From: Greg Kroah-Hartman Date: Mon, 20 Dec 2010 19:42:05 +0000 (-0800) Subject: .36 patches X-Git-Tag: v2.6.36.3~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ee3e6ab22baa66d3340e80dca6dee1b9efb57fb1;p=thirdparty%2Fkernel%2Fstable-queue.git .36 patches --- diff --git a/queue-2.6.36/8139cp-fix-checksum-broken.patch b/queue-2.6.36/8139cp-fix-checksum-broken.patch new file mode 100644 index 00000000000..6ab3c26cf3f --- /dev/null +++ b/queue-2.6.36/8139cp-fix-checksum-broken.patch @@ -0,0 +1,48 @@ +From 5960f8eec97369034004398d38e6bb795d7eee72 Mon Sep 17 00:00:00 2001 +From: Shan Wei +Date: Wed, 17 Nov 2010 11:55:08 -0800 +Subject: 8139cp: fix checksum broken + + +From: Shan Wei + +[ Upstream commit 24b7ea9f6c9787fad885442ed0cc010f1aa69cca ] + +I am not family with RealTek RTL-8139C+ series 10/100 PCI Ethernet driver. +I try to guess the meaning of RxProtoIP and IPFail. +RxProtoIP stands for received IPv4 packet that upper protocol is not tcp and udp. +!(status & IPFail) is true means that driver correctly to check checksum in IPv4 header. + +If these are right, driver will set ip_summed with CHECKSUM_UNNECESSARY for other +upper protocol, e.g. sctp, igmp protocol. This will cause protocol stack ignores +checksum check for packets with invalid checksum. + +This patch is only compile-test. + +Signed-off-by: Shan Wei +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/8139cp.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/net/8139cp.c ++++ b/drivers/net/8139cp.c +@@ -490,13 +490,11 @@ static inline unsigned int cp_rx_csum_ok + { + unsigned int protocol = (status >> 16) & 0x3; + +- if (likely((protocol == RxProtoTCP) && (!(status & TCPFail)))) ++ if (((protocol == RxProtoTCP) && !(status & TCPFail)) || ++ ((protocol == RxProtoUDP) && !(status & UDPFail))) + return 1; +- else if ((protocol == RxProtoUDP) && (!(status & UDPFail))) +- return 1; +- else if ((protocol == RxProtoIP) && (!(status & IPFail))) +- return 1; +- return 0; ++ else ++ return 0; + } + + static int cp_rx_poll(struct napi_struct *napi, int budget) diff --git a/queue-2.6.36/af_unix-limit-recursion-level.patch b/queue-2.6.36/af_unix-limit-recursion-level.patch new file mode 100644 index 00000000000..d9e3eb3d481 --- /dev/null +++ b/queue-2.6.36/af_unix-limit-recursion-level.patch @@ -0,0 +1,176 @@ +From a1e61b5127af75c0126e38533c25936c422c1191 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 25 Nov 2010 04:11:39 +0000 +Subject: af_unix: limit recursion level + + +From: Eric Dumazet + +[ Upstream commit 25888e30319f8896fc656fc68643e6a078263060 ] + +Its easy to eat all kernel memory and trigger NMI watchdog, using an +exploit program that queues unix sockets on top of others. + +lkml ref : http://lkml.org/lkml/2010/11/25/8 + +This mechanism is used in applications, one choice we have is to have a +recursion limit. + +Other limits might be needed as well (if we queue other types of files), +since the passfd mechanism is currently limited by socket receive queue +sizes only. + +Add a recursion_level to unix socket, allowing up to 4 levels. + +Each time we send an unix socket through sendfd mechanism, we copy its +recursion level (plus one) to receiver. This recursion level is cleared +when socket receive queue is emptied. + +Reported-by: Марк Коренберг +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/af_unix.h | 2 ++ + net/unix/af_unix.c | 37 ++++++++++++++++++++++++++++++++----- + net/unix/garbage.c | 2 +- + 3 files changed, 35 insertions(+), 6 deletions(-) + +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *f + extern void unix_notinflight(struct file *fp); + extern void unix_gc(void); + extern void wait_for_unix_gc(void); ++extern struct sock *unix_get_socket(struct file *filp); + + #define UNIX_HASH_SIZE 256 + +@@ -56,6 +57,7 @@ struct unix_sock { + spinlock_t lock; + unsigned int gc_candidate : 1; + unsigned int gc_maybe_cycle : 1; ++ unsigned char recursion_level; + struct socket_wq peer_wq; + }; + #define unix_sk(__sk) ((struct unix_sock *)__sk) +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1343,9 +1343,25 @@ static void unix_destruct_scm(struct sk_ + sock_wfree(skb); + } + ++#define MAX_RECURSION_LEVEL 4 ++ + static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) + { + int i; ++ unsigned char max_level = 0; ++ int unix_sock_count = 0; ++ ++ for (i = scm->fp->count - 1; i >= 0; i--) { ++ struct sock *sk = unix_get_socket(scm->fp->fp[i]); ++ ++ if (sk) { ++ unix_sock_count++; ++ max_level = max(max_level, ++ unix_sk(sk)->recursion_level); ++ } ++ } ++ if (unlikely(max_level > MAX_RECURSION_LEVEL)) ++ return -ETOOMANYREFS; + + /* + * Need to duplicate file references for the sake of garbage +@@ -1356,9 +1372,11 @@ static int unix_attach_fds(struct scm_co + if (!UNIXCB(skb).fp) + return -ENOMEM; + +- for (i = scm->fp->count-1; i >= 0; i--) +- unix_inflight(scm->fp->fp[i]); +- return 0; ++ if (unix_sock_count) { ++ for (i = scm->fp->count - 1; i >= 0; i--) ++ unix_inflight(scm->fp->fp[i]); ++ } ++ return max_level; + } + + static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds) +@@ -1393,6 +1411,7 @@ static int unix_dgram_sendmsg(struct kio + struct sk_buff *skb; + long timeo; + struct scm_cookie tmp_scm; ++ int max_level; + + if (NULL == siocb->scm) + siocb->scm = &tmp_scm; +@@ -1431,8 +1450,9 @@ static int unix_dgram_sendmsg(struct kio + goto out; + + err = unix_scm_to_skb(siocb->scm, skb, true); +- if (err) ++ if (err < 0) + goto out_free; ++ max_level = err + 1; + unix_get_secdata(siocb->scm, skb); + + skb_reset_transport_header(skb); +@@ -1512,6 +1532,8 @@ restart: + } + + skb_queue_tail(&other->sk_receive_queue, skb); ++ if (max_level > unix_sk(other)->recursion_level) ++ unix_sk(other)->recursion_level = max_level; + unix_state_unlock(other); + other->sk_data_ready(other, len); + sock_put(other); +@@ -1542,6 +1564,7 @@ static int unix_stream_sendmsg(struct ki + int sent = 0; + struct scm_cookie tmp_scm; + bool fds_sent = false; ++ int max_level; + + if (NULL == siocb->scm) + siocb->scm = &tmp_scm; +@@ -1605,10 +1628,11 @@ static int unix_stream_sendmsg(struct ki + + /* Only send the fds in the first buffer */ + err = unix_scm_to_skb(siocb->scm, skb, !fds_sent); +- if (err) { ++ if (err < 0) { + kfree_skb(skb); + goto out_err; + } ++ max_level = err + 1; + fds_sent = true; + + err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size); +@@ -1624,6 +1648,8 @@ static int unix_stream_sendmsg(struct ki + goto pipe_err_free; + + skb_queue_tail(&other->sk_receive_queue, skb); ++ if (max_level > unix_sk(other)->recursion_level) ++ unix_sk(other)->recursion_level = max_level; + unix_state_unlock(other); + other->sk_data_ready(other, size); + sent += size; +@@ -1840,6 +1866,7 @@ static int unix_stream_recvmsg(struct ki + unix_state_lock(sk); + skb = skb_dequeue(&sk->sk_receive_queue); + if (skb == NULL) { ++ unix_sk(sk)->recursion_level = 0; + if (copied >= target) + goto unlock; + +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -96,7 +96,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_w + unsigned int unix_tot_inflight; + + +-static struct sock *unix_get_socket(struct file *filp) ++struct sock *unix_get_socket(struct file *filp) + { + struct sock *u_sock = NULL; + struct inode *inode = filp->f_path.dentry->d_inode; diff --git a/queue-2.6.36/af_unix-limit-unix_tot_inflight.patch b/queue-2.6.36/af_unix-limit-unix_tot_inflight.patch new file mode 100644 index 00000000000..dadbdeef786 --- /dev/null +++ b/queue-2.6.36/af_unix-limit-unix_tot_inflight.patch @@ -0,0 +1,52 @@ +From b13723cb6f2a7b7d9ef39a1afca59e942fdf6fcd Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 24 Nov 2010 09:15:27 -0800 +Subject: af_unix: limit unix_tot_inflight + + +From: Eric Dumazet + +[ Upstream commit 9915672d41273f5b77f1b3c29b391ffb7732b84b ] + +Vegard Nossum found a unix socket OOM was possible, posting an exploit +program. + +My analysis is we can eat all LOWMEM memory before unix_gc() being +called from unix_release_sock(). Moreover, the thread blocked in +unix_gc() can consume huge amount of time to perform cleanup because of +huge working set. + +One way to handle this is to have a sensible limit on unix_tot_inflight, +tested from wait_for_unix_gc() and to force a call to unix_gc() if this +limit is hit. + +This solves the OOM and also reduce overall latencies, and should not +slowdown normal workloads. + +Reported-by: Vegard Nossum +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/garbage.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struc + } + + static bool gc_in_progress = false; ++#define UNIX_INFLIGHT_TRIGGER_GC 16000 + + void wait_for_unix_gc(void) + { ++ /* ++ * If number of inflight sockets is insane, ++ * force a garbage collect right now. ++ */ ++ if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress) ++ unix_gc(); + wait_event(unix_gc_wait, gc_in_progress == false); + } + diff --git a/queue-2.6.36/bonding-fix-slave-selection-bug.patch b/queue-2.6.36/bonding-fix-slave-selection-bug.patch new file mode 100644 index 00000000000..bdaf53aa291 --- /dev/null +++ b/queue-2.6.36/bonding-fix-slave-selection-bug.patch @@ -0,0 +1,36 @@ +From 1e75090199d666bd15857a9cd5cc1e662878dfca Mon Sep 17 00:00:00 2001 +From: Hillf Danton +Date: Fri, 10 Dec 2010 18:54:11 +0000 +Subject: bonding: Fix slave selection bug. + + +From: Hillf Danton + +[ Upstream commit af3e5bd5f650163c2e12297f572910a1af1b8236 ] + +The returned slave is incorrect, if the net device under check is not +charged yet by the master. + +Signed-off-by: Hillf Danton +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bonding.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/bonding/bonding.h ++++ b/drivers/net/bonding/bonding.h +@@ -240,11 +240,11 @@ static inline struct slave *bond_get_sla + + bond_for_each_slave(bond, slave, i) { + if (slave->dev == slave_dev) { +- break; ++ return slave; + } + } + +- return slave; ++ return 0; + } + + static inline struct bonding *bond_get_bond_by_slave(struct slave *slave) diff --git a/queue-2.6.36/bridge-fix-ipv6-queries-for-bridge-multicast-snooping.patch b/queue-2.6.36/bridge-fix-ipv6-queries-for-bridge-multicast-snooping.patch new file mode 100644 index 00000000000..754685c1e72 --- /dev/null +++ b/queue-2.6.36/bridge-fix-ipv6-queries-for-bridge-multicast-snooping.patch @@ -0,0 +1,31 @@ +From a85d2f3d0ecb5f841628d1963b8a534d5acd08f1 Mon Sep 17 00:00:00 2001 +From: David Stevens +Date: Tue, 14 Dec 2010 08:42:16 +0000 +Subject: bridge: fix IPv6 queries for bridge multicast snooping + + +From: David Stevens + +[ Upstream commit 04bdf0c9a451863e50fff627713a900a2cabb998 ] + +This patch fixes a missing ntohs() for bridge IPv6 multicast snooping. + +Signed-off-by: David L Stevens +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_multicast.