[PATCH 00/61] 2.6.18-stable review

[PATCH 00/61] 2.6.18-stable review

[Chris Wright]

This is the start of the stable review cycle for the 2.6.18.2 release.
There are 61 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let us know.  If anyone is a maintainer of the proper subsystem, and
wants to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the
Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
to add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Friday, November 3, 05:30:00 UTC.
Anything received after that time might be too late.

An all-in-one patch for this series can be found at:                            
                                                                                
	http://www.kernel.org/pub/linux/kernel/people/chrisw/stable/patch-2.6.18.2-rc1.gz  
if anyone wants to test this out that way.

thanks,

the -stable release team
--

[PATCH 01/61] [DECNET]: Fix sfuzz hanging on 2.6.18

[Chris Wright]

[-- Attachment #1: fix-sfuzz-hanging-on-2.6.18.patch --]
[-- Type: text/plain, Size: 1598 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Patrick McHardy <kaber@trash.net>

Dave Jones wrote:
> sfuzz         D 724EF62A  2828 28717  28691                     (NOTLB)
>        cd69fe98 00000082 0000012d 724ef62a 0001971a 00000010 00000007 df6d22b0
>        dfd81080 725bbc5e 0001971a 000cc634 00000001 df6d23bc c140e260 00000202
>        de1d5ba0 cd69fea0 de1d5ba0 00000000 00000000 de1d5b60 de1d5b8c de1d5ba0
> Call Trace:
>  [<c05b1708>] lock_sock+0x75/0xa6
>  [<e0b0b604>] dn_getname+0x18/0x5f [decnet]
>  [<c05b083b>] sys_getsockname+0x5c/0xb0
>  [<c05b0b46>] sys_socketcall+0xef/0x261
>  [<c0403f97>] syscall_call+0x7/0xb
> DWARF2 unwinder stuck at syscall_call+0x7/0xb
>
> I wonder if the plethora of lockdep related changes inadvertantly broke something?

Looks like unbalanced locking.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 net/decnet/af_decnet.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- linux-2.6.18.1.orig/net/decnet/af_decnet.c
+++ linux-2.6.18.1/net/decnet/af_decnet.c
@@ -1177,8 +1177,10 @@ static int dn_getname(struct socket *soc
 	if (peer) {
 		if ((sock->state != SS_CONNECTED && 
 		     sock->state != SS_CONNECTING) && 
-		    scp->accept_mode == ACC_IMMED)
+		    scp->accept_mode == ACC_IMMED) {
+		    	release_sock(sk);
 			return -ENOTCONN;
+		}
 
 		memcpy(sa, &scp->peer, sizeof(struct sockaddr_dn));
 	} else {

--

[PATCH 02/61] splice: fix pipe_to_file() ->prepare_write() error path

[Chris Wright]

[-- Attachment #1: splice-fix-pipe_to_file-prepare_write-error-path.patch --]
[-- Type: text/plain, Size: 999 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jens Axboe <jens.axboe@oracle.com>

Don't jump to the unlock+release path, we already did that.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 fs/splice.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.18.1.orig/fs/splice.c
+++ linux-2.6.18.1/fs/splice.c
@@ -607,7 +607,7 @@ find_page:
 			ret = -ENOMEM;
 			page = page_cache_alloc_cold(mapping);
 			if (unlikely(!page))
-				goto out_nomem;
+				goto out_ret;
 
 			/*
 			 * This will also lock the page
@@ -666,7 +666,7 @@ find_page:
 		if (sd->pos + this_len > isize)
 			vmtruncate(mapping->host, isize);
 
-		goto out;
+		goto out_ret;
 	}
 
 	if (buf->page != page) {
@@ -698,7 +698,7 @@ find_page:
 out:
 	page_cache_release(page);
 	unlock_page(page);
-out_nomem:
+out_ret:
 	return ret;
 }
 

--

[PATCH 03/61] [S390] __div64_32 for 31 bit.

[Chris Wright]

[-- Attachment #1: __div64_32-for-31-bit.patch --]
[-- Type: text/plain, Size: 7398 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

The clocksource infrastructure introduced with commit
ad596171ed635c51a9eef829187af100cbf8dcf7 broke 31 bit s390.
The reason is that the do_div() primitive for 31 bit always
had a restriction: it could only divide an unsigned 64 bit
integer by an unsigned 31 bit integer. The clocksource code
now uses do_div() with a base value that has the most
significant bit set. The result is that clock->cycle_interval
has a funny value which causes the linux time to jump around
like mad. 
The solution is "obvious": implement a proper __div64_32
function for 31 bit s390.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/s390/Kconfig        |    4 +
 arch/s390/lib/Makefile   |    1 
 arch/s390/lib/div64.c    |  151 +++++++++++++++++++++++++++++++++++++++++++++++
 include/asm-s390/div64.h |   48 --------------
 4 files changed, 156 insertions(+), 48 deletions(-)

--- linux-2.6.18.1.orig/arch/s390/Kconfig
+++ linux-2.6.18.1/arch/s390/Kconfig
@@ -51,6 +51,10 @@ config 64BIT
 	  Select this option if you have a 64 bit IBM zSeries machine
 	  and want to use the 64 bit addressing mode.
 
