From: Greg Kroah-Hartman Date: Thu, 14 Apr 2011 23:41:19 +0000 (-0700) Subject: .38 patches X-Git-Tag: v2.6.38.4~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=be392078021180cab8d77daf31d7a0af97f78a59;p=thirdparty%2Fkernel%2Fstable-queue.git .38 patches --- diff --git a/queue-2.6.38/bridge-fix-possibly-wrong-mld-queries-ethernet-source-address.patch b/queue-2.6.38/bridge-fix-possibly-wrong-mld-queries-ethernet-source-address.patch new file mode 100644 index 00000000000..206849811ab --- /dev/null +++ b/queue-2.6.38/bridge-fix-possibly-wrong-mld-queries-ethernet-source-address.patch @@ -0,0 +1,39 @@ +From 30ae9139dc3b44d14a56fbbc2a3f8f63aa586a17 Mon Sep 17 00:00:00 2001 +From: Linus Lüssing +Date: Tue, 22 Mar 2011 11:40:32 +0000 +Subject: bridge: Fix possibly wrong MLD queries' ethernet source address + + +From: Linus Lüssing + +[ Upstream commit a7bff75b087e7a355838a32efe61707cfa73c194 ] + +The ipv6_dev_get_saddr() is currently called with an uninitialized +destination address. Although in tests it usually seemed to nevertheless +always fetch the right source address, there seems to be a possible race +condition. + +Therefore this commit changes this, first setting the destination +address and only after that fetching the source address. + +Reported-by: Jan Beulich +Signed-off-by: Linus Lüssing +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_multicast.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -445,9 +445,9 @@ static struct sk_buff *br_ip6_multicast_ + ip6h->payload_len = htons(8 + sizeof(*mldq)); + ip6h->nexthdr = IPPROTO_HOPOPTS; + ip6h->hop_limit = 1; ++ ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1)); + ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, + &ip6h->saddr); +- ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1)); + ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); + + hopopt = (u8 *)(ip6h + 1); diff --git a/queue-2.6.38/bridge-reset-ipcb-when-entering-ip-stack-on-nf_forward.patch b/queue-2.6.38/bridge-reset-ipcb-when-entering-ip-stack-on-nf_forward.patch new file mode 100644 index 00000000000..395da7495bc --- /dev/null +++ b/queue-2.6.38/bridge-reset-ipcb-when-entering-ip-stack-on-nf_forward.patch @@ -0,0 +1,39 @@ +From 0589d1f7a527e5f4c4c6d16b734cfed4e3608f1c Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 18 Mar 2011 05:27:28 +0000 +Subject: bridge: Reset IPCB when entering IP stack on NF_FORWARD + + +From: Herbert Xu + +[ Upstream commit 6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e ] + +Whenever we enter the IP stack proper from bridge netfilter we +need to ensure that the skb is in a form the IP stack expects +it to be in. + +The entry point on NF_FORWARD did not meet the requirements of +the IP stack, therefore leading to potential crashes/panics. + +This patch fixes the problem. + +Signed-off-by: Herbert Xu +Acked-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_netfilter.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bridge/br_netfilter.c ++++ b/net/bridge/br_netfilter.c +@@ -741,6 +741,9 @@ static unsigned int br_nf_forward_ip(uns + nf_bridge->mask |= BRNF_PKT_TYPE; + } + ++ if (br_parse_ip_options(skb)) ++ return NF_DROP; ++ + /* The physdev module checks on this */ + nf_bridge->mask |= BRNF_BRIDGED; + nf_bridge->physoutdev = skb->dev; diff --git a/queue-2.6.38/fib-add-rtnl-locking-in-ip_fib_net_exit.patch b/queue-2.6.38/fib-add-rtnl-locking-in-ip_fib_net_exit.patch new file mode 100644 index 00000000000..6512487a740 --- /dev/null +++ b/queue-2.6.38/fib-add-rtnl-locking-in-ip_fib_net_exit.patch @@ -0,0 +1,39 @@ +From 228f4d04e7d7a239b4c44e6f329aaec88f40e54a Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 30 Mar 2011 16:57:46 -0700 +Subject: fib: add rtnl locking in ip_fib_net_exit + + +From: Eric Dumazet + +[ Upstream commit e2666f84958adb3a034b98e99699b55705117e01 ] + +Daniel J Blueman reported a lockdep splat in trie_firstleaf(), caused by +RTNL being not locked before a call to fib_table_flush() + +Reported-by: Daniel J Blueman +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/fib_frontend.