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -437,7 +437,7 @@ static struct sk_buff *br_ip6_multicast_ + ip6h = ipv6_hdr(skb); + + *(__force __be32 *)ip6h = htonl(0x60000000); +- ip6h->payload_len = 8 + sizeof(*mldq); ++ ip6h->payload_len = htons(8 + sizeof(*mldq)); + ip6h->nexthdr = IPPROTO_HOPOPTS; + ip6h->hop_limit = 1; + ipv6_addr_set(&ip6h->saddr, 0, 0, 0, 0); diff --git a/queue-2.6.36/cls_cgroup-fix-crash-on-module-unload.patch b/queue-2.6.36/cls_cgroup-fix-crash-on-module-unload.patch new file mode 100644 index 00000000000..54bd4251645 --- /dev/null +++ b/queue-2.6.36/cls_cgroup-fix-crash-on-module-unload.patch @@ -0,0 +1,38 @@ +From ad799b34e3d81861fa8cc5d4f4c8a5d6befadc4c Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Wed, 3 Nov 2010 13:31:05 +0000 +Subject: cls_cgroup: Fix crash on module unload + + +From: Herbert Xu + +[ Upstream commit c00b2c9e79466d61979cd21af526cc6d5d0ee04f ] + +Somewhere along the lines net_cls_subsys_id became a macro when +cls_cgroup is built as a module. Not only did it make cls_cgroup +completely useless, it also causes it to crash on module unload. + +This patch fixes this by removing that macro. + +Thanks to Eric Dumazet for diagnosing this problem. + +Reported-by: Randy Dunlap +Signed-off-by: Herbert Xu +Reviewed-by: Li Zefan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/cls_cgroup.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/net/sched/cls_cgroup.c ++++ b/net/sched/cls_cgroup.c +@@ -34,8 +34,6 @@ struct cgroup_subsys net_cls_subsys = { + .populate = cgrp_populate, + #ifdef CONFIG_NET_CLS_CGROUP + .subsys_id = net_cls_subsys_id, +-#else +-#define net_cls_subsys_id net_cls_subsys.subsys_id + #endif + .module = THIS_MODULE, + }; diff --git a/queue-2.6.36/driver-net-benet-fix-be_cmd_multicast_set-memcpy-bug.patch b/queue-2.6.36/driver-net-benet-fix-be_cmd_multicast_set-memcpy-bug.patch new file mode 100644 index 00000000000..10a79d24264 --- /dev/null +++ b/queue-2.6.36/driver-net-benet-fix-be_cmd_multicast_set-memcpy-bug.patch @@ -0,0 +1,36 @@ +From 7b0b9f4142dfd88923f329b17c2e02a2ca3785ff Mon Sep 17 00:00:00 2001 +From: Joe Jin +Date: Mon, 6 Dec 2010 03:00:59 +0000 +Subject: driver/net/benet: fix be_cmd_multicast_set() memcpy bug + + +From: Joe Jin + +[ Upstream commit 3fd40d0ceac9c234243730f4d7a6ffdb2fd3023a ] + +Regarding benet be_cmd_multicast_set() function, now using +netdev_for_each_mc_addr() helper for mac address copy, but +when copying to req->mac[] did not increase of the index. + +Cc: Sathya Perla +Cc: Subbu Seetharaman +Cc: Sarveshwar Bandi +Cc: Ajit Khaparde +Signed-off-by: Joe Jin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/benet/be_cmds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/benet/be_cmds.c ++++ b/drivers/net/benet/be_cmds.c +@@ -1179,7 +1179,7 @@ int be_cmd_multicast_set(struct be_adapt + + i = 0; + netdev_for_each_mc_addr(ha, netdev) +- memcpy(req->mac[i].byte, ha->addr, ETH_ALEN); ++ memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN); + } else { + req->promiscuous = 1; + } diff --git a/queue-2.6.36/econet-do-the-correct-cleanup-after-an-unprivileged-siocsifaddr.patch b/queue-2.6.36/econet-do-the-correct-cleanup-after-an-unprivileged-siocsifaddr.patch new file mode 100644 index 00000000000..af52ee1790c --- /dev/null +++ b/queue-2.6.36/econet-do-the-correct-cleanup-after-an-unprivileged-siocsifaddr.patch @@ -0,0 +1,35 @@ +From ae6c6401042f6046ba1d67255dee4d55584c8095 Mon Sep 17 00:00:00 2001 +From: Nelson Elhage +Date: Wed, 8 Dec 2010 10:13:55 -0800 +Subject: econet: Do the correct cleanup after an unprivileged SIOCSIFADDR. + + +From: Nelson Elhage + +[ Upstream commit f24b8bedf70c524775eabd51570c3fa7708a97b7 ] + +We need to drop the mutex and do a dev_put, so set an error code and break like +the other paths, instead of returning directly. + +Signed-off-by: Nelson Elhage +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/econet/af_econet.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/econet/af_econet.c ++++ b/net/econet/af_econet.c +@@ -661,8 +661,10 @@ static int ec_dev_ioctl(struct socket *s + err = 0; + switch (cmd) { + case SIOCSIFADDR: +- if (!capable(CAP_NET_ADMIN)) +- return -EPERM; ++ if (!capable(CAP_NET_ADMIN)) { ++ err = -EPERM; ++ break; ++ } + + edev = dev->ec_ptr; + if (edev == NULL) { diff --git a/queue-2.6.36/econet-fix-crash-in-aun_incoming.patch b/queue-2.6.36/econet-fix-crash-in-aun_incoming.patch new file mode 100644 index 00000000000..e60d2dab295 --- /dev/null +++ b/queue-2.6.36/econet-fix-crash-in-aun_incoming.patch @@ -0,0 +1,41 @@ +From ca737e3fe3069e4f6cd78104679e368c4e8bbafa Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 8 Dec 2010 18:42:23 -0800 +Subject: econet: Fix crash in aun_incoming(). + + +From: David S. Miller + +[ Upstream commit 4e085e76cbe558b79b54cbab772f61185879bc64 ] + +Unconditional use of skb->dev won't work here, +try to fetch the econet device via skb_dst()->dev +instead. + +Suggested by Eric Dumazet. + +Reported-by: Nelson Elhage +Tested-by: Nelson Elhage +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/econet/af_econet.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/econet/af_econet.c ++++ b/net/econet/af_econet.c +@@ -851,9 +851,13 @@ static void aun_incoming(struct sk_buff + { + struct iphdr *ip = ip_hdr(skb); + unsigned char stn = ntohl(ip->saddr) & 0xff; ++ struct dst_entry *dst = skb_dst(skb); ++ struct ec_device *edev = NULL; + struct sock *sk = NULL; + struct sk_buff *newskb; +- struct ec_device *edev = skb->dev->ec_ptr; ++ ++ if (dst) ++ edev = dst->dev->ec_ptr; + + if (! edev) + goto bad; diff --git a/queue-2.6.36/filter-fix-sk_filter-rcu-handling.patch b/queue-2.6.36/filter-fix-sk_filter-rcu-handling.patch new file mode 100644 index 00000000000..9b456fb4917 --- /dev/null +++ b/queue-2.6.36/filter-fix-sk_filter-rcu-handling.patch @@ -0,0 +1,100 @@ +From 2874b37a3009f34d6a80a3b63f21ab73759430f7 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 6 Dec 2010 09:29:43 -0800 +Subject: filter: fix sk_filter rcu handling + + +From: Eric Dumazet + +[ Upstream commit 46bcf14f44d8f31ecfdc8b6708ec15a3b33316d9 ] + +Pavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and +sk_clone() in commit 47e958eac280c263397 + +Problem is we can have several clones sharing a common sk_filter, and +these clones might want to sk_filter_attach() their own filters at the +same time, and can overwrite old_filter->rcu, corrupting RCU queues. + +We can not use filter->rcu without being sure no other thread could do +the same thing. + +Switch code to a more conventional ref-counting technique : Do the +atomic decrement immediately and queue one rcu call back when last +reference is released. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sock.h | 4 +++- + net/core/filter.c | 19 ++++++------------- + 2 files changed, 9 insertions(+), 14 deletions(-) + +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1155,6 +1155,8 @@ extern void sk_common_release(struct soc + /* Initialise core socket variables */ + extern void sock_init_data(struct socket *sock, struct sock *sk); + ++extern void sk_filter_release_rcu(struct rcu_head *rcu); ++ + /** + * sk_filter_release - release a socket filter + * @fp: filter to remove +@@ -1165,7 +1167,7 @@ extern void sock_init_data(struct socket + static inline void sk_filter_release(struct sk_filter *fp) + { + if (atomic_dec_and_test(&fp->refcnt)) +- kfree(fp); ++ call_rcu_bh(&fp->rcu, sk_filter_release_rcu); + } + + static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp) +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -589,23 +589,16 @@ int sk_chk_filter(struct sock_filter *fi + EXPORT_SYMBOL(sk_chk_filter); + + /** +- * sk_filter_rcu_release: Release a socket filter by rcu_head ++ * sk_filter_release_rcu - Release a socket filter by rcu_head + * @rcu: rcu_head that contains the sk_filter to free + */ +-static void sk_filter_rcu_release(struct rcu_head *rcu) ++void sk_filter_release_rcu(struct rcu_head *rcu) + { + struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu); + +- sk_filter_release(fp); +-} +- +-static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp) +-{ +- unsigned int size = sk_filter_len(fp); +- +- atomic_sub(size, &sk->sk_omem_alloc); +- call_rcu_bh(&fp->rcu, sk_filter_rcu_release); ++ kfree(fp); + } ++EXPORT_SYMBOL(sk_filter_release_rcu); + + /** + * sk_attach_filter - attach a socket filter +@@ -650,7 +643,7 @@ int sk_attach_filter(struct sock_fprog * + rcu_read_unlock_bh(); + + if (old_fp) +- sk_filter_delayed_uncharge(sk, old_fp); ++ sk_filter_uncharge(sk, old_fp); + return 0; + } + EXPORT_SYMBOL_GPL(sk_attach_filter); +@@ -664,7 +657,7 @@ int sk_detach_filter(struct sock *sk) + filter = rcu_dereference_bh(sk->sk_filter); + if (filter) { + rcu_assign_pointer(sk->sk_filter, NULL); +- sk_filter_delayed_uncharge(sk, filter); ++ sk_filter_uncharge(sk, filter); + ret = 0; + } + rcu_read_unlock_bh(); diff --git a/queue-2.6.36/ifb-goto-resched-directly-if-error-happens-and-dp-tq-isn-t-empty.patch b/queue-2.6.36/ifb-goto-resched-directly-if-error-happens-and-dp-tq-isn-t-empty.patch new file mode 100644 index 00000000000..f7c56449091 --- /dev/null +++ b/queue-2.6.36/ifb-goto-resched-directly-if-error-happens-and-dp-tq-isn-t-empty.patch @@ -0,0 +1,37 @@ +From 63eeabe277682c5513fc10dca72bc2393243a0da Mon Sep 17 00:00:00 2001 +From: Changli Gao +Date: Sat, 4 Dec 2010 14:09:08 +0000 +Subject: ifb: goto resched directly if error happens and dp->tq isn't empty + + +From: Changli Gao + +[ Upstream commit 75c1c82566f23dd539fb7ccbf57a1caa7ba82628 ] + +If we break the loop when there are still skbs in tq and no skb in +rq, the skbs will be left in txq until new skbs are enqueued into rq. +In rare cases, no new skb is queued, then these skbs will stay in rq +forever. + +After this patch, if tq isn't empty when we break the loop, we goto +resched directly. + +Signed-off-by: Changli Gao +Signed-off-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ifb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ifb.c ++++ b/drivers/net/ifb.c +@@ -104,6 +104,8 @@ static void ri_tasklet(unsigned long dev + rcu_read_unlock(); + dev_kfree_skb(skb); + stats->tx_dropped++; ++ if (skb_queue_len(&dp->tq) != 0) ++ goto resched; + break; + } + rcu_read_unlock(); diff --git a/queue-2.6.36/l2tp-fix-modalias-of-l2tp_ip.patch b/queue-2.6.36/l2tp-fix-modalias-of-l2tp_ip.patch new file mode 100644 index 00000000000..3b17ac2b67e --- /dev/null +++ b/queue-2.6.36/l2tp-fix-modalias-of-l2tp_ip.patch @@ -0,0 +1,33 @@ +From 2f2765fa320f450509254a5a630287b7bda0d7f2 Mon Sep 17 00:00:00 2001 +From: Michal Marek +Date: Mon, 6 Dec 2010 02:39:12 +0000 +Subject: l2tp: Fix modalias of l2tp_ip + + +From: Michal Marek + +[ Upstream commit 3e5653f0bc5150a2cc67b707130344ce05fb440e ] + +Using the SOCK_DGRAM enum results in +"net-pf-2-proto-SOCK_DGRAM-type-115", so use the numeric value like it +is done in net/dccp. + +Signed-off-by: Michal Marek +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/l2tp/l2tp_ip.