+config 32BIT
+	bool
+	default y if !64BIT
+
 config SMP
 	bool "Symmetric multi-processing support"
 	---help---
--- linux-2.6.18.1.orig/arch/s390/lib/Makefile
+++ linux-2.6.18.1/arch/s390/lib/Makefile
@@ -7,3 +7,4 @@ EXTRA_AFLAGS := -traditional
 lib-y += delay.o string.o
 lib-y += $(if $(CONFIG_64BIT),uaccess64.o,uaccess.o)
 lib-$(CONFIG_SMP) += spinlock.o
+lib-$(CONFIG_32BIT) += div64.o
--- /dev/null
+++ linux-2.6.18.1/arch/s390/lib/div64.c
@@ -0,0 +1,151 @@
+/*
+ *  arch/s390/lib/div64.c
+ *
+ *  __div64_32 implementation for 31 bit.
+ *
+ *    Copyright (C) IBM Corp. 2006
+ *    Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com),
+ */
+
+#include <linux/types.h>
+#include <linux/module.h>
+
+#ifdef CONFIG_MARCH_G5
+
+/*
+ * Function to divide an unsigned 64 bit integer by an unsigned
+ * 31 bit integer using signed 64/32 bit division.
+ */
+static uint32_t __div64_31(uint64_t *n, uint32_t base)
+{
+	register uint32_t reg2 asm("2");
+	register uint32_t reg3 asm("3");
+	uint32_t *words = (uint32_t *) n;
+	uint32_t tmp;
+
+	/* Special case base==1, remainder = 0, quotient = n */
+	if (base == 1)
+		return 0;
+	/*
+	 * Special case base==0 will cause a fixed point divide exception
+	 * on the dr instruction and may not happen anyway. For the
+	 * following calculation we can assume base > 1. The first
+	 * signed 64 / 32 bit division with an upper half of 0 will
+	 * give the correct upper half of the 64 bit quotient.
+	 */
+	reg2 = 0UL;
+	reg3 = words[0];
+	asm volatile(
+		"	dr	%0,%2\n"
+		: "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" );
+	words[0] = reg3;
+	reg3 = words[1];
+	/*
+	 * To get the lower half of the 64 bit quotient and the 32 bit
+	 * remainder we have to use a little trick. Since we only have
+	 * a signed division the quotient can get too big. To avoid this
+	 * the 64 bit dividend is halved, then the signed division will
+	 * work. Afterwards the quotient and the remainder are doubled.
+	 * If the last bit of the dividend has been one the remainder
+	 * is increased by one then checked against the base. If the
+	 * remainder has overflown subtract base and increase the
+	 * quotient. Simple, no ?
+	 */
+	asm volatile(
+		"	nr	%2,%1\n"
+		"	srdl	%0,1\n"
+		"	dr	%0,%3\n"
+		"	alr	%0,%0\n"
+		"	alr	%1,%1\n"
+		"	alr	%0,%2\n"
+		"	clr	%0,%3\n"
+		"	jl	0f\n"
+		"	slr	%0,%3\n"
+		"	alr	%1,%2\n"
+		"0:\n"
+		: "+d" (reg2), "+d" (reg3), "=d" (tmp)
+		: "d" (base), "2" (1UL) : "cc" );
+	words[1] = reg3;
+	return reg2;
+}
+
+/*
+ * Function to divide an unsigned 64 bit integer by an unsigned
+ * 32 bit integer using the unsigned 64/31 bit division.
+ */
+uint32_t __div64_32(uint64_t *n, uint32_t base)
+{
+	uint32_t r;
+
+	/*
+	 * If the most significant bit of base is set, divide n by
+	 * (base/2). That allows to use 64/31 bit division and gives a
+	 * good approximation of the result: n = (base/2)*q + r. The
+	 * result needs to be corrected with two simple transformations.
+	 * If base is already < 2^31-1 __div64_31 can be used directly.
+	 */
+	r = __div64_31(n, ((signed) base < 0) ? (base/2) : base);
+	if ((signed) base < 0) {
+		uint64_t q = *n;
+		/*
+		 * First transformation:
+		 * n = (base/2)*q + r
+		 *   = ((base/2)*2)*(q/2) + ((q&1) ? (base/2) : 0) + r
+		 * Since r < (base/2), r + (base/2) < base.
+		 * With q1 = (q/2) and r1 = r + ((q&1) ? (base/2) : 0)
+		 * n = ((base/2)*2)*q1 + r1 with r1 < base.
+		 */
+		if (q & 1)
+			r += base/2;
+		q >>= 1;
+		/*
+		 * Second transformation. ((base/2)*2) could have lost the
+		 * last bit.
+		 * n = ((base/2)*2)*q1 + r1
+		 *   = base*q1 - ((base&1) ? q1 : 0) + r1
+		 */
+		if (base & 1) {
+			int64_t rx = r - q;
+			/*
+			 * base is >= 2^31. The worst case for the while
+			 * loop is n=2^64-1 base=2^31+1. That gives a
+			 * maximum for q=(2^64-1)/2^31 = 0x1ffffffff. Since
+			 * base >= 2^31 the loop is finished after a maximum
+			 * of three iterations.
+			 */
+			while (rx < 0) {
+				rx += base;
+				q--;
+			}
+			r = rx;
+		}
+		*n = q;
+	}
+	return r;
+}
+
+#else /* MARCH_G5 */
+
+uint32_t __div64_32(uint64_t *n, uint32_t base)
+{
+	register uint32_t reg2 asm("2");
+	register uint32_t reg3 asm("3");
+	uint32_t *words = (uint32_t *) n;
+
+	reg2 = 0UL;
+	reg3 = words[0];
+	asm volatile(
+		"	dlr	%0,%2\n"
+		: "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" );
+	words[0] = reg3;
+	reg3 = words[1];
+	asm volatile(
+		"	dlr	%0,%2\n"
+		: "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" );
+	words[1] = reg3;
+	return reg2;
+}
+
+#endif /* MARCH_G5 */
+
+EXPORT_SYMBOL(__div64_32);
--- linux-2.6.18.1.orig/include/asm-s390/div64.h
+++ linux-2.6.18.1/include/asm-s390/div64.h
@@ -1,49 +1 @@
-#ifndef __S390_DIV64
-#define __S390_DIV64
-
-#ifndef __s390x__
-
-/* for do_div "base" needs to be smaller than 2^31-1 */
-#define do_div(n, base) ({                                      \
-	unsigned long long __n = (n);				\
-	unsigned long __r;					\
-								\
-	asm ("   slr  0,0\n"					\
-	     "   l    1,%1\n"					\
-	     "   srdl 0,1\n"					\
-	     "   dr   0,%2\n"					\
-	     "   alr  1,1\n"					\
-	     "   alr  0,0\n"					\
-	     "   lhi  2,1\n"					\
-	     "   n    2,%1\n"					\
-	     "   alr  0,2\n"					\
-	     "   clr  0,%2\n"					\
-	     "   jl   0f\n"					\
-	     "   slr  0,%2\n"					\
-             "   ahi  1,1\n"					\
-	     "0: st   1,%1\n"					\
-	     "   l    1,4+%1\n"					\
-	     "   srdl 0,1\n"					\
-             "   dr   0,%2\n"					\
-	     "   alr  1,1\n"					\
-	     "   alr  0,0\n"					\
-	     "   lhi  2,1\n"					\
-	     "   n    2,4+%1\n"					\
-	     "   alr  0,2\n"					\
-	     "   clr  0,%2\n"					\
-             "   jl   1f\n"					\
-	     "   slr  0,%2\n"					\
-	     "   ahi  1,1\n"					\
-	     "1: st   1,4+%1\n"					\
-             "   lr   %0,0"					\
-	     : "=d" (__r), "=m" (__n)				\
-	     : "d" (base), "m" (__n) : "0", "1", "2", "cc" );	\
-	(n) = (__n);						\
-        __r;                                                    \
-})
-
-#else /* __s390x__ */
 #include <asm-generic/div64.h>
-#endif /* __s390x__ */
-
-#endif