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1041,6 +1041,7 @@ static void ip_fib_net_exit(struct net * + fib4_rules_exit(net); + #endif + ++ rtnl_lock(); + for (i = 0; i < FIB_TABLE_HASHSZ; i++) { + struct fib_table *tb; + struct hlist_head *head; +@@ -1053,6 +1054,7 @@ static void ip_fib_net_exit(struct net * + fib_free_table(tb); + } + } ++ rtnl_unlock(); + kfree(net->ipv4.fib_table_hash); + } + diff --git a/queue-2.6.38/gianfar-fall-back-to-software-tcp-udp-checksum-on-older-controllers.patch b/queue-2.6.38/gianfar-fall-back-to-software-tcp-udp-checksum-on-older-controllers.patch new file mode 100644 index 00000000000..eeb2cd71f80 --- /dev/null +++ b/queue-2.6.38/gianfar-fall-back-to-software-tcp-udp-checksum-on-older-controllers.patch @@ -0,0 +1,66 @@ +From 4dbd99fd8453ae681dad8fc1e7aa2c05e16b0cc1 Mon Sep 17 00:00:00 2001 +From: Alex Dubov +Date: Wed, 16 Mar 2011 17:57:13 +0000 +Subject: gianfar: Fall back to software tcp/udp checksum on older controllers + + +From: Alex Dubov + +[ Upstream commit 4363c2fddb1399b728ef21ee8101c148a311ea45 ] + +As specified by errata eTSEC49 of MPC8548 and errata eTSEC12 of MPC83xx, +older revisions of gianfar controllers will be unable to calculate a TCP/UDP +packet checksum for some alignments of the appropriate FCB. This patch checks +for FCB alignment on such controllers and falls back to software checksumming +if the alignment is known to be bad. + +Signed-off-by: Alex Dubov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/gianfar.c | 16 ++++++++++++++-- + drivers/net/gianfar.h | 1 + + 2 files changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/net/gianfar.c ++++ b/drivers/net/gianfar.c +@@ -950,6 +950,11 @@ static void gfar_detect_errata(struct gf + (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0)) + priv->errata |= GFAR_ERRATA_A002; + ++ /* MPC8313 Rev < 2.0, MPC8548 rev 2.0 */ ++ if ((pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020) || ++ (pvr == 0x80210020 && mod == 0x8030 && rev == 0x0020)) ++ priv->errata |= GFAR_ERRATA_12; ++ + if (priv->errata) + dev_info(dev, "enabled errata workarounds, flags: 0x%x\n", + priv->errata); +@@ -2156,8 +2161,15 @@ static int gfar_start_xmit(struct sk_buf + /* Set up checksumming */ + if (CHECKSUM_PARTIAL == skb->ip_summed) { + fcb = gfar_add_fcb(skb); +- lstatus |= BD_LFLAG(TXBD_TOE); +- gfar_tx_checksum(skb, fcb); ++ /* as specified by errata */ ++ if (unlikely(gfar_has_errata(priv, GFAR_ERRATA_12) ++ && ((unsigned long)fcb % 0x20) > 0x18)) { ++ __skb_pull(skb, GMAC_FCB_LEN); ++ skb_checksum_help(skb); ++ } else { ++ lstatus |= BD_LFLAG(TXBD_TOE); ++ gfar_tx_checksum(skb, fcb); ++ } + } + + if (vlan_tx_tag_present(skb)) { +--- a/drivers/net/gianfar.h ++++ b/drivers/net/gianfar.h +@@ -1039,6 +1039,7 @@ enum gfar_errata { + GFAR_ERRATA_74 = 0x01, + GFAR_ERRATA_76 = 0x02, + GFAR_ERRATA_A002 = 0x04, ++ GFAR_ERRATA_12 = 0x08, /* a.k.a errata eTSEC49 */ + }; + + /* Struct stolen almost completely (and shamelessly) from the FCC enet source diff --git a/queue-2.6.38/l2tp-fix-possible-oops-on-l2tp_eth-module-unload.patch b/queue-2.6.38/l2tp-fix-possible-oops-on-l2tp_eth-module-unload.patch new file mode 100644 index 00000000000..123a2f0e8e8 --- /dev/null +++ b/queue-2.6.38/l2tp-fix-possible-oops-on-l2tp_eth-module-unload.patch @@ -0,0 +1,45 @@ +From 2f288c99c4ba53a7ddbb5a7a77e42ae72d6da3b9 Mon Sep 17 00:00:00 2001 +From: James Chapman +Date: Mon, 21 Mar 2011 18:10:25 -0700 +Subject: l2tp: fix possible oops on l2tp_eth module unload + + +From: James Chapman + +[ Upstream commit 8aa525a9340da4227797a06221ca08399006635f ] + +A struct used in the l2tp_eth driver for registering network namespace +ops was incorrectly marked as __net_initdata, leading to oops when +module unloaded. + +BUG: unable to handle kernel paging request at ffffffffa00ec098 +IP: [] ops_exit_list+0x7/0x4b +PGD 142d067 PUD 1431063 PMD 195da8067 PTE 0 +Oops: 0000 [#1] SMP +last sysfs file: /sys/module/l2tp_eth/refcnt +Call Trace: + [] ? unregister_pernet_operations+0x32/0x93 + [] ? unregister_pernet_device+0x2b/0x38 + [] ? sys_delete_module+0x1b8/0x222 + [] ? do_munmap+0x254/0x318 + [] ? page_fault+0x25/0x30 + [] ? system_call_fastpath+0x16/0x1b + +Signed-off-by: James Chapman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/l2tp/l2tp_eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/l2tp/l2tp_eth.c ++++ b/net/l2tp/l2tp_eth.c +@@ -283,7 +283,7 @@ static __net_init int l2tp_eth_init_net( + return 0; + } + +-static __net_initdata struct pernet_operations l2tp_eth_net_ops = { ++static