From: Greg Kroah-Hartman Date: Tue, 15 Jan 2008 20:13:36 +0000 (-0800) Subject: 2.6.22 patches added X-Git-Tag: v2.6.22.19~61 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bdd0535cc037256f051e4cc10f73052c34edf61b;p=thirdparty%2Fkernel%2Fstable-queue.git 2.6.22 patches added --- diff --git a/queue-2.6.22/acpica-fix-acpi-cpufreq-boot-crash-due-to-_psd-return-by-reference.patch b/queue-2.6.22/acpica-fix-acpi-cpufreq-boot-crash-due-to-_psd-return-by-reference.patch new file mode 100644 index 00000000000..b8cf453e276 --- /dev/null +++ b/queue-2.6.22/acpica-fix-acpi-cpufreq-boot-crash-due-to-_psd-return-by-reference.patch @@ -0,0 +1,151 @@ +From stable-bounces@linux.kernel.org Wed Dec 5 20:42:26 2007 +From: Bob Moore +Date: Wed, 5 Dec 2007 23:42:10 -0500 +Subject: ACPICA: fix acpi-cpufreq boot crash due to _PSD return-by-reference +To: stable@kernel.org +Cc: linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, Adrian Bunk +Message-ID: <200712052342.10986.lenb@kernel.org> +Content-Disposition: inline + + +From: Bob Moore + +patch 152c300d007c70c4a1847dad39ecdaba22e7d457 in mainline. + +Changed resolution of named references in packages + +Fixed a problem with the Package operator where all named +references were created as object references and left otherwise +unresolved. According to the ACPI specification, a Package can +only contain Data Objects or references to control methods. The +implication is that named references to Data Objects (Integer, +Buffer, String, Package, BufferField, Field) should be resolved +immediately upon package creation. This is the approach taken +with this change. References to all other named objects (Methods, +Devices, Scopes, etc.) are all now properly created as reference objects. + +http://bugzilla.kernel.org/show_bug.cgi?id=5328 +http://bugzilla.kernel.org/show_bug.cgi?id=9429 + +Signed-off-by: Bob Moore +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/dispatcher/dsobject.c | 91 ++++++++++++++++++++++++++++++++++--- + 1 file changed, 85 insertions(+), 6 deletions(-) + +--- a/drivers/acpi/dispatcher/dsobject.c ++++ b/drivers/acpi/dispatcher/dsobject.c +@@ -137,6 +137,71 @@ acpi_ds_build_internal_object(struct acp + return_ACPI_STATUS(status); + } + } ++ ++ /* Special object resolution for elements of a package */ ++ ++ if ((op->common.parent->common.aml_opcode == AML_PACKAGE_OP) || ++ (op->common.parent->common.aml_opcode == ++ AML_VAR_PACKAGE_OP)) { ++ /* ++ * Attempt to resolve the node to a value before we insert it into ++ * the package. If this is a reference to a common data type, ++ * resolve it immediately. According to the ACPI spec, package ++ * elements can only be "data objects" or method references. ++ * Attempt to resolve to an Integer, Buffer, String or Package. ++ * If cannot, return the named reference (for things like Devices, ++ * Methods, etc.) Buffer Fields and Fields will resolve to simple ++ * objects (int/buf/str/pkg). ++ * ++ * NOTE: References to things like Devices, Methods, Mutexes, etc. ++ * will remain as named references. This behavior is not described ++ * in the ACPI spec, but it appears to be an oversight. ++ */ ++ obj_desc = (union acpi_operand_object *)op->common.node; ++ ++ status = ++ acpi_ex_resolve_node_to_value(ACPI_CAST_INDIRECT_PTR ++ (struct ++ acpi_namespace_node, ++ &obj_desc), ++ walk_state); ++ if (ACPI_FAILURE(status)) { ++ return_ACPI_STATUS(status); ++ } ++ ++ switch (op->common.node->type) { ++ /* ++ * For these types, we need the actual node, not the subobject. ++ * However, the subobject got an extra reference count