--

[PATCH 04/61] mm: fix a race condition under SMC + COW

[Chris Wright]

[-- Attachment #1: mm-fix-a-race-condition-under-smc-cow.patch --]
[-- Type: text/plain, Size: 3004 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Suresh Siddha <suresh.b.siddha@intel.com>

Failing context is a multi threaded process context and the failing
sequence is as follows.

One thread T0 doing self modifying code on page X on processor P0 and
another thread T1 doing COW (breaking the COW setup as part of just
happened fork() in another thread T2) on the same page X on processor P1.
T0 doing SMC can endup modifying the new page Y (allocated by the T1 doing
COW on P1) but because of different I/D TLB's, P0 ITLB will not see the new
mapping till the flush TLB IPI from P1 is received.  During this interval,
if T0 executes the code created by SMC it can result in an app error (as
ITLB still points to old page X and endup executing the content in page X
rather than using the content in page Y).

Fix this issue by first clearing the PTE and flushing it, before updating
it with new entry.

Hugh sayeth:

  I was a bit sceptical, in the habit of thinking that Self Modifying Code
  must look such issues itself: but I guess there's nothing it can do to avoid
  this one.

  Fair enough, what you're changing it to is pretty much what powerpc and
  s390 were already doing, and is a more robust way of proceeding, consistent
  with how ptes are set everywhere else.

  The ptep_clear_flush is a bit heavy-handed (it's anxious to return the pte
  that was atomically cleared), but we'd have to wander through lots of arches
  to get the right minimal behaviour.  It'd also be nice to eliminate
  ptep_establish completely, now only used to define other macros/inlines: it
  always seemed obfuscation to me, what you've got there now is clearer.
  Let's put those cleanups on a TODO list.

Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Acked-by: "David S. Miller" <davem@davemloft.net>
Acked-by: Hugh Dickins <hugh@veritas.com>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 mm/memory.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- linux-2.6.18.1.orig/mm/memory.c
+++ linux-2.6.18.1/mm/memory.c
@@ -1551,7 +1551,14 @@ gotten:
 		entry = mk_pte(new_page, vma->vm_page_prot);
 		entry = maybe_mkwrite(pte_mkdirty(entry), vma);
 		lazy_mmu_prot_update(entry);
-		ptep_establish(vma, address, page_table, entry);
+		/*
+		 * Clear the pte entry and flush it first, before updating the
+		 * pte with the new entry. This will avoid a race condition
+		 * seen in the presence of one thread doing SMC and another
+		 * thread doing COW.
+		 */
+		ptep_clear_flush(vma, address, page_table);
+		set_pte_at(mm, address, page_table, entry);
 		update_mmu_cache(vma, address, entry);
 		lru_cache_add_active(new_page);
 		page_add_new_anon_rmap(new_page, vma, address);

--

[PATCH 05/61] sky2: MSI test race and message

[Chris Wright]

[-- Attachment #1: sky2-msi-test-race-and-message.patch --]
[-- Type: text/plain, Size: 1815 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Stephen Hemminger <shemminger@osdl.org>

Make sure and do PCI reads after writes in the MSI test setup code.

