From: Greg Kroah-Hartman Date: Tue, 7 Aug 2007 09:00:19 +0000 (-0700) Subject: more 2.6.22 patches X-Git-Tag: v2.6.21.7~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c3e65127ea64653dd9f026d9a520156f7cebdcaa;p=thirdparty%2Fkernel%2Fstable-queue.git more 2.6.22 patches --- diff --git a/queue-2.6.22/acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch b/queue-2.6.22/acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch new file mode 100644 index 00000000000..e37af8cb0dd --- /dev/null +++ b/queue-2.6.22/acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch @@ -0,0 +1,64 @@ +From stable-bounces@linux.kernel.org Mon Jul 16 13:57:50 2007 +From: Venki Pallipadi +Date: Mon, 16 Jul 2007 16:57:38 -0400 +Subject: acpi-cpufreq: Proper ReadModifyWrite of PERF_CTL MSR +Cc: Dave Jones +Message-ID: <469BDBC2.3030701@redhat.com> + + +From: Venki Pallipadi + +[CPUFREQ] acpi-cpufreq: Proper ReadModifyWrite of PERF_CTL MSR + +During recent acpi-cpufreq changes, writing to PERF_CTL msr +changed from RMW of entire 64 bit to RMW of low 32 bit and clearing of +upper 32 bit. Fix it back to do a proper RMW of the MSR. + +Signed-off-by: Venkatesh Pallipadi +Signed-off-by: Dave Jones +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +--- a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c ++++ b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c +@@ -167,11 +167,13 @@ static void do_drv_read(struct drv_cmd * + + static void do_drv_write(struct drv_cmd *cmd) + { +- u32 h = 0; ++ u32 lo, hi; + + switch (cmd->type) { + case SYSTEM_INTEL_MSR_CAPABLE: +- wrmsr(cmd->addr.msr.reg, cmd->val, h); ++ rdmsr(cmd->addr.msr.reg, lo, hi); ++ lo = (lo & ~INTEL_MSR_RANGE) | (cmd->val & INTEL_MSR_RANGE); ++ wrmsr(cmd->addr.msr.reg, lo, hi); + break; + case SYSTEM_IO_CAPABLE: + acpi_os_write_port((acpi_io_address)cmd->addr.io.port, +@@ -372,7 +374,6 @@ static int acpi_cpufreq_target(struct cp + struct cpufreq_freqs freqs; + cpumask_t online_policy_cpus; + struct drv_cmd cmd; +- unsigned int msr; + unsigned int next_state = 0; /* Index into freq_table */ + unsigned int next_perf_state = 0; /* Index into perf table */ + unsigned int i; +@@ -417,11 +418,7 @@ static int acpi_cpufreq_target(struct cp + case SYSTEM_INTEL_MSR_CAPABLE: + cmd.type = SYSTEM_INTEL_MSR_CAPABLE; + cmd.addr.msr.reg = MSR_IA32_PERF_CTL; +- msr = +- (u32) perf->states[next_perf_state]. +- control & INTEL_MSR_RANGE; +- cmd.val = get_cur_val(online_policy_cpus); +- cmd.val = (cmd.val & ~INTEL_MSR_RANGE) | msr; ++ cmd.val = (u32) perf->states[next_perf_state].control; + break; + case SYSTEM_IO_CAPABLE: + cmd.type = SYSTEM_IO_CAPABLE; diff --git a/queue-2.6.22/cfq-iosched-fix-async-queue-behaviour.patch b/queue-2.6.22/cfq-iosched-fix-async-queue-behaviour.patch new file mode 100644 index 00000000000..b87f94cb7fc --- /dev/null +++ b/queue-2.6.22/cfq-iosched-fix-async-queue-behaviour.patch @@ -0,0 +1,121 @@ +From stable-bounces@linux.kernel.org Tue Jul 10 14:04:56 2007 +From: Jens Axboe +Date: Tue, 10 Jul 2007 22:11:00 +0200 +Subject: cfq-iosched: fix async queue behaviour +To: stable@kernel.org +Message-ID: <20070710201059.GB4587@kernel.dk> +Content-Disposition: inline + +From: Jens Axboe + +With the cfq_queue hash removal, we inadvertently got rid of the +async queue sharing. This was not intentional, in fact CFQ purposely +shares the async queue per priority level to get good merging for +async writes. + +So put some logic in cfq_get_queue() to track the shared queues. + +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/cfq-iosched.c | 39 ++++++++++++++++++++++++++++++++++++--- + include/linux/ioprio.h | 6 ++++-- + 2 files changed, 40 insertions(+), 5 deletions(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -92,6 +92,8 @@ struct cfq_data { + struct cfq_queue *active_queue; + struct cfq_io_context *active_cic; + ++ struct cfq_queue *async_cfqq[IOPRIO_BE_NR]; ++ + struct timer_list idle_class_timer; + + sector_t last_position; +@@ -1351,8 +1353,8 @@ static void cfq_ioc_set_ioprio(struct io + } + + static struct cfq_queue * +-cfq_get_queue(struct cfq_data *cfqd, int is_sync, struct task_struct *tsk, +- gfp_t gfp_mask) ++cfq_find_alloc_queue(struct cfq_data *cfqd, int is_sync, ++ struct task_struct *tsk, gfp_t gfp_mask) + { + struct cfq_queue *cfqq, *new_cfqq = NULL; + struct cfq_io_context *cic; +@@ -1405,12 +1407,35 @@ retry: + if (new_cfqq) + kmem_cache_free(cfq_pool, new_cfqq); + +- atomic_inc(&cfqq->ref); + out: + WARN_ON((gfp_mask & __GFP_WAIT) && !cfqq); + return cfqq; + } + ++static struct cfq_queue * ++cfq_get_queue(struct cfq_data *cfqd, int is_sync, struct task_struct *tsk, ++ gfp_t gfp_mask) ++{ ++ const int ioprio = task_ioprio(tsk); ++ struct cfq_queue *cfqq = NULL; ++ ++ if (!is_sync) ++ cfqq = cfqd->async_cfqq[ioprio]; ++ if (!cfqq) ++ cfqq = cfq_find_alloc_queue(cfqd, is_sync, tsk, gfp_mask); ++ ++ /* ++ * pin the queue now that it's allocated, scheduler exit will prune it ++ */ ++ if (!is_sync && !cfqd->async_cfqq[ioprio]) { ++ atomic_inc(&cfqq->ref); ++ cfqd->async_cfqq[ioprio] = cfqq; ++ } ++ ++ atomic_inc(&cfqq->ref); ++ return cfqq; ++} ++ + /* + * We drop cfq io contexts lazily, so we may find a dead one. + */ +@@ -2019,6 +2044,7 @@ static void cfq_exit_queue(elevator_t *e + { + struct cfq_data *cfqd = e->elevator_data; + request_queue_t *q = cfqd->queue; ++ int i; + + cfq_shutdown_timer_wq(cfqd); + +@@ -2035,6 +2061,13 @@ static void cfq_exit_queue(elevator_t *e + __cfq_exit_single_io_context(cfqd, cic); + } + ++ /* ++ * Put the async queues ++ */ ++ for (i = 0; i < IOPRIO_BE_NR; i++) ++ if (cfqd->async_cfqq[i]) ++ cfq_put_queue(cfqd->async_cfqq[i]); ++ + spin_unlock_irq(q->queue_lock); + + cfq_shutdown_timer_wq(cfqd); +--- a/include/linux/ioprio.h ++++ b/include/linux/ioprio.h +@@ -47,8 +47,10 @@ enum { + #define IOPRIO_NORM (4) + static inline int task_ioprio(struct task_struct *task) + { +- WARN_ON(!ioprio_valid(task->ioprio)); +- return IOPRIO_PRIO_DATA(task->ioprio); ++ if (ioprio_valid(task->ioprio)) ++ return IOPRIO_PRIO_DATA(task->ioprio); ++ ++ return IOPRIO_NORM; + } + + static inline int task_nice_ioprio(struct task_struct *task) diff --git a/queue-2.6.22/destroy_workqueue-can-livelock.patch b/queue-2.6.22/destroy_workqueue-can-livelock.patch new file mode 100644 index 00000000000..5bcc6ba5b06 --- /dev/null +++ b/queue-2.6.22/destroy_workqueue-can-livelock.patch @@ -0,0 +1,61 @@ +From stable-bounces@linux.kernel.org Tue Jul 17 04:17:35 2007 +From: Oleg Nesterov +Date: Tue, 17 Jul 2007 04:03:55 -0700 +Subject: destroy_workqueue() can livelock +To: torvalds@linux-foundation.org +Cc: vatsa@in.ibm.com, akpm@linux-foundation.org, mschmidt@redhat.com, oleg@tv-sign.ru, stable@kernel.org +Message-ID: <200707171103.l6HB3t59013472@imap1.linux-foundation.org> + + +From: Oleg Nesterov + +Pointed out by Michal Schmidt . + +The bug was introduced in 2.6.22 by me. + +cleanup_workqueue_thread() does flush_cpu_workqueue(cwq) in a loop until +->worklist becomes empty. This is live-lockable, a re-niced caller can get +CPU after wake_up() and insert a new barrier before the lower-priority +cwq->thread has a chance to clear ->current_work. + +Change cleanup_workqueue_thread() to do flush_cpu_workqueue(cwq) only once. + We can rely on the fact that run_workqueue() won't return until it flushes +all works. So it is safe to call kthread_stop() after that, the "should +stop" request won't be noticed until run_workqueue() returns. + +Signed-off-by: Oleg Nesterov +Cc: Michal Schmidt +Cc: Srivatsa Vaddagiri +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/workqueue.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -739,18 +739,17 @@ static void cleanup_workqueue_thread(str + if (cwq->thread == NULL) + return; + ++ flush_cpu_workqueue(cwq); + /* +- * If the caller is CPU_DEAD the single flush_cpu_workqueue() +- * is not enough, a concurrent flush_workqueue() can insert a +- * barrier after us. ++ * If the caller is CPU_DEAD and cwq->worklist was not empty, ++ * a concurrent flush_workqueue() can insert a barrier after us. ++ * However, in that case run_workqueue() won't return and check ++ * kthread_should_stop() until it flushes all work_struct's. + * When ->worklist becomes empty it is safe to exit because no + * more work_structs can be queued on this cwq: flush_workqueue + * checks list_empty(), and a "normal" queue_work() can't use + * a dead CPU. + */ +- while (flush_cpu_workqueue(cwq)) +- ; +- + kthread_stop(cwq->thread); + cwq->thread = NULL; + } diff --git a/queue-2.6.22/do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch b/queue-2.6.22/do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch new file mode 100644 index 00000000000..92ff1bfa2bc --- /dev/null +++ b/queue-2.6.22/do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch @@ -0,0 +1,41 @@ +From stable-bounces@linux.kernel.org Sun Jul 15 23:49:08 2007 +From: Herbert van den Bergh +Date: Sun, 15 Jul 2007 23:38:25 -0700 +Subject: do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY +To: torvalds@linux-foundation.org +Cc: Herbert.van.den.Bergh@oracle.com, akpm@linux-foundation.org, stable@kernel.org, chris.mason@oracle.com, herbert.van.den.bergh@oracle.com +Message-ID: <200707160638.l6G6cP6N014235@imap1.linux-foundation.org> + + +From: Herbert van den Bergh + +Fix a bug in mm/mlock.c on 32-bit architectures that prevents a user from +locking more than 4GB of shared memory, or allocating more than 4GB of +shared memory in hugepages, when rlim[RLIMIT_MEMLOCK] is set to +RLIM_INFINITY. + +Signed-off-by: Herbert van den Bergh +Acked-by: Chris Mason +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mlock.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -244,9 +244,12 @@ int user_shm_lock(size_t size, struct us + + locked = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; + lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur; ++ if (lock_limit == RLIM_INFINITY) ++ allowed = 1; + lock_limit >>= PAGE_SHIFT; + spin_lock(&shmlock_user_lock); +- if (locked + user->locked_shm > lock_limit && !capable(CAP_IPC_LOCK)) ++ if (!allowed && ++ locked + user->locked_shm > lock_limit && !capable(CAP_IPC_LOCK)) + goto out; + get_uid(user); + user->locked_shm += locked; diff --git a/queue-2.6.22/drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch b/queue-2.6.22/drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch new file mode 100644 index 00000000000..3bad80f84a3 --- /dev/null +++ b/queue-2.6.22/drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch @@ -0,0 +1,57 @@ +From stable-bounces@linux.kernel.org Tue Jul 17 04:15:55 2007 +From: Adrian Bunk +Date: Tue, 17 Jul 2007 04:05:53 -0700 +Subject: drivers/video/macmodes.c:mac_find_mode() mustn't be __devinit +To: torvalds@linux-foundation.org +Cc: adaplas@pol.net, akpm@linux-foundation.org, michal.k.k.piotrowski@gmail.com, stable@kernel.org, bunk@stusta.de +Message-ID: <200707171105.l6HB5rQT014210@imap1.linux-foundation.org> + + +From: Adrian Bunk + +If it's EXPORT_SYMBOL'ed it