be used only once. The current code +may pass va_list arguments multiple times and may cause Oops. +Copy/release the arguments temporarily to avoid this problem. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/info.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/sound/core/info.c ++++ linux-2.6.18.1/sound/core/info.c +@@ -119,7 +119,10 @@ int snd_iprintf(struct snd_info_buffer * + len = buffer->len - buffer->size; + va_start(args, fmt); + for (;;) { +- res = vsnprintf(buffer->buffer + buffer->curr, len, fmt, args); ++ va_list ap; ++ va_copy(ap, args); ++ res = vsnprintf(buffer->buffer + buffer->curr, len, fmt, ap); ++ va_end(ap); + if (res < len) + break; + err = resize_info_buffer(buffer, buffer->len + PAGE_SIZE); diff --git a/queue-2.6.18/audit-fix-missing-ifdefs-in-syscall-classes-hookup-for-generic-targets.patch b/queue-2.6.18/audit-fix-missing-ifdefs-in-syscall-classes-hookup-for-generic-targets.patch new file mode 100644 index 00000000000..743899cd564 --- /dev/null +++ b/queue-2.6.18/audit-fix-missing-ifdefs-in-syscall-classes-hookup-for-generic-targets.patch @@ -0,0 +1,85 @@ +From stable-bounces@linux.kernel.org Sun Oct 29 04:05:46 2006 +Date: Sun, 29 Oct 2006 13:03:49 +0100 +From: Al Viro +To: stable@kernel.org +Message-ID: <20061029120349.GA7012@deprecation.cyrius.com> +MIME-Version: 1.0 +Content-Disposition: inline +Subject: Audit: fix missing ifdefs in syscall classes hookup for generic targets +Content-Type: text/plain; charset="us-ascii" + +From: Al Viro + +[PATCH] fix missing ifdefs in syscall classes hookup for generic targets + +several targets have no ....at() family and m32r calls its only chown variant +chown32(), with __NR_chown being undefined. creat(2) is also absent in some +targets. + +Signed-off-by: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-generic/audit_change_attr.h | 4 ++++ + include/asm-generic/audit_dir_write.h | 4 ++++ + lib/audit.c | 2 ++ + 3 files changed, 10 insertions(+) + +--- linux-2.6.18.1.orig/include/asm-generic/audit_change_attr.h ++++ linux-2.6.18.1/include/asm-generic/audit_change_attr.h +@@ -1,16 +1,20 @@ + __NR_chmod, + __NR_fchmod, ++#ifdef __NR_chown + __NR_chown, + __NR_fchown, + __NR_lchown, ++#endif + __NR_setxattr, + __NR_lsetxattr, + __NR_fsetxattr, + __NR_removexattr, + __NR_lremovexattr, + __NR_fremovexattr, ++#ifdef __NR_fchownat + __NR_fchownat, + __NR_fchmodat, ++#endif + #ifdef __NR_chown32 + __NR_chown32, + __NR_fchown32, +--- linux-2.6.18.1.orig/include/asm-generic/audit_dir_write.h ++++ linux-2.6.18.1/include/asm-generic/audit_dir_write.h +@@ -1,14 +1,18 @@ + __NR_rename, + __NR_mkdir, + __NR_rmdir, ++#ifdef __NR_creat + __NR_creat, ++#endif + __NR_link, + __NR_unlink, + __NR_symlink, + __NR_mknod, ++#ifdef __NR_mkdirat + __NR_mkdirat, + __NR_mknodat, + __NR_unlinkat, + __NR_renameat, + __NR_linkat, + __NR_symlinkat, ++#endif +--- linux-2.6.18.1.orig/lib/audit.c ++++ linux-2.6.18.1/lib/audit.c +@@ -28,8 +28,10 @@ int audit_classify_syscall(int abi, unsi + switch(syscall) { + case __NR_open: + return 2; ++#ifdef __NR_openat + case __NR_openat: + return 3; ++#endif + #ifdef __NR_socketcall + case __NR_socketcall: + return 4; diff --git a/queue-2.6.18/bcm43xx-fix-watchdog-timeouts.patch b/queue-2.6.18/bcm43xx-fix-watchdog-timeouts.patch new file mode 100644 index 00000000000..328fecbc059 --- /dev/null +++ b/queue-2.6.18/bcm43xx-fix-watchdog-timeouts.patch @@ -0,0 +1,59 @@ +From stable-bounces@linux.kernel.org Fri Oct 27 10:09:29 2006 +Message-ID: <454230E7.3090909@lwfinger.net> +Date: Fri, 27 Oct 2006 11:16:39 -0500 +From: Michael Buesch +MIME-Version: 1.0 +To: stable@kernel.org +Cc: Michael Buesch +Subject: bcm43xx: fix watchdog timeouts. +Content-Type: text/plain; charset="us-ascii" + +From: Michael Buesch + +This fixes a netdev watchdog timeout problem. +The problem is caused by a needed netif_tx_disable +in the hardware calibration code and can be shown by the +following timegraph. + +|---5secs - ~10 jiffies time---|---|OOPS +^ ^ +last real TX periodic work stops netif + +At OOPS, the following happens: +The watchdog timer triggers, because the timeout of 5secs +is over. The watchdog first checks for stopped TX. +_Usually_ TX is only stopped from the TX handler to indicate +a full TX queue. But this is different. We need to stop TX here, +regardless of the TX queue state. So the watchdog recognizes +the stopped device and assumes it is stopped due to full +TX queues (Which is a _wrong_ assumption in this case). It then +tests how far the last TX has been in the past. If it's more than +5secs (which is the case for low or no traffic), it will fire +a TX timeout. + +Signed-off-by: Michael Buesch +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- linux-2.6.18.1.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c ++++ linux-2.6.18.1/drivers/net/wireless/bcm43xx/bcm43xx_main.c +@@ -3165,7 +3165,15 @@ static void bcm43xx_periodic_work_handle + + badness = estimate_periodic_work_badness(bcm->periodic_state); + mutex_lock(&bcm->mutex); ++ ++ /* We must fake a started transmission here, as we are going to ++ * disable TX. If we wouldn't fake a TX, it would be possible to ++ * trigger the netdev watchdog, if the last real TX is already ++ * some time on the past (slightly less than 5secs) ++ */ ++ bcm->net_dev->trans_start = jiffies; + netif_tx_disable(bcm->net_dev); ++ + spin_lock_irqsave(&bcm->irq_lock, flags); + if (badness > BADNESS_LIMIT) { + /* Periodic work will take a long time, so we want it to diff --git a/queue-2.6.18/dvb-fix-dvb_pll_attach-for-mt352-zl10353-in-cx88-dvb-and-nxt200x.patch b/queue-2.6.18/dvb-fix-dvb_pll_attach-for-mt352-zl10353-in-cx88-dvb-and-nxt200x.patch new file mode 100644 index 00000000000..fde02da3489 --- /dev/null +++ b/queue-2.6.18/dvb-fix-dvb_pll_attach-for-mt352-zl10353-in-cx88-dvb-and-nxt200x.patch @@ -0,0 +1,147 @@ +From stable-bounces@linux.kernel.org Sat Oct 28 14:53:34 2006 +Message-ID: <4543A73D.100@linuxtv.org> +Date: Sat, 28 Oct 2006 14:53:49 -0400 +From: Michael Krufky +MIME-Version: 1.0 +To: stable@kernel.org +Cc: Christopher Pascoe , v4l-dvb maintainer list +Subject: DVB: fix dvb_pll_attach for mt352/zl10353 in cx88-dvb, and nxt200x +Content-Type: text/plain; charset="us-ascii" + +From: Michael Krufky + +DVB: fix dvb_pll_attach for mt352/zl10353 in cx88-dvb, and nxt200x + +Typical wiring of MT352, ZL10353, NXT2002 and NXT2004 based tuners +differ from dvb-pll's expectation that the PLL is directly accessible. +On these boards, the PLL is actually hidden behind the demodulator, and +as such can only be accessed via the demodulator's interface. It was +failing to communicate with the PLL during an attach test and +subsequently not connecting the tuner ops. + +By passing a NULL I2C bus handle to dvb_pll_attach, this accessibility +check can be bypassed. Do this for the affected boards. Also fix a +possible NULL dereference at sleep time, which would otherwise be +exposed by this change. + +This patch has been backported to the 2.6.18.y stable kernel series +from the original changesets from Chris Pascoe and Michael Krufky, +already present in the upstream 2.6.19 kernel tree. + +Signed-off-by: Chris Pascoe +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/b2c2/flexcop-fe-tuner.c | 2 +- + drivers/media/dvb/frontends/dvb-pll.c | 3 +++ + drivers/media/video/cx88/cx88-dvb.c | 14 +++++++------- + drivers/media/video/saa7134/saa7134-dvb.c | 4 ++-- + 4 files changed, 13 insertions(+), 10 deletions(-) + +--- linux-2.6.18.1.orig/drivers/media/dvb/b2c2/flexcop-fe-tuner.c ++++ linux-2.6.18.1/drivers/media/dvb/b2c2/flexcop-fe-tuner.c +@@ -527,7 +527,7 @@ int flexcop_frontend_init(struct flexcop + /* try the air atsc 2nd generation (nxt2002) */ + if ((fc->fe = nxt200x_attach(&samsung_tbmv_config, &fc->i2c_adap)) != NULL) { + fc->dev_type = FC_AIR_ATSC2; +- dvb_pll_attach(fc->fe, 0x61, &fc->i2c_adap, &dvb_pll_samsung_tbmv); ++ dvb_pll_attach(fc->fe, 0x61, NULL, &dvb_pll_samsung_tbmv); + info("found the nxt2002 at i2c address: 0x%02x",samsung_tbmv_config.demod_address); + } else + /* try the air atsc 3nd generation (lgdt3303) */ +--- linux-2.6.18.1.orig/drivers/media/dvb/frontends/dvb-pll.c ++++ linux-2.6.18.1/drivers/media/dvb/frontends/dvb-pll.c +@@ -493,6 +493,9 @@ static int dvb_pll_sleep(struct dvb_fron + int i; + int result; + ++ if (priv->i2c == NULL) ++ return -EINVAL; ++ + for (i = 0; i < priv->pll_desc->count; i++) { + if (priv->pll_desc->entries[i].limit == 0) + break; +--- linux-2.6.18.1.orig/drivers/media/video/cx88/cx88-dvb.c ++++ linux-2.6.18.1/drivers/media/video/cx88/cx88-dvb.c +@@ -576,7 +576,7 @@ static int dvb_register(struct cx8802_de + &dev->core->i2c_adap); + if (dev->dvb.frontend != NULL) { + dvb_pll_attach(dev->dvb.frontend, 0x60, +- &dev->core->i2c_adap, ++ NULL, + &dvb_pll_thomson_dtt7579); + break; + } +@@ -587,7 +587,7 @@ static int dvb_register(struct cx8802_de + &dev->core->i2c_adap); + if (dev->dvb.frontend != NULL) { + dvb_pll_attach(dev->dvb.frontend, 0x60, +- &dev->core->i2c_adap, ++ NULL, + &dvb_pll_thomson_dtt7579); + } + #endif +@@ -600,7 +600,7 @@ static int dvb_register(struct cx8802_de + &dev->core->i2c_adap); + if (dev->dvb.frontend != NULL) { + dvb_pll_attach(dev->dvb.frontend, 0x61, +- &dev->core->i2c_adap, ++ NULL, + &dvb_pll_thomson_dtt7579); + break; + } +@@ -611,7 +611,7 @@ static int dvb_register(struct cx8802_de + &dev->core->i2c_adap); + if (dev->dvb.frontend != NULL) { + dvb_pll_attach(dev->dvb.frontend, 0x61, +- &dev->core->i2c_adap, ++ NULL, + &dvb_pll_thomson_dtt7579); + } + #endif +@@ -623,7 +623,7 @@ static int dvb_register(struct cx8802_de + &dev->core->i2c_adap); + if (dev->dvb.frontend != NULL) { + dvb_pll_attach(dev->dvb.frontend, 0x61, +- &dev->core->i2c_adap, ++ NULL, + &dvb_pll_lg_z201); + } + break; +@@ -634,7 +634,7 @@ static int dvb_register(struct cx8802_de + &dev->core->i2c_adap); + if (dev->dvb.frontend != NULL) { + dvb_pll_attach(dev->dvb.frontend, 0x61, +- &dev->core->i2c_adap, ++ NULL, + &dvb_pll_unknown_1); + } + break; +@@ -757,7 +757,7 @@ static int dvb_register(struct cx8802_de + &dev->core->i2c_adap); + if (dev->dvb.frontend != NULL) { + dvb_pll_attach(dev->dvb.frontend, 0x61, +- &dev->core->i2c_adap, ++ NULL, + &dvb_pll_tuv1236d); + } + break; +--- linux-2.6.18.1.orig/drivers/media/video/saa7134/saa7134-dvb.c ++++ linux-2.6.18.1/drivers/media/video/saa7134/saa7134-dvb.c +@@ -1158,13 +1158,13 @@ static int dvb_init(struct saa7134_dev * + case SAA7134_BOARD_AVERMEDIA_AVERTVHD_A180: + dev->dvb.frontend = nxt200x_attach(&avertvhda180, &dev->i2c_adap); + if (dev->dvb.frontend) { +- dvb_pll_attach(dev->dvb.frontend, 0x61, &dev->i2c_adap, &dvb_pll_tdhu2); ++ dvb_pll_attach(dev->dvb.frontend, 0x61, NULL, &dvb_pll_tdhu2); + } + break; + case SAA7134_BOARD_KWORLD_ATSC110: + dev->dvb.frontend = nxt200x_attach(&kworldatsc110, &dev->i2c_adap); + if (dev->dvb.frontend) { +- dvb_pll_attach(dev->dvb.frontend, 0x61, &dev->i2c_adap, &dvb_pll_tuv1236d); ++ dvb_pll_attach(dev->dvb.frontend, 0x61, NULL, &dvb_pll_tuv1236d); + } + break; + #endif diff --git a/queue-2.6.18/fix-potential-interrupts-during-alternative-patching.patch b/queue-2.6.18/fix-potential-interrupts-during-alternative-patching.patch new file mode 100644 index 00000000000..5e31f1bd7c9 --- /dev/null +++ b/queue-2.6.18/fix-potential-interrupts-during-alternative-patching.patch @@ -0,0 +1,49 @@ +From stable-bounces@linux.kernel.org Fri Oct 20 14:19:30 2006 +Message-ID: <45393D3B.1040904@vmware.com> +Date: Fri, 20 Oct 2006 14:18:51 -0700 +From: Zachary Amsden +MIME-Version: 1.0 +To: stable@kernel.org +Subject: Fix potential interrupts during alternative patching + +From: Zachary Amsden + +Interrupts must be disabled during alternative instruction patching. +On systems with high timer IRQ rates, or when running in an emulator, +timing differences can result in random kernel panics because of +running partially patched instructions. This doesn't yet fix NMIs, +which requires extricating the patch code from the late bug checking +and is logically separate (and also less likely to cause problems). + +Signed-off-by: Zachary Amsden +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/kernel/alternative.