Some motherboards don't implement MSI correctly. The driver handles this
but the warning is too verbose and overly cautious.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/net/sky2.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- linux-2.6.18.1.orig/drivers/net/sky2.c
+++ linux-2.6.18.1/drivers/net/sky2.c
@@ -3208,6 +3208,8 @@ static int __devinit sky2_test_msi(struc
 	struct pci_dev *pdev = hw->pdev;
 	int err;
 
+	init_waitqueue_head (&hw->msi_wait);
+
 	sky2_write32(hw, B0_IMSK, Y2_IS_IRQ_SW);
 
 	err = request_irq(pdev->irq, sky2_test_intr, IRQF_SHARED, DRV_NAME, hw);
@@ -3217,18 +3219,15 @@ static int __devinit sky2_test_msi(struc
 		return err;
 	}
 
-	init_waitqueue_head (&hw->msi_wait);
-
 	sky2_write8(hw, B0_CTST, CS_ST_SW_IRQ);
-	wmb();
+	sky2_read8(hw, B0_CTST);
 
 	wait_event_timeout(hw->msi_wait, hw->msi_detected, HZ/10);
 
 	if (!hw->msi_detected) {
 		/* MSI test failed, go back to INTx mode */
-		printk(KERN_WARNING PFX "%s: No interrupt was generated using MSI, "
-		       "switching to INTx mode. Please report this failure to "
-		       "the PCI maintainer and include system chipset information.\n",
+		printk(KERN_INFO PFX "%s: No interrupt generated using MSI, "
+		       "switching to INTx mode.\n",
 		       pci_name(pdev));
 
 		err = -EOPNOTSUPP;
@@ -3236,6 +3235,7 @@ static int __devinit sky2_test_msi(struc
 	}
 
 	sky2_write32(hw, B0_IMSK, 0);
+	sky2_read32(hw, B0_IMSK);
 
 	free_irq(pdev->irq, hw);
 

--

[PATCH 06/61] sky2: pause parameter adjustment

[Chris Wright]

[-- Attachment #1: sky2-pause-parameter-adjustment.patch --]
[-- Type: text/plain, Size: 1033 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Stephen Hemminger <shemminger@osdl.org>

The lower pause threshold set by the driver is too large and causes FIFO overruns.
Especially on laptops running at slower clock rates.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>


---
 drivers/net/sky2.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/drivers/net/sky2.c
+++ linux-2.6.18.1/drivers/net/sky2.c
@@ -678,7 +678,7 @@ static void sky2_mac_init(struct sky2_hw
 	sky2_write16(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_OPER_ON);
 
 	if (hw->chip_id == CHIP_ID_YUKON_EC_U) {
-		sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 768/8);
+		sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 512/8);
 		sky2_write8(hw, SK_REG(port, RX_GMF_UP_THR), 1024/8);
 		if (hw->dev[port]->mtu > ETH_DATA_LEN) {
 			/* set Tx GMAC FIFO Almost Empty Threshold */

--

[PATCH 07/61] sky2: turn off PHY IRQ on shutdown

[Chris Wright]

[-- Attachment #1: sky2-turn-off-phy-irq-on-shutdown.patch --]
[-- Type: text/plain, Size: 1885 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Stephen Hemminger <shemminger@osdl.org>

When PHY is turned off on shutdown, it can causes the IRQ to get stuck on.
Make sure and disable the IRQ first, and if IRQ occurs when device
is not running, don't access PHY because that can hang.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/net/sky2.c |   16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

--- linux-2.6.18.1.orig/drivers/net/sky2.c
+++ linux-2.6.18.1/drivers/net/sky2.c
@@ -1429,6 +1429,11 @@ static int sky2_down(struct net_device *
 	/* Stop more packets from being queued */
 	netif_stop_queue(dev);
 
+	/* Disable port IRQ */
+	imask = sky2_read32(hw, B0_IMSK);
+	imask &= ~portirq_msk[port];
+	sky2_write32(hw, B0_IMSK, imask);
+
 	sky2_phy_reset(hw, port);
 
 	/* Stop transmitter */
@@ -1472,11 +1477,6 @@ static int sky2_down(struct net_device *
 	sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_SET);
 	sky2_write8(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_RST_SET);
 
-	/* Disable port IRQ */
-	imask = sky2_read32(hw, B0_IMSK);
-	imask &= ~portirq_msk[port];
-	sky2_write32(hw, B0_IMSK, imask);
-
 	/* turn off LED's */
 	sky2_write16(hw, B0_Y2LED, LED_STAT_OFF);
 
@@ -1687,13 +1687,13 @@ static void sky2_phy_intr(struct sky2_hw
 	struct sky2_port *sky2 = netdev_priv(dev);
 	u16 istatus, phystat;
 
+	if (!netif_running(dev))
+		return;
+
 	spin_lock(&sky2->phy_lock);
 	istatus = gm_phy_read(hw, port, PHY_MARV_INT_STAT);
 	phystat = gm_phy_read(hw, port, PHY_MARV_PHY_STAT);
 
-	if (!netif_running(dev))
-		goto out;
-
 	if (netif_msg_intr(sky2))
 		printk(KERN_INFO PFX "%s: phy interrupt status 0x%x 0x%x\n",
 		       sky2->netdev->name, istatus, phystat);

--

[PATCH 08/61] ALSA: emu10k1: Fix outl() in snd_emu10k1_resume_regs()

[Chris Wright]

[-- Attachment #1: alsa-emu10k1-fix-outl-in-snd_emu10k1_resume_regs.patch --]
[-- Type: text/plain, Size: 1155 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Arnaud Patard <arnaud.patard@rtp-net.org>

[PATCH] ALSA: emu10k1: Fix outl() in snd_emu10k1_resume_regs()

The emu10k1 driver saves the A_IOCFG and HCFG register on suspend and restores
it on resumes. Unfortunately, this doesn't work as the arguments to outl() are
reversed.