struct pernet_operations l2tp_eth_net_ops = { + .init = l2tp_eth_init_net, + .id = &l2tp_eth_net_id, + .size = sizeof(struct l2tp_eth_net), diff --git a/queue-2.6.38/net-ipv6-fix-duplicate-proc-sys-net-ipv6-neigh-directory-entries.patch b/queue-2.6.38/net-ipv6-fix-duplicate-proc-sys-net-ipv6-neigh-directory-entries.patch new file mode 100644 index 00000000000..17fde811a42 --- /dev/null +++ b/queue-2.6.38/net-ipv6-fix-duplicate-proc-sys-net-ipv6-neigh-directory-entries.patch @@ -0,0 +1,71 @@ +From c751cf0998164651824e1f68d124110d448d5ec3 Mon Sep 17 00:00:00 2001 +From: Eric W. Biederman +Date: Mon, 21 Mar 2011 18:23:34 -0700 +Subject: net ipv6: Fix duplicate /proc/sys/net/ipv6/neigh directory entries. + + +From: Eric W. Biederman + +[ Upstream commit 9d2a8fa96a44ba242de3a6f56acaef7a40a97b97 ] + +When I was fixing issues with unregisgtering tables under /proc/sys/net/ipv6/neigh +by adding a mount point it appears I missed a critical ordering issue, in the +ipv6 initialization. I had not realized that ipv6_sysctl_register is called +at the very end of the ipv6 initialization and in particular after we call +neigh_sysctl_register from ndisc_init. + +"neigh" needs to be initialized in ipv6_static_sysctl_register which is +the first ipv6 table to initialized, and definitely before ndisc_init. +This removes the weirdness of duplicate tables while still providing a +"neigh" mount point which prevents races in sysctl unregistering. + +This was initially reported at https://bugzilla.kernel.org/show_bug.cgi?id=31232 +Reported-by: sunkan@zappa.cx +Signed-off-by: Eric W. Biederman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/sysctl_net_ipv6.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/net/ipv6/sysctl_net_ipv6.c ++++ b/net/ipv6/sysctl_net_ipv6.c +@@ -17,6 +17,16 @@ + + static struct ctl_table empty[1]; + ++static ctl_table ipv6_static_skeleton[] = { ++ { ++ .procname = "neigh", ++ .maxlen = 0, ++ .mode = 0555, ++ .child = empty, ++ }, ++ { } ++}; ++ + static ctl_table ipv6_table_template[] = { + { + .procname = "route", +@@ -37,12 +47,6 @@ static ctl_table ipv6_table_template[] = + .mode = 0644, + .proc_handler = proc_dointvec + }, +- { +- .procname = "neigh", +- .maxlen = 0, +- .mode = 0555, +- .child = empty, +- }, + { } + }; + +@@ -160,7 +164,7 @@ static struct ctl_table_header *ip6_base + + int ipv6_static_sysctl_register(void) + { +- ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty); ++ ip6_base = register_sysctl_paths(net_ipv6_ctl_path, ipv6_static_skeleton); + if (ip6_base == NULL) + return -ENOMEM; + return 0; diff --git a/queue-2.6.38/net_sched-fix-ip_tos2prio.patch b/queue-2.6.38/net_sched-fix-ip_tos2prio.patch new file mode 100644 index 00000000000..a066d29822a --- /dev/null +++ b/queue-2.6.38/net_sched-fix-ip_tos2prio.patch @@ -0,0 +1,43 @@ +From f041eaa28a108f73cf02e7059cf0616dfd43b232 Mon Sep 17 00:00:00 2001 +From: Dan Siemon +Date: Tue, 15 Mar 2011 13:56:07 +0000 +Subject: net_sched: fix ip_tos2prio + + +From: Dan Siemon + +[ Upstream commit 4a2b9c3756077c05dd8666e458a751d2248b61b6 ] + +ECN support incorrectly maps ECN BESTEFFORT packets to TC_PRIO_FILLER +(1) instead of TC_PRIO_BESTEFFORT (0) + +This means ECN enabled flows are placed in pfifo_fast/prio low priority +band, giving ECN enabled flows [ECT(0) and CE codepoints] higher drop +probabilities. + +This is rather unfortunate, given we would like ECN being more widely +used. + +Ref : http://www.coverfire.com/archives/2011/03/13/pfifo_fast-and-ecn/ + +Signed-off-by: Dan Siemon +Signed-off-by: Eric Dumazet +Cc: Dave Täht +Cc: Jonathan Morton +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -171,7 +171,7 @@ static struct dst_ops ipv4_dst_ops = { + + const __u8 ip_tos2prio[16] = { + TC_PRIO_BESTEFFORT, +- ECN_OR_COST(FILLER), ++ ECN_OR_COST(BESTEFFORT), + TC_PRIO_BESTEFFORT, + ECN_OR_COST(BESTEFFORT), + TC_PRIO_BULK, diff --git a/queue-2.6.38/pppoe-drop-pppox_zombies-in-pppoe_flush_dev.patch b/queue-2.6.38/pppoe-drop-pppox_zombies-in-pppoe_flush_dev.patch new file mode 100644 index 00000000000..38a04cf9a23 --- /dev/null +++ b/queue-2.6.38/pppoe-drop-pppox_zombies-in-pppoe_flush_dev.patch @@ -0,0 +1,32 @@ +From 1a3ea69b2cb514439d4a5f6cabac89a845204f1b Mon Sep 17 00:00:00 2001 +From: Ulrich Weber +Date: Wed, 6 Apr 2011 14:04:49 -0700 +Subject: pppoe: drop PPPOX_ZOMBIEs in pppoe_flush_dev + + +From: Ulrich Weber + +[ Upstream commit ae07b0b221b6ab2edf9e3abd518aec6cd3f1ba66 ] + +otherwise we loop forever if a PPPoE socket was set +to PPPOX_ZOMBIE state by a PADT message when the +ethernet device is going down afterwards. + +Signed-off-by: Ulrich Weber +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/pppoe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/pppoe.c ++++ b/drivers/net/pppoe.c +@@ -317,7 +317,7 @@ static void pppoe_flush_dev(struct net_d + lock_sock(sk); + + if (po->pppoe_dev == dev && +- sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { ++ sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { + pppox_unbind_sock(sk); + sk->sk_state = PPPOX_ZOMBIE; + sk->sk_state_change(sk); diff --git a/queue-2.6.38/sctp-pass-__gfp_nowarn-to-hash-table-allocation-attempts.patch b/queue-2.6.38/sctp-pass-__gfp_nowarn-to-hash-table-allocation-attempts.patch new file mode 100644 index 00000000000..d6d92fc867d --- /dev/null +++ b/queue-2.6.38/sctp-pass-__gfp_nowarn-to-hash-table-allocation-attempts.patch @@ -0,0 +1,42 @@ +From b51d6615ff5f9fc7c55727740b565b4eeafb7c4c Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 30 Mar 2011 17:51:36 -0700 +Subject: sctp: Pass __GFP_NOWARN to hash table allocation attempts. + + +From: David S. Miller + +[ Upstream commit a84b50ceb7d640437d0dc28a2bef0d0de054de89 ] + +Like DCCP and other similar pieces of code, there are mechanisms +here to try allocating smaller hash tables if the allocation +fails. So pass in __GFP_NOWARN like the others do instead of +emitting a scary message. + +Reported-by: Dave Jones +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/protocol.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -1204,7 +1204,7 @@ SCTP_STATIC __init int sctp_init(void) + if ((sctp_assoc_hashsize > (64 * 1024)) && order > 0) + continue; + sctp_assoc_hashtable = (struct sctp_hashbucket *) +- __get_free_pages(GFP_ATOMIC, order); ++ __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order); + } while (!sctp_assoc_hashtable && --order > 0); + if (!sctp_assoc_hashtable) { + pr_err("Failed association hash alloc\n"); +@@ -1237,7 +1237,7 @@ SCTP_STATIC __init int sctp_init(void) + if ((sctp_port_hashsize > (64 * 1024)) && order > 0) + continue; + sctp_port_hashtable = (struct sctp_bind_hashbucket *) +- __get_free_pages(GFP_ATOMIC, order); ++ __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order); + } while (!sctp_port_hashtable && --order > 0); + if (!sctp_port_hashtable) { + pr_err("Failed bind hash alloc\n"); diff --git a/queue-2.6.38/series b/queue-2.6.38/series index 53de628d5ba..8206172788d 100644 --- a/queue-2.6.38/series +++ b/queue-2.6.38/series @@ -15,3 +15,19 @@ mca.c-fix-cast-from-integer-to-pointer-warning.patch vm-fix-mlock-on-stack-guard-page.patch ubifs-fix-assertion-warnings.patch perf-fix-task-context-scheduling.patch +bridge-fix-possibly-wrong-mld-queries-ethernet-source-address.patch +fib-add-rtnl-locking-in-ip_fib_net_exit.patch +gianfar-fall-back-to-software-tcp-udp-checksum-on-older-controllers.patch +l2tp-fix-possible-oops-on-l2tp_eth-module-unload.patch +net-ipv6-fix-duplicate-proc-sys-net-ipv6-neigh-directory-entries.patch +net_sched-fix-ip_tos2prio.patch +pppoe-drop-pppox_zombies-in-pppoe_flush_dev.patch +sctp-pass-__gfp_nowarn-to-hash-table-allocation-attempts.patch +tcp-avoid-cwnd-moderation-in-undo.patch +xfrm-refcount-destination-entry-on-xfrm_lookup.patch +vlan-should-take-into-account-needed_headroom.patch +bridge-reset-ipcb-when-entering-ip-stack-on-nf_forward.patch +sparc-fix-.size-directive-for-do_int_load.patch +sparc32-fix-might-be-used-uninitialized-warning-in-do_sparc_fault.patch +sparc32-pass-task_struct-to-schedule_tail-in-ret_from_fork.patch +sparc64-fix-build-errors-with-gcc-4.6.0.patch diff --git a/queue-2.6.38/sparc-fix-.size-directive-for-do_int_load.patch b/queue-2.6.38/sparc-fix-.size-directive-for-do_int_load.patch new file mode 100644 index 00000000000..dcc42700c1f --- /dev/null +++ b/queue-2.6.38/sparc-fix-.size-directive-for-do_int_load.patch @@ -0,0 +1,32 @@ +From 919a6006d36ab51a70ca5d80e192cba953c874cb Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 9 Mar 2011 12:54:27 -0800 +Subject: sparc: Fix .size directive for do_int_load + + +From: Ben Hutchings + +[ Upstream commit 35043c428f1fcb92feb5792f5878a8852ee00771 ] + +gas used to accept (and ignore?) .size directives which referred to +undefined symbols, as this does. In binutils 2.21 these are treated +as errors. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/una_asm_64.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/kernel/una_asm_64.S ++++ b/arch/sparc/kernel/una_asm_64.S +@@ -127,7 +127,7 @@ do_int_load: + wr %o5, 0x0, %asi + retl + mov 0, %o0 +- .size __do_int_load, .-__do_int_load ++ .size do_int_load, .-do_int_load + + .section __ex_table,"a" + .word 4b, __retl_efault diff --git a/queue-2.6.38/sparc32-fix-might-be-used-uninitialized-warning-in-do_sparc_fault.patch b/queue-2.6.38/sparc32-fix-might-be-used-uninitialized-warning-in-do_sparc_fault.patch new file mode 100644 index 00000000000..d808e25af0a --- /dev/null +++ b/queue-2.6.38/sparc32-fix-might-be-used-uninitialized-warning-in-do_sparc_fault.patch @@ -0,0 +1,37 @@ +From c90b2d78650ae1ec6db90f07533e0382fa63acad Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 9 Mar 2011 13:00:47 -0800 +Subject: sparc32: Fix might-be-used-uninitialized warning in do_sparc_fault(). + + +From: David S. Miller + +[ Upstream commit c816be7b5f24585baa9eba1f2413935f771d6ad6 ] + +When we try to handle vmalloc faults, we can take a code +path which uses "code" before we actually set it. + +Amusingly gcc-3.3 notices this yet gcc-4.x does not. + +Reported-by: Bob Breuer +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/mm/fault_32.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/sparc/mm/fault_32.c ++++ b/arch/sparc/mm/fault_32.c +@@ -240,11 +240,10 @@ asmlinkage void do_sparc_fault(struct pt + * only copy the information from the master page table, + * nothing more. + */ ++ code = SEGV_MAPERR; + if (!ARCH_SUN4C && address >= TASK_SIZE) + goto vmalloc_fault; + +- code = SEGV_MAPERR; +- + /* + * If we're in an interrupt or have no user + * context, we must not take the fault.. diff --git a/queue-2.6.38/sparc32-pass-task_struct-to-schedule_tail-in-ret_from_fork.patch b/queue-2.6.38/sparc32-pass-task_struct-to-schedule_tail-in-ret_from_fork.patch new file mode 100644 index 00000000000..0e0c9b371e8 --- /dev/null +++ b/queue-2.6.38/sparc32-pass-task_struct-to-schedule_tail-in-ret_from_fork.patch @@ -0,0 +1,39 @@ +From d4f295b7863f094b4d76ce10cb99f4617b5d00ad Mon Sep 17 00:00:00 2001 +From: Tkhai Kirill +Date: Thu, 31 Mar 2011 00:52:38 -0700 +Subject: sparc32: Pass task_struct to schedule_tail() in ret_from_fork + + +From: Tkhai Kirill + +[ Upstream commit 47c7c97a93a5b8f719093dbf83555090b3b8228b ] + +We have to pass task_struct of previous process to function +schedule_tail(). Currently in ret_from_fork previous thread_info +is passed: + +switch_to: mov %g6, %g3 /* previous thread_info in g6 */ + +ret_from_fork: call schedule_tail + mov %g3, %o0 /* previous thread_info is passed */ + +void schedule_tail(struct task_struct *prev); + +Signed-off-by: Tkhai Kirill +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/entry.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/kernel/entry.S ++++ b/arch/sparc/kernel/entry.S +@@ -1283,7 +1283,7 @@ linux_syscall_trace: + .globl ret_from_fork + ret_from_fork: + call schedule_tail +- mov %g3, %o0 ++ ld [%g3 + TI_TASK], %o0 + b ret_sys_call + ld [%sp + STACKFRAME_SZ + PT_I0], %o0 + diff --git a/queue-2.6.38/sparc64-fix-build-errors-with-gcc-4.6.0.patch b/queue-2.6.38/sparc64-fix-build-errors-with-gcc-4.6.0.patch new file mode 100644 index 00000000000..7a5253ffb1f --- /dev/null +++ b/queue-2.6.38/sparc64-fix-build-errors-with-gcc-4.6.0.patch @@ -0,0 +1,286 @@ +From 9567fc1bffdb332f7254c9bd2a913c80a6e18e16 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Sat, 26 Feb 2011 23:40:02 -0800 +Subject: sparc64: Fix build errors with gcc-4.6.0 + + +From: David S. Miller + +[ Upstream commit c6fee0810df4e0f4cf9c4834d2569ca01c02cffc ] + +Most of the warnings emitted (we fail arch/sparc file +builds with -Werror) were legitimate but harmless, however +one case (n2_pcr_write) was a genuine bug. + +Based almost entirely upon a patch by Sam Ravnborg. + +Reported-by: Dennis Gilmore +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/iommu.c | 3 --- + arch/sparc/kernel/ldc.c | 28 ++++++++++++++++++---------- + arch/sparc/kernel/pci.c | 1 + + arch/sparc/kernel/pci_common.c | 11 +++++++---- + arch/sparc/kernel/pci_fire.c | 2 -- + arch/sparc/kernel/pci_schizo.c | 4 +--- + arch/sparc/kernel/pci_sun4v.c | 3 +-- + arch/sparc/kernel/pcr.c | 2 +- + arch/sparc/kernel/ptrace_64.c | 3 ++- + arch/sparc/kernel/smp_64.c | 11 ++++------- + arch/sparc/kernel/traps_64.c | 3 +-- + 11 files changed, 36 insertions(+), 35 deletions(-) + +--- a/arch/sparc/kernel/iommu.c ++++ b/arch/sparc/kernel/iommu.c +@@ -333,13 +333,10 @@ static void dma_4u_free_coherent(struct + void *cpu, dma_addr_t dvma) + { + struct iommu *iommu; +- iopte_t *iopte; + unsigned long flags, order, npages; + + npages = IO_PAGE_ALIGN(size) >> IO_PAGE_SHIFT; + iommu = dev->archdata.iommu; +- iopte = iommu->page_table + +- ((dvma - iommu->page_table_map_base) >> IO_PAGE_SHIFT); + + spin_lock_irqsave(&iommu->lock, flags); + +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -790,16 +790,20 @@ static void send_events(struct ldc_chann + static irqreturn_t ldc_rx(int irq, void *dev_id) + { + struct ldc_channel *lp = dev_id; +- unsigned long orig_state, hv_err, flags; ++ unsigned long orig_state, flags; + unsigned int event_mask; + + spin_lock_irqsave(&lp->lock, flags); + + orig_state = lp->chan_state; +- hv_err = sun4v_ldc_rx_get_state(lp->id, +- &lp->rx_head, +- &lp->rx_tail, +- &lp->chan_state); ++ ++ /* We should probably check for hypervisor errors here and ++ * reset the LDC channel if we get one. ++ */ ++ sun4v_ldc_rx_get_state(lp->id, ++ &lp->rx_head, ++ &lp->rx_tail, ++ &lp->chan_state); + + ldcdbg(RX, "RX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n", + orig_state, lp->chan_state, lp->rx_head, lp->rx_tail); +@@ -904,16 +908,20 @@ out: + static irqreturn_t ldc_tx(int irq, void *dev_id) + { + struct ldc_channel *lp = dev_id; +- unsigned long flags, hv_err, orig_state; ++ unsigned long flags, orig_state; + unsigned int event_mask = 0; + + spin_lock_irqsave(&lp->lock, flags); + + orig_state = lp->chan_state; +- hv_err = sun4v_ldc_tx_get_state(lp->id, +- &lp->tx_head, +- &lp->tx_tail, +- &lp->chan_state); ++ ++ /* We should probably check for hypervisor errors here and ++ * reset the LDC channel if we get one. ++ */ ++ sun4v_ldc_tx_get_state(lp->id, ++ &lp->tx_head, ++ &lp->tx_tail, ++ &lp->chan_state); + + ldcdbg(TX, " TX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n", + orig_state, lp->chan_state, lp->tx_head, lp->tx_tail); +--- a/arch/sparc/kernel/pci.c ++++ b/arch/sparc/kernel/pci.c +@@ -675,6 +675,7 @@ static void __devinit pci_bus_register_o + * humanoid. + */ + err = sysfs_create_file(&dev->dev.kobj, &dev_attr_obppath.attr); ++ (void) err; + } + list_for_each_entry(child_bus, &bus->children, node) + pci_bus_register_of_sysfs(child_bus); +--- a/arch/sparc/kernel/pci_common.c ++++ b/arch/sparc/kernel/pci_common.c +@@ -295,14 +295,17 @@ static int sun4v_write_pci_cfg(struct pc + unsigned int bus = bus_dev->number; + unsigned int device = PCI_SLOT(devfn); + unsigned int func = PCI_FUNC(devfn); +- unsigned long ret; + + if (config_out_of_range(pbm, bus, devfn, where)) { + /* Do nothing. */ + } else { +- ret = pci_sun4v_config_put(devhandle, +- HV_PCI_DEVICE_BUILD(bus, device, func), +- where, size, value); ++ /* We don't check for hypervisor errors here, but perhaps ++ * we should and influence our return value depending upon ++ * what kind of error is thrown. ++ */ ++ pci_sun4v_config_put(devhandle, ++ HV_PCI_DEVICE_BUILD(bus, device, func), ++ where, size, value); + } + return PCIBIOS_SUCCESSFUL; + } +--- a/arch/sparc/kernel/pci_fire.c ++++ b/arch/sparc/kernel/pci_fire.c +@@ -214,11 +214,9 @@ static int pci_fire_msi_setup(struct pci + + static int pci_fire_msi_teardown(struct pci_pbm_info *pbm, unsigned long msi) + { +- unsigned long msiqid; + u64 val; + + val = upa_readq(pbm->pbm_regs + MSI_MAP(msi)); +- msiqid = (val & MSI_MAP_EQNUM); + + val &= ~MSI_MAP_VALID; + +--- a/arch/sparc/kernel/pci_schizo.c ++++ b/arch/sparc/kernel/pci_schizo.c +@@ -1313,7 +1313,7 @@ static int __devinit schizo_pbm_init(str + const struct linux_prom64_registers *regs; + struct device_node *dp = op->dev.of_node; + const char *chipset_name; +- int is_pbm_a, err; ++ int err; + + switch (chip_type) { + case PBM_CHIP_TYPE_TOMATILLO: +@@ -1343,8 +1343,6 @@ static int __devinit schizo_pbm_init(str + */ + regs = of_get_property(dp, "reg", NULL); + +- is_pbm_a = ((regs[0].phys_addr & 0x00700000) == 0x00600000); +- + pbm->next = pci_pbm_root; + pci_pbm_root = pbm; + +--- a/arch/sparc/kernel/pci_sun4v.c ++++ b/arch/sparc/kernel/pci_sun4v.c +@@ -580,7 +580,7 @@ static int __devinit pci_sun4v_iommu_ini + { + static const u32 vdma_default[] = { 0x80000000, 0x80000000 }; + struct iommu *iommu = pbm->iommu; +- unsigned long num_tsb_entries, sz, tsbsize; ++ unsigned long num_tsb_entries, sz; + u32 dma_mask, dma_offset; + const u32 *vdma; + +@@ -596,7 +596,6 @@ static int __devinit pci_sun4v_iommu_ini + + dma_mask = (roundup_pow_of_two(vdma[1]) - 1UL); + num_tsb_entries = vdma[1] / IO_PAGE_SIZE; +- tsbsize = num_tsb_entries * sizeof(iopte_t); + + dma_offset = vdma[0]; + +--- a/arch/sparc/kernel/pcr.c ++++ b/arch/sparc/kernel/pcr.c +@@ -81,7 +81,7 @@ static void n2_pcr_write(u64 val) + unsigned long ret; + + ret = sun4v_niagara2_setperf(HV_N2_PERF_SPARC_CTL, val); +- if (val != HV_EOK) ++ if (ret != HV_EOK) + write_pcr(val); + } + +--- a/arch/sparc/kernel/ptrace_64.c ++++ b/arch/sparc/kernel/ptrace_64.c +@@ -1086,6 +1086,7 @@ asmlinkage int syscall_trace_enter(struc + + asmlinkage void syscall_trace_leave(struct pt_regs *regs) + { ++#ifdef CONFIG_AUDITSYSCALL + if (unlikely(current->audit_context)) { + unsigned long tstate = regs->tstate; + int result = AUDITSC_SUCCESS; +@@ -1095,7 +1096,7 @@ asmlinkage void syscall_trace_leave(stru + + audit_syscall_exit(result, regs->u_regs[UREG_I0]); + } +- ++#endif + if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) + trace_sys_exit(regs, regs->u_regs[UREG_G1]); + +--- a/arch/sparc/kernel/smp_64.c ++++ b/arch/sparc/kernel/smp_64.c +@@ -189,7 +189,7 @@ static inline long get_delta (long *rt, + void smp_synchronize_tick_client(void) + { + long i, delta, adj, adjust_latency = 0, done = 0; +- unsigned long flags, rt, master_time_stamp, bound; ++ unsigned long flags, rt, master_time_stamp; + #if DEBUG_TICK_SYNC + struct { + long rt; /* roundtrip time */ +@@ -208,10 +208,8 @@ void smp_synchronize_tick_client(void) + { + for (i = 0; i < NUM_ROUNDS; i++) { + delta = get_delta(&rt, &master_time_stamp); +- if (delta == 0) { ++ if (delta == 0) + done = 1; /* let's lock on to this... */ +- bound = rt; +- } + + if (!done) { + if (i > 0) { +@@ -933,13 +931,12 @@ void smp_flush_dcache_page_impl(struct p + void flush_dcache_page_all(struct mm_struct *mm, struct page *page) + { + void *pg_addr; +- int this_cpu; + u64 data0; + + if (tlb_type == hypervisor) + return; + +- this_cpu = get_cpu(); ++ preempt_disable(); + + #ifdef CONFIG_DEBUG_DCFLUSH + atomic_inc(&dcpage_flushes); +@@ -964,7 +961,7 @@ void flush_dcache_page_all(struct mm_str + } + __local_flush_dcache_page(page); + +- put_cpu(); ++ preempt_enable(); + } + + void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs) +--- a/arch/sparc/kernel/traps_64.c ++++ b/arch/sparc/kernel/traps_64.c +@@ -2152,7 +2152,7 @@ static void user_instruction_dump(unsign + + void show_stack(struct task_struct *tsk, unsigned long *_ksp) + { +- unsigned long fp, thread_base, ksp; ++ unsigned long fp, ksp; + struct thread_info *tp; + int count = 0; + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +@@ -2173,7 +2173,6 @@ void show_stack(struct task_struct *tsk, + flushw_all(); + + fp = ksp + STACK_BIAS; +- thread_base = (unsigned long) tp; + + printk("Call Trace:\n"); + do { diff --git a/queue-2.6.38/tcp-avoid-cwnd-moderation-in-undo.patch b/queue-2.6.38/tcp-avoid-cwnd-moderation-in-undo.patch new file mode 100644 index 00000000000..0fce890d00a --- /dev/null +++ b/queue-2.6.38/tcp-avoid-cwnd-moderation-in-undo.patch @@ -0,0 +1,71 @@ +From bd59e4b2b325a4f0fcd491a8ec55a619fef91ded Mon Sep 17 00:00:00 2001 +From: Yuchung Cheng +Date: Mon, 14 Mar 2011 10:57:03 +0000 +Subject: tcp: avoid cwnd moderation in undo + + +From: Yuchung Cheng + +[ Upstream commit 67d4120a1793138bc9f4a6eb61d0fc5298ed97e0 ] + +In the current undo logic, cwnd is moderated after it was restored +to the value prior entering fast-recovery. It was moderated first +in tcp_try_undo_recovery then again in tcp_complete_cwr. + +Since the undo indicates recovery was false, these moderations +are not necessary. If the undo is triggered when most of the +outstanding data have been acknowledged, the (restored) cwnd is +falsely pulled down to a small value. + +This patch removes these cwnd moderations if cwnd is undone + a) during fast-recovery + b) by receiving DSACKs past fast-recovery + +Signed-off-by: Yuchung Cheng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_input.