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- linux-2.6.18.1.orig/arch/i386/kernel/alternative.c ++++ linux-2.6.18.1/arch/i386/kernel/alternative.c +@@ -344,6 +344,7 @@ void alternatives_smp_switch(int smp) + + void __init alternative_instructions(void) + { ++ unsigned long flags; + if (no_replacement) { + printk(KERN_INFO "(SMP-)alternatives turned off\n"); + free_init_pages("SMP alternatives", +@@ -351,6 +352,8 @@ void __init alternative_instructions(voi + (unsigned long)__smp_alt_end); + return; + } ++ ++ local_irq_save(flags); + apply_alternatives(__alt_instructions, __alt_instructions_end); + + /* switch to patch-once-at-boottime-only mode and free the +@@ -386,4 +389,5 @@ void __init alternative_instructions(voi + alternatives_smp_switch(0); + } + #endif ++ local_irq_restore(flags); + } diff --git a/queue-2.6.18/fuse-fix-hang-on-smp.patch b/queue-2.6.18/fuse-fix-hang-on-smp.patch new file mode 100644 index 00000000000..e6aac687b13 --- /dev/null +++ b/queue-2.6.18/fuse-fix-hang-on-smp.patch @@ -0,0 +1,148 @@ +From stable-bounces@linux.kernel.org Wed Oct 18 02:09:28 2006 +To: stable@kernel.org +Message-Id: +From: Miklos Szeredi +Date: Wed, 18 Oct 2006 11:08:30 +0200 +Subject: fuse: fix hang on SMP +MIME-Version: 1.0 +Content-Type: text/plain; charset="us-ascii" + +From: Miklos Szeredi + +Fuse didn't always call i_size_write() with i_mutex held which caused +rare hangs on SMP/32bit. This bug has been present since fuse-2.2, +well before being merged into mainline. + +The simplest solution is to protect i_size_write() with the +per-connection spinlock. Using i_mutex for this purpose would require +some restructuring of the code and I'm not even sure it's always safe +to acquire i_mutex in all places i_size needs to be set. + +Since most of vmtruncate is already duplicated for other reasons, +duplicate the remaining part as well, making all i_size_write() calls +internal to fuse. + +Using i_size_write() was unnecessary in fuse_init_inode(), since this +function is only called on a newly created locked inode. + +Reported by a few people over the years, but special thanks to Dana +Henriksen who was persistent enough in helping me debug it. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 30 +++++++++++++++++++++--------- + fs/fuse/file.c | 12 +++++++++--- + fs/fuse/inode.c | 5 ++++- + 3 files changed, 34 insertions(+), 13 deletions(-) + +--- linux-2.6.18.1.orig/fs/fuse/dir.c ++++ linux-2.6.18.1/fs/fuse/dir.c +@@ -935,14 +935,30 @@ static void iattr_to_fattr(struct iattr + } + } + ++static void fuse_vmtruncate(struct inode *inode, loff_t offset) ++{ ++ struct fuse_conn *fc = get_fuse_conn(inode); ++ int need_trunc; ++ ++ spin_lock(&fc->lock); ++ need_trunc = inode->i_size > offset; ++ i_size_write(inode, offset); ++ spin_unlock(&fc->lock); ++ ++ if (need_trunc) { ++ struct address_space *mapping = inode->i_mapping; ++ unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1); ++ truncate_inode_pages(mapping, offset); ++ } ++} ++ + /* + * Set attributes, and at the same time refresh them. + * + * Truncation is slightly complicated, because the 'truncate' request + * may fail, in which case we don't want to touch the mapping. +- * vmtruncate() doesn't allow for this case. So do the rlimit +- * checking by hand and call vmtruncate() only after the file has +- * actually been truncated. ++ * vmtruncate() doesn't allow for this case, so do the rlimit checking ++ * and the actual truncation by hand. + */ + static int fuse_setattr(struct dentry *entry, struct iattr *attr) + { +@@ -993,12 +1009,8 @@ static int fuse_setattr(struct dentry *e + make_bad_inode(inode); + err = -EIO; + } else { +- if (is_truncate) { +- loff_t origsize = i_size_read(inode); +- i_size_write(inode, outarg.attr.size); +- if (origsize > outarg.attr.size) +- vmtruncate(inode, outarg.attr.size); +- } ++ if (is_truncate) ++ fuse_vmtruncate(inode, outarg.attr.size); + fuse_change_attributes(inode, &outarg.attr); + fi->i_time = time_to_jiffies(outarg.attr_valid, + outarg.attr_valid_nsec); +--- linux-2.6.18.1.orig/fs/fuse/file.c ++++ linux-2.6.18.1/fs/fuse/file.c +@@ -481,8 +481,10 @@ static int fuse_commit_write(struct file + err = -EIO; + if (!err) { + pos += count; +- if (pos > i_size_read(inode)) ++ spin_lock(&fc->lock); ++ if (pos > inode->i_size) + i_size_write(inode, pos); ++ spin_unlock(&fc->lock); + + if (offset == 0 && to == PAGE_CACHE_SIZE) { + clear_page_dirty(page); +@@ -586,8 +588,12 @@ static ssize_t fuse_direct_io(struct fil + } + fuse_put_request(fc, req); + if (res > 0) { +- if (write && pos > i_size_read(inode)) +- i_size_write(inode, pos); ++ if (write) { ++ spin_lock(&fc->lock); ++ if (pos > inode->i_size) ++ i_size_write(inode, pos); ++ spin_unlock(&fc->lock); ++ } + *ppos = pos; + } + fuse_invalidate_attr(inode); +--- linux-2.6.18.1.orig/fs/fuse/inode.c ++++ linux-2.6.18.1/fs/fuse/inode.c +@@ -109,6 +109,7 @@ static int fuse_remount_fs(struct super_ + + void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr) + { ++ struct fuse_conn *fc = get_fuse_conn(inode); + if (S_ISREG(inode->i_mode) && i_size_read(inode) != attr->size) + invalidate_inode_pages(inode->i_mapping); + +@@ -117,7 +118,9 @@ void fuse_change_attributes(struct inode + inode->i_nlink = attr->nlink; + inode->i_uid = attr->uid; + inode->i_gid = attr->gid; ++ spin_lock(&fc->lock); + i_size_write(inode, attr->size); ++ spin_unlock(&fc->lock); + inode->i_blksize = PAGE_CACHE_SIZE; + inode->i_blocks = attr->blocks; + inode->i_atime.tv_sec = attr->atime; +@@ -131,7 +134,7 @@ void fuse_change_attributes(struct inode + static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr) + { + inode->i_mode = attr->mode & S_IFMT; +- i_size_write(inode, attr->size); ++ inode->i_size = attr->size; + if (S_ISREG(inode->i_mode)) { + fuse_init_common(inode); + fuse_init_file_inode(inode); diff --git a/queue-2.6.18/ib-mthca-use-mmiowb-after-doorbell-ring.patch b/queue-2.6.18/ib-mthca-use-mmiowb-after-doorbell-ring.patch new file mode 100644 index 00000000000..0fbf53555b9 --- /dev/null +++ b/queue-2.6.18/ib-mthca-use-mmiowb-after-doorbell-ring.patch @@ -0,0 +1,128 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 16:23:45 2006 +To: stable@kernel.org +From: Arthur Kepner +Date: Tue, 17 Oct 2006 16:22:59 -0700 +Message-ID: +MIME-Version: 1.0 +Subject: IB/mthca: Use mmiowb after doorbell ring +Content-Type: text/plain; charset="us-ascii" + +From: Arthur Kepner + +We discovered a problem when running IPoIB applications on multiple +CPUs on an Altix system. Many messages such as: + +ib_mthca 0002:01:00.0: SQ 000014 full (19941644 head, 19941707 tail, 64 max, 0 nreq) + +appear in syslog, and the driver wedges up. + +Apparently this is because writes to the doorbells from different CPUs +reach the device out of order. The following patch adds mmiowb() calls +after doorbell rings to ensure the doorbell writes are ordered. + +Signed-off-by: Arthur Kepner +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mthca/mthca_cq.c | 7 +++++++ + drivers/infiniband/hw/mthca/mthca_qp.c | 19 +++++++++++++++++++ + drivers/infiniband/hw/mthca/mthca_srq.c | 8 ++++++++ + 3 files changed, 34 insertions(+) + +--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_cq.c ++++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_cq.c +@@ -39,6 +39,8 @@ + #include + #include + ++#include ++ + #include + + #include "mthca_dev.h" +@@ -210,6 +212,11 @@ static inline void update_cons_index(str + mthca_write64(doorbell, + dev->kar + MTHCA_CQ_DOORBELL, + MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock)); ++ /* ++ * Make sure doorbells don't leak out of CQ spinlock ++ * and reach the HCA out of order: ++ */ ++ mmiowb(); + } + } + +--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_qp.c ++++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_qp.c +@@ -39,6 +39,8 @@ + #include + #include + ++#include ++ + #include + #include + #include +@@ -1730,6 +1732,11 @@ out: + mthca_write64(doorbell, + dev->kar + MTHCA_SEND_DOORBELL, + MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock)); ++ /* ++ * Make sure doorbells don't leak out of SQ spinlock ++ * and reach the HCA out of order: ++ */ ++ mmiowb(); + } + + qp->sq.next_ind = ind; +@@ -1849,6 +1856,12 @@ out: + qp->rq.next_ind = ind; + qp->rq.head += nreq; + ++ /* ++ * Make sure doorbells don't leak out of RQ spinlock and reach ++ * the HCA out of order: ++ */ ++ mmiowb(); ++ + spin_unlock_irqrestore(&qp->rq.lock, flags); + return err; + } +@@ -2110,6 +2123,12 @@ out: + MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock)); + } + ++ /* ++ * Make sure doorbells don't leak out of SQ spinlock and reach ++ * the HCA out of order: ++ */ ++ mmiowb(); ++ + spin_unlock_irqrestore(&qp->sq.lock, flags); + return err; + } +--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_srq.c ++++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_srq.c +@@ -35,6 +35,8 @@ + #include + #include + ++#include ++ + #include "mthca_dev.h" + #include "mthca_cmd.h" + #include "mthca_memfree.h" +@@ -593,6 +595,12 @@ int mthca_tavor_post_srq_recv(struct ib_ + MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock)); + } + ++ /* ++ * Make sure doorbells don't leak out of SRQ spinlock and ++ * reach the HCA out of order: ++ */ ++ mmiowb(); ++ + spin_unlock_irqrestore(&srq->lock, flags); + return err; + } diff --git a/queue-2.6.18/ipoib-rejoin-all-multicast-groups-after-a-port-event.patch b/queue-2.6.18/ipoib-rejoin-all-multicast-groups-after-a-port-event.patch new file mode 100644 index 00000000000..73f7c40b7a0 --- /dev/null +++ b/queue-2.6.18/ipoib-rejoin-all-multicast-groups-after-a-port-event.patch @@ -0,0 +1,41 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 16:23:45 2006 +To: stable@kernel.org +From: Eli Cohen +Date: Tue, 17 Oct 2006 16:23:25 -0700 +Message-ID: +MIME-Version: 1.0 +Subject: IPoIB: Rejoin all multicast groups after a port event +Content-Type: text/plain; charset="us-ascii" + +From: Eli Cohen + +When ipoib_ib_dev_flush() is called because of a port event, the +driver needs to rejoin all multicast groups, since the flush will call +ipoib_mcast_dev_flush() (via ipoib_ib_dev_down()). Otherwise no +(non-broadcast) multicast groups will be rejoined until the networking +core calls ->set_multicast_list again, and so multicast reception will +be broken for potentially a long time. + +Signed-off-by: Eli Cohen +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ linux-2.6.18.1/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -619,8 +619,10 @@ void ipoib_ib_dev_flush(void *_dev) + * The device could have been brought down between the start and when + * we get here, don't bring it back up if it's not configured up + */ +- if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)) ++ if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)) { + ipoib_ib_dev_up(dev); ++ ipoib_mcast_restart_task(dev); ++ } + + mutex_lock(&priv->vlan_mutex); + diff --git a/queue-2.6.18/jfs-pageno-needs-to-be-long.patch b/queue-2.6.18/jfs-pageno-needs-to-be-long.patch new file mode 100644 index 00000000000..037a217eaa6 --- /dev/null +++ b/queue-2.6.18/jfs-pageno-needs-to-be-long.patch @@ -0,0 +1,42 @@ +From stable-bounces@linux.kernel.org Tue Oct 24 23:30:17 2006 +Date: Mon, 23 Oct 2006 17:00:13 GMT +Message-Id: <200610231700.k9NH0Dp4016676@hera.kernel.org> +From: Dave Kleikamp +MIME-Version: 1.0 +Subject: JFS: pageno needs to be long +Content-Type: text/plain; charset="us-ascii" + +From: Dave Kleikamp + +JFS: pageno needs to be long + +diRead and diWrite are representing the page number as an unsigned int. +This causes file system corruption on volumes larger than 16TB. + +Signed-off-by: Dave Kleikamp +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jfs/jfs_imap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.18.1.orig/fs/jfs/jfs_imap.c ++++ linux-2.6.18.1/fs/jfs/jfs_imap.c +@@ -318,7 +318,7 @@ int diRead(struct inode *ip) + struct inomap *imap; + int block_offset; + int inodes_left; +- uint pageno; ++ unsigned long pageno; + int rel_inode; + + jfs_info("diRead: ino = %ld", ip->i_ino); +@@ -606,7 +606,7 @@ int diWrite(tid_t tid, struct inode *ip) + int block_offset; + int inodes_left; + struct metapage *mp; +- uint pageno; ++ unsigned long pageno; + int rel_inode; + int dioffset; + struct inode *ipimap; diff --git a/queue-2.6.18/knfsd-fix-race-that-can-disable-nfs-server.patch b/queue-2.6.18/knfsd-fix-race-that-can-disable-nfs-server.patch new file mode 100644 index 00000000000..c3ae4550cb1 --- /dev/null +++ b/queue-2.6.18/knfsd-fix-race-that-can-disable-nfs-server.patch @@ -0,0 +1,52 @@ +From stable-bounces@linux.kernel.org Thu Oct 19 18:53:27 2006 +From: NeilBrown +To: Andrew Morton +Date: Fri, 20 Oct 2006 11:52:44 +1000 +Message-Id: <1061020015244.26756@suse.de> +Cc: Adrian Bunk , nfs@lists.sourceforge.net, linux-kernel@vger.kernel.org, stable@kernel.org +Subject: knfsd: Fix race that can disable NFS server. +MIME-Version: 1.0 +Content-Type: text/plain; charset="us-ascii" + +From: NeilBrown + +This is a long standing bug that seems to have only recently become +apparent, presumably due to increasing use of NFS over TCP - many +distros seem to be making it the default. + +The SK_CONN bit gets set when a listening socket may be ready +for an accept, just as SK_DATA is set when data may be available. + +It is entirely possible for svc_tcp_accept to be called with neither +of these set. It doesn't happen often but there is a small race in +svc_sock_enqueue as SK_CONN and SK_DATA are tested outside the +spin_lock. They could be cleared immediately after the test and +before the lock is gained. + +This normally shouldn't be a problem. The sockets are non-blocking so +trying to read() or accept() when ther is nothing to do is not a problem. + +However: svc_tcp_recvfrom makes the decision "Should I accept() or +should I read()" based on whether SK_CONN is set or not. This usually +works but is not safe. The decision should be based on whether it is +a TCP_LISTEN socket or a TCP_CONNECTED socket. + + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/svcsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/net/sunrpc/svcsock.c ++++ linux-2.6.18.1/net/sunrpc/svcsock.c +@@ -902,7 +902,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp) + return 0; + } + +- if (test_bit(SK_CONN, &svsk->sk_flags)) { ++ if (svsk->sk_sk->sk_state == TCP_LISTEN) { + svc_tcp_accept(svsk); + svc_sock_received(svsk); + return 0; diff --git a/queue-2.6.18/md-fix-bug-where-spares-don-t-always-get-rebuilt-properly-when-they-become-live.patch b/queue-2.6.18/md-fix-bug-where-spares-don-t-always-get-rebuilt-properly-when-they-become-live.patch new file mode 100644 index 00000000000..a864b1e7aa7 --- /dev/null +++ b/queue-2.6.18/md-fix-bug-where-spares-don-t-always-get-rebuilt-properly-when-they-become-live.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Mon Oct 23 00:08:31 2006 +From: NeilBrown +To: Andrew Morton +Date: Mon, 23 Oct 2006 17:07:48 +1000 +Message-Id: <1061023070748.29223@suse.de> +Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org +Subject: md: Fix bug where spares don't always get rebuilt properly when they become live. +MIME-Version: 1.0 +Content-Type: text/plain; charset="us-ascii" + +From: NeilBrown + +If save_raid_disk is >= 0, then the device could be a device that is +already in sync that is being re-added. So we need to default this +value to -1. + + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.18.1.orig/drivers/md/md.c ++++ linux-2.6.18.1/drivers/md/md.c +@@ -1994,6 +1994,7 @@ static mdk_rdev_t *md_import_device(dev_ + kobject_init(&rdev->kobj); + + rdev->desc_nr = -1; ++ rdev->saved_raid_disk = -1; + rdev->flags = 0; + rdev->data_offset = 0; + rdev->sb_events = 0; diff --git a/queue-2.6.18/md-fix-calculation-of-degraded-for-multipath-and-raid10.patch b/queue-2.6.18/md-fix-calculation-of-degraded-for-multipath-and-raid10.patch new file mode 100644 index 00000000000..68433538784 --- /dev/null +++ b/queue-2.6.18/md-fix-calculation-of-degraded-for-multipath-and-raid10.patch @@ -0,0 +1,45 @@ +From stable-bounces@linux.kernel.org Thu Oct 19 20:26:21 2006 +From: NeilBrown +To: Andrew Morton +Date: Fri, 20 Oct 2006 13:25:30 +1000 +Message-Id: <1061020032530.1668@suse.de> +Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org +Subject: md: Fix calculation of ->degraded for multipath and raid10 +MIME-Version: 1.0 +Content-Type: text/plain; charset="us-ascii" + +From: NeilBrown + +Two less-used md personalities have bugs in the calculation of + ->degraded (the extent to which the array is degraded). + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/multipath.c | 2 +- + drivers/md/raid10.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.18.1.orig/drivers/md/multipath.c ++++ linux-2.6.18.1/drivers/md/multipath.c +@@ -480,7 +480,7 @@ static int multipath_run (mddev_t *mddev + mdname(mddev)); + goto out_free_conf; + } +- mddev->degraded = conf->raid_disks = conf->working_disks; ++ mddev->degraded = conf->raid_disks - conf->working_disks; + + conf->pool = mempool_create_kzalloc_pool(NR_RESERVED_BUFS, + sizeof(struct multipath_bh)); +--- linux-2.6.18.1.orig/drivers/md/raid10.c ++++ linux-2.6.18.1/drivers/md/raid10.c +@@ -2042,7 +2042,7 @@ static int run(mddev_t *mddev) + disk = conf->mirrors + i; + + if (!disk->rdev || +- !test_bit(In_sync, &rdev->flags)) { ++ !test_bit(In_sync, &disk->rdev->flags)) { + disk->head_position = 0; + mddev->degraded++; + } diff --git a/queue-2.6.18/net-fix-skb_segment-handling-of-fully-linear-skbs.patch b/queue-2.6.18/net-fix-skb_segment-handling-of-fully-linear-skbs.patch new file mode 100644 index 00000000000..ac780c8f47c --- /dev/null +++ b/queue-2.6.18/net-fix-skb_segment-handling-of-fully-linear-skbs.patch @@ -0,0 +1,57 @@ +From stable-bounces@linux.kernel.org Sun Oct 29 16:12:23 2006 +Date: Sun, 29 Oct 2006 16:11:38 -0800 (PST) +Message-Id: <20061029.161138.63123403.davem@davemloft.net> +From: Herbert Xu +Mime-Version: 1.0 +Subject: NET: Fix skb_segment() handling of fully linear SKBs +Content-Type: text/plain; charset="us-ascii" + +From: Herbert Xu + +[NET]: Fix segmentation of linear packets + +skb_segment fails to segment linear packets correctly because it +tries to write all linear parts of the original skb into each +segment. This will always panic as each segment only contains +enough space for one MSS. + +This was not detected earlier because linear packets should be +rare for GSO. In fact it still remains to be seen what exactly +created the linear packets that triggered this bug. Basically +the only time this should happen is if someone enables GSO +emulation on an interface that does not support SG. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/skbuff.