From: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 sound/pci/emu10k1/emu10k1_main.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.18.1.orig/sound/pci/emu10k1/emu10k1_main.c
+++ linux-2.6.18.1/sound/pci/emu10k1/emu10k1_main.c
@@ -1460,8 +1460,8 @@ void snd_emu10k1_resume_regs(struct snd_
 
 	/* resore for spdif */
 	if (emu->audigy)
-		outl(emu->port + A_IOCFG, emu->saved_a_iocfg);
-	outl(emu->port + HCFG, emu->saved_hcfg);
+		outl(emu->saved_a_iocfg, emu->port + A_IOCFG);
+	outl(emu->saved_hcfg, emu->port + HCFG);
 
 	val = emu->saved_ptr;
 	for (reg = saved_regs; *reg != 0xff; reg++)

--

[PATCH 09/61] ALSA: powermac - Fix Oops when conflicting with aoa driver

[Chris Wright]

[-- Attachment #1: alsa-powermac-fix-oops-when-conflicting-with-aoa-driver.patch --]
[-- Type: text/plain, Size: 868 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: powermac - Fix Oops when conflicting with aoa driver

Fixed Oops when conflictin with aoa driver due to lack of
i2c initialization.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 sound/ppc/keywest.c |    3 +++
 1 file changed, 3 insertions(+)

--- linux-2.6.18.1.orig/sound/ppc/keywest.c
+++ linux-2.6.18.1/sound/ppc/keywest.c
@@ -117,6 +117,9 @@ int __init snd_pmac_tumbler_post_init(vo
 {
 	int err;
 	
+	if (!keywest_ctx || !keywest_ctx->client)
+		return -ENXIO;
+
 	if ((err = keywest_ctx->init_client(keywest_ctx)) < 0) {
 		snd_printk(KERN_ERR "tumbler: %i :cannot initialize the MCS\n", err);
 		return err;

--

[PATCH 10/61] sound/pci/au88x0/au88x0.c: ioremap balanced with iounmap

[Chris Wright]

[-- Attachment #1: sound-pci-au88x0-au88x0.c-ioremap-balanced-with-iounmap.patch --]
[-- Type: text/plain, Size: 890 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Amol Lad <amol@verismonetworks.com>

[PATCH] sound/pci/au88x0/au88x0.c: ioremap balanced with iounmap

From: Amol Lad <amol@verismonetworks.com>
Signed-off-by: Amol Lad <amol@verismonetworks.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 sound/pci/au88x0/au88x0.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.18.1.orig/sound/pci/au88x0/au88x0.c
+++ linux-2.6.18.1/sound/pci/au88x0/au88x0.c
@@ -128,6 +128,7 @@ static int snd_vortex_dev_free(struct sn
 	// Take down PCI interface.
 	synchronize_irq(vortex->irq);
 	free_irq(vortex->irq, vortex);
+	iounmap(vortex->mmio);
 	pci_release_regions(vortex->pci_dev);
 	pci_disable_device(vortex->pci_dev);
 	kfree(vortex);

--

[PATCH 11/61] ALSA: Dereference after free in snd_hwdep_release()

[Chris Wright]

[-- Attachment #1: alsa-dereference-after-free-in-snd_hwdep_release.patch --]
[-- Type: text/plain, Size: 1282 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Florin Malita <fmalita@gmail.com>

[PATCH] ALSA: Dereference after free in snd_hwdep_release()

snd_card_file_remove() may free hw->card so we can't dereference
hw->card->module after that.

Coverity ID 1420.

This bug actually causes an Oops at usb-disconnection, especially
with CONFIG_PREEMPT.

From: Florin Malita <fmalita@gmail.com>
Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 sound/core/hwdep.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.18.1.orig/sound/core/hwdep.c
+++ linux-2.6.18.1/sound/core/hwdep.c
@@ -158,6 +158,7 @@ static int snd_hwdep_release(struct inod
 {
 	int err = -ENXIO;
 	struct snd_hwdep *hw = file->private_data;
+	struct module *mod = hw->card->module;
 	mutex_lock(&hw->open_mutex);
 	if (hw->ops.release) {
 		err = hw->ops.release(hw, file);
@@ -167,7 +168,7 @@ static int snd_hwdep_release(struct inod
 		hw->used--;
 	snd_card_file_remove(hw->card, file);
 	mutex_unlock(&hw->open_mutex);
-	module_put(hw->card->module);
+	module_put(mod);
 	return err;
 }
 

--

[PATCH 12/61] ALSA: Fix bug in snd-usb-usx2ys usX2Y_pcms_lock_check()

[Chris Wright]