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2659,7 +2659,7 @@ static void DBGUNDO(struct sock *sk, con + #define DBGUNDO(x...) do { } while (0) + #endif + +-static void tcp_undo_cwr(struct sock *sk, const int undo) ++static void tcp_undo_cwr(struct sock *sk, const int undo_ssthresh) + { + struct tcp_sock *tp = tcp_sk(sk); + +@@ -2671,14 +2671,13 @@ static void tcp_undo_cwr(struct sock *sk + else + tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh << 1); + +- if (undo && tp->prior_ssthresh > tp->snd_ssthresh) { ++ if (undo_ssthresh && tp->prior_ssthresh > tp->snd_ssthresh) { + tp->snd_ssthresh = tp->prior_ssthresh; + TCP_ECN_withdraw_cwr(tp); + } + } else { + tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh); + } +- tcp_moderate_cwnd(tp); + tp->snd_cwnd_stamp = tcp_time_stamp; + } + +@@ -2822,8 +2821,11 @@ static int tcp_try_undo_loss(struct sock + static inline void tcp_complete_cwr(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); +- tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh); +- tp->snd_cwnd_stamp = tcp_time_stamp; ++ /* Do not moderate cwnd if it's already undone in cwr or recovery */ ++ if (tp->undo_marker && tp->snd_cwnd > tp->snd_ssthresh) { ++ tp->snd_cwnd = tp->snd_ssthresh; ++ tp->snd_cwnd_stamp = tcp_time_stamp; ++ } + tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR); + } + diff --git a/queue-2.6.38/vlan-should-take-into-account-needed_headroom.patch b/queue-2.6.38/vlan-should-take-into-account-needed_headroom.patch new file mode 100644 index 00000000000..f44abba5d91 --- /dev/null +++ b/queue-2.6.38/vlan-should-take-into-account-needed_headroom.patch @@ -0,0 +1,40 @@ +From c0fd11cf45228241f8b3fb42020b1c9493dcdac7 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 18 Mar 2011 00:27:27 +0000 +Subject: vlan: should take into account needed_headroom + + +From: Eric Dumazet + +[ Upstream commit d870bfb9d366c5d466c0f5419a4ec95a3f71ea8a ] + +Commit c95b819ad7 (gre: Use needed_headroom) +made gre use needed_headroom instead of hard_header_len + +This uncover a bug in vlan code. + +We should make sure vlan devices take into account their +real_dev->needed_headroom or we risk a crash in ipgre_header(), because +we dont have enough room to push IP header in skb. + +Reported-by: Diddi Oscarsson +Signed-off-by: Eric Dumazet +Cc: Patrick McHardy +Cc: Herbert Xu +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/8021q/vlan_dev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -707,6 +707,7 @@ static int vlan_dev_init(struct net_devi + dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid; + #endif + ++ dev->needed_headroom = real_dev->needed_headroom; + if (real_dev->features & NETIF_F_HW_VLAN_TX) { + dev->header_ops = real_dev->header_ops; + dev->hard_header_len = real_dev->hard_header_len; diff --git a/queue-2.6.38/xfrm-refcount-destination-entry-on-xfrm_lookup.patch b/queue-2.6.38/xfrm-refcount-destination-entry-on-xfrm_lookup.patch new file mode 100644 index 00000000000..c1bd7a292ca --- /dev/null +++ b/queue-2.6.38/xfrm-refcount-destination-entry-on-xfrm_lookup.patch @@ -0,0 +1,37 @@ +From 6677647340a5d58b48b792af078701f4068be4b4 Mon Sep 17 00:00:00 2001 +From: Steffen Klassert +Date: Tue, 15 Mar 2011 21:12:49 +0000 +Subject: xfrm: Refcount destination entry on xfrm_lookup + + +From: Steffen Klassert + +[ Upstream commit fbd5060875d25f7764fd1c3d35b83a8ed1d88d7b ] + +We return a destination entry without refcount if a socket +policy is found in xfrm_lookup. This triggers a warning on +a negative refcount when freeeing this dst entry. So take +a refcount in this case to fix it. + +This refcount was forgotten when xfrm changed to cache bundles +instead of policies for outgoing flows. + +Signed-off-by: Steffen Klassert +Acked-by: Timo Teräs +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_policy.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1778,6 +1778,8 @@ restart: + goto no_transform; + } + ++ dst_hold(&xdst->u.dst); ++ + spin_lock_bh(&xfrm_policy_sk_bundle_lock); + xdst->u.dst.next = xfrm_policy_sk_bundles; + xfrm_policy_sk_bundles = &xdst->u.dst;