--- /dev/null
+From 97ae72869e28151235f53f5564b29e74cc5dc18b Mon Sep 17 00:00:00 2001
+From: Andrea Shepard <andrea@persephoneslair.org>
+Date: Sun, 19 Oct 2008 23:33:03 -0700
+Subject: sparc64: Fix race in arch/sparc64/kernel/trampoline.S
+
+From: Andrea Shepard <andrea@persephoneslair.org>
+
+[ Upstream commit e0037df3852b4b60edbe01f70f4968e4a9fdb272 ]
+
+Make arch/sparc64/kernel/trampoline.S in 2.6.27.1 lock prom_entry_lock
+when calling the PROM. This prevents a race condition that I observed
+causing a hang on startup on a 12-CPU E4500.
+
+I am not subscribed to this list, so please CC me on replies.
+
+Signed-off-by: Andrea Shepard <andrea@persephoneslair.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/trampoline.S | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/arch/sparc64/kernel/trampoline.S
++++ b/arch/sparc64/kernel/trampoline.S
+@@ -328,6 +328,12 @@ after_lock_tlb:
+
+ wrpr %g0, 0, %wstate
+
++ sethi %hi(prom_entry_lock), %g2
++1: ldstub [%g2 + %lo(prom_entry_lock)], %g1
++ membar #StoreLoad | #StoreStore
++ brnz,pn %g1, 1b
++ nop
++
+ /* As a hack, put &init_thread_union into %g6.
+ * prom_world() loads from here to restore the %asi
+ * register.
+@@ -337,7 +343,7 @@ after_lock_tlb:
+
+ sethi %hi(is_sun4v), %o0
+ lduw [%o0 + %lo(is_sun4v)], %o0
+- brz,pt %o0, 1f
++ brz,pt %o0, 2f
+ nop
+
+ TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
+@@ -369,10 +375,10 @@ after_lock_tlb:
+ call %o1
+ add %sp, (2047 + 128), %o0
+
+- ba,pt %xcc, 2f
++ ba,pt %xcc, 3f
+ nop
+
+-1: sethi %hi(sparc64_ttable_tl0), %o0
++2: sethi %hi(sparc64_ttable_tl0), %o0
+ set prom_set_trap_table_name, %g2
+ stx %g2, [%sp + 2047 + 128 + 0x00]
+ mov 1, %g2
+@@ -386,7 +392,11 @@ after_lock_tlb:
+ call %o1
+ add %sp, (2047 + 128), %o0
+
+-2: ldx [%l0], %g6
++3: sethi %hi(prom_entry_lock), %g2
++ stb %g0, [%g2 + %lo(prom_entry_lock)]
++ membar #StoreStore | #StoreLoad
++
++ ldx [%l0], %g6
+ ldx [%g6 + TI_TASK], %g4
+
+ mov 1, %g5
--- /dev/null
+From f2315569a93389eaf63bcb8968b00fceaa5ac5d7 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 29 Oct 2008 00:28:12 -0700
+Subject: syncookies: fix inclusion of tcp options in syn-ack
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 8b5f12d04b2e93842f3dda01f029842047bf3f81 ]
+
+David Miller noticed that commit
+33ad798c924b4a1afad3593f2796d465040aadd5 '(tcp: options clean up')
+did not move the req->cookie_ts check.
+This essentially disabled commit 4dfc2817025965a2fc78a18c50f540736a6b5c24
+'[Syncookies]: Add support for TCP options via timestamps.'.
+
+This restores the original logic.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2266,6 +2266,11 @@ struct sk_buff *tcp_make_synack(struct s
+ }
+
+ memset(&opts, 0, sizeof(opts));
++#ifdef CONFIG_SYN_COOKIES
++ if (unlikely(req->cookie_ts))
++ TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
++ else
++#endif
+ TCP_SKB_CB(skb)->when = tcp_time_stamp;
+ tcp_header_size = tcp_synack_options(sk, req,
+ dst_metric(dst, RTAX_ADVMSS),
+@@ -2292,11 +2297,6 @@ struct sk_buff *tcp_make_synack(struct s
+
+ /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
+ th->window = htons(min(req->rcv_wnd, 65535U));
+-#ifdef CONFIG_SYN_COOKIES
+- if (unlikely(req->cookie_ts))
+- TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
+- else
+-#endif
+ tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
+ th->doff = (tcp_header_size >> 2);
+ TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
--- /dev/null
+From 94173babaf430c76ff702118ad404290480f3dcc Mon Sep 17 00:00:00 2001
+From: Kumar Gala <galak@kernel.crashing.org>
+Date: Tue, 21 Oct 2008 22:19:00 -0700
+Subject: math-emu: Fix signalling of underflow and inexact while packing result.