[-- Attachment #1: alsa-fix-bug-in-snd-usb-usx2y-s-usx2y_pcms_lock_check.patch --]
[-- Type: text/plain, Size: 1119 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Karsten Wiese <annabellesgarden@yahoo.de>

[PATCH] ALSA: Fix bug in snd-usb-usx2y's usX2Y_pcms_lock_check()

Fix bug in snd-usb-usx2y's usX2Y_pcms_lock_check()

substream can be NULL......
in mainline, bug was introduced by:
2006-06-22  [ALSA] Add O_APPEND flag support to PCM

From: Karsten Wiese <annabellesgarden@yahoo.de>
Signed-off-by: Karsten Wiese <annabellesgarden@yahoo.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 sound/usb/usx2y/usx2yhwdeppcm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/sound/usb/usx2y/usx2yhwdeppcm.c
+++ linux-2.6.18.1/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -632,7 +632,7 @@ static int usX2Y_pcms_lock_check(struct 
 		for (s = 0; s < 2; ++s) {
 			struct snd_pcm_substream *substream;
 			substream = pcm->streams[s].substream;
-			if (SUBSTREAM_BUSY(substream))
+			if (substream && SUBSTREAM_BUSY(substream))
 				err = -EBUSY;
 		}
 	}

--

[PATCH 13/61] ALSA: Repair snd-usb-usx2y for usb 2.6.18

[Chris Wright]

[-- Attachment #1: alsa-repair-snd-usb-usx2y-for-usb-2.6.18.patch --]
[-- Type: text/plain, Size: 4243 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Karsten Wiese <annabellesgarden@yahoo.de>

urb->start_frame rolls over beyond MAX_INT now.
This is for stable kernel and stable alsa.

From: Karsten Wiese <annabellesgarden@yahoo.de>
Signed-off-by: Karsten Wiese <annabellesgarden@yahoo.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 sound/usb/usx2y/usbusx2yaudio.c |   18 ++++++------------
 sound/usb/usx2y/usx2yhwdeppcm.c |   15 +++++----------
 2 files changed, 11 insertions(+), 22 deletions(-)

--- linux-2.6.18.1.orig/sound/usb/usx2y/usbusx2yaudio.c
+++ linux-2.6.18.1/sound/usb/usx2y/usbusx2yaudio.c
@@ -322,7 +322,7 @@ static void i_usX2Y_urb_complete(struct 
 		usX2Y_error_urb_status(usX2Y, subs, urb);
 		return;
 	}
-	if (likely((0xFFFF & urb->start_frame) == usX2Y->wait_iso_frame))
+	if (likely(urb->start_frame == usX2Y->wait_iso_frame))
 		subs->completed_urb = urb;
 	else {
 		usX2Y_error_sequence(usX2Y, subs, urb);
@@ -335,13 +335,9 @@ static void i_usX2Y_urb_complete(struct 
 		    atomic_read(&capsubs->state) >= state_PREPARED &&
 		    (playbacksubs->completed_urb ||
 		     atomic_read(&playbacksubs->state) < state_PREPARED)) {
-			if (!usX2Y_usbframe_complete(capsubs, playbacksubs, urb->start_frame)) {
-				if (nr_of_packs() <= urb->start_frame &&
-				    urb->start_frame <= (2 * nr_of_packs() - 1))	// uhci and ohci
-					usX2Y->wait_iso_frame = urb->start_frame - nr_of_packs();
-				else
-					usX2Y->wait_iso_frame +=  nr_of_packs();
-			} else {
+			if (!usX2Y_usbframe_complete(capsubs, playbacksubs, urb->start_frame))
+				usX2Y->wait_iso_frame += nr_of_packs();
+			else {
 				snd_printdd("\n");
 				usX2Y_clients_stop(usX2Y);
 			}
@@ -495,7 +491,6 @@ static int usX2Y_urbs_start(struct snd_u
 		if (subs != NULL && atomic_read(&subs->state) >= state_PREPARED)
 			goto start;
 	}
-	usX2Y->wait_iso_frame = -1;
 
  start:
 	usX2Y_subs_startup(subs);
@@ -516,10 +511,9 @@ static int usX2Y_urbs_start(struct snd_u
 				snd_printk (KERN_ERR "cannot submit datapipe for urb %d, err = %d\n", i, err);
 				err = -EPIPE;
 				goto cleanup;
-			} else {
-				if (0 > usX2Y->wait_iso_frame)
+			} else
+				if (i == 0)
 					usX2Y->wait_iso_frame = urb->start_frame;
-			}
 			urb->transfer_flags = 0;
 		} else {
 			atomic_set(&subs->state, state_STARTING1);
--- linux-2.6.18.1.orig/sound/usb/usx2y/usx2yhwdeppcm.c
+++ linux-2.6.18.1/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -243,7 +243,7 @@ static void i_usX2Y_usbpcm_urb_complete(
 		usX2Y_error_urb_status(usX2Y, subs, urb);
 		return;
 	}
-	if (likely((0xFFFF & urb->start_frame) == usX2Y->wait_iso_frame))
+	if (likely(urb->start_frame == usX2Y->wait_iso_frame))
 		subs->completed_urb = urb;
 	else {
 		usX2Y_error_sequence(usX2Y, subs, urb);
@@ -256,13 +256,9 @@ static void i_usX2Y_usbpcm_urb_complete(
 	if (capsubs->completed_urb && atomic_read(&capsubs->state) >= state_PREPARED &&
 	    (NULL == capsubs2 || capsubs2->completed_urb) &&
 	    (playbacksubs->completed_urb || atomic_read(&playbacksubs->state) < state_PREPARED)) {
-		if (!usX2Y_usbpcm_usbframe_complete(capsubs, capsubs2, playbacksubs, urb->start_frame)) {
-			if (nr_of_packs() <= urb->start_frame &&
-			    urb->start_frame <= (2 * nr_of_packs() - 1))	// uhci and ohci
-				usX2Y->wait_iso_frame = urb->start_frame - nr_of_packs();
-			else
-				usX2Y->wait_iso_frame +=  nr_of_packs();
-		} else {
+		if (!usX2Y_usbpcm_usbframe_complete(capsubs, capsubs2, playbacksubs, urb->start_frame))
+			usX2Y->wait_iso_frame += nr_of_packs();
+		else {
 			snd_printdd("\n");
 			usX2Y_clients_stop(usX2Y);
 		}
@@ -433,7 +429,6 @@ static int usX2Y_usbpcm_urbs_start(struc
 		if (subs != NULL && atomic_read(&subs->state) >= state_PREPARED)
 			goto start;
 	}
-	usX2Y->wait_iso_frame = -1;
 