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- linux-2.6.18.1.orig/net/core/skbuff.c ++++ linux-2.6.18.1/net/core/skbuff.c +@@ -1945,7 +1945,7 @@ struct sk_buff *skb_segment(struct sk_bu + do { + struct sk_buff *nskb; + skb_frag_t *frag; +- int hsize, nsize; ++ int hsize; + int k; + int size; + +@@ -1956,11 +1956,10 @@ struct sk_buff *skb_segment(struct sk_bu + hsize = skb_headlen(skb) - offset; + if (hsize < 0) + hsize = 0; +- nsize = hsize + doffset; +- if (nsize > len + doffset || !sg) +- nsize = len + doffset; ++ if (hsize > len || !sg) ++ hsize = len; + +- nskb = alloc_skb(nsize + headroom, GFP_ATOMIC); ++ nskb = alloc_skb(hsize + doffset + headroom, GFP_ATOMIC); + if (unlikely(!nskb)) + goto err; + diff --git a/queue-2.6.18/scsi-aic7xxx-avoid-checking-sblkctl-register-for-certain-cards.patch b/queue-2.6.18/scsi-aic7xxx-avoid-checking-sblkctl-register-for-certain-cards.patch new file mode 100644 index 00000000000..8a351f7b03a --- /dev/null +++ b/queue-2.6.18/scsi-aic7xxx-avoid-checking-sblkctl-register-for-certain-cards.patch @@ -0,0 +1,53 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 22:49:31 2006 +Date: Sun, 24 Sep 2006 04:01:16 GMT +Message-Id: <200609240401.k8O41GAH026953@hera.kernel.org> +From: James Bottomley +MIME-Version: 1.0 +Subject: SCSI: aic7xxx: avoid checking SBLKCTL register for certain cards +Content-Type: text/plain; charset="us-ascii" + +From: James Bottomley + +[SCSI] aic7xxx: avoid checking SBLKCTL register for certain cards + +For cards that don't support LVD, checking the SBLKCTL register to +determine the bus singalling doesn't work. So, check that the card +supports LVD first (AHC_ULTRA2) before checking the register. + +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/aic7xxx/aic7xxx_osm.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- linux-2.6.18.1.orig/drivers/scsi/aic7xxx/aic7xxx_osm.c ++++ linux-2.6.18.1/drivers/scsi/aic7xxx/aic7xxx_osm.c +@@ -2539,15 +2539,23 @@ static void ahc_linux_set_iu(struct scsi + static void ahc_linux_get_signalling(struct Scsi_Host *shost) + { + struct ahc_softc *ahc = *(struct ahc_softc **)shost->hostdata; +- u8 mode = ahc_inb(ahc, SBLKCTL); ++ u8 mode; + +- if (mode & ENAB40) +- spi_signalling(shost) = SPI_SIGNAL_LVD; +- else if (mode & ENAB20) ++ if (!(ahc->features & AHC_ULTRA2)) { ++ /* non-LVD chipset, may not have SBLKCTL reg */ + spi_signalling(shost) = + ahc->features & AHC_HVD ? + SPI_SIGNAL_HVD : + SPI_SIGNAL_SE; ++ return; ++ } ++ ++ mode = ahc_inb(ahc, SBLKCTL); ++ ++ if (mode & ENAB40) ++ spi_signalling(shost) = SPI_SIGNAL_LVD; ++ else if (mode & ENAB20) ++ spi_signalling(shost) = SPI_SIGNAL_SE; + else + spi_signalling(shost) = SPI_SIGNAL_UNKNOWN; + } diff --git a/queue-2.6.18/scsi-aic7xxx-pause-sequencer-before-touching-sblkctl.patch b/queue-2.6.18/scsi-aic7xxx-pause-sequencer-before-touching-sblkctl.patch new file mode 100644 index 00000000000..21793a27dec --- /dev/null +++ b/queue-2.6.18/scsi-aic7xxx-pause-sequencer-before-touching-sblkctl.patch @@ -0,0 +1,46 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 22:49:31 2006 +Date: Sun, 24 Sep 2006 04:01:16 GMT +Message-Id: <200609240401.k8O41G02026969@hera.kernel.org> +From: Doug Ledford +MIME-Version: 1.0 +Subject: SCSI: aic7xxx: pause sequencer before touching SBLKCTL +Content-Type: text/plain; charset="us-ascii" + +From: Doug Ledford + +[SCSI] aic7xxx: pause sequencer before touching SBLKCTL + +Some cards need to pause the sequencer before the SBLKCTL register is +touched. This fixes a PCI related oops seen on powerpc macs with this +card caused by trying to ascertain the bus signalling before beginning +domain validation. + +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/aic7xxx/aic7xxx_osm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- linux-2.6.18.1.orig/drivers/scsi/aic7xxx/aic7xxx_osm.c ++++ linux-2.6.18.1/drivers/scsi/aic7xxx/aic7xxx_osm.c +@@ -2539,6 +2539,7 @@ static void ahc_linux_set_iu(struct scsi + static void ahc_linux_get_signalling(struct Scsi_Host *shost) + { + struct ahc_softc *ahc = *(struct ahc_softc **)shost->hostdata; ++ unsigned long flags; + u8 mode; + + if (!(ahc->features & AHC_ULTRA2)) { +@@ -2550,7 +2551,11 @@ static void ahc_linux_get_signalling(str + return; + } + ++ ahc_lock(ahc, &flags); ++ ahc_pause(ahc); + mode = ahc_inb(ahc, SBLKCTL); ++ ahc_unpause(ahc); ++ ahc_unlock(ahc, &flags); + + if (mode & ENAB40) + spi_signalling(shost) = SPI_SIGNAL_LVD; diff --git a/queue-2.6.18/sctp-always-linearise-packet-on-input.patch b/queue-2.6.18/sctp-always-linearise-packet-on-input.patch new file mode 100644 index 00000000000..d62a7e2ddb1 --- /dev/null +++ b/queue-2.6.18/sctp-always-linearise-packet-on-input.patch @@ -0,0 +1,45 @@ +From stable-bounces@linux.kernel.org Sun Oct 29 23:49:17 2006 +Date: Sun, 29 Oct 2006 23:48:51 -0800 (PST) +Message-Id: <20061029.234851.48808018.davem@davemloft.net> +From: Herbert Xu +To: stable@kernel.org +Mime-Version: 1.0 +Subject: SCTP: Always linearise packet on input +Content-Type: text/plain; charset="us-ascii" + +From: Herbert Xu + +I was looking at a RHEL5 bug report involving Xen and SCTP +(https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212550). +It turns out that SCTP wasn't written to handle skb fragments at +all. The absence of any calls to skb_may_pull is testament to +that. + +It just so happens that Xen creates fragmented packets more often +than other scenarios (header & data split when going from domU to +dom0). That's what caused this bug to show up. + +Until someone has the time sits down and audits the entire net/sctp +directory, here is a conservative and safe solution that simply +linearises all packets on input. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sctp/input.