can't be __devinit. + +Reported by Mikael Pettersson. + +Signed-off-by: Adrian Bunk +Cc: "Antonino A. Daplas" +Cc: Michal Piotrowski +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/macmodes.c | 5 ++--- + drivers/video/macmodes.h | 8 ++++---- + 2 files changed, 6 insertions(+), 7 deletions(-) + +--- a/drivers/video/macmodes.c ++++ b/drivers/video/macmodes.c +@@ -369,9 +369,8 @@ EXPORT_SYMBOL(mac_map_monitor_sense); + * + */ + +-int __devinit mac_find_mode(struct fb_var_screeninfo *var, +- struct fb_info *info, const char *mode_option, +- unsigned int default_bpp) ++int mac_find_mode(struct fb_var_screeninfo *var, struct fb_info *info, ++ const char *mode_option, unsigned int default_bpp) + { + const struct fb_videomode *db = NULL; + unsigned int dbsize = 0; +--- a/drivers/video/macmodes.h ++++ b/drivers/video/macmodes.h +@@ -55,10 +55,10 @@ extern int mac_vmode_to_var(int vmode, i + extern int mac_var_to_vmode(const struct fb_var_screeninfo *var, int *vmode, + int *cmode); + extern int mac_map_monitor_sense(int sense); +-extern int __devinit mac_find_mode(struct fb_var_screeninfo *var, +- struct fb_info *info, +- const char *mode_option, +- unsigned int default_bpp); ++extern int mac_find_mode(struct fb_var_screeninfo *var, ++ struct fb_info *info, ++ const char *mode_option, ++ unsigned int default_bpp); + + + /* diff --git a/queue-2.6.22/ecryptfs-ecryptfs_setattr-bugfix.patch b/queue-2.6.22/ecryptfs-ecryptfs_setattr-bugfix.patch new file mode 100644 index 00000000000..e1f22c95ca9 --- /dev/null +++ b/queue-2.6.22/ecryptfs-ecryptfs_setattr-bugfix.patch @@ -0,0 +1,41 @@ +From stable-bounces@linux.kernel.org Thu Jul 19 02:07:34 2007 +From: Michael Halcrow +Date: Thu, 19 Jul 2007 01:47:54 -0700 +Subject: eCryptfs: ecryptfs_setattr() bugfix +To: torvalds@linux-foundation.org +Cc: akpm@linux-foundation.org, mhalcrow@us.ibm.com, stable@kernel.org +Message-ID: <200707190847.l6J8lsEP023004@imap1.linux-foundation.org> + + +From: Michael Halcrow + +There is another bug recently introduced into the ecryptfs_setattr() +function in 2.6.22. eCryptfs will attempt to treat special files like +regular eCryptfs files on chmod, chown, and so forth. This leads to a NULL +pointer dereference. This patch validates that the file is a regular file +before proceeding with operations related to the inode's crypt_stat. + +Thanks to Ryusuke Konishi for finding this bug and suggesting the fix. + +Signed-off-by: Michael Halcrow +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/inode.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -902,8 +902,9 @@ static int ecryptfs_setattr(struct dentr + mutex_lock(&crypt_stat->cs_mutex); + if (S_ISDIR(dentry->d_inode->i_mode)) + crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); +- else if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED) +- || !(crypt_stat->flags & ECRYPTFS_KEY_VALID)) { ++ else if (S_ISREG(dentry->d_inode->i_mode) ++ && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED) ++ || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) { + struct vfsmount *lower_mnt; + struct file *lower_file = NULL; + struct ecryptfs_mount_crypt_stat *mount_crypt_stat; diff --git a/queue-2.6.22/forcedeth-bug-fix-cicada-phy.patch b/queue-2.6.22/forcedeth-bug-fix-cicada-phy.patch new file mode 100644 index 00000000000..268c4a537ec --- /dev/null +++ b/queue-2.6.22/forcedeth-bug-fix-cicada-phy.patch @@ -0,0 +1,68 @@ +From stable-bounces@linux.kernel.org Mon Jul 16 15:39:18 2007 +From: Ayaz Abdulla +Date: Mon, 16 Jul 2007 09:49:51 -0400 +Subject: forcedeth bug fix: cicada phy +To: stable@kernel.org +Message-ID: <469B777F.3000309@nvidia.com> + +From: Ayaz Abdulla + +This patch contains errata fixes for the cicada phy. It only renamed the +defines to be phy specific. + + +Signed-off-by: Ayaz Abdulla +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/forcedeth.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/net/forcedeth.c ++++ b/drivers/net/forcedeth.c +@@ -557,12 +557,12 @@ union ring_type { + #define PHYID2_MODEL_MASK 0x03f0 + #define PHY_MODEL_MARVELL_E3016 0x220 + #define PHY_MARVELL_E3016_INITMASK 0x0300 +-#define PHY_INIT1 0x0f000 +-#define PHY_INIT2 0x0e00 +-#define PHY_INIT3 0x01000 +-#define PHY_INIT4 0x0200 +-#define PHY_INIT5 0x0004 +-#define PHY_INIT6 0x02000 ++#define PHY_CICADA_INIT1 0x0f000 ++#define PHY_CICADA_INIT2 0x0e00 ++#define PHY_CICADA_INIT3 0x01000 ++#define PHY_CICADA_INIT4 0x0200 ++#define PHY_CICADA_INIT5 0x0004 ++#define PHY_CICADA_INIT6 0x02000 + #define PHY_GIGABIT 0x0100 + + #define PHY_TIMEOUT 0x1 +@@ -1141,14 +1141,14 @@ static int phy_init(struct net_device *d + /* phy vendor specific configuration */ + if ((np->phy_oui == PHY_OUI_CICADA) && (phyinterface & PHY_RGMII) ) { + phy_reserved = mii_rw(dev, np->phyaddr, MII_RESV1, MII_READ); +- phy_reserved &= ~(PHY_INIT1 | PHY_INIT2); +- phy_reserved |= (PHY_INIT3 | PHY_INIT4); ++ phy_reserved &= ~(PHY_CICADA_INIT1 | PHY_CICADA_INIT2); ++ phy_reserved |= (PHY_CICADA_INIT3 | PHY_CICADA_INIT4); + if (mii_rw(dev, np->phyaddr, MII_RESV1, phy_reserved)) { + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); + return PHY_ERROR; + } + phy_reserved = mii_rw(dev, np->phyaddr, MII_NCONFIG, MII_READ); +- phy_reserved |= PHY_INIT5; ++ phy_reserved |= PHY_CICADA_INIT5; + if (mii_rw(dev, np->phyaddr, MII_NCONFIG, phy_reserved)) { + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); + return PHY_ERROR; +@@ -1156,7 +1156,7 @@ static int phy_init(struct net_device *d + } + if (np->phy_oui == PHY_OUI_CICADA) { + phy_reserved = mii_rw(dev, np->phyaddr, MII_SREVISION, MII_READ); +- phy_reserved |= PHY_INIT6; ++ phy_reserved |= PHY_CICADA_INIT6; + if (mii_rw(dev, np->phyaddr, MII_SREVISION, phy_reserved)) { + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); + return PHY_ERROR; diff --git a/queue-2.6.22/forcedeth-bug-fix-realtek-phy.patch b/queue-2.6.22/forcedeth-bug-fix-realtek-phy.patch new file mode 100644 index 00000000000..9cb0471982a --- /dev/null +++ b/queue-2.6.22/forcedeth-bug-fix-realtek-phy.patch @@ -0,0 +1,103 @@ +From stable-bounces@linux.kernel.org Mon Jul 16 15:38:04 2007 +From: Ayaz Abdulla +Date: Mon, 16 Jul 2007 09:50:24 -0400 +Subject: forcedeth bug fix: realtek phy +To: stable@kernel.org +Message-ID: <469B77A0.7080206@nvidia.com> + +From: Ayaz Abdulla + +This patch contains errata fixes for the realtek phy. It only renamed the +defines to be phy specific. + +Signed-off-by: Ayaz Abdulla +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/forcedeth.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 54 insertions(+) + +--- a/drivers/net/forcedeth.c ++++ b/drivers/net/forcedeth.c +@@ -551,6 +551,7 @@ union ring_type { + #define PHY_OUI_MARVELL 0x5043 + #define PHY_OUI_CICADA 0x03f1 + #define PHY_OUI_VITESSE 0x01c1 ++#define PHY_OUI_REALTEK 0x01c1 + #define PHYID1_OUI_MASK 0x03ff + #define PHYID1_OUI_SHFT 6 + #define PHYID2_OUI_MASK 0xfc00 +@@ -580,6 +581,13 @@ union ring_type { + #define PHY_VITESSE_INIT8 0x0100 + #define PHY_VITESSE_INIT9 0x8f82 + #define PHY_VITESSE_INIT10 0x0 ++#define PHY_REALTEK_INIT_REG1 0x1f ++#define PHY_REALTEK_INIT_REG2 0x19 ++#define PHY_REALTEK_INIT_REG3 0x13 ++#define PHY_REALTEK_INIT1 0x0000 ++#define PHY_REALTEK_INIT2 0x8e00 ++#define PHY_REALTEK_INIT3 0x0001 ++#define PHY_REALTEK_INIT4 0xad17 + + #define PHY_GIGABIT 0x0100 + +@@ -1114,6 +1122,28 @@ static int phy_init(struct net_device *d + return PHY_ERROR; + } + } ++ if (np->phy_oui == PHY_OUI_REALTEK) { ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ } + + /* set advertise register */ + reg = mii_rw(dev, np->phyaddr, MII_ADVERTISE, MII_READ); +@@ -1250,6 +1280,30 @@ static int phy_init(struct net_device *d + return PHY_ERROR; + } + } ++ if (np->phy_oui == PHY_OUI_REALTEK) { ++ /* reset could have cleared these out, set them back */ ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ } ++ + /* some phys clear out pause advertisment on reset, set it back */ + mii_rw(dev, np->phyaddr, MII_ADVERTISE, reg); + diff --git a/queue-2.6.22/forcedeth-bug-fix-vitesse-phy.patch b/queue-2.6.22/forcedeth-bug-fix-vitesse-phy.patch new file mode 100644 index 00000000000..c990cdd1638 --- /dev/null +++ b/queue-2.6.22/forcedeth-bug-fix-vitesse-phy.patch @@ -0,0 +1,130 @@ +From stable-bounces@linux.kernel.org Mon Jul 16 15:38:04 2007 +From: Ayaz Abdulla +Date: Mon, 16 Jul 2007 09:50:01 -0400 +Subject: forcedeth bug fix: vitesse phy +To: stable@kernel.org +Message-ID: <469B7789.5090703@nvidia.com> + +From: Ayaz Abdulla + +This patch contains errata fixes for the vitesse phy. It only renamed the +defines to be phy specific. + +Signed-off-by: Ayaz Abdulla +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/forcedeth.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 88 insertions(+) + +--- a/drivers/net/forcedeth.c ++++ b/drivers/net/forcedeth.c +@@ -550,6 +550,7 @@ union ring_type { + /* PHY defines */ + #define PHY_OUI_MARVELL 0x5043 + #define PHY_OUI_CICADA 0x03f1 ++#define PHY_OUI_VITESSE 0x01c1 + #define PHYID1_OUI_MASK 0x03ff + #define PHYID1_OUI_SHFT 6 + #define PHYID2_OUI_MASK 0xfc00 +@@ -563,6 +564,23 @@ union ring_type { + #define PHY_CICADA_INIT4 0x0200 + #define PHY_CICADA_INIT5 0x0004 + #define PHY_CICADA_INIT6 0x02000 ++#define PHY_VITESSE_INIT_REG1 0x1f ++#define PHY_VITESSE_INIT_REG2 0x10 ++#define PHY_VITESSE_INIT_REG3 0x11 ++#define PHY_VITESSE_INIT_REG4 0x12 ++#define PHY_VITESSE_INIT_MSK1 0xc ++#define PHY_VITESSE_INIT_MSK2 0x0180 ++#define PHY_VITESSE_INIT1 0x52b5 ++#define PHY_VITESSE_INIT2 0xaf8a ++#define PHY_VITESSE_INIT3 0x8 ++#define PHY_VITESSE_INIT4 0x8f8a ++#define PHY_VITESSE_INIT5 0xaf86 ++#define PHY_VITESSE_INIT6 0x8f86 ++#define PHY_VITESSE_INIT7 0xaf82 ++#define PHY_VITESSE_INIT8 0x0100 ++#define PHY_VITESSE_INIT9 0x8f82 ++#define PHY_VITESSE_INIT10 0x0 ++ + #define PHY_GIGABIT 0x0100 + + #define PHY_TIMEOUT 0x1 +@@ -1162,6 +1180,76 @@ static int phy_init(struct net_device *d + return PHY_ERROR; + } + } ++ if (np->phy_oui == PHY_OUI_VITESSE) { ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT2)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ); ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ); ++ phy_reserved &= ~PHY_VITESSE_INIT_MSK1; ++ phy_reserved |= PHY_VITESSE_INIT3; ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT4)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT5)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ); ++ phy_reserved &= ~PHY_VITESSE_INIT_MSK1; ++ phy_reserved |= PHY_VITESSE_INIT3; ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ); ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT6)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT7)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ); ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ); ++ phy_reserved &= ~PHY_VITESSE_INIT_MSK2; ++ phy_reserved |= PHY_VITESSE_INIT8; ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT9)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT10)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ } + /* some phys clear out pause advertisment on reset, set it back */ + mii_rw(dev, np->phyaddr, MII_ADVERTISE, reg); + diff --git a/queue-2.6.22/fs-9p-conv.c-error-path-fix.patch b/queue-2.6.22/fs-9p-conv.c-error-path-fix.patch new file mode 100644 index 00000000000..560c865f0b9 --- /dev/null +++ b/queue-2.6.22/fs-9p-conv.c-error-path-fix.patch @@ -0,0 +1,33 @@ +From stable-bounces@linux.kernel.org Thu Jul 19 17:27:52 2007 +From: Mariusz Kozlowski +Date: Thu, 19 Jul 2007 17:27:22 -0700 +Subject: fs: 9p/conv.c error path fix +To: stable@kernel.org +Cc: Latchesar Ionkov , Mariusz Kozlowski , Eric Van Hensbergen +Message-ID: <20070719172722.1d4500f1.akpm@linux-foundation.org> + + +From: Mariusz Kozlowski + + +When buf_check_overflow() returns != 0 we will hit kfree(ERR_PTR(err)) +and it will not be happy about it. + +Signed-off-by: Mariusz Kozlowski +Cc: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/9p/conv.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/9p/conv.c ++++ b/fs/9p/conv.c +@@ -742,6 +742,7 @@ struct v9fs_fcall *v9fs_create_twrite(u3 + if (err) { + kfree(fc); + fc = ERR_PTR(err); ++ goto error; + } + + if (buf_check_overflow(bufp)) { diff --git a/queue-2.6.22/hugetlb-fix-race-in-alloc_fresh_huge_page.patch b/queue-2.6.22/hugetlb-fix-race-in-alloc_fresh_huge_page.patch new file mode 100644 index 00000000000..2f85c25f54b --- /dev/null +++ b/queue-2.6.22/hugetlb-fix-race-in-alloc_fresh_huge_page.patch @@ -0,0 +1,49 @@ +From stable-bounces@linux.kernel.org Sun Jul 15 23:48:48 2007 +From: Joe Jin +Date: Sun, 15 Jul 2007 23:38:12 -0700 +Subject: hugetlb: fix race in alloc_fresh_huge_page() +To: torvalds@linux-foundation.org +Cc: akpm@linux-foundation.org, joe.jin@oracle.com, stable@kernel.org, gurudas.pai@oracle.com +Message-ID: <200707160638.l6G6cC01014158@imap1.linux-foundation.org> + + +From: Joe Jin + +That static `nid' index needs locking. Without it we can end up calling +alloc_pages_node() with an illegal node ID and the kernel crashes. + +Acked-by: Gurudas Pai +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -101,13 +101,20 @@ static void free_huge_page(struct page * + + static int alloc_fresh_huge_page(void) + { +- static int nid = 0; ++ static int prev_nid; + struct page *page; +- page = alloc_pages_node(nid, GFP_HIGHUSER|__GFP_COMP|__GFP_NOWARN, +- HUGETLB_PAGE_ORDER); +- nid = next_node(nid, node_online_map); ++ static DEFINE_SPINLOCK(nid_lock); ++ int nid; ++ ++ spin_lock(&nid_lock); ++ nid = next_node(prev_nid, node_online_map); + if (nid == MAX_NUMNODES) + nid = first_node(node_online_map); ++ prev_nid = nid; ++ spin_unlock(&nid_lock); ++ ++ page = alloc_pages_node(nid, GFP_HIGHUSER|__GFP_COMP|__GFP_NOWARN, ++ HUGETLB_PAGE_ORDER); + if (page) { + set_compound_page_dtor(page, free_huge_page); + spin_lock(&hugetlb_lock); diff --git a/queue-2.6.22/ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch b/queue-2.6.22/ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch new file mode 100644 index 00000000000..976193fe123 --- /dev/null +++ b/queue-2.6.22/ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch @@ -0,0 +1,44 @@ +From stable-bounces@linux.kernel.org Sat Aug 4 09:39:55 2007 +From: Stefan Richter +Date: Sat, 4 Aug 2007 18:39:34 +0200 (CEST) +Subject: ieee1394: revert "sbp2: enforce 32bit DMA mapping" +To: stable@kernel.org +Cc: linux-kernel@vger.kernel.org +Message-ID: +Content-Disposition: INLINE + + +From: Stefan Richter + +Revert commit 0555659d63c285ceb7ead3115532e1b71b0f27a7 from 2.6.22-rc1. +The dma_set_mask call somehow failed on a PowerMac G5, PPC64: +http://lkml.org/lkml/2007/8/1/344 + +Should there ever occur a DMA mapping beyond the physical DMA range, a +proper SBP-2 firmware will report transport errors. So let's leave it +at that. + +Same as commit a9c2f18800753c82c45fc13b27bdc148849bdbb2. + +Signed-off-by: Stefan Richter +Tested-by: Olaf Hering +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ieee1394/sbp2.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/ieee1394/sbp2.c ++++ b/drivers/ieee1394/sbp2.c +@@ -774,11 +774,6 @@ static struct sbp2_lu *sbp2_alloc_device + SBP2_ERR("failed to register lower 4GB address range"); + goto failed_alloc; + } +-#else +- if (dma_set_mask(hi->host->device.parent, DMA_32BIT_MASK)) { +- SBP2_ERR("failed to set 4GB DMA mask"); +- goto failed_alloc; +- } + #endif + } + diff --git a/queue-2.6.22/jbd-commit-fix-transaction-dropping.patch b/queue-2.6.22/jbd-commit-fix-transaction-dropping.patch new file mode 100644 index 00000000000..cf3064f98cc --- /dev/null +++ b/queue-2.6.22/jbd-commit-fix-transaction-dropping.patch @@ -0,0 +1,37 @@ +From stable-bounces@linux.kernel.org Sun Jul 15 23:37:47 2007 +From: Jan Kara +Date: Sun, 15 Jul 2007 23:37:18 -0700 +Subject: jbd commit: fix transaction dropping +To: torvalds@linux-foundation.org +Cc: dev@openvz.org, jack@suse.cz, cebbert@redhat.com, akpm@linux-foundation.org, linux-ext4@vger.kernel.org, stable@kernel.org +Message-ID: <200707160637.l6G6bIOv013980@imap1.linux-foundation.org> + + +From: Jan Kara + +We have to check that also the second checkpoint list is non-empty before +dropping the transaction. + +Signed-off-by: Jan Kara +Cc: Chuck Ebbert +Cc: Kirill Korotaev +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd/commit.