above. ++ */ ++ case ACPI_TYPE_MUTEX: ++ case ACPI_TYPE_METHOD: ++ case ACPI_TYPE_POWER: ++ case ACPI_TYPE_PROCESSOR: ++ case ACPI_TYPE_EVENT: ++ case ACPI_TYPE_REGION: ++ case ACPI_TYPE_DEVICE: ++ case ACPI_TYPE_THERMAL: ++ ++ obj_desc = ++ (union acpi_operand_object *)op->common. ++ node; ++ break; ++ ++ default: ++ break; ++ } ++ ++ /* ++ * If above resolved to an operand object, we are done. Otherwise, ++ * we have a NS node, we must create the package entry as a named ++ * reference. ++ */ ++ if (ACPI_GET_DESCRIPTOR_TYPE(obj_desc) != ++ ACPI_DESC_TYPE_NAMED) { ++ goto exit; ++ } ++ } + } + + /* Create and init a new internal ACPI object */ +@@ -156,6 +221,7 @@ acpi_ds_build_internal_object(struct acp + return_ACPI_STATUS(status); + } + ++ exit: + *obj_desc_ptr = obj_desc; + return_ACPI_STATUS(AE_OK); + } +@@ -356,12 +422,25 @@ acpi_ds_build_internal_package_obj(struc + arg = arg->common.next; + for (i = 0; arg && (i < element_count); i++) { + if (arg->common.aml_opcode == AML_INT_RETURN_VALUE_OP) { +- +- /* This package element is already built, just get it */ +- +- obj_desc->package.elements[i] = +- ACPI_CAST_PTR(union acpi_operand_object, +- arg->common.node); ++ if (arg->common.node->type == ACPI_TYPE_METHOD) { ++ /* ++ * A method reference "looks" to the parser to be a method ++ * invocation, so we special case it here ++ */ ++ arg->common.aml_opcode = AML_INT_NAMEPATH_OP; ++ status = ++ acpi_ds_build_internal_object(walk_state, ++ arg, ++ &obj_desc-> ++ package. ++ elements[i]); ++ } else { ++ /* This package element is already built, just get it */ ++ ++ obj_desc->package.elements[i] = ++ ACPI_CAST_PTR(union acpi_operand_object, ++ arg->common.node); ++ } + } else { + status = acpi_ds_build_internal_object(walk_state, arg, + &obj_desc-> diff --git a/queue-2.6.22/cassini_1.patch b/queue-2.6.22/cassini_1.patch new file mode 100644 index 00000000000..9fefaef2a6d --- /dev/null +++ b/queue-2.6.22/cassini_1.patch @@ -0,0 +1,110 @@ +From stable-bounces@linux.kernel.org Fri Jan 11 01:38:55 2008 +Date: Fri, 11 Jan 2008 01:38:38 -0800 (PST) +From: Al Viro +Subject: CASSINI: Fix endianness bug. +Message-ID: <20080111.013838.267004233.davem@davemloft.net> + +From: Al Viro + +[ Upstream commit: e5e025401f6e926c1d9dc3f3f2813cf98a2d8708 ] + +Here's proposed fix for RX checksum handling in cassini; it affects +little-endian working with half-duplex gigabit, but obviously needs +testing on big-endian too. + +The problem is, we need to convert checksum to fixed-endian *before* +correcting for (unstripped) FCS. On big-endian it won't matter +(conversion is no-op), on little-endian it will, but only if FCS is +not stripped by hardware; i.e. in half-duplex gigabit mode when +->crc_size is set. + +cassini.c part is that fix, cassini.h one consists of trivial +endianness annotations. With that applied the sucker is endian-clean, +according to sparse. + +Signed-off-by: Al Viro +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/cassini.c | 8 +++++--- + drivers/net/cassini.h | 18 +++++++++--------- + 2 files changed, 14 insertions(+), 12 deletions(-) + +--- a/drivers/net/cassini.c ++++ b/drivers/net/cassini.c +@@ -1979,6 +1979,7 @@ static int cas_rx_process_pkt(struct cas + struct cas_page *page; + struct sk_buff *skb; + void *addr, *crcaddr; ++ __sum16 csum; + char *p; + + hlen = CAS_VAL(RX_COMP2_HDR_SIZE, words[1]); +@@ -2158,14 +2159,15 @@ end_copy_pkt: + skb_put(skb, alloclen); + } + +- i = CAS_VAL(RX_COMP4_TCP_CSUM, words[3]); ++ csum = (__force __sum16)htons(CAS_VAL(RX_COMP4_TCP_CSUM, words[3])); + if (cp->crc_size) { + /* checksum