+
+From: Kumar Gala <galak@kernel.crashing.org>
+
+[ Upstream commit 930cc144a043ff95e56b6888fa51c618b33f89e7 ]
+
+I'm trying to move the powerpc math-emu code to use the include/math-emu bits.
+
+In doing so I've been using TestFloat to see how good or bad we are
+doing. For the most part the current math-emu code that PPC uses has
+a number of issues that the code in include/math-emu seems to solve
+(plus bugs we've had for ever that no one every realized).
+
+Anyways, I've come across a case that we are flagging underflow and
+inexact because we think we have a denormalized result from a double
+precision divide:
+
+000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE
+ soft: 001.0000000000000 ..... syst: 001.0000000000000 ...ux
+
+What it looks like is the results out of FP_DIV_D are:
+
+D:
+sign: 0
+mantissa: 01000000 00000000
+exp: -1023 (0)
+
+The problem seems like we aren't normalizing the result and bumping the exp.
+
+Now that I'm digging into this a bit I'm thinking my issue has to do with
+the fix DaveM put in place from back in Aug 2007 (commit
+405849610fd96b4f34cd1875c4c033228fea6c0f):
+
+[MATH-EMU]: Fix underflow exception reporting.
+
+ 2) we ended up rounding back up to normal (this is the case where
+ we set the exponent to 1 and set the fraction to zero), this
+ should set inexact too
+...
+
+ Another example, "0x0.0000000000001p-1022 / 16.0", should signal both
+ inexact and underflow. The cpu implementations and ieee1754
+ literature is very clear about this. This is case #2 above.
+
+Here is the distilled glibc test case from Jakub Jelinek which prompted that
+commit:
+
+--------------------
+#include <float.h>
+#include <fenv.h>
+#include <stdio.h>
+
+volatile double d = DBL_MIN;
+volatile double e = 0x0.0000000000001p-1022;
+volatile double f = 16.0;
+int
+main (void)
+{
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ d /= f;
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ e /= f;
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ return 0;
+}
+--------------------
+
+It looks like the case I have we are exact before rounding, but think it
+looks like the rounding case since it appears as if "overflow is set".
+
+000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE = 001.0000000000000
+
+I think the following adds the check for my case and still works for the
+issue your commit was trying to resolve.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/math-emu/op-common.h | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/include/math-emu/op-common.h
++++ b/include/math-emu/op-common.h
+@@ -139,18 +139,27 @@ do { \
+ if (X##_e <= _FP_WFRACBITS_##fs) \
+ { \
+ _FP_FRAC_SRS_##wc(X, X##_e, _FP_WFRACBITS_##fs); \
+- _FP_ROUND(wc, X); \
+ if (_FP_FRAC_HIGH_##fs(X) \
+ & (_FP_OVERFLOW_##fs >> 1)) \
+ { \
+ X##_e = 1; \
+ _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
+- FP_SET_EXCEPTION(FP_EX_INEXACT); \
+ } \
+ else \
+ { \
+- X##_e = 0; \
+- _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
++ _FP_ROUND(wc, X); \
++ if (_FP_FRAC_HIGH_##fs(X) \
++ & (_FP_OVERFLOW_##fs >> 1)) \
++ { \
++ X##_e = 1; \
++ _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
++ FP_SET_EXCEPTION(FP_EX_INEXACT); \
++ } \
++ else \
++ { \
++ X##_e = 0; \
++ _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
++ } \
+ } \
+ if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
+ (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \
--- /dev/null
+From e5bc56211e3dfb06929ce7cd523ad2d87f2fe4f2 Mon Sep 17 00:00:00 2001
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Date: Thu, 23 Oct 2008 14:06:35 -0700
+Subject: tcp: Restore ordering of TCP options for the sake of inter-operability
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+
+[ Upstream commit fd6149d332973bafa50f03ddb0ea9513e67f4517 ]
+
+This is not our bug! Sadly some devices cannot cope with the change
+of TCP option ordering which was a result of the recent rewrite of
+the option code (not that there was some particular reason steming
+from the rewrite for the reordering) though any ordering of TCP
+options is perfectly legal. Thus we restore the original ordering
+to allow interoperability with/through such broken devices and add
+some warning about this trap. Since the reordering just happened
+without any particular reason, this change shouldn't cost us
+anything.