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/jbd/commit.c ++++ b/fs/jbd/commit.c +@@ -887,7 +887,8 @@ restart_loop: + journal->j_committing_transaction = NULL; + spin_unlock(&journal->j_state_lock); + +- if (commit_transaction->t_checkpoint_list == NULL) { ++ if (commit_transaction->t_checkpoint_list == NULL && ++ commit_transaction->t_checkpoint_io_list == NULL) { + __journal_drop_transaction(journal, commit_transaction); + } else { + if (journal->j_checkpoint_transactions == NULL) { diff --git a/queue-2.6.22/jbd2-commit-fix-transaction-dropping.patch b/queue-2.6.22/jbd2-commit-fix-transaction-dropping.patch new file mode 100644 index 00000000000..530711104ae --- /dev/null +++ b/queue-2.6.22/jbd2-commit-fix-transaction-dropping.patch @@ -0,0 +1,37 @@ +From stable-bounces@linux.kernel.org Sun Jul 15 23:37:38 2007 +From: Jan Kara +Date: Sun, 15 Jul 2007 23:37:20 -0700 +Subject: jbd2 commit: fix transaction dropping +To: torvalds@linux-foundation.org +Cc: dev@openvz.org, jack@suse.cz, cebbert@redhat.com, akpm@linux-foundation.org, linux-ext4@vger.kernel.org, stable@kernel.org +Message-ID: <200707160637.l6G6bKPk013984@imap1.linux-foundation.org> + + +From: Jan Kara + +We have to check that also the second checkpoint list is non-empty before +dropping the transaction. + +Signed-off-by: Jan Kara +Cc: Chuck Ebbert +Cc: Kirill Korotaev +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/commit.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -896,7 +896,8 @@ restart_loop: + journal->j_committing_transaction = NULL; + spin_unlock(&journal->j_state_lock); + +- if (commit_transaction->t_checkpoint_list == NULL) { ++ if (commit_transaction->t_checkpoint_list == NULL && ++ commit_transaction->t_checkpoint_io_list == NULL) { + __jbd2_journal_drop_transaction(journal, commit_transaction); + } else { + if (journal->j_checkpoint_transactions == NULL) { diff --git a/queue-2.6.22/libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch b/queue-2.6.22/libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch new file mode 100644 index 00000000000..3c72f83f394 --- /dev/null +++ b/queue-2.6.22/libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch @@ -0,0 +1,35 @@ +From stable-bounces@linux.kernel.org Tue Jul 10 00:16:33 2007 +From: Tejun Heo +Date: Tue, 10 Jul 2007 16:16:18 +0900 +Subject: libata: add FUJITSU MHV2080BH to NCQ blacklist +To: Jeff Garzik , linux-ide@vger.kernel.org, Serge van Thillo , stable@kernel.org +Message-ID: <20070710071618.GB23568@htj.dyndns.org> +Content-Disposition: inline + + +Please warmly welcome the first member from FUJITSU to the prestigious +NCQ spurious completion club. + +This is reported by Serge Van Thillo in bugzilla bug 8730. + + http://bugzilla.kernel.org/show_bug.cgi?id=8730 + +Signed-off-by: Tejun Heo +Cc: Serge van Thillo +Cc: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -3800,6 +3800,7 @@ static const struct ata_blacklist_entry + { "HTS541612J9SA00", "SBDIC7JP", ATA_HORKAGE_NONCQ, }, + { "Hitachi HTS541616J9SA00", "SB4OC70P", ATA_HORKAGE_NONCQ, }, + { "WDC WD740ADFD-00NLR1", NULL, ATA_HORKAGE_NONCQ, }, ++ { "FUJITSU MHV2080BH", "00840028", ATA_HORKAGE_NONCQ, }, + + /* Devices with NCQ limits */ + diff --git a/queue-2.6.22/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch b/queue-2.6.22/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch new file mode 100644 index 00000000000..35b70abc645 --- /dev/null +++ b/queue-2.6.22/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch @@ -0,0 +1,48 @@ +From stable-bounces@linux.kernel.org Mon Jul 23 18:44:35 2007 +From: J. Bruce Fields +Date: Mon, 23 Jul 2007 18:43:52 -0700 +Subject: nfsd: fix possible oops on re-insertion of rpcsec_gss modules +To: torvalds@linux-foundation.org +Cc: neilb@suse.de, bfields@citi.umich.edu, akinobu.mita@gmail.com, trond.myklebust@fys.uio.no, akpm@linux-foundation.org, stable@kernel.org +Message-ID: <200707240143.l6O1hqkS022398@imap1.linux-foundation.org> + + +From: J. Bruce Fields + +The handling of the re-registration case is wrong here; the "test" that was +returned from auth_domain_lookup will not be used again, so that reference +should be put. And auth_domain_lookup never did anything with "new" in +this case, so we should just clean it up ourself. + +Thanks to Akinobu Mita for bug report, analysis, and testing. + +Cc: Akinobu Mita +Signed-off-by: "J. Bruce Fields" +Cc: Neil Brown +Cc: Trond Myklebust +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/auth_gss/svcauth_gss.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -760,11 +760,12 @@ svcauth_gss_register_pseudoflavor(u32 ps + new->h.flavour = &svcauthops_gss; + new->pseudoflavor = pseudoflavor; + ++ stat = 0; + test = auth_domain_lookup(name, &new->h); +- if (test != &new->h) { /* XXX Duplicate registration? */ +- auth_domain_put(&new->h); +- /* dangling ref-count... */ +- goto out; ++ if (test != &new->h) { /* Duplicate registration */ ++ auth_domain_put(test); ++ kfree(new->h.name); ++ goto out_free_dom; + } + return 0; + diff --git a/queue-2.6.22/nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch b/queue-2.6.22/nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch new file mode 100644 index 00000000000..41f70706821 --- /dev/null +++ b/queue-2.6.22/nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch @@ -0,0 +1,45 @@ +From stable-bounces@linux.kernel.org Thu Jul 19 02:18:50 2007 +From: J. Bruce Fields +Date: Thu, 19 Jul 2007 01:49:18 -0700 +Subject: nfsd: fix possible read-ahead cache and export table corruption +To: torvalds@linux-foundation.org +Cc: neilb@suse.de, stable@kernel.org, akpm@linux-foundation.org, bfields@citi.umich.edu, gnb@melbourne.sgi.com +Message-ID: <200707190849.l6J8nIm4023400@imap1.linux-foundation.org> + + +From: J. Bruce Fields + +The value of nperbucket calculated here is too small--we should be rounding up +instead of down--with the result that the index j in the following loop can +overflow the raparm_hash array. At least in my case, the next thing in memory +turns out to be export_table, so the symptoms I see are crashes caused by the +appearance of four zeroed-out export entries in the first bucket of the hash +table of exports (which were actually entries in the readahead cache, a +pointer to which had been written to the export table in this initialization +code). + +It looks like the bug was probably introduced with commit +fce1456a19f5c08b688c29f00ef90fdfa074c79b ("knfsd: make the readahead params +cache SMP-friendly"). + +Cc: Greg Banks +Signed-off-by: "J. Bruce Fields" +Acked-by: NeilBrown +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/vfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1890,7 +1890,7 @@ nfsd_racache_init(int cache_size) + raparm_hash[i].pb_head = NULL; + spin_lock_init(&raparm_hash[i].pb_lock); + } +- nperbucket = cache_size >> RAPARM_HASH_BITS; ++ nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE); + for (i = 0; i < cache_size - 1; i++) { + if (i % nperbucket == 0) + raparm_hash[j++].pb_head = raparml + i; diff --git a/queue-2.6.22/readahead-min_ra_pages-max_ra_pages-macros.patch b/queue-2.6.22/readahead-min_ra_pages-max_ra_pages-macros.patch new file mode 100644 index 00000000000..8abb595aa0c --- /dev/null +++ b/queue-2.6.22/readahead-min_ra_pages-max_ra_pages-macros.patch @@ -0,0 +1,58 @@ +From stable-bounces@linux.kernel.org Thu Jul 19 02:21:38 2007 +From: Fengguang Wu +Date: Thu, 19 Jul 2007 01:47:58 -0700 +Subject: readahead: MIN_RA_PAGES/MAX_RA_PAGES macros +To: torvalds@linux-foundation.org +Cc: slpratt@austin.ibm.com, rusty@rustcorp.com.au, linuxram@us.ibm.com, wfg@mail.ustc.edu.cn, akpm@linux-foundation.org, stable@kernel.org +Message-ID: <200707190847.l6J8lw9h023020@imap1.linux-foundation.org> + + +From: Fengguang Wu + +Define two convenient macros for read-ahead: + - MAX_RA_PAGES: rounded down counterpart of VM_MAX_READAHEAD + - MIN_RA_PAGES: rounded _up_ counterpart of VM_MIN_READAHEAD + +Note that the rounded up MIN_RA_PAGES will work flawlessly with _large_ +page sizes like 64k. + +Signed-off-by: Fengguang Wu +Cc: Steven Pratt +Cc: Ram Pai +Cc: Rusty Russell +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + mm/readahead.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/mm/readahead.c ++++ b/mm/readahead.c +@@ -21,8 +21,16 @@ void default_unplug_io_fn(struct backing + } + EXPORT_SYMBOL(default_unplug_io_fn); + ++/* ++ * Convienent macros for min/max read-ahead pages. ++ * Note that MAX_RA_PAGES is rounded down, while MIN_RA_PAGES is rounded up. ++ * The latter is necessary for systems with large page size(i.e. 64k). ++ */ ++#define MAX_RA_PAGES (VM_MAX_READAHEAD*1024 / PAGE_CACHE_SIZE) ++#define MIN_RA_PAGES DIV_ROUND_UP(VM_MIN_READAHEAD*1024, PAGE_CACHE_SIZE) ++ + struct backing_dev_info default_backing_dev_info = { +- .ra_pages = (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE, ++ .ra_pages = MAX_RA_PAGES, + .state = 0, + .capabilities = BDI_CAP_MAP_COPY, + .unplug_io_fn = default_unplug_io_fn, +@@ -51,7 +59,7 @@ static inline unsigned long get_max_read + + static inline unsigned long get_min_readahead(struct file_ra_state *ra) + { +- return (VM_MIN_READAHEAD * 1024) / PAGE_CACHE_SIZE; ++ return MIN_RA_PAGES; + } + + static inline void reset_ahead_window(struct file_ra_state *ra) diff --git a/queue-2.6.22/series b/queue-2.6.22/series index 49f05df44da..975741f03ab 100644 --- a/queue-2.6.22/series +++ b/queue-2.6.22/series @@ -46,3 +46,24 @@ dm-io-fix-panic-on-large-request.patch i386-hpet-check-if-the-counter-works.patch fw-ohci-fix-scheduling-while-atomic.patch firewire-fix-memory-leak-of-fw_request-instances.patch +softmac-fix-essid-problem.patch +ecryptfs-ecryptfs_setattr-bugfix.patch +nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch +readahead-min_ra_pages-max_ra_pages-macros.patch +fs-9p-conv.c-error-path-fix.patch +forcedeth-bug-fix-cicada-phy.patch +forcedeth-bug-fix-vitesse-phy.patch +forcedeth-bug-fix-realtek-phy.patch +acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch +jbd-commit-fix-transaction-dropping.patch +jbd2-commit-fix-transaction-dropping.patch +hugetlb-fix-race-in-alloc_fresh_huge_page.patch +do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch +uml-limit-request-size-on-cowed-devices.patch +sony-laptop-fix-bug-in-event-handling.patch +destroy_workqueue-can-livelock.patch +drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch +cfq-iosched-fix-async-queue-behaviour.patch +libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch +ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch +nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch diff --git a/queue-2.6.22/softmac-fix-essid-problem.patch b/queue-2.6.22/softmac-fix-essid-problem.patch new file mode 100644 index 00000000000..ee256d14807 --- /dev/null +++ b/queue-2.6.22/softmac-fix-essid-problem.patch @@ -0,0 +1,40 @@ +From stable-bounces@linux.kernel.org Tue Jul 17 08:47:14 2007 +From: Jean Tourrilhes +Date: Tue, 17 Jul 2007 10:46:33 -0500 +Subject: softmac: Fix ESSID problem +To: stable@kernel.org +Cc: linux-wireless@vger.kernel.org +Message-ID: <469CE459.4070300@lwfinger.net> + + +From: Jean Tourrilhes + +Victor Porton reported that the SoftMAC layer had random problem when setting the ESSID : +http://bugzilla.kernel.org/show_bug.cgi?id=8686 After investigation, it turned out to be +worse, the SoftMAC layer is left in an inconsistent state. The fix is pretty trivial. + +Signed-off-by: Jean Tourrilhes +Acked-by: Michael Buesch +Acked-by: Larry Finger +Acked-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/ieee80211/softmac/ieee80211softmac_assoc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c ++++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c +@@ -271,8 +271,11 @@ ieee80211softmac_assoc_work(struct work_ + */ + dprintk(KERN_INFO PFX "Associate: Scanning for networks first.