  start:
 	usX2Y_usbpcm_subs_startup(subs);
@@ -459,7 +454,7 @@ static int usX2Y_usbpcm_urbs_start(struc
 						goto cleanup;
 					}  else {
 						snd_printdd("%i\n", urb->start_frame);
-						if (0 > usX2Y->wait_iso_frame)
+						if (u == 0)
 							usX2Y->wait_iso_frame = urb->start_frame;
 					}
 					urb->transfer_flags = 0;

--

[PATCH 14/61] sky2: accept multicast pause frames

[Chris Wright]

[-- Attachment #1: sky2-accept-multicast-pause-frames.patch --]
[-- Type: text/plain, Size: 2066 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Stephen Hemminger <shemminger@osdl.org>

When using flow control, the PHY needs to accept multicast pause frames.
Without this fix, these frames were getting discarded by the PHY before
doing any flow control.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/net/sky2.c |   20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

--- linux-2.6.18.1.orig/drivers/net/sky2.c
+++ linux-2.6.18.1/drivers/net/sky2.c
@@ -2745,6 +2745,14 @@ static int sky2_set_mac_address(struct n
 	return 0;
 }
 
+static void inline sky2_add_filter(u8 filter[8], const u8 *addr)
+{
+	u32 bit;
+
+	bit = ether_crc(ETH_ALEN, addr) & 63;
+	filter[bit >> 3] |= 1 << (bit & 7);
+}
+
 static void sky2_set_multicast(struct net_device *dev)
 {
 	struct sky2_port *sky2 = netdev_priv(dev);
@@ -2753,6 +2761,7 @@ static void sky2_set_multicast(struct ne
 	struct dev_mc_list *list = dev->mc_list;
 	u16 reg;
 	u8 filter[8];
+	static const u8 pause_mc_addr[ETH_ALEN] = { 0x1, 0x80, 0xc2, 0x0, 0x0, 0x1 };
 
 	memset(filter, 0, sizeof(filter));
 
@@ -2763,16 +2772,17 @@ static void sky2_set_multicast(struct ne
 		reg &= ~(GM_RXCR_UCF_ENA | GM_RXCR_MCF_ENA);
 	else if ((dev->flags & IFF_ALLMULTI) || dev->mc_count > 16)	/* all multicast */
 		memset(filter, 0xff, sizeof(filter));
-	else if (dev->mc_count == 0)	/* no multicast */
+	else if (dev->mc_count == 0 && !sky2->rx_pause)
 		reg &= ~GM_RXCR_MCF_ENA;
 	else {
 		int i;
 		reg |= GM_RXCR_MCF_ENA;
 
-		for (i = 0; list && i < dev->mc_count; i++, list = list->next) {
-			u32 bit = ether_crc(ETH_ALEN, list->dmi_addr) & 0x3f;
-			filter[bit / 8] |= 1 << (bit % 8);
-		}
+		if (sky2->rx_pause)
+			sky2_add_filter(filter, pause_mc_addr);
+
+		for (i = 0; list && i < dev->mc_count; i++, list = list->next)
+			sky2_add_filter(filter, list->dmi_addr);
 	}
 
 	gma_write16(hw, port, GM_MC_ADDR_H1,

--

[PATCH 15/61] sky2: GMAC pause frame

[Chris Wright]

[-- Attachment #1: sky2-gmac-pause-frame.patch --]
[-- Type: text/plain, Size: 885 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Stephen Hemminger <shemminger@osdl.org>

This reverts earlier change that attempted to fix flow control.
Device needs to discard pause frames, otherwise it passes pause frames up
the stack.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>


---
 drivers/net/sky2.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/drivers/net/sky2.h
+++ linux-2.6.18.1/drivers/net/sky2.h
@@ -1566,7 +1566,7 @@ enum {
 
 	GMR_FS_ANY_ERR	= GMR_FS_RX_FF_OV | GMR_FS_CRC_ERR |
 			  GMR_FS_FRAGMENT | GMR_FS_LONG_ERR |
-		  	  GMR_FS_MII_ERR | GMR_FS_BAD_FC |
+		  	  GMR_FS_MII_ERR | GMR_FS_GOOD_FC | GMR_FS_BAD_FC |
 			  GMR_FS_UN_SIZE | GMR_FS_JABBER,
 };
 