includes FCS. strip it out. */ +- i = csum_fold(csum_partial(crcaddr, cp->crc_size, i)); ++ csum = csum_fold(csum_partial(crcaddr, cp->crc_size, ++ csum_unfold(csum))); + if (addr) + cas_page_unmap(addr); + } +- skb->csum = ntohs(i ^ 0xffff); ++ skb->csum = csum_unfold(~csum); + skb->ip_summed = CHECKSUM_COMPLETE; + skb->protocol = eth_type_trans(skb, cp->dev); + return len; +--- a/drivers/net/cassini.h ++++ b/drivers/net/cassini.h +@@ -4122,8 +4122,8 @@ cas_saturn_patch_t cas_saturn_patch[] = + inserted into + outgoing frame. */ + struct cas_tx_desc { +- u64 control; +- u64 buffer; ++ __le64 control; ++ __le64 buffer; + }; + + /* descriptor ring for free buffers contains page-sized buffers. the index +@@ -4131,8 +4131,8 @@ struct cas_tx_desc { + * the completion ring. + */ + struct cas_rx_desc { +- u64 index; +- u64 buffer; ++ __le64 index; ++ __le64 buffer; + }; + + /* received packets are put on the completion ring. */ +@@ -4210,10 +4210,10 @@ struct cas_rx_desc { + #define RX_INDEX_RELEASE 0x0000000000002000ULL + + struct cas_rx_comp { +- u64 word1; +- u64 word2; +- u64 word3; +- u64 word4; ++ __le64 word1; ++ __le64 word2; ++ __le64 word3; ++ __le64 word4; + }; + + enum link_state { +@@ -4252,7 +4252,7 @@ struct cas_init_block { + struct cas_rx_comp rxcs[N_RX_COMP_RINGS][INIT_BLOCK_RX_COMP]; + struct cas_rx_desc rxds[N_RX_DESC_RINGS][INIT_BLOCK_RX_DESC]; + struct cas_tx_desc txds[N_TX_RINGS][INIT_BLOCK_TX]; +- u64 tx_compwb; ++ __le64 tx_compwb; + }; + + /* tiny buffers to deal with target abort issue. we allocate a bit diff --git a/queue-2.6.22/cassini_2.patch b/queue-2.6.22/cassini_2.patch new file mode 100644 index 00000000000..961413673bd --- /dev/null +++ b/queue-2.6.22/cassini_2.patch @@ -0,0 +1,129 @@ +From stable-bounces@linux.kernel.org Fri Jan 11 01:38:55 2008 +Date: Fri, 11 Jan 2008 01:38:38 -0800 (PST) +From: David Miller +Subject: CASSINI: Revert 'dont touch page_count'. +Message-ID: <20080111.013838.267004233.davem@davemloft.net> + +From: David Miller + +[ Upstream commit: 9de4dfb4c7176e5bb232a21cdd8df78da2b15cac ] + +This reverts changeset fa4f0774d7c6cccb4d1fda76b91dd8eddcb2dd6a +([CASSINI]: dont touch page_count) because it breaks the driver. + +The local page counting added by this changeset did not account +for the asynchronous page count changes done by kfree_skb() +and friends. + +The change adds extra atomics and on top of it all appears to be +totally unnecessary as well. + +Signed-off-by: David S. Miller +Acked-by: Nick Piggin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/cassini.c | 36 ++++-------------------------------- + 1 file changed, 4 insertions(+), 32 deletions(-) + +--- a/drivers/net/cassini.c ++++ b/drivers/net/cassini.c +@@ -336,30 +336,6 @@ static inline void cas_mask_intr(struct + cas_disable_irq(cp, i); + } + +-static inline void cas_buffer_init(cas_page_t *cp) +-{ +- struct page *page = cp->buffer; +- atomic_set((atomic_t *)&page->lru.next, 1); +-} +- +-static inline int cas_buffer_count(cas_page_t *cp) +-{ +- struct page *page = cp->buffer; +- return atomic_read((atomic_t *)&page->lru.next); +-} +- +-static inline void cas_buffer_inc(cas_page_t *cp) +-{ +- struct page *page = cp->buffer; +- atomic_inc((atomic_t *)&page->lru.next); +-} +- +-static inline void cas_buffer_dec(cas_page_t *cp) +-{ +- struct page *page = cp->buffer; +- atomic_dec((atomic_t *)&page->lru.next); +-} +- + static void cas_enable_irq(struct cas *cp, const int ring) + { + if (ring == 0) { /* all but TX_DONE */ +@@ -497,7 +473,6 @@ static int cas_page_free(struct cas *cp, + { + pci_unmap_page(cp->pdev, page->dma_addr, cp->page_size, + PCI_DMA_FROMDEVICE); +- cas_buffer_dec(page); + __free_pages(page->buffer, cp->page_order); + kfree(page); + return 0; +@@ -527,7 +502,6 @@ static cas_page_t *cas_page_alloc(struct + page->buffer = alloc_pages(flags, cp->page_order); + if (!page->buffer) + goto page_err; +- cas_buffer_init(page); + page->dma_addr = pci_map_page(cp->pdev, page->buffer, 0, + cp->page_size, PCI_DMA_FROMDEVICE); + return page; +@@ -606,7 +580,7 @@ static void cas_spare_recover(struct cas + list_for_each_safe(elem, tmp, &list) { + cas_page_t *page = list_entry(elem, cas_page_t, list); + +- if (cas_buffer_count(page) > 1) ++ if (page_count(page->buffer) > 1) + continue; + + list_del(elem); +@@ -1374,7 +1348,7 @@ static inline cas_page_t *cas_page_spare + cas_page_t *page = cp->rx_pages[1][index]; + cas_page_t *new; + +- if (cas_buffer_count(page) == 1) ++ if (page_count(page->buffer) == 1) + return page; + + new = cas_page_dequeue(cp); +@@ -1394,7 +1368,7 @@ static cas_page_t *cas_page_swap(struct + cas_page_t **page1 = cp->rx_pages[1]; + + /* swap if buffer is in use */ +- if (cas_buffer_count(page0[index]) > 1) { ++ if (page_count(page0[index]->buffer) > 1) { + cas_page_t *new = cas_page_spare(cp, index); + if (new) { + page1[index] = page0[index]; +@@ -2066,7 +2040,6 @@ static int cas_rx_process_pkt(struct cas + skb->len += hlen - swivel; + + get_page(page->buffer); +- cas_buffer_inc(page); + frag->page = page->buffer; + frag->page_offset = off; + frag->size = hlen - swivel; +@@ -2091,7 +2064,6 @@ static int cas_rx_process_pkt(struct cas + frag++; + + get_page(page->buffer); +- cas_buffer_inc(page); + frag->page = page->buffer; + frag->page_offset = 0; + frag->size = hlen; +@@ -2255,7 +2227,7 @@ static int cas_post_rxds_ringN(struct ca + released = 0; + while (entry != last) { + /* make a new buffer if it's still in use */ +- if (cas_buffer_count(page[entry]) > 1) { ++ if (page_count(page[entry]->buffer) > 1) { + cas_page_t *new = cas_page_dequeue(cp); + if (!new) { + /* let the timer know that we need to diff --git a/queue-2.6.22/cassini_3.patch b/queue-2.6.22/cassini_3.patch new file mode 100644 index 00000000000..a9a5d7761b8 --- /dev/null +++ b/queue-2.6.22/cassini_3.patch @@ -0,0 +1,30 @@ +From stable-bounces@linux.kernel.org Fri Jan 11 01:38:55 2008 +Date: Fri, 11 Jan 2008 01:38:38 -0800 (PST) +From: David Miller +Subject: CASSINI: Set skb->truesize properly on receive packets. +Message-ID: <20080111.013838.267004233.davem@davemloft.net> + +From: David Miller + +[ Upstream commit: d011a231675b240157a3c335dd53e9b849d7d30d ] + +skb->truesize was not being incremented at all to +reflect the page based data added to RX SKBs. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/cassini.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/cassini.c ++++ b/drivers/net/cassini.c +@@ -2037,6 +2037,7 @@ static int cas_rx_process_pkt(struct cas + + skb_shinfo(skb)->nr_frags++; + skb->data_len += hlen - swivel; ++ skb->truesize += hlen - swivel; + skb->len += hlen - swivel; + + get_page(page->buffer); diff --git a/queue-2.6.22/series b/queue-2.6.22/series index afe062b6436..a9ed927e383 100644 --- a/queue-2.6.22/series +++ b/queue-2.6.22/series @@ -14,3 +14,7 @@ fix-sparc64-cpu-cross-call-hangs.patch connector-don-t-touch-queue-dev-after-decrement-of-ref-count.patch atm-delay-irq-setup-until-card-is-configured.patch atm-check-ip-header-validity-in-mpc_send_packet.patch +cassini_1.patch +cassini_2.patch +cassini_3.patch +acpica-fix-acpi-cpufreq-boot-crash-due-to-_psd-return-by-reference.patch