\n"); + ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify_scan, NULL); +- if (ieee80211softmac_start_scan(mac)) ++ if (ieee80211softmac_start_scan(mac)) { + dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n"); ++ mac->associnfo.associating = 0; ++ mac->associnfo.associated = 0; ++ } + goto out; + } else { + mac->associnfo.associating = 0; diff --git a/queue-2.6.22/sony-laptop-fix-bug-in-event-handling.patch b/queue-2.6.22/sony-laptop-fix-bug-in-event-handling.patch new file mode 100644 index 00000000000..1523ca9f967 --- /dev/null +++ b/queue-2.6.22/sony-laptop-fix-bug-in-event-handling.patch @@ -0,0 +1,89 @@ +From stable-bounces@linux.kernel.org Sun Jul 15 10:45:08 2007 +From: Mattia Dongili +Date: Mon, 16 Jul 2007 02:44:58 +0900 +Subject: sony-laptop: fix bug in event handling +To: stable@kernel.org +Cc: Stelian Pop , Len Brown +Message-ID: <20070715174458.GA22949@inferi.kami.home> +Content-Disposition: inline + +From: Mattia Dongili + +The rewritten event reading code from sonypi was absolutely wrong, +this patche makes things functional for type2 and type1 models. + +Cc: Andrei Paskevich +Signed-off-by: Mattia Dongili +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/sony-laptop.c | 30 ++++++++++++++++++++++-------- + 1 file changed, 22 insertions(+), 8 deletions(-) + +--- a/drivers/misc/sony-laptop.c ++++ b/drivers/misc/sony-laptop.c +@@ -908,7 +908,9 @@ static struct acpi_driver sony_nc_driver + #define SONYPI_DEVICE_TYPE2 0x00000002 + #define SONYPI_DEVICE_TYPE3 0x00000004 + +-#define SONY_PIC_EV_MASK 0xff ++#define SONYPI_TYPE1_OFFSET 0x04 ++#define SONYPI_TYPE2_OFFSET 0x12 ++#define SONYPI_TYPE3_OFFSET 0x12 + + struct sony_pic_ioport { + struct acpi_resource_io io; +@@ -922,6 +924,7 @@ struct sony_pic_irq { + + struct sony_pic_dev { + int model; ++ u16 evport_offset; + u8 camera_power; + u8 bluetooth_power; + u8 wwan_power; +@@ -1998,20 +2001,17 @@ end: + static irqreturn_t sony_pic_irq(int irq, void *dev_id) + { + int i, j; +- u32 port_val = 0; + u8 ev = 0; + u8 data_mask = 0; + u8 device_event = 0; + + struct sony_pic_dev *dev = (struct sony_pic_dev *) dev_id; + +- acpi_os_read_port(dev->cur_ioport->io.minimum, &port_val, +- dev->cur_ioport->io.address_length); +- ev = port_val & SONY_PIC_EV_MASK; +- data_mask = 0xff & (port_val >> (dev->cur_ioport->io.address_length - 8)); ++ ev = inb_p(dev->cur_ioport->io.minimum); ++ data_mask = inb_p(dev->cur_ioport->io.minimum + dev->evport_offset); + +- dprintk("event (0x%.8x [%.2x] [%.2x]) at port 0x%.4x\n", +- port_val, ev, data_mask, dev->cur_ioport->io.minimum); ++ dprintk("event ([%.2x] [%.2x]) at port 0x%.4x(+0x%.2x)\n", ++ ev, data_mask, dev->cur_ioport->io.minimum, dev->evport_offset); + + if (ev == 0x00 || ev == 0xff) + return IRQ_HANDLED; +@@ -2102,6 +2102,20 @@ static int sony_pic_add(struct acpi_devi + spic_dev.model = sony_pic_detect_device_type(); + mutex_init(&spic_dev.lock); + ++ /* model specific characteristics */ ++ switch(spic_dev.model) { ++ case SONYPI_DEVICE_TYPE1: ++ spic_dev.evport_offset = SONYPI_TYPE1_OFFSET; ++ break; ++ case SONYPI_DEVICE_TYPE3: ++ spic_dev.evport_offset = SONYPI_TYPE3_OFFSET; ++ break; ++ case SONYPI_DEVICE_TYPE2: ++ default: ++ spic_dev.evport_offset = SONYPI_TYPE2_OFFSET; ++ break; ++ } ++ + /* read _PRS resources */ + result = sony_pic_possible_resources(device); + if (result) { diff --git a/queue-2.6.22/uml-limit-request-size-on-cowed-devices.patch b/queue-2.6.22/uml-limit-request-size-on-cowed-devices.patch new file mode 100644 index 00000000000..229701249d2 --- /dev/null +++ b/queue-2.6.22/uml-limit-request-size-on-cowed-devices.patch @@ -0,0 +1,37 @@ +From stable-bounces@linux.kernel.org Sun Jul 15 23:49:08 2007 +From: Jeff Dike +Date: Sun, 15 Jul 2007 23:38:58 -0700 +Subject: uml: limit request size on COWed devices +To: torvalds@linux-foundation.org +Cc: akpm@linux-foundation.org, jdike@linux.intel.com, blaisorblade@yahoo.it, jdike@addtoit.com, stable@kernel.org +Message-ID: <200707160638.l6G6cw5e014373@imap1.linux-foundation.org> + + +From: Jeff Dike + +COWed devices can't handle more than 32 (64 on x86_64) sectors in one request +due to the size of the bitmap being carried around in the io_thread_req. + +Enforce that by telling the block layer not to put too many sectors in +requests to COWed devices. + +Signed-off-by: Jeff Dike +Cc: Paolo 'Blaisorblade' Giarrusso +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/drivers/ubd_kern.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -712,6 +712,8 @@ static int ubd_add(int n, char **error_o + ubd_dev->queue->queuedata = ubd_dev; + + blk_queue_max_hw_segments(ubd_dev->queue, MAX_SG); ++ if(ubd_dev->cow.file != NULL) ++ blk_queue_max_sectors(ubd_dev->queue, 8 * sizeof(long)); + err = ubd_disk_register(MAJOR_NR, ubd_dev->size, n, &ubd_gendisk[n]); + if(err){ + *error_out = "Failed to register device";