+
+There are already couple of known failure reports (within close
+proximity of the last release), so the problem might be more
+wide-spread than a single device. And other reports which may
+be due to the same problem though the symptoms were less obvious.
+Analysis of one of the case revealed (with very high probability)
+that sack capability cannot be negotiated as the first option
+(SYN never got a response).
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Reported-by: Aldo Maggi <sentiniate@tiscali.it>
+Tested-by: Aldo Maggi <sentiniate@tiscali.it>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -357,6 +357,17 @@ struct tcp_out_options {
+ __u32 tsval, tsecr; /* need to include OPTION_TS */
+ };
+
++/* Beware: Something in the Internet is very sensitive to the ordering of
++ * TCP options, we learned this through the hard way, so be careful here.
++ * Luckily we can at least blame others for their non-compliance but from
++ * inter-operatibility perspective it seems that we're somewhat stuck with
++ * the ordering which we have been using if we want to keep working with
++ * those broken things (not that it currently hurts anybody as there isn't
++ * particular reason why the ordering would need to be changed).
++ *
++ * At least SACK_PERM as the first option is known to lead to a disaster
++ * (but it may well be that other scenarios fail similarly).
++ */
+ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
+ const struct tcp_out_options *opts,
+ __u8 **md5_hash) {
+@@ -371,6 +382,12 @@ static void tcp_options_write(__be32 *pt
+ *md5_hash = NULL;
+ }
+
++ if (unlikely(opts->mss)) {
++ *ptr++ = htonl((TCPOPT_MSS << 24) |
++ (TCPOLEN_MSS << 16) |
++ opts->mss);
++ }
++
+ if (likely(OPTION_TS & opts->options)) {
+ if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) {
+ *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
+@@ -387,12 +404,6 @@ static void tcp_options_write(__be32 *pt
+ *ptr++ = htonl(opts->tsecr);
+ }
+
+- if (unlikely(opts->mss)) {
+- *ptr++ = htonl((TCPOPT_MSS << 24) |
+- (TCPOLEN_MSS << 16) |
+- opts->mss);
+- }
+-
+ if (unlikely(OPTION_SACK_ADVERTISE & opts->options &&
+ !(OPTION_TS & opts->options))) {
+ *ptr++ = htonl((TCPOPT_NOP << 24) |
--- /dev/null
+From 3f38c6ec1cf177b95bcdf02e17d6ddeeac048bad Mon Sep 17 00:00:00 2001
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Date: Wed, 8 Oct 2008 14:36:33 -0700
+Subject: tcpv6: fix option space offsets with md5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+
+[ Upstream commit 53b125779fb0b29e5b316bf3dc7d199e6dcea567 ]
+
+More breakage :-), part of timestamps just were previously
+overwritten.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/tcp_ipv6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1087,7 +1087,7 @@ static void tcp_v6_send_ack(struct sk_bu
+ *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
+ (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
+ *topt++ = htonl(tcp_time_stamp);
+- *topt = htonl(ts);
++ *topt++ = htonl(ts);
+ }
+
+ #ifdef CONFIG_TCP_MD5SIG
--- /dev/null
+From 93ed2b025ba5049e39d0aa3f7d2453418c85b9e9 Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Sun, 19 Oct 2008 23:37:47 -0700
+Subject: pkt_sched: sch_generic: Fix oops in sch_teql
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+[ Upstream commit 9f3ffae0dbce491a3e9871b686342fd5aa854f05 ]
+
+After these commands:
+# modprobe sch_teql
+# tc qdisc add dev eth0 root teql0
+# tc qdisc del dev eth0 root
+we get an oops in teql_destroy() when spin_lock is taken from a null
+qdisc_sleeping pointer. It's because at the moment teql0 dev haven't
+been activated yet, and a qdisc_root_sleeping() is pointing to noop
+qdisc's netdev_queue with qdisc_sleeping uninitialized. This patch
+fixes this both for noop and noqueue netdev_queues to avoid similar
+problems in the future.