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- linux-2.6.18.1.orig/net/sctp/input.c ++++ linux-2.6.18.1/net/sctp/input.c +@@ -135,6 +135,9 @@ int sctp_rcv(struct sk_buff *skb) + + SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS); + ++ if (skb_linearize(skb)) ++ goto discard_it; ++ + sh = (struct sctphdr *) skb->h.raw; + + /* Pull up the IP and SCTP headers. */ diff --git a/queue-2.6.18/series b/queue-2.6.18/series index 26236b6fb7c..278e7ad92e9 100644 --- a/queue-2.6.18/series +++ b/queue-2.6.18/series @@ -19,3 +19,23 @@ fix-uninitialised-spinlock-in-via-pmu-backlight-code.patch serial-fix-resume-handling-bug.patch serial-fix-oops-when-removing-suspended-serial-port.patch bluetooth-check-if-dlc-is-still-attached-to-the-tty.patch +jfs-pageno-needs-to-be-long.patch +sparc64-fix-central-fhc-bus-handling-on-ex000-systems.patch +sparc64-fix-memory-corruption-in-pci_4u_free_consistent.patch +bcm43xx-fix-watchdog-timeouts.patch +dvb-fix-dvb_pll_attach-for-mt352-zl10353-in-cx88-dvb-and-nxt200x.patch +alsa-fix-re-use-of-va_list.patch +md-fix-bug-where-spares-don-t-always-get-rebuilt-properly-when-they-become-live.patch +md-fix-calculation-of-degraded-for-multipath-and-raid10.patch +knfsd-fix-race-that-can-disable-nfs-server.patch +scsi-aic7xxx-avoid-checking-sblkctl-register-for-certain-cards.patch +ipoib-rejoin-all-multicast-groups-after-a-port-event.patch +ib-mthca-use-mmiowb-after-doorbell-ring.patch +fuse-fix-hang-on-smp.patch +fix-potential-interrupts-during-alternative-patching.patch +sky2-88e803x-transmit-lockup.patch +scsi-aic7xxx-pause-sequencer-before-touching-sblkctl.patch +audit-fix-missing-ifdefs-in-syscall-classes-hookup-for-generic-targets.patch +net-fix-skb_segment-handling-of-fully-linear-skbs.patch +sctp-always-linearise-packet-on-input.patch +x86-64-fix-c3-timer-test.patch diff --git a/queue-2.6.18/sky2-88e803x-transmit-lockup.patch b/queue-2.6.18/sky2-88e803x-transmit-lockup.patch new file mode 100644 index 00000000000..09697c2f9a4 --- /dev/null +++ b/queue-2.6.18/sky2-88e803x-transmit-lockup.patch @@ -0,0 +1,84 @@ +From stable-bounces@linux.kernel.org Fri Oct 20 17:14:23 2006 +Date: Fri, 20 Oct 2006 17:13:20 -0700 +From: Stephen Hemminger +To: stable@kernel.org +Message-ID: <20061020171320.4a4c8140@freekitty> +Mime-Version: 1.0 +Subject: sky2: 88E803X transmit lockup (2.6.18) +Content-Type: text/plain; charset="us-ascii" + +From: Stephen Hemminger + +The reason sky2 driver was locking up on transmit on the Yukon-FE chipset +is that it was misconfiguring the internal RAM buffer so the transmitter +and receiver were sharing the same space. It is a wonder it worked at all! + +This patch addresses this, and fixes an easily reproducible hang on Transmit. +Only the Yukon-FE chip is Marvell 88E803X (10/100 only) are affected. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 33 ++++++++++++--------------------- + 1 file changed, 12 insertions(+), 21 deletions(-) + +--- linux-2.6.18.1.orig/drivers/net/sky2.c ++++ linux-2.6.18.1/drivers/net/sky2.c +@@ -690,16 +690,10 @@ static void sky2_mac_init(struct sky2_hw + + } + +-/* Assign Ram Buffer allocation. +- * start and end are in units of 4k bytes +- * ram registers are in units of 64bit words +- */ +-static void sky2_ramset(struct sky2_hw *hw, u16 q, u8 startk, u8 endk) ++/* Assign Ram Buffer allocation in units of 64bit (8 bytes) */ ++static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 end) + { +- u32 start, end; +- +- start = startk * 4096/8; +- end = (endk * 4096/8) - 1; ++ pr_debug(PFX "q %d %#x %#x\n", q, start, end); + + sky2_write8(hw, RB_ADDR(q, RB_CTRL), RB_RST_CLR); + sky2_write32(hw, RB_ADDR(q, RB_START), start); +@@ -708,7 +702,7 @@ static void sky2_ramset(struct sky2_hw * + sky2_write32(hw, RB_ADDR(q, RB_RP), start); + + if (q == Q_R1 || q == Q_R2) { +- u32 space = (endk - startk) * 4096/8; ++ u32 space = end - start + 1; + u32 tp = space - space/4; + + /* On receive queue's set the thresholds +@@ -1090,19 +1084,16 @@ static int sky2_up(struct net_device *de + + sky2_mac_init(hw, port); + +- /* Determine available ram buffer space (in 4K blocks). +- * Note: not sure about the FE setting below yet +- */ +- if (hw->chip_id == CHIP_ID_YUKON_FE) +- ramsize = 4; +- else +- ramsize = sky2_read8(hw, B2_E_0); ++ /* Determine available ram buffer space in qwords. */ ++ ramsize = sky2_read8(hw, B2_E_0) * 4096/8; + +- /* Give transmitter one third (rounded up) */ +- rxspace = ramsize - (ramsize + 2) / 3; ++ if (ramsize > 6*1024/8) ++ rxspace = ramsize - (ramsize + 2) / 3; ++ else ++ rxspace = ramsize / 2; + +- sky2_ramset(hw, rxqaddr[port], 0, rxspace); +- sky2_ramset(hw, txqaddr[port], rxspace, ramsize); ++ sky2_ramset(hw, rxqaddr[port], 0, rxspace-1); ++ sky2_ramset(hw, txqaddr[port], rxspace, ramsize-1); + + /* Make sure SyncQ is disabled */ + sky2_write8(hw, RB_ADDR(port == 0 ? Q_XS1 : Q_XS2, RB_CTRL), diff --git a/queue-2.6.18/sparc64-fix-central-fhc-bus-handling-on-ex000-systems.patch b/queue-2.6.18/sparc64-fix-central-fhc-bus-handling-on-ex000-systems.patch new file mode 100644 index 00000000000..c284a201fbe --- /dev/null +++ b/queue-2.6.18/sparc64-fix-central-fhc-bus-handling-on-ex000-systems.patch @@ -0,0 +1,188 @@ +From stable-bounces@linux.kernel.org Wed Oct 25 23:50:44 2006 +Date: Wed, 25 Oct 2006 23:50:12 -0700 (PDT) +Message-Id: <20061025.235012.48807053.davem@davemloft.net> +To: stable@kernel.org +From: David Miller +Mime-Version: 1.0 +Subject: SPARC64: Fix central/FHC bus handling on Ex000 systems. +Content-Type: text/plain; charset="us-ascii" + +From: David Miller + +1) probe_other_fhcs() wants to see only non-central FHC + busses, so skip FHCs that don't sit off the root + +2) Like SBUS, FHC can lack the appropriate address and + size cell count properties, so add an of_busses[] + entry and handlers for that. + +3) Central FHC irq translator probing was buggy. We + were trying to use dp->child in irq_trans_init but + that linkage is not setup at this point. + + So instead, pass in the parent of "dp" and look for + the child "fhc" with parent "central". + +Thanks to the tireless assistence of Ben Collins in tracking +down these problems and testing out these fixes. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/central.c | 4 ++++ + arch/sparc64/kernel/of_device.c | 33 ++++++++++++++++++++++++--------- + arch/sparc64/kernel/prom.c | 30 +++++++++++++++--------------- + 3 files changed, 43 insertions(+), 24 deletions(-) + +--- linux-2.6.18.1.orig/arch/sparc64/kernel/central.c ++++ linux-2.6.18.1/arch/sparc64/kernel/central.c +@@ -126,6 +126,10 @@ static void probe_other_fhcs(void) + int board; + u32 tmp; + ++ if (dp->parent && ++ dp->parent->parent != NULL) ++ continue; ++ + fhc = (struct linux_fhc *) + central_alloc_bootmem(sizeof(struct linux_fhc)); + if (fhc == NULL) +--- linux-2.6.18.1.orig/arch/sparc64/kernel/of_device.c ++++ linux-2.6.18.1/arch/sparc64/kernel/of_device.c +@@ -398,16 +398,22 @@ static void of_bus_sbus_count_cells(stru + *sizec = 1; + } + +-static int of_bus_sbus_map(u32 *addr, const u32 *range, int na, int ns, int pna) +-{ +- return of_bus_default_map(addr, range, na, ns, pna); +-} +- +-static unsigned int of_bus_sbus_get_flags(u32 *addr) ++/* ++ * FHC/Central bus specific translator. ++ * ++ * This is just needed to hard-code the address and size cell ++ * counts. 