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -676,4 +676,8 @@ MODULE_LICENSE("GPL"); + MODULE_AUTHOR("James Chapman "); + MODULE_DESCRIPTION("L2TP over IP"); + MODULE_VERSION("1.0"); +-MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, SOCK_DGRAM, IPPROTO_L2TP); ++ ++/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like ++ * enums ++ */ ++MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP); diff --git a/queue-2.6.36/net-ax25-fix-information-leak-to-userland.patch b/queue-2.6.36/net-ax25-fix-information-leak-to-userland.patch new file mode 100644 index 00000000000..645252b1ec0 --- /dev/null +++ b/queue-2.6.36/net-ax25-fix-information-leak-to-userland.patch @@ -0,0 +1,40 @@ +From 1f61298146dfba86e2bfc915ed4a55268fe8fb9c Mon Sep 17 00:00:00 2001 +From: Vasiliy Kulikov +Date: Wed, 10 Nov 2010 10:14:33 -0800 +Subject: net: ax25: fix information leak to userland + + +From: Vasiliy Kulikov + +[ Upstream commit fe10ae53384e48c51996941b7720ee16995cbcb7 ] + +Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater +field of fsa struct, also the struct has padding bytes between +sax25_call and sax25_ndigis fields. This structure is then copied to +userland. It leads to leaking of contents of kernel stack memory. + +Signed-off-by: Vasiliy Kulikov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ax25/af_ax25.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -1392,6 +1392,7 @@ static int ax25_getname(struct socket *s + ax25_cb *ax25; + int err = 0; + ++ memset(fsa, 0, sizeof(fsa)); + lock_sock(sk); + ax25 = ax25_sk(sk); + +@@ -1403,7 +1404,6 @@ static int ax25_getname(struct socket *s + + fsa->fsa_ax25.sax25_family = AF_AX25; + fsa->fsa_ax25.sax25_call = ax25->dest_addr; +- fsa->fsa_ax25.sax25_ndigis = 0; + + if (ax25->digipeat != NULL) { + ndigi = ax25->digipeat->ndigi; diff --git a/queue-2.6.36/net-dst-dst_dev_event-called-after-other-notifiers.patch b/queue-2.6.36/net-dst-dst_dev_event-called-after-other-notifiers.patch new file mode 100644 index 00000000000..8d0bb38b520 --- /dev/null +++ b/queue-2.6.36/net-dst-dst_dev_event-called-after-other-notifiers.patch @@ -0,0 +1,46 @@ +From cda994f8dd99aeedd618ac316dcecee653f9a09f Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 9 Nov 2010 11:46:33 -0800 +Subject: net/dst: dst_dev_event() called after other notifiers + + +From: Eric Dumazet + +[ Upstream commit 332dd96f7ac15e937088fe11f15cfe0210e8edd1 ] + +Followup of commit ef885afbf8a37689 (net: use rcu_barrier() in +rollback_registered_many) + +dst_dev_event() scans a garbage dst list that might be feeded by various +network notifiers at device dismantle time. + +Its important to call dst_dev_event() after other notifiers, or we might +enter the infamous msleep(250) in netdev_wait_allrefs(), and wait one +second before calling again call_netdevice_notifiers(NETDEV_UNREGISTER, +dev) to properly remove last device references. + +Use priority -10 to let dst_dev_notifier be called after other network +notifiers (they have the default 0 priority) + +Reported-by: Ben Greear +Reported-by: Nicolas Dichtel +Reported-by: Octavian Purdila +Reported-by: Benjamin LaHaise +Tested-by: Ben Greear +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dst.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -343,6 +343,7 @@ static int dst_dev_event(struct notifier + + static struct notifier_block dst_dev_notifier = { + .notifier_call = dst_dev_event, ++ .priority = -10, /* must be called after other network notifiers */ + }; + + void __init dst_init(void) diff --git a/queue-2.6.36/net-fix-header-size-check-for-gso-case-in-recvmsg-af_packet.patch b/queue-2.6.36/net-fix-header-size-check-for-gso-case-in-recvmsg-af_packet.patch new file mode 100644 index 00000000000..b31a6ea70e6 --- /dev/null +++ b/queue-2.6.36/net-fix-header-size-check-for-gso-case-in-recvmsg-af_packet.patch @@ -0,0 +1,34 @@ +From 0ea6875ae44c16d0d60c78b907a629bfd0469fc5 Mon Sep 17 00:00:00 2001 +From: Mariusz Kozlowski +Date: Mon, 8 Nov 2010 11:58:45 +0000 +Subject: net: Fix header size check for GSO case in recvmsg (af_packet) + + +From: Mariusz Kozlowski + +[ Upstream commit 54dd76848bf67b9fa40ac0340e5ee9c2876d5393 ] + +Parameter 'len' is size_t type so it will never get negative. + +Signed-off-by: Mariusz Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1610,9 +1610,11 @@ static int packet_recvmsg(struct kiocb * + + err = -EINVAL; + vnet_hdr_len = sizeof(vnet_hdr); +- if ((len -= vnet_hdr_len) < 0) ++ if (len < vnet_hdr_len) + goto out_free; + ++ len -= vnet_hdr_len; ++ + if (skb_is_gso(skb)) { + struct skb_shared_info *sinfo = skb_shinfo(skb); + diff --git a/queue-2.6.36/net-fix-skb_defer_rx_timestamp.patch b/queue-2.6.36/net-fix-skb_defer_rx_timestamp.patch new file mode 100644 index 00000000000..6f70de772fc --- /dev/null +++ b/queue-2.6.36/net-fix-skb_defer_rx_timestamp.patch @@ -0,0 +1,43 @@ +From a73552715830986b525c4483245eae628ed56f03 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sun, 5 Dec 2010 18:50:32 +0000 +Subject: net: fix skb_defer_rx_timestamp() + + +From: Eric Dumazet + +[ Upstream commit a19faf0250e09b16cac169354126404bc8aa342b ] + +After commit c1f19b51d1d8 (net: support time stamping in phy devices.), +kernel might crash if CONFIG_NETWORK_PHY_TIMESTAMPING=y and +skb_defer_rx_timestamp() handles a packet without an ethernet header. + +Fixes kernel bugzilla #24102 + +Reference: https://bugzilla.kernel.org/show_bug.cgi?id=24102 +Reported-and-tested-by: Andrew Watts +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/timestamping.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/core/timestamping.c ++++ b/net/core/timestamping.c +@@ -96,11 +96,13 @@ bool skb_defer_rx_timestamp(struct sk_bu + struct phy_device *phydev; + unsigned int type; + +- skb_push(skb, ETH_HLEN); ++ if (skb_headroom(skb) < ETH_HLEN) ++ return false; ++ __skb_push(skb, ETH_HLEN); + + type = classify(skb); + +- skb_pull(skb, ETH_HLEN); ++ __skb_pull(skb, ETH_HLEN); + + switch (type) { + case PTP_CLASS_V1_IPV4: diff --git a/queue-2.6.36/net-packet-fix-information-leak-to-userland.patch b/queue-2.6.36/net-packet-fix-information-leak-to-userland.patch new file mode 100644 index 00000000000..324e4fb0c7c --- /dev/null +++ b/queue-2.6.36/net-packet-fix-information-leak-to-userland.patch @@ -0,0 +1,44 @@ +From a2f962f45a112ae310caf82ba78c773cc4c4bcfe Mon Sep 17 00:00:00 2001 +From: Vasiliy Kulikov +Date: Wed, 10 Nov 2010 12:09:10 -0800 +Subject: net: packet: fix information leak to userland + + +From: Vasiliy Kulikov + +[ Upstream commit 67286640f638f5ad41a946b9a3dc75327950248f ] + +packet_getname_spkt() doesn't initialize all members of sa_data field of +sockaddr struct if strlen(dev->name) < 13. This structure is then copied +to userland. It leads to leaking of contents of kernel stack memory. +We have to fully fill sa_data with strncpy() instead of strlcpy(). + +The same with packet_getname(): it doesn't initialize sll_pkttype field of +sockaddr_ll. Set it to zero. + +Signed-off-by: Vasiliy Kulikov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1721,7 +1721,7 @@ static int packet_getname_spkt(struct so + rcu_read_lock(); + dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); + if (dev) +- strlcpy(uaddr->sa_data, dev->name, 15); ++ strncpy(uaddr->sa_data, dev->name, 14); + else + memset(uaddr->sa_data, 0, 14); + rcu_read_unlock(); +@@ -1744,6 +1744,7 @@ static int packet_getname(struct socket + sll->sll_family = AF_PACKET; + sll->sll_ifindex = po->ifindex; + sll->sll_protocol = po->num; ++ sll->sll_pkttype = 0; + rcu_read_lock(); + dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex); + if (dev) { diff --git a/queue-2.6.36/pppoe.c-fix-kernel-panic-caused-by-__pppoe_xmit.patch b/queue-2.6.36/pppoe.c-fix-kernel-panic-caused-by-__pppoe_xmit.patch new file mode 100644 index 00000000000..9c99678503d --- /dev/null +++ b/queue-2.6.36/pppoe.c-fix-kernel-panic-caused-by-__pppoe_xmit.patch @@ -0,0 +1,44 @@ +From 821fbf5a13a45e3aa9a7a2f0a1ca330adb3778ab Mon Sep 17 00:00:00 2001 +From: Andrej Ota +Date: Sun, 12 Dec 2010 15:06:16 -0800 +Subject: pppoe.c: Fix kernel panic caused by __pppoe_xmit + + +From: Andrej Ota + +[ Upstream commit 2a27a03d3a891e87ca33d27a858b4db734a4cbab ] + +__pppoe_xmit function return value was invalid resulting in +additional call to kfree_skb on already freed skb. This resulted in +memory corruption and consequent kernel panic after PPPoE peer +terminated the link. + +This fixes commit 55c95e738da85373965cb03b4f975d0fd559865b. + +Reported-by: Gorik Van Steenberge +Reported-by: Daniel Kenzelmann +Reported-by: Denys Fedoryshchenko +Reported-by: Pawel Staszewski +Diagnosed-by: Andrej Ota +Diagnosed-by: Eric Dumazet +Tested-by: Denys Fedoryshchenko +Tested-by: Pawel Staszewski +Signed-off-by: Jarek Poplawski +Signed-off-by: Andrej Ota +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/pppoe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/pppoe.c ++++ b/drivers/net/pppoe.c +@@ -948,7 +948,7 @@ static int __pppoe_xmit(struct sock *sk, + + abort: + kfree_skb(skb); +- return 0; ++ return 1; + } + + /************************************************************************ diff --git a/queue-2.6.36/r8169-fix-sleeping-while-holding-spinlock.patch b/queue-2.6.36/r8169-fix-sleeping-while-holding-spinlock.patch new file mode 100644 index 00000000000..a7f6f3c130e --- /dev/null +++ b/queue-2.6.36/r8169-fix-sleeping-while-holding-spinlock.patch @@ -0,0 +1,36 @@ +From 38ee10ad3fe93cb40985376fbf7ae0a30b48fa41 Mon Sep 17 00:00:00 2001 +From: françois romieu +Date: Mon, 8 Nov 2010 13:23:58 +0000 +Subject: r8169: fix sleeping while holding spinlock. + +From: françois romieu + +[ Upstream commit ea80907ff066edd1dd43c5fe90ae6677d15e6384 ] + +As device_set_wakeup_enable can now sleep, move the call to outside +the critical section. + +Signed-off-by: Daniel J Blueman +Acked-by: Rafael J. Wysocki +Acked-by: Andrew Hendry +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/r8169.