+
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/sch_generic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -319,6 +319,7 @@ struct Qdisc_ops noop_qdisc_ops __read_m
+
+ static struct netdev_queue noop_netdev_queue = {
+ .qdisc = &noop_qdisc,
++ .qdisc_sleeping = &noop_qdisc,
+ };
+
+ struct Qdisc noop_qdisc = {
+@@ -344,6 +345,7 @@ static struct Qdisc_ops noqueue_qdisc_op
+ static struct Qdisc noqueue_qdisc;
+ static struct netdev_queue noqueue_netdev_queue = {
+ .qdisc = &noqueue_qdisc,
++ .qdisc_sleeping = &noqueue_qdisc,
+ };
+
+ static struct Qdisc noqueue_qdisc = {
--- /dev/null
+From f667fdbbbea8bcce6cf9f7acb51b7cb4c264cc61 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 20 Oct 2008 13:11:56 +0900
+Subject: [PATCH] libata: initialize port_task when !CONFIG_ATA_SFF
+
+From: Tejun Heo <tj@kernel.org>
+
+commit f667fdbbbea8bcce6cf9f7acb51b7cb4c264cc61 upstream
+
+ap->port_task was not initialized if !CONFIG_ATA_SFF later triggering
+lockdep warning. Make sure it's initialized.
+
+Reported by Larry Finger.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5259,6 +5259,8 @@ struct ata_port *ata_port_alloc(struct a
+
+ #ifdef CONFIG_ATA_SFF
+ INIT_DELAYED_WORK(&ap->port_task, ata_pio_task);
++#else
++ INIT_DELAYED_WORK(&ap->port_task, NULL);
+ #endif
+ INIT_DELAYED_WORK(&ap->hotplug_task, ata_scsi_hotplug);
+ INIT_WORK(&ap->scsi_rescan_task, ata_scsi_dev_rescan);
--- /dev/null
+From 022b7024d4bb1f9a2f30021a2672a0f940ebfa7a Mon Sep 17 00:00:00 2001
+From: Dan Nicholson <dbn.lists@gmail.com>
+Date: Fri, 17 Oct 2008 11:29:46 +0200
+Subject: Revert "HID: Invert HWHEEL mappings for some Logitech mice"
+
+From: Dan Nicholson <dbn.lists@gmail.com>
+
+commit 022b7024d4bb1f9a2f30021a2672a0f940ebfa7a upstream.
+
+This reverts commit 740f370dc61dc478d891d7d47660bb3ae39ddb4f.
+
+It turned out to be correct in the first place: a positive value should
+be sent when the wheel is moved to the right, and a negative value when
+moved to the left. This is the behavior expected by the Xorg evdev
+driver. I must have had a remapping somewhere else in my system when
+originally testing this. Testing on another system shows that the
+unpatched kernel is correct.
+
+Here is a bug report from Mandriva that brought the problem to my
+attention:
+
+ https://qa.mandriva.com/show_bug.cgi?id=44309#c19
+
+Signed-off-by: Dan Nicholson <dbn.lists@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/usbhid/hid-quirks.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -247,8 +247,6 @@
+ #define USB_DEVICE_ID_LD_MACHINETEST 0x2040
+
+ #define USB_VENDOR_ID_LOGITECH 0x046d
+-#define USB_DEVICE_ID_LOGITECH_LX3 0xc044
+-#define USB_DEVICE_ID_LOGITECH_V150 0xc047
+ #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
+ #define USB_DEVICE_ID_LOGITECH_HARMONY 0xc110
+ #define USB_DEVICE_ID_LOGITECH_HARMONY_2 0xc111
+@@ -603,8 +601,6 @@ static const struct hid_blacklist {
+
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
+- { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_LX3, HID_QUIRK_INVERT_HWHEEL },
+- { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_V150, HID_QUIRK_INVERT_HWHEEL },
+
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K, HID_QUIRK_MICROSOFT_KEYS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K, HID_QUIRK_MICROSOFT_KEYS },
x86-fix-dev-mem-mmap-breakage-when-pat-is-disabled.patch
atl1-fix-vlan-tag-regression.patch
libertas-fix-buffer-overrun.patch
+revert-hid-invert-hwheel-mappings-for-some-logitech-mice.patch
+libata-initialize-port_task-when-config_ata_sff.patch
+0001-syncookies-fix-inclusion-of-tcp-options-in-syn-ack.patch
+0002-tcp-Restore-ordering-of-TCP-options-for-the-sake-of.patch
+0003-tcpv6-fix-option-space-offsets-with-md5.patch
+0004-pkt_sched-sch_generic-Fix-oops-in-sch_teql.patch
+0001-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch
+0002-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