'fhc' and 'central' nodes lack the #address-cells and ++ * #size-cells properties, and if you walk to the root on such ++ * Enterprise boxes all you'll get is a #size-cells of 2 which is ++ * not what we want to use. ++ */ ++static int of_bus_fhc_match(struct device_node *np) + { +- return IORESOURCE_MEM; ++ return !strcmp(np->name, "fhc") || ++ !strcmp(np->name, "central"); + } + ++#define of_bus_fhc_count_cells of_bus_sbus_count_cells + + /* + * Array of bus specific translators +@@ -429,8 +435,17 @@ static struct of_bus of_busses[] = { + .addr_prop_name = "reg", + .match = of_bus_sbus_match, + .count_cells = of_bus_sbus_count_cells, +- .map = of_bus_sbus_map, +- .get_flags = of_bus_sbus_get_flags, ++ .map = of_bus_default_map, ++ .get_flags = of_bus_default_get_flags, ++ }, ++ /* FHC */ ++ { ++ .name = "fhc", ++ .addr_prop_name = "reg", ++ .match = of_bus_fhc_match, ++ .count_cells = of_bus_fhc_count_cells, ++ .map = of_bus_default_map, ++ .get_flags = of_bus_default_get_flags, + }, + /* Default */ + { +--- linux-2.6.18.1.orig/arch/sparc64/kernel/prom.c ++++ linux-2.6.18.1/arch/sparc64/kernel/prom.c +@@ -1080,23 +1080,22 @@ static void sun4v_vdev_irq_trans_init(st + + static void irq_trans_init(struct device_node *dp) + { +- const char *model; + #ifdef CONFIG_PCI ++ const char *model; + int i; + #endif + ++#ifdef CONFIG_PCI + model = of_get_property(dp, "model", NULL); + if (!model) + model = of_get_property(dp, "compatible", NULL); +- if (!model) +- return; +- +-#ifdef CONFIG_PCI +- for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) { +- struct irq_trans *t = &pci_irq_trans_table[i]; ++ if (model) { ++ for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) { ++ struct irq_trans *t = &pci_irq_trans_table[i]; + +- if (!strcmp(model, t->name)) +- return t->init(dp); ++ if (!strcmp(model, t->name)) ++ return t->init(dp); ++ } + } + #endif + #ifdef CONFIG_SBUS +@@ -1104,8 +1103,9 @@ static void irq_trans_init(struct device + !strcmp(dp->name, "sbi")) + return sbus_irq_trans_init(dp); + #endif +- if (!strcmp(dp->name, "central")) +- return central_irq_trans_init(dp->child); ++ if (!strcmp(dp->name, "fhc") && ++ !strcmp(dp->parent->name, "central")) ++ return central_irq_trans_init(dp); + if (!strcmp(dp->name, "virtual-devices")) + return sun4v_vdev_irq_trans_init(dp); + } +@@ -1517,7 +1517,7 @@ static char * __init get_one_property(ph + return buf; + } + +-static struct device_node * __init create_node(phandle node) ++static struct device_node * __init create_node(phandle node, struct device_node *parent) + { + struct device_node *dp; + +@@ -1526,6 +1526,7 @@ static struct device_node * __init creat + + dp = prom_early_alloc(sizeof(*dp)); + dp->unique_id = unique_id++; ++ dp->parent = parent; + + kref_init(&dp->kref); + +@@ -1544,12 +1545,11 @@ static struct device_node * __init build + { + struct device_node *dp; + +- dp = create_node(node); ++ dp = create_node(node, parent); + if (dp) { + *(*nextp) = dp; + *nextp = &dp->allnext; + +- dp->parent = parent; + dp->path_component_name = build_path_component(dp); + dp->full_name = build_full_name(dp); + +@@ -1565,7 +1565,7 @@ void __init prom_build_devicetree(void) + { + struct device_node **nextp; + +- allnodes = create_node(prom_root_node); ++ allnodes = create_node(prom_root_node, NULL); + allnodes->path_component_name = ""; + allnodes->full_name = "/"; + diff --git a/queue-2.6.18/sparc64-fix-memory-corruption-in-pci_4u_free_consistent.patch b/queue-2.6.18/sparc64-fix-memory-corruption-in-pci_4u_free_consistent.patch new file mode 100644 index 00000000000..8c978bfc514 --- /dev/null +++ b/queue-2.6.18/sparc64-fix-memory-corruption-in-pci_4u_free_consistent.patch @@ -0,0 +1,33 @@ +From stable-bounces@linux.kernel.org Wed Oct 25 23:51:42 2006 +Date: Wed, 25 Oct 2006 23:51:07 -0700 (PDT) +Message-Id: <20061025.235107.39158283.davem@davemloft.net> +To: stable@kernel.org +From: David Miller +Mime-Version: 1.0 +Subject: SPARC64: Fix memory corruption in pci_4u_free_consistent(). +Content-Type: text/plain; charset="us-ascii" + +From: David Miller + +The second argument to free_npages() was being incorrectly +calculated, which would thus access far past the end of the +arena->map[] bitmap. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/pci_iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/arch/sparc64/kernel/pci_iommu.c ++++ linux-2.6.18.1/arch/sparc64/kernel/pci_iommu.c +@@ -281,7 +281,7 @@ static void pci_4u_free_consistent(struc + + spin_lock_irqsave(&iommu->lock, flags); + +- free_npages(iommu, dvma, npages); ++ free_npages(iommu, dvma - iommu->page_table_map_base, npages); + + spin_unlock_irqrestore(&iommu->lock, flags); + diff --git a/queue-2.6.18/x86-64-fix-c3-timer-test.patch b/queue-2.6.18/x86-64-fix-c3-timer-test.patch new file mode 100644 index 00000000000..4a0d8d19dc3 --- /dev/null +++ b/queue-2.6.18/x86-64-fix-c3-timer-test.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Mon Oct 30 07:58:11 2006 +Date: Sun, 22 Oct 2006 00:59:04 GMT +Message-Id: <200610220059.k9M0x4e8025532@hera.kernel.org> +From: Andi Kleen +MIME-Version: 1.0 +Subject: x86-64: Fix C3 timer test +Content-Type: text/plain; charset="us-ascii" + +From: Andi Kleen + +There was a typo in the C3 latency test to decide of the TSC +should be used or not. It used the C2 latency threshold, not the +C3 one. Fix that. + +This should fix the time on various dual core laptops. + +Signed-off-by: Andi Kleen +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86_64/kernel/time.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/arch/x86_64/kernel/time.c ++++ linux-2.6.18.1/arch/x86_64/kernel/time.c +@@ -960,7 +960,7 @@ __cpuinit int unsynchronized_tsc(void) + if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) { + #ifdef CONFIG_ACPI + /* But TSC doesn't tick in C3 so don't use it there */ +- if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 100) ++ if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 1000) + return 1; + #endif + return 0;