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -855,10 +855,10 @@ static int rtl8169_set_wol(struct net_de + else + tp->features &= ~RTL_FEATURE_WOL; + __rtl8169_set_wol(tp, wol->wolopts); +- device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts); +- + spin_unlock_irq(&tp->lock); + ++ device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts); ++ + return 0; + } + diff --git a/queue-2.6.36/series b/queue-2.6.36/series index bee6bd645cd..9bec671cbc0 100644 --- a/queue-2.6.36/series +++ b/queue-2.6.36/series @@ -40,3 +40,40 @@ ath9k-fix-bug-in-reading-input-gpio-state-for-ar9003.patch ath9k_hw-fix-endian-issues-with-ctls-on-ar9003.patch ath9k-fix-bug-in-tx-power.patch mac80211-fix-bug-in-pskb_expand_head-when-transmitting-shared-skbs.patch +sparc-leon-removed-constant-timer-initialization-as-if-hz-100-now-it-reflects-the-value-of-hz.patch +sparc64-delete-prom_puts-unused.patch +sparc-remove-prom_pathtoinode.patch +sparc-kill-prom-devops_-32-64-.c.patch +sparc64-unexport-prom_service_exists.patch +sparc64-delete-prom_setcallback.patch +sparc-do-not-export-prom_nb-get-put-char.patch +sparc-pass-buffer-pointer-all-the-way-down-to-prom_-get-put-char.patch +sparc-delete-prom_-getchar.patch +sparc-write-to-prom-console-using-indirect-buffer.patch +tcp-don-t-change-unlocked-socket-state-in-tcp_v4_err.patch +tcp-increase-tcp_maxseg-socket-option-minimum.patch +tcp-make-tcp_maxseg-minimum-more-correct.patch +tcp-bug-fix-in-initialization-of-receive-window.patch +tcp-avoid-a-possible-divide-by-zero.patch +tcp-protect-sysctl_tcp_cookie_size-reads.patch +8139cp-fix-checksum-broken.patch +r8169-fix-sleeping-while-holding-spinlock.patch +af_unix-limit-unix_tot_inflight.patch +af_unix-limit-recursion-level.patch +net-ax25-fix-information-leak-to-userland.patch +driver-net-benet-fix-be_cmd_multicast_set-memcpy-bug.patch +bonding-fix-slave-selection-bug.patch +bridge-fix-ipv6-queries-for-bridge-multicast-snooping.patch +cls_cgroup-fix-crash-on-module-unload.patch +filter-fix-sk_filter-rcu-handling.patch +econet-do-the-correct-cleanup-after-an-unprivileged-siocsifaddr.patch +econet-fix-crash-in-aun_incoming.patch +ifb-goto-resched-directly-if-error-happens-and-dp-tq-isn-t-empty.patch +l2tp-fix-modalias-of-l2tp_ip.patch +x25-decrement-netdev-reference-counts-on-unload.patch +tehuti-firmware-filename-is-tehuti-bdx.bin.patch +net-dst-dst_dev_event-called-after-other-notifiers.patch +net-fix-header-size-check-for-gso-case-in-recvmsg-af_packet.patch +net-fix-skb_defer_rx_timestamp.patch +net-packet-fix-information-leak-to-userland.patch +pppoe.c-fix-kernel-panic-caused-by-__pppoe_xmit.patch diff --git a/queue-2.6.36/sparc-delete-prom_-getchar.patch b/queue-2.6.36/sparc-delete-prom_-getchar.patch new file mode 100644 index 00000000000..7c6f8e4be2f --- /dev/null +++ b/queue-2.6.36/sparc-delete-prom_-getchar.patch @@ -0,0 +1,154 @@ +From 771babb4c614ecc81ee901527fbbfe61d45d3570 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 30 Nov 2010 14:53:05 -0800 +Subject: sparc: Delete prom_*getchar(). + + +From: David S. Miller + +[ Upstream commit 12c7a35ee6a1c605e740733f2cbd5b5079f09f0f ] + +Completely unused. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/oplib_32.h | 5 ---- + arch/sparc/include/asm/oplib_64.h | 5 ---- + arch/sparc/prom/console_32.c | 41 -------------------------------------- + arch/sparc/prom/console_64.c | 32 ----------------------------- + 4 files changed, 83 deletions(-) + +--- a/arch/sparc/include/asm/oplib_32.h ++++ b/arch/sparc/include/asm/oplib_32.h +@@ -102,11 +102,6 @@ extern int prom_getrev(void); + /* Get the prom firmware revision. */ + extern int prom_getprev(void); + +-/* Character operations to/from the console.... */ +- +-/* Blocking get character from console. */ +-extern void prom_getchar(char *buf); +- + /* Blocking put character to console. */ + extern void prom_putchar(const char *buf); + +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -94,11 +94,6 @@ extern void prom_halt_power_off(void) __ + */ + extern unsigned char prom_get_idprom(char *idp_buffer, int idpbuf_size); + +-/* Character operations to/from the console.... */ +- +-/* Blocking get character from console. */ +-extern void prom_getchar(char *buf); +- + /* Blocking put character to console. */ + extern void prom_putchar(const char *buf); + +--- a/arch/sparc/prom/console_32.c ++++ b/arch/sparc/prom/console_32.c +@@ -16,37 +16,6 @@ + + extern void restore_current(void); + +-/* Non blocking get character from console input device, returns -1 +- * if no input was taken. This can be used for polling. +- */ +-static int prom_nbgetchar(char *buf) +-{ +- unsigned long flags; +- int i = -1; +- +- spin_lock_irqsave(&prom_lock, flags); +- switch(prom_vers) { +- case PROM_V0: +- i = (*(romvec->pv_nbgetchar))(); +- if (i != -1) { +- *buf = i; +- i = 0; +- } +- break; +- case PROM_V2: +- case PROM_V3: +- if ((*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin, +- buf, 0x1) == 1) +- i = 0; +- break; +- default: +- break; +- }; +- restore_current(); +- spin_unlock_irqrestore(&prom_lock, flags); +- return i; /* Ugh, we could spin forever on unsupported proms ;( */ +-} +- + /* Non blocking put character to console device, returns -1 if + * unsuccessful. + */ +@@ -74,16 +43,6 @@ static int prom_nbputchar(const char *bu + return i; /* Ugh, we could spin forever on unsupported proms ;( */ + } + +-/* Blocking version of get character routine above. */ +-void prom_getchar(char *buf) +-{ +- while (1) { +- int err = prom_nbgetchar(buf); +- if (!err) +- break; +- } +-} +- + /* Blocking version of put character routine above. */ + void prom_putchar(const char *buf) + { +--- a/arch/sparc/prom/console_64.c ++++ b/arch/sparc/prom/console_64.c +@@ -15,28 +15,6 @@ + + extern int prom_stdin, prom_stdout; + +-/* Non blocking get character from console input device, returns -1 +- * if no input was taken. This can be used for polling. +- */ +-static int prom_nbgetchar(char *buf) +-{ +- unsigned long args[7]; +- +- args[0] = (unsigned long) "read"; +- args[1] = 3; +- args[2] = 1; +- args[3] = (unsigned int) prom_stdin; +- args[4] = (unsigned long) buf; +- args[5] = 1; +- args[6] = (unsigned long) -1; +- +- p1275_cmd_direct(args); +- +- if (args[6] == 1) +- return 0; +- return -1; +-} +- + /* Non blocking put character to console device, returns -1 if + * unsuccessful. + */ +@@ -60,16 +38,6 @@ static int prom_nbputchar(const char *bu + return -1; + } + +-/* Blocking version of get character routine above. */ +-void prom_getchar(char *buf) +-{ +- while (1) { +- int err = prom_nbgetchar(buf); +- if (!err) +- break; +- } +-} +- + /* Blocking version of put character routine above. */ + void prom_putchar(const char *buf) + { diff --git a/queue-2.6.36/sparc-do-not-export-prom_nb-get-put-char.patch b/queue-2.6.36/sparc-do-not-export-prom_nb-get-put-char.patch new file mode 100644 index 00000000000..3e093fe9bb6 --- /dev/null +++ b/queue-2.6.36/sparc-do-not-export-prom_nb-get-put-char.patch @@ -0,0 +1,95 @@ +From d775633c84060f48f0136a69d15249a806ad407e Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 17 Nov 2010 10:22:56 -0800 +Subject: sparc: Do not export prom_nb{get,put}char(). + + +From: David S. Miller + +[ Upstream commit 91921fef7c658b12de53376b312d071d757f7770 ] + +Never used outside of console_{32,64}.c + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/oplib_32.h | 6 ------ + arch/sparc/include/asm/oplib_64.h | 6 ------ + arch/sparc/prom/console_32.c | 6 ++---- + arch/sparc/prom/console_64.c | 6 ++---- + 4 files changed, 4 insertions(+), 20 deletions(-) + +--- a/arch/sparc/include/asm/oplib_32.h ++++ b/arch/sparc/include/asm/oplib_32.h +@@ -104,12 +104,6 @@ extern int prom_getprev(void); + + /* Character operations to/from the console.... */ + +-/* Non-blocking get character from console. */ +-extern int prom_nbgetchar(void); +- +-/* Non-blocking put character to console. */ +-extern int prom_nbputchar(char character); +- + /* Blocking get character from console. */ + extern char prom_getchar(void); + +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -96,12 +96,6 @@ extern unsigned char prom_get_idprom(cha + + /* Character operations to/from the console.... */ + +-/* Non-blocking get character from console. */ +-extern int prom_nbgetchar(void); +- +-/* Non-blocking put character to console. */ +-extern int prom_nbputchar(char character); +- + /* Blocking get character from console. */ + extern char prom_getchar(void); + +--- a/arch/sparc/prom/console_32.c ++++ b/arch/sparc/prom/console_32.c +@@ -19,8 +19,7 @@ extern void restore_current(void); + /* Non blocking get character from console input device, returns -1 + * if no input was taken. This can be used for polling. + */ +-int +-prom_nbgetchar(void) ++static int prom_nbgetchar(void) + { + static char inc; + int i = -1; +@@ -51,8 +50,7 @@ prom_nbgetchar(void) + /* Non blocking put character to console device, returns -1 if + * unsuccessful. + */ +-int +-prom_nbputchar(char c) ++static int prom_nbputchar(char c) + { + static char outc; + unsigned long flags; +--- a/arch/sparc/prom/console_64.c ++++ b/arch/sparc/prom/console_64.c +@@ -18,8 +18,7 @@ extern int prom_stdin, prom_stdout; + /* Non blocking get character from console input device, returns -1 + * if no input was taken. This can be used for polling. + */ +-inline int +-prom_nbgetchar(void) ++static int prom_nbgetchar(void) + { + unsigned long args[7]; + char inc; +@@ -42,8 +41,7 @@ prom_nbgetchar(void) + /* Non blocking put character to console device, returns -1 if + * unsuccessful. + */ +-inline int +-prom_nbputchar(char c) ++static int prom_nbputchar(char c) + { + unsigned long args[7]; + char outc; diff --git a/queue-2.6.36/sparc-kill-prom-devops_-32-64-.c.patch b/queue-2.6.36/sparc-kill-prom-devops_-32-64-.c.patch new file mode 100644 index 00000000000..c1bb3c36185 --- /dev/null +++ b/queue-2.6.36/sparc-kill-prom-devops_-32-64-.c.patch @@ -0,0 +1,252 @@ +From 731e466bd3f80a9601e848fe0262e65c9ef0b377 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 16 Nov 2010 12:23:20 -0800 +Subject: sparc: Kill prom devops_{32,64}.c + + +From: David S. Miller + +[ Upstream commit b148246912bea92bde2a0cba125ca94f1f776b12 ] + +Completely unused. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/oplib_32.h | 19 -------- + arch/sparc/include/asm/oplib_64.h | 21 --------- + arch/sparc/prom/Makefile | 1 + arch/sparc/prom/devops_32.c | 87 -------------------------------------- + arch/sparc/prom/devops_64.c | 67 ----------------------------- + 5 files changed, 195 deletions(-) + delete mode 100644 arch/sparc/prom/devops_32.c + delete mode 100644 arch/sparc/prom/devops_64.c + +--- a/arch/sparc/include/asm/oplib_32.h ++++ b/arch/sparc/include/asm/oplib_32.h +@@ -60,25 +60,6 @@ extern char *prom_getbootargs(void); + extern char *prom_mapio(char *virt_hint, int io_space, unsigned int phys_addr, unsigned int num_bytes); + extern void prom_unmapio(char *virt_addr, unsigned int num_bytes); + +-/* Device operations. */ +- +-/* Open the device described by the passed string. Note, that the format +- * of the string is different on V0 vs. V2->higher proms. The caller must +- * know what he/she is doing! Returns the device descriptor, an int. +- */ +-extern int prom_devopen(char *device_string); +- +-/* Close a previously opened device described by the passed integer +- * descriptor. +- */ +-extern int prom_devclose(int device_handle); +- +-/* Do a seek operation on the device described by the passed integer +- * descriptor. +- */ +-extern void prom_seek(int device_handle, unsigned int seek_hival, +- unsigned int seek_lowval); +- + /* Miscellaneous routines, don't really fit in any category per se. */ + + /* Reboot the machine with the command line passed. */ +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -67,27 +67,6 @@ extern void prom_init(void *cif_handler, + /* Boot argument acquisition, returns the boot command line string. */ + extern char *prom_getbootargs(void); + +-/* Device utilities. */ +- +-/* Device operations. */ +- +-/* Open the device described by the passed string. Note, that the format +- * of the string is different on V0 vs. V2->higher proms. The caller must +- * know what he/she is doing! Returns the device descriptor, an int. +- */ +-extern int prom_devopen(const char *device_string); +- +-/* Close a previously opened device described by the passed integer +- * descriptor. +- */ +-extern int prom_devclose(int device_handle); +- +-/* Do a seek operation on the device described by the passed integer +- * descriptor. +- */ +-extern void prom_seek(int device_handle, unsigned int seek_hival, +- unsigned int seek_lowval); +- + /* Miscellaneous routines, don't really fit in any category per se. */ + + /* Reboot the machine with the command line passed. */ +--- a/arch/sparc/prom/Makefile ++++ b/arch/sparc/prom/Makefile +@@ -6,7 +6,6 @@ ccflags := -Werror + + lib-y := bootstr_$(BITS).o + lib-$(CONFIG_SPARC32) += devmap.o +-lib-y += devops_$(BITS).o + lib-y += init_$(BITS).o + lib-$(CONFIG_SPARC32) += memory.o + lib-y += misc_$(BITS).o +--- a/arch/sparc/prom/devops_32.c ++++ /dev/null +@@ -1,87 +0,0 @@ +-/* +- * devops.c: Device operations using the PROM. +- * +- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu) +- */ +-#include +-#include +-#include +- +-#include +-#include +- +-extern void restore_current(void); +- +-/* Open the device described by the string 'dstr'. Returns the handle +- * to that device used for subsequent operations on that device. +- * Returns -1 on failure. +- */ +-int +-prom_devopen(char *dstr) +-{ +- int handle; +- unsigned long flags; +- spin_lock_irqsave(&prom_lock, flags); +- switch(prom_vers) { +- case PROM_V0: +- handle = (*(romvec->pv_v0devops.v0_devopen))(dstr); +- if(handle == 0) handle = -1; +- break; +- case PROM_V2: +- case PROM_V3: +- handle = (*(romvec->pv_v2devops.v2_dev_open))(dstr); +- break; +- default: +- handle = -1; +- break; +- }; +- restore_current(); +- spin_unlock_irqrestore(&prom_lock, flags); +- +- return handle; +-} +- +-/* Close the device described by device handle 'dhandle'. */ +-int +-prom_devclose(int dhandle) +-{ +- unsigned long flags; +- spin_lock_irqsave(&prom_lock, flags); +- switch(prom_vers) { +- case PROM_V0: +- (*(romvec->pv_v0devops.v0_devclose))(dhandle); +- break; +- case PROM_V2: +- case PROM_V3: +- (*(romvec->pv_v2devops.v2_dev_close))(dhandle); +- break; +- default: +- break; +- }; +- restore_current(); +- spin_unlock_irqrestore(&prom_lock, flags); +- return 0; +-} +- +-/* Seek to specified location described by 'seekhi' and 'seeklo' +- * for device 'dhandle'. +- */ +-void +-prom_seek(int dhandle, unsigned int seekhi, unsigned int seeklo) +-{ +- unsigned long flags; +- spin_lock_irqsave(&prom_lock, flags); +- switch(prom_vers) { +- case PROM_V0: +- (*(romvec->pv_v0devops.v0_seekdev))(dhandle, seekhi, seeklo); +- break; +- case PROM_V2: +- case PROM_V3: +- (*(romvec->pv_v2devops.v2_dev_seek))(dhandle, seekhi, seeklo); +- break; +- default: +- break; +- }; +- restore_current(); +- spin_unlock_irqrestore(&prom_lock, flags); +-} +--- a/arch/sparc/prom/devops_64.c ++++ /dev/null +@@ -1,67 +0,0 @@ +-/* +- * devops.c: Device operations using the PROM. +- * +- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu) +- * Copyright (C) 1996,1997 Jakub Jelinek (jj@sunsite.mff.cuni.cz) +- */ +-#include +-#include +-#include +- +-#include +-#include +- +-/* Open the device described by the string 'dstr'. Returns the handle +- * to that device used for subsequent operations on that device. +- * Returns 0 on failure. +- */ +-int +-prom_devopen(const char *dstr) +-{ +- unsigned long args[5]; +- +- args[0] = (unsigned long) "open"; +- args[1] = 1; +- args[2] = 1; +- args[3] = (unsigned long) dstr; +- args[4] = (unsigned long) -1; +- +- p1275_cmd_direct(args); +- +- return (int) args[4]; +-} +- +-/* Close the device described by device handle 'dhandle'. */ +-int +-prom_devclose(int dhandle) +-{ +- unsigned long args[4]; +- +- args[0] = (unsigned long) "close"; +- args[1] = 1; +- args[2] = 0; +- args[3] = (unsigned int) dhandle; +- +- p1275_cmd_direct(args); +- +- return 0; +-} +- +-/* Seek to specified location described by 'seekhi' and 'seeklo' +- * for device 'dhandle'. +- */ +-void +-prom_seek(int dhandle, unsigned int seekhi, unsigned int seeklo) +-{ +- unsigned long args[7]; +- +- args[0] = (unsigned long) "seek"; +- args[1] = 3; +- args[2] = 1; +- args[3] = (unsigned int) dhandle; +- args[4] = seekhi; +- args[5] = seeklo; +- args[6] = (unsigned long) -1; +- +- p1275_cmd_direct(args); +-} diff --git a/queue-2.6.36/sparc-leon-removed-constant-timer-initialization-as-if-hz-100-now-it-reflects-the-value-of-hz.patch b/queue-2.6.36/sparc-leon-removed-constant-timer-initialization-as-if-hz-100-now-it-reflects-the-value-of-hz.patch new file mode 100644 index 00000000000..e3cf514f192 --- /dev/null +++ b/queue-2.6.36/sparc-leon-removed-constant-timer-initialization-as-if-hz-100-now-it-reflects-the-value-of-hz.patch @@ -0,0 +1,37 @@ +From b203e3cc8ab98a0e6a0d1bef65dbabc0d2ebad0e Mon Sep 17 00:00:00 2001 +From: Daniel Hellstrom +Date: Fri, 29 Oct 2010 13:25:24 -0700 +Subject: SPARC/LEON: removed constant timer initialization as if HZ=100, now it reflects the value of HZ + + +From: Daniel Hellstrom + +[ Upstream commit b690c425fe07c725e7f1f7d40303588416cba67f ] + +Signed-off-by: Daniel Hellstrom +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/leon_kernel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/leon_kernel.c ++++ b/arch/sparc/kernel/leon_kernel.c +@@ -114,7 +114,7 @@ void __init leon_init_timers(irq_handler + if (leon3_gptimer_regs && leon3_irqctrl_regs) { + LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].val, 0); + LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].rld, +- (((1000000 / 100) - 1))); ++ (((1000000 / HZ) - 1))); + LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].ctrl, 0); + + #ifdef CONFIG_SMP +@@ -128,7 +128,7 @@ void __init leon_init_timers(irq_handler + } + + LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].val, 0); +- LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].rld, (((1000000/100) - 1))); ++ LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].rld, (((1000000/HZ) - 1))); + LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].ctrl, 0); + # endif + diff --git a/queue-2.6.36/sparc-pass-buffer-pointer-all-the-way-down-to-prom_-get-put-char.patch b/queue-2.6.36/sparc-pass-buffer-pointer-all-the-way-down-to-prom_-get-put-char.patch new file mode 100644 index 00000000000..d7f40ddb361 --- /dev/null +++ b/queue-2.6.36/sparc-pass-buffer-pointer-all-the-way-down-to-prom_-get-put-char.patch @@ -0,0 +1,270 @@ +From 859fb9bffac2f3fb2e32766a2ce57f1789e33064 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 30 Nov 2010 14:33:29 -0800 +Subject: sparc: Pass buffer pointer all the way down to prom_{get,put}char(). + + +From: David S. Miller + +[ Upstream commit e62cac1fd035b4cde707285008499dbe71955a86 ] + +This gets us closer to being able to eliminate the use +of dynamic and stack based buffers, so that we can adhere +to the "no buffer addresses above 4GB" rule for PROM calls. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/openprom.h | 2 - + arch/sparc/include/asm/oplib_32.h | 4 +-- + arch/sparc/include/asm/oplib_64.h | 4 +-- + arch/sparc/prom/console_32.c | 50 +++++++++++++++++++------------------- + arch/sparc/prom/console_64.c | 34 ++++++++++++------------- + arch/sparc/prom/printf.c | 15 ++++++----- + 6 files changed, 55 insertions(+), 54 deletions(-) + +--- a/arch/sparc/include/asm/openprom.h ++++ b/arch/sparc/include/asm/openprom.h +@@ -37,7 +37,7 @@ struct linux_dev_v2_funcs { + int (*v2_dev_open)(char *devpath); + void (*v2_dev_close)(int d); + int (*v2_dev_read)(int d, char *buf, int nbytes); +- int (*v2_dev_write)(int d, char *buf, int nbytes); ++ int (*v2_dev_write)(int d, const char *buf, int nbytes); + int (*v2_dev_seek)(int d, int hi, int lo); + + /* Never issued (multistage load support) */ +--- a/arch/sparc/include/asm/oplib_32.h ++++ b/arch/sparc/include/asm/oplib_32.h +@@ -105,10 +105,10 @@ extern int prom_getprev(void); + /* Character operations to/from the console.... */ + + /* Blocking get character from console. */ +-extern char prom_getchar(void); ++extern void prom_getchar(char *buf); + + /* Blocking put character to console. */ +-extern void prom_putchar(char character); ++extern void prom_putchar(const char *buf); + + /* Prom's internal routines, don't use in kernel/boot code. */ + extern void prom_printf(const char *fmt, ...); +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -97,10 +97,10 @@ extern unsigned char prom_get_idprom(cha + /* Character operations to/from the console.... */ + + /* Blocking get character from console. */ +-extern char prom_getchar(void); ++extern void prom_getchar(char *buf); + + /* Blocking put character to console. */ +-extern void prom_putchar(char character); ++extern void prom_putchar(const char *buf); + + /* Prom's internal routines, don't use in kernel/boot code. */ + extern void prom_printf(const char *fmt, ...); +--- a/arch/sparc/prom/console_32.c ++++ b/arch/sparc/prom/console_32.c +@@ -19,27 +19,27 @@ extern void restore_current(void); + /* Non blocking get character from console input device, returns -1 + * if no input was taken. This can be used for polling. + */ +-static int prom_nbgetchar(void) ++static int prom_nbgetchar(char *buf) + { +- static char inc; +- int i = -1; + unsigned long flags; ++ int i = -1; + + spin_lock_irqsave(&prom_lock, flags); + switch(prom_vers) { + case PROM_V0: + i = (*(romvec->pv_nbgetchar))(); ++ if (i != -1) { ++ *buf = i; ++ i = 0; ++ } + break; + case PROM_V2: + case PROM_V3: +- if( (*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin , &inc, 0x1) == 1) { +- i = inc; +- } else { +- i = -1; +- } ++ if ((*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin, ++ buf, 0x1) == 1) ++ i = 0; + break; + default: +- i = -1; + break; + }; + restore_current(); +@@ -50,27 +50,23 @@ static int prom_nbgetchar(void) + /* Non blocking put character to console device, returns -1 if + * unsuccessful. + */ +-static int prom_nbputchar(char c) ++static int prom_nbputchar(const char *buf) + { +- static char outc; + unsigned long flags; + int i = -1; + + spin_lock_irqsave(&prom_lock, flags); + switch(prom_vers) { + case PROM_V0: +- i = (*(romvec->pv_nbputchar))(c); ++ i = (*(romvec->pv_nbputchar))(*buf); + break; + case PROM_V2: + case PROM_V3: +- outc = c; +- if( (*(romvec->pv_v2devops).v2_dev_write)(*romvec->pv_v2bootargs.fd_stdout, &outc, 0x1) == 1) ++ if ((*(romvec->pv_v2devops).v2_dev_write)(*romvec->pv_v2bootargs.fd_stdout, ++ buf, 0x1) == 1) + i = 0; +- else +- i = -1; + break; + default: +- i = -1; + break; + }; + restore_current(); +@@ -79,17 +75,21 @@ static int prom_nbputchar(char c) + } + + /* Blocking version of get character routine above. */ +-char +-prom_getchar(void) ++void prom_getchar(char *buf) + { +- int character; +- while((character = prom_nbgetchar()) == -1) ; +- return (char) character; ++ while (1) { ++ int err = prom_nbgetchar(buf); ++ if (!err) ++ break; ++ } + } + + /* Blocking version of put character routine above. */ +-void +-prom_putchar(char c) ++void prom_putchar(const char *buf) + { +- while(prom_nbputchar(c) == -1) ; ++ while (1) { ++ int err = prom_nbputchar(buf); ++ if (!err) ++ break; ++ } + } +--- a/arch/sparc/prom/console_64.c ++++ b/arch/sparc/prom/console_64.c +@@ -18,41 +18,37 @@ extern int prom_stdin, prom_stdout; + /* Non blocking get character from console input device, returns -1 + * if no input was taken. This can be used for polling. + */ +-static int prom_nbgetchar(void) ++static int prom_nbgetchar(char *buf) + { + unsigned long args[7]; +- char inc; + + args[0] = (unsigned long) "read"; + args[1] = 3; + args[2] = 1; + args[3] = (unsigned int) prom_stdin; +- args[4] = (unsigned long) &inc; ++ args[4] = (unsigned long) buf; + args[5] = 1; + args[6] = (unsigned long) -1; + + p1275_cmd_direct(args); + + if (args[6] == 1) +- return inc; ++ return 0; + return -1; + } + + /* Non blocking put character to console device, returns -1 if + * unsuccessful. + */ +-static int prom_nbputchar(char c) ++static int prom_nbputchar(const char *buf) + { + unsigned long args[7]; +- char outc; +- +- outc = c; + + args[0] = (unsigned long) "write"; + args[1] = 3; + args[2] = 1; + args[3] = (unsigned int) prom_stdout; +- args[4] = (unsigned long) &outc; ++ args[4] = (unsigned long) buf; + args[5] = 1; + args[6] = (unsigned long) -1; + +@@ -65,17 +61,21 @@ static int prom_nbputchar(char c) + } + + /* Blocking version of get character routine above. */ +-char +-prom_getchar(void) ++void prom_getchar(char *buf) + { +- int character; +- while((character = prom_nbgetchar()) == -1) ; +- return (char) character; ++ while (1) { ++ int err = prom_nbgetchar(buf); ++ if (!err) ++ break; ++ } + } + + /* Blocking version of put character routine above. */ +-void +-prom_putchar(char c) ++void prom_putchar(const char *buf) + { +- prom_nbputchar(c); ++ while (1) { ++ int err = prom_nbputchar(buf); ++ if (!err) ++ break; ++ } + } +--- a/arch/sparc/prom/printf.c ++++ b/arch/sparc/prom/printf.c +@@ -23,13 +23,14 @@ static char ppbuf[1024]; + + void notrace prom_write(const char *buf, unsigned int n) + { +- char ch; +- +- while (n != 0) { +- --n; +- if ((ch = *buf++) == '\n') +- prom_putchar('\r'); +- prom_putchar(ch); ++ while (n-- != 0) { ++ char ch = *buf; ++ if (ch == '\n') { ++ char tmp = '\r'; ++ prom_putchar(&tmp); ++ } ++ prom_putchar(buf); ++ buf++; + } + } + diff --git a/queue-2.6.36/sparc-remove-prom_pathtoinode.patch b/queue-2.6.36/sparc-remove-prom_pathtoinode.patch new file mode 100644 index 00000000000..c0b2778aa36 --- /dev/null +++ b/queue-2.6.36/sparc-remove-prom_pathtoinode.patch @@ -0,0 +1,89 @@ +From 4948cb473bbe934273498daec57176dddf188c65 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 16 Nov 2010 12:11:15 -0800 +Subject: sparc: Remove prom_pathtoinode() + + +From: David S. Miller + +[ Upstream commit 17d70d6df0c4ea7a203b444001572a91ad9c2bef ] + +Unused. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/oplib_32.h | 1 - + arch/sparc/include/asm/oplib_64.h | 1 - + arch/sparc/prom/tree_32.c | 15 --------------- + arch/sparc/prom/tree_64.c | 18 ------------------ + 4 files changed, 35 deletions(-) + +--- a/arch/sparc/include/asm/oplib_32.h ++++ b/arch/sparc/include/asm/oplib_32.h +@@ -238,7 +238,6 @@ extern int prom_node_has_property(int no + extern int prom_setprop(int node, const char *prop_name, char *prop_value, + int value_size); + +-extern int prom_pathtoinode(char *path); + extern int prom_inst2pkg(int); + + /* Dorking with Bus ranges... */ +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -278,7 +278,6 @@ extern int prom_finddevice(const char *n + extern int prom_setprop(int node, const char *prop_name, char *prop_value, + int value_size); + +-extern int prom_pathtoinode(const char *path); + extern int prom_inst2pkg(int); + extern int prom_service_exists(const char *service_name); + extern void prom_sun4v_guest_soft_state(void); +--- a/arch/sparc/prom/tree_32.c ++++ b/arch/sparc/prom/tree_32.c +@@ -341,18 +341,3 @@ int prom_inst2pkg(int inst) + if (node == -1) return 0; + return node; + } +- +-/* Return 'node' assigned to a particular prom 'path' +- * FIXME: Should work for v0 as well +- */ +-int prom_pathtoinode(char *path) +-{ +- int node, inst; +- +- inst = prom_devopen (path); +- if (inst == -1) return 0; +- node = prom_inst2pkg (inst); +- prom_devclose (inst); +- if (node == -1) return 0; +- return node; +-} +--- a/arch/sparc/prom/tree_64.c ++++ b/arch/sparc/prom/tree_64.c +@@ -374,24 +374,6 @@ inline int prom_inst2pkg(int inst) + return node; + } + +-/* Return 'node' assigned to a particular prom 'path' +- * FIXME: Should work for v0 as well +- */ +-int +-prom_pathtoinode(const char *path) +-{ +- int node, inst; +- +- inst = prom_devopen (path); +- if (inst == 0) +- return 0; +- node = prom_inst2pkg(inst); +- prom_devclose(inst); +- if (node == -1) +- return 0; +- return node; +-} +- + int prom_ihandle2path(int handle, char *buffer, int bufsize) + { + unsigned long args[7]; diff --git a/queue-2.6.36/sparc-write-to-prom-console-using-indirect-buffer.patch b/queue-2.6.36/sparc-write-to-prom-console-using-indirect-buffer.patch new file mode 100644 index 00000000000..800e95e1a92 --- /dev/null +++ b/queue-2.6.36/sparc-write-to-prom-console-using-indirect-buffer.patch @@ -0,0 +1,190 @@ +From 699a02e295c0ee4826731598611556935e0f2457 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 30 Nov 2010 20:15:58 -0800 +Subject: sparc: Write to prom console using indirect buffer. + + +From: David S. Miller + +[ Upstream commit 595a251c0740785fd3c0d2156d78578c7479811e ] + +sparc64 systems have a restriction in that passing in buffer +addressses above 4GB to prom calls is not reliable. + +We end up violating this when we do prom console writes, because we +use an on-stack buffer to translate '\n' into '\r\n'. + +So instead, do this translation into an intermediate buffer, which is +in the kernel image and thus below 4GB, then pass that to the PROM +console write calls. + +On the 32-bit side we don't have to deal with any of these issues, so +the new prom_console_write_buf() uses the existing prom_nbputchar() +implementation. However we can now mark those routines static. + +Since the 64-bit side completely uses new code we can delete the +putchar bits as they are now completely unused. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/oplib_32.h | 4 ++-- + arch/sparc/include/asm/oplib_64.h | 4 ++-- + arch/sparc/prom/console_32.c | 14 ++++++++------ + arch/sparc/prom/console_64.c | 27 +++++++++++++-------------- + arch/sparc/prom/printf.c | 32 +++++++++++++++++++++++++++----- + 5 files changed, 52 insertions(+), 29 deletions(-) + +--- a/arch/sparc/include/asm/oplib_32.h ++++ b/arch/sparc/include/asm/oplib_32.h +@@ -102,8 +102,8 @@ extern int prom_getrev(void); + /* Get the prom firmware revision. */ + extern int prom_getprev(void); + +-/* Blocking put character to console. */ +-extern void prom_putchar(const char *buf); ++/* Write a buffer of characters to the console. */ ++extern void prom_console_write_buf(const char *buf, int len); + + /* Prom's internal routines, don't use in kernel/boot code. */ + extern void prom_printf(const char *fmt, ...); +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -94,8 +94,8 @@ extern void prom_halt_power_off(void) __ + */ + extern unsigned char prom_get_idprom(char *idp_buffer, int idpbuf_size); + +-/* Blocking put character to console. */ +-extern void prom_putchar(const char *buf); ++/* Write a buffer of characters to the console. */ ++extern void prom_console_write_buf(const char *buf, int len); + + /* Prom's internal routines, don't use in kernel/boot code. */ + extern void prom_printf(const char *fmt, ...); +--- a/arch/sparc/prom/console_32.c ++++ b/arch/sparc/prom/console_32.c +@@ -43,12 +43,14 @@ static int prom_nbputchar(const char *bu + return i; /* Ugh, we could spin forever on unsupported proms ;( */ + } + +-/* Blocking version of put character routine above. */ +-void prom_putchar(const char *buf) ++void prom_console_write_buf(const char *buf, int len) + { +- while (1) { +- int err = prom_nbputchar(buf); +- if (!err) +- break; ++ while (len) { ++ int n = prom_nbputchar(buf); ++ if (n) ++ continue; ++ len--; ++ buf++; + } + } ++ +--- a/arch/sparc/prom/console_64.c ++++ b/arch/sparc/prom/console_64.c +@@ -15,35 +15,34 @@ + + extern int prom_stdin, prom_stdout; + +-/* Non blocking put character to console device, returns -1 if +- * unsuccessful. +- */ +-static int prom_nbputchar(const char *buf) ++static int __prom_console_write_buf(const char *buf, int len) + { + unsigned long args[7]; ++ int ret; + + args[0] = (unsigned long) "write"; + args[1] = 3; + args[2] = 1; + args[3] = (unsigned int) prom_stdout; + args[4] = (unsigned long) buf; +- args[5] = 1; ++ args[5] = (unsigned int) len; + args[6] = (unsigned long) -1; + + p1275_cmd_direct(args); + +- if (args[6] == 1) +- return 0; +- else ++ ret = (int) args[6]; ++ if (ret < 0) + return -1; ++ return ret; + } + +-/* Blocking version of put character routine above. */ +-void prom_putchar(const char *buf) ++void prom_console_write_buf(const char *buf, int len) + { +- while (1) { +- int err = prom_nbputchar(buf); +- if (!err) +- break; ++ while (len) { ++ int n = __prom_console_write_buf(buf, len); ++ if (n < 0) ++ continue; ++ len -= n; ++ buf += len; + } + } +--- a/arch/sparc/prom/printf.c ++++ b/arch/sparc/prom/printf.c +@@ -15,23 +15,45 @@ + + #include + #include ++#include + + #include + #include + ++#define CONSOLE_WRITE_BUF_SIZE 1024 ++ + static char ppbuf[1024]; ++static char console_write_buf[CONSOLE_WRITE_BUF_SIZE]; ++static DEFINE_RAW_SPINLOCK(console_write_lock); + + void notrace prom_write(const char *buf, unsigned int n) + { ++ unsigned int dest_len; ++ unsigned long flags; ++ char *dest; ++ ++ dest = console_write_buf; ++ raw_spin_lock_irqsave(&console_write_lock, flags); ++ ++ dest_len = 0; + while (n-- != 0) { +- char ch = *buf; ++ char ch = *buf++; + if (ch == '\n') { +- char tmp = '\r'; +- prom_putchar(&tmp); ++ *dest++ = '\r'; ++ dest_len++; ++ } ++ *dest++ = ch; ++ dest_len++; ++ if (dest_len >= CONSOLE_WRITE_BUF_SIZE - 1) { ++ prom_console_write_buf(console_write_buf, dest_len); ++ dest = console_write_buf; ++ dest_len = 0; + } +- prom_putchar(buf); +- buf++; + } ++ if (dest_len) ++ prom_console_write_buf(console_write_buf, dest_len); ++ ++ raw_spin_unlock_irqrestore(&console_write_lock, flags); + } + + void notrace prom_printf(const char *fmt, ...) diff --git a/queue-2.6.36/sparc64-delete-prom_puts-unused.patch b/queue-2.6.36/sparc64-delete-prom_puts-unused.patch new file mode 100644 index 00000000000..499e955b774 --- /dev/null +++ b/queue-2.6.36/sparc64-delete-prom_puts-unused.patch @@ -0,0 +1,38 @@ +From bc389c4be6cfaf636103b4e4dfdeabb6e8adbe32 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 16 Nov 2010 12:08:23 -0800 +Subject: sparc64: Delete prom_puts() unused. + + +From: David S. Miller + +[ Upstream commit ce05a94efaf71d562eeefd30d6bbc2ab42b06bac ] + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/prom/console_64.c | 16 ---------------- + 1 file changed, 16 deletions(-) + +--- a/arch/sparc/prom/console_64.c ++++ b/arch/sparc/prom/console_64.c +@@ -81,19 +81,3 @@ prom_putchar(char c) + { + prom_nbputchar(c); + } +- +-void +-prom_puts(const char *s, int len) +-{ +- unsigned long args[7]; +- +- args[0] = (unsigned long) "write"; +- args[1] = 3; +- args[2] = 1; +- args[3] = (unsigned int) prom_stdout; +- args[4] = (unsigned long) s; +- args[5] = len; +- args[6] = (unsigned long) -1; +- +- p1275_cmd_direct(args); +-} diff --git a/queue-2.6.36/sparc64-delete-prom_setcallback.patch b/queue-2.6.36/sparc64-delete-prom_setcallback.patch new file mode 100644 index 00000000000..cad1d1c97ca --- /dev/null +++ b/queue-2.6.36/sparc64-delete-prom_setcallback.patch @@ -0,0 +1,59 @@ +From 1bcb53777cfdf5f1148e5aab9a4742789b4c52a4 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 16 Nov 2010 12:50:19 -0800 +Subject: sparc64: Delete prom_setcallback(). + + +From: David S. Miller + +[ Upstream commit c540ee70e49b573535c7ddfd0e9a0fc9d549c8b7 ] + +Unused. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/oplib_64.h | 8 -------- + arch/sparc/prom/misc_64.c | 14 -------------- + 2 files changed, 22 deletions(-) + +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -88,14 +88,6 @@ extern void prom_halt(void) __attribute_ + /* Halt and power-off the machine. */ + extern void prom_halt_power_off(void) __attribute__ ((noreturn)); + +-/* Set the PROM 'sync' callback function to the passed function pointer. +- * When the user gives the 'sync' command at the prom prompt while the +- * kernel is still active, the prom will call this routine. +- * +- */ +-typedef int (*callback_func_t)(long *cmd); +-extern void prom_setcallback(callback_func_t func_ptr); +- + /* Acquire the IDPROM of the root node in the prom device tree. This + * gets passed a buffer where you would like it stuffed. The return value + * is the format type of this idprom or 0xff on error. +--- a/arch/sparc/prom/misc_64.c ++++ b/arch/sparc/prom/misc_64.c +@@ -150,20 +150,6 @@ void prom_halt_power_off(void) + prom_halt(); + } + +-/* Set prom sync handler to call function 'funcp'. */ +-void prom_setcallback(callback_func_t funcp) +-{ +- unsigned long args[5]; +- if (!funcp) +- return; +- args[0] = (unsigned long) "set-callback"; +- args[1] = 1; +- args[2] = 1; +- args[3] = (unsigned long) funcp; +- args[4] = (unsigned long) -1; +- p1275_cmd_direct(args); +-} +- + /* Get the idprom and stuff it into buffer 'idbuf'. Returns the + * format type. 'num_bytes' is the number of bytes that your idbuf + * has space for. Returns 0xff on error. diff --git a/queue-2.6.36/sparc64-unexport-prom_service_exists.patch b/queue-2.6.36/sparc64-unexport-prom_service_exists.patch new file mode 100644 index 00000000000..eae10b70411 --- /dev/null +++ b/queue-2.6.36/sparc64-unexport-prom_service_exists.patch @@ -0,0 +1,41 @@ +From b3596383d350eeb552954eee4aaeee64efcdc443 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 16 Nov 2010 12:24:16 -0800 +Subject: sparc64: Unexport prom_service_exists(). + + +From: David S. Miller + +[ Upstream commit f7b5f55ac1623dfde24ef5319ad77c1746645f3f ] + +Only used by functions in misc_64.c so make it private +to that file. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/oplib_64.h | 1 - + arch/sparc/prom/misc_64.c | 2 +- + 2 files changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -258,7 +258,6 @@ extern int prom_setprop(int node, const + int value_size); + + extern int prom_inst2pkg(int); +-extern int prom_service_exists(const char *service_name); + extern void prom_sun4v_guest_soft_state(void); + + extern int prom_ihandle2path(int handle, char *buffer, int bufsize); +--- a/arch/sparc/prom/misc_64.c ++++ b/arch/sparc/prom/misc_64.c +@@ -18,7 +18,7 @@ + #include + #include + +-int prom_service_exists(const char *service_name) ++static int prom_service_exists(const char *service_name) + { + unsigned long args[5]; + diff --git a/queue-2.6.36/tcp-avoid-a-possible-divide-by-zero.patch b/queue-2.6.36/tcp-avoid-a-possible-divide-by-zero.patch new file mode 100644 index 00000000000..e8642c8b2ce --- /dev/null +++ b/queue-2.6.36/tcp-avoid-a-possible-divide-by-zero.patch @@ -0,0 +1,48 @@ +From b6bd33114e63d96f424c8e2baf46b3a58745077b Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 7 Dec 2010 12:03:55 +0000 +Subject: tcp: avoid a possible divide by zero + + +From: Eric Dumazet + +[ Upstream commit ad9f4f50fe9288bbe65b7dfd76d8820afac6a24c ] + +sysctl_tcp_tso_win_divisor might be set to zero while one cpu runs in +tcp_tso_should_defer(). Make sure we dont allow a divide by zero by +reading sysctl_tcp_tso_win_divisor exactly once. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1518,6 +1518,7 @@ static int tcp_tso_should_defer(struct s + struct tcp_sock *tp = tcp_sk(sk); + const struct inet_connection_sock *icsk = inet_csk(sk); + u32 send_win, cong_win, limit, in_flight; ++ int win_divisor; + + if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN) + goto send_now; +@@ -1549,13 +1550,14 @@ static int tcp_tso_should_defer(struct s + if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len)) + goto send_now; + +- if (sysctl_tcp_tso_win_divisor) { ++ win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor); ++ if (win_divisor) { + u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache); + + /* If at least some fraction of a window is available, + * just use it. + */ +- chunk /= sysctl_tcp_tso_win_divisor; ++ chunk /= win_divisor; + if (limit >= chunk) + goto send_now; + } else { diff --git a/queue-2.6.36/tcp-bug-fix-in-initialization-of-receive-window.patch b/queue-2.6.36/tcp-bug-fix-in-initialization-of-receive-window.patch new file mode 100644 index 00000000000..241b1d78a3a --- /dev/null +++ b/queue-2.6.36/tcp-bug-fix-in-initialization-of-receive-window.patch @@ -0,0 +1,41 @@ +From 18ab4520fd46404b67d415045ee5d9c4535eaacb Mon Sep 17 00:00:00 2001 +From: Nandita Dukkipati +Date: Fri, 3 Dec 2010 13:33:44 +0000 +Subject: tcp: Bug fix in initialization of receive window. + + +From: Nandita Dukkipati + +[ Upstream commit b1afde60f2b9ee8444fba4e012dc99a3b28d224d ] + +The bug has to do with boundary checks on the initial receive window. +If the initial receive window falls between init_cwnd and the +receive window specified by the user, the initial window is incorrectly +brought down to init_cwnd. The correct behavior is to allow it to +remain unchanged. + +Signed-off-by: Nandita Dukkipati +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -237,11 +237,10 @@ void tcp_select_initial_window(int __spa + /* when initializing use the value from init_rcv_wnd + * rather than the default from above + */ +- if (init_rcv_wnd && +- (*rcv_wnd > init_rcv_wnd * mss)) +- *rcv_wnd = init_rcv_wnd * mss; +- else if (*rcv_wnd > init_cwnd * mss) +- *rcv_wnd = init_cwnd * mss; ++ if (init_rcv_wnd) ++ *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss); ++ else ++ *rcv_wnd = min(*rcv_wnd, init_cwnd * mss); + } + + /* Set the clamp no higher than max representable value */ diff --git a/queue-2.6.36/tcp-don-t-change-unlocked-socket-state-in-tcp_v4_err.patch b/queue-2.6.36/tcp-don-t-change-unlocked-socket-state-in-tcp_v4_err.patch new file mode 100644 index 00000000000..10e02a96d1e --- /dev/null +++ b/queue-2.6.36/tcp-don-t-change-unlocked-socket-state-in-tcp_v4_err.patch @@ -0,0 +1,56 @@ +From 34eef919139f6a7558b43576b12b40731f12f7d7 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Fri, 12 Nov 2010 13:35:00 -0800 +Subject: tcp: Don't change unlocked socket state in tcp_v4_err(). + + +From: David S. Miller + +[ Upstream commit 8f49c2703b33519aaaccc63f571b465b9d2b3a2d ] + +Alexey Kuznetsov noticed a regression introduced by +commit f1ecd5d9e7366609d640ff4040304ea197fbc618 +("Revert Backoff [v3]: Revert RTO on ICMP destination unreachable") + +The RTO and timer modification code added to tcp_v4_err() +doesn't check sock_owned_by_user(), which if true means we +don't have exclusive access to the socket and therefore cannot +modify it's critical state. + +Just skip this new code block if sock_owned_by_user() is true +and eliminate the now superfluous sock_owned_by_user() code +block contained within. + +Reported-by: Alexey Kuznetsov +Signed-off-by: David S. Miller +CC: Damian Lukowski +Acked-by: Eric Dumazet +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_ipv4.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -415,6 +415,9 @@ void tcp_v4_err(struct sk_buff *icmp_skb + !icsk->icsk_backoff) + break; + ++ if (sock_owned_by_user(sk)) ++ break; ++ + icsk->icsk_backoff--; + inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) << + icsk->icsk_backoff; +@@ -429,11 +432,6 @@ void tcp_v4_err(struct sk_buff *icmp_skb + if (remaining) { + inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, + remaining, TCP_RTO_MAX); +- } else if (sock_owned_by_user(sk)) { +- /* RTO revert clocked out retransmission, +- * but socket is locked. Will defer. */ +- inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, +- HZ/20, TCP_RTO_MAX); + } else { + /* RTO revert clocked out retransmission. + * Will retransmit now */ diff --git a/queue-2.6.36/tcp-increase-tcp_maxseg-socket-option-minimum.patch b/queue-2.6.36/tcp-increase-tcp_maxseg-socket-option-minimum.patch new file mode 100644 index 00000000000..f42df415bde --- /dev/null +++ b/queue-2.6.36/tcp-increase-tcp_maxseg-socket-option-minimum.patch @@ -0,0 +1,39 @@ +From 47a8c78fffc3bde1f828c9fce0aae5ae5320cfb3 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 10 Nov 2010 21:35:37 -0800 +Subject: tcp: Increase TCP_MAXSEG socket option minimum. + + +From: David S. Miller + +[ Upstream commit 7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2 ] + +As noted by Steve Chen, since commit +f5fff5dc8a7a3f395b0525c02ba92c95d42b7390 ("tcp: advertise MSS +requested by user") we can end up with a situation where +tcp_select_initial_window() does a divide by a zero (or +even negative) mss value. + +The problem is that sometimes we effectively subtract +TCPOLEN_TSTAMP_ALIGNED and/or TCPOLEN_MD5SIG_ALIGNED from the mss. + +Fix this by increasing the minimum from 8 to 64. + +Reported-by: Steve Chen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock + /* Values greater than interface MTU won't take effect. However + * at the point when this call is done we typically don't yet + * know which interface is going to be used */ +- if (val < 8 || val > MAX_TCP_WINDOW) { ++ if (val < 64 || val > MAX_TCP_WINDOW) { + err = -EINVAL; + break; + } diff --git a/queue-2.6.36/tcp-make-tcp_maxseg-minimum-more-correct.patch b/queue-2.6.36/tcp-make-tcp_maxseg-minimum-more-correct.patch new file mode 100644 index 00000000000..2d04147ce9c --- /dev/null +++ b/queue-2.6.36/tcp-make-tcp_maxseg-minimum-more-correct.patch @@ -0,0 +1,30 @@ +From 9f3ec7da60ef8443addc35828214f129590495f2 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 24 Nov 2010 11:47:22 -0800 +Subject: tcp: Make TCP_MAXSEG minimum more correct. + + +From: David S. Miller + +[ Upstream commit c39508d6f118308355468314ff414644115a07f3 ] + +Use TCP_MIN_MSS instead of constant 64. + +Reported-by: Min Zhang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock + /* Values greater than interface MTU won't take effect. However + * at the point when this call is done we typically don't yet + * know which interface is going to be used */ +- if (val < 64 || val > MAX_TCP_WINDOW) { ++ if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) { + err = -EINVAL; + break; + } diff --git a/queue-2.6.36/tcp-protect-sysctl_tcp_cookie_size-reads.patch b/queue-2.6.36/tcp-protect-sysctl_tcp_cookie_size-reads.patch new file mode 100644 index 00000000000..8f2e2e77d19 --- /dev/null +++ b/queue-2.6.36/tcp-protect-sysctl_tcp_cookie_size-reads.patch @@ -0,0 +1,68 @@ +From e1e9ef4b173c9437d9966b2d953a2c624190d2c9 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 7 Dec 2010 12:20:47 +0000 +Subject: tcp: protect sysctl_tcp_cookie_size reads + + +From: Eric Dumazet + +[ Upstream commit f19872575ff7819a3723154657a497d9bca66b33 ] + +Make sure sysctl_tcp_cookie_size is read once in +tcp_cookie_size_check(), or we might return an illegal value to caller +if sysctl_tcp_cookie_size is changed by another cpu. + +Signed-off-by: Eric Dumazet +Cc: Ben Hutchings +Cc: William Allen Simpson +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -391,27 +391,30 @@ struct tcp_out_options { + */ + static u8 tcp_cookie_size_check(u8 desired) + { +- if (desired > 0) { ++ int cookie_size; ++ ++ if (desired > 0) + /* previously specified */ + return desired; +- } +- if (sysctl_tcp_cookie_size <= 0) { ++ ++ cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size); ++ if (cookie_size <= 0) + /* no default specified */ + return 0; +- } +- if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) { ++ ++ if (cookie_size <= TCP_COOKIE_MIN) + /* value too small, specify minimum */ + return TCP_COOKIE_MIN; +- } +- if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) { ++ ++ if (cookie_size >= TCP_COOKIE_MAX) + /* value too large, specify maximum */ + return TCP_COOKIE_MAX; +- } +- if (0x1 & sysctl_tcp_cookie_size) { ++ ++ if (cookie_size & 1) + /* 8-bit multiple, illegal, fix it */ +- return (u8)(sysctl_tcp_cookie_size + 0x1); +- } +- return (u8)sysctl_tcp_cookie_size; ++ cookie_size++; ++ ++ return (u8)cookie_size; + } + + /* Write previously computed TCP options to the packet. diff --git a/queue-2.6.36/tehuti-firmware-filename-is-tehuti-bdx.bin.patch b/queue-2.6.36/tehuti-firmware-filename-is-tehuti-bdx.bin.patch new file mode 100644 index 00000000000..b0a6bdef299 --- /dev/null +++ b/queue-2.6.36/tehuti-firmware-filename-is-tehuti-bdx.bin.patch @@ -0,0 +1,39 @@ +From 9b350d25af41819ff669769beb8cd80e59dc3bfe Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Fri, 17 Dec 2010 10:16:23 -0800 +Subject: tehuti: Firmware filename is tehuti/bdx.bin + + +From: Ben Hutchings + +[ Upstream commit 46814e08d80f87449b5adb3d549a3cae6f9f8148 ] + +My conversion of tehuti to use request_firmware() was confused about +the filename of the firmware blob. Change the driver to match the +blob. + +Signed-off-by: Ben Hutchings +Signed-off-by: Andy Gospodarek +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tehuti.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/tehuti.c ++++ b/drivers/net/tehuti.c +@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv * + ENTER; + master = READ_REG(priv, regINIT_SEMAPHORE); + if (!READ_REG(priv, regINIT_STATUS) && master) { +- rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev); ++ rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev); + if (rc) + goto out; + bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size); +@@ -2516,4 +2516,4 @@ module_exit(bdx_module_exit); + MODULE_LICENSE("GPL"); + MODULE_AUTHOR(DRIVER_AUTHOR); + MODULE_DESCRIPTION(BDX_DRV_DESC); +-MODULE_FIRMWARE("tehuti/firmware.bin"); ++MODULE_FIRMWARE("tehuti/bdx.bin"); diff --git a/queue-2.6.36/x25-decrement-netdev-reference-counts-on-unload.patch b/queue-2.6.36/x25-decrement-netdev-reference-counts-on-unload.patch new file mode 100644 index 00000000000..98b787dbb84 --- /dev/null +++ b/queue-2.6.36/x25-decrement-netdev-reference-counts-on-unload.patch @@ -0,0 +1,36 @@ +From 388812334ba75bf32b76f6a364a34bc37f7d50c4 Mon Sep 17 00:00:00 2001 +From: Apollon Oikonomopoulos +Date: Tue, 7 Dec 2010 09:43:30 +0000 +Subject: x25: decrement netdev reference counts on unload + + +From: Apollon Oikonomopoulos + +[ Upstream commit 33ce2b3d81dca76f589641b7a675c28f0f6375b1 ] + +x25 does not decrement the network device reference counts on module unload. +Thus unregistering any pre-existing interface after unloading the x25 module +hangs and results in + + unregister_netdevice: waiting for tap0 to become free. Usage count = 1 + +This patch decrements the reference counts of all interfaces in x25_link_free, +the way it is already done in x25_link_device_down for NETDEV_DOWN events. + +Signed-off-by: Apollon Oikonomopoulos +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/x25/x25_link.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/x25/x25_link.c ++++ b/net/x25/x25_link.c +@@ -394,6 +394,7 @@ void __exit x25_link_free(void) + list_for_each_safe(entry, tmp, &x25_neigh_list) { + nb = list_entry(entry, struct x25_neigh, node); + __x25_remove_neigh(nb); ++ dev_put(nb->dev); + } + write_unlock_bh(&x25_neigh_list_lock); + }