--

[PATCH 16/61] uml: fix processor selection to exclude unsupported processors and features

[Chris Wright]

[-- Attachment #1: uml-fix-processor-selection-to-exclude-unsupported-processors-and-features.patch --]
[-- Type: text/plain, Size: 1321 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>

Makes UML compile on any possible processor choice. The two problems were:

*) x86 code, when 386 is selected, checks at runtime boot_cpuflags, which we do
   not have.
*) 3Dnow support for memcpy() et al. does not compile currently and fixing this
   is not trivial, so simply disable it; with this change, if one selects MK7
   UML compiles (while it did not).
Merged upstream.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 arch/i386/Kconfig.cpu |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.18.1.orig/arch/i386/Kconfig.cpu
+++ linux-2.6.18.1/arch/i386/Kconfig.cpu
@@ -7,6 +7,7 @@ choice
 
 config M386
 	bool "386"
+	depends on !UML
 	---help---
 	  This is the processor type of your CPU. This information is used for
 	  optimizing purposes. In order to compile a kernel that can run on
@@ -301,7 +302,7 @@ config X86_USE_PPRO_CHECKSUM
 
 config X86_USE_3DNOW
 	bool
-	depends on MCYRIXIII || MK7 || MGEODE_LX
+	depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
 	default y
 
 config X86_OOSTORE

--

[PATCH 17/61] SCSI: DAC960: PCI id table fixup

[Chris Wright]

[-- Attachment #1: scsi-dac960-pci-id-table-fixup.patch --]
[-- Type: text/plain, Size: 1080 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Brian King <brking@us.ibm.com>

[SCSI] DAC960: PCI id table fixup

The PCI ID table in the DAC960 driver conflicts with some devices
that use the ipr driver. All ipr adapters that use this chip
have an IBM subvendor ID and all DAC960 adapters that use this
chip have a Mylex subvendor id.

Signed-off-by: Brian King <brking@us.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/block/DAC960.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/drivers/block/DAC960.c
+++ linux-2.6.18.1/drivers/block/DAC960.c
@@ -7115,7 +7115,7 @@ static struct pci_device_id DAC960_id_ta
 	{
 		.vendor 	= PCI_VENDOR_ID_MYLEX,
 		.device		= PCI_DEVICE_ID_MYLEX_DAC960_GEM,
-		.subvendor	= PCI_ANY_ID,
+		.subvendor	= PCI_VENDOR_ID_MYLEX,
 		.subdevice	= PCI_ANY_ID,
 		.driver_data	= (unsigned long) &DAC960_GEM_privdata,
 	},

--

[PATCH 18/61] Fix uninitialised spinlock in via-pmu-backlight code.

[Chris Wright]

[-- Attachment #1: fix-uninitialised-spinlock-in-via-pmu-backlight-code.patch --]
[-- Type: text/plain, Size: 1215 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Woodhouse <dwmw2@infradead.org>

[PATCH] Fix uninitialised spinlock in via-pmu-backlight code.

The uninitialised pmu_backlight_lock causes the current Fedora test kernel
(which has spinlock debugging enabled) to panic on suspend.

This is suboptimal, so I fixed it.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Michael Hanselmann <linux-kernel@hansmi.ch>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/macintosh/via-pmu-backlight.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/drivers/macintosh/via-pmu-backlight.c
+++ linux-2.6.18.1/drivers/macintosh/via-pmu-backlight.c
@@ -16,7 +16,7 @@
 #define MAX_PMU_LEVEL 0xFF
 
 static struct backlight_properties pmu_backlight_data;
-static spinlock_t pmu_backlight_lock;
+static DEFINE_SPINLOCK(pmu_backlight_lock);
 static int sleeping;
 static u8 bl_curve[FB_BACKLIGHT_LEVELS];
 

--

[PATCH 19/61] SERIAL: Fix resume handling bug

[Chris Wright]

[-- Attachment #1: serial-fix-resume-handling-bug.patch --]
[-- Type: text/plain, Size: 1249 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Russell King <rmk+kernel@arm.linux.org.uk>

Unfortunately, pcmcia_dev_present() returns false when a device is
suspended, so checking this on resume does not work too well.  Omit
this test.

the backported patch below is already in fedora tree. -maks

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: maximilian attems <maks@sternwelten.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/serial/serial_cs.c |   12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

--- linux-2.6.18.1.orig/drivers/serial/serial_cs.c
+++ linux-2.6.18.1/drivers/serial/serial_cs.c
@@ -185,14 +185,12 @@ static int serial_suspend(struct pcmcia_
 
 static int serial_resume(struct pcmcia_device *link)
 {
-	if (pcmcia_dev_present(link)) {
-		struct serial_info *info = link->priv;
-		int i;
+	struct serial_info *info = link->priv;
+	int i;
 
-		for (i = 0; i < info->ndev; i++)
-			serial8250_resume_port(info->line[i]);
-		wakeup_card(info);
-	}
+	for (i = 0; i < info->ndev; i++)
+		serial8250_resume_port(info->line[i]);
+	wakeup_card(info);
 
 	return 0;
 }

--

[PATCH 20/61] SERIAL: Fix oops when removing suspended serial port

[Chris Wright]

[-- Attachment #1: serial-fix-oops-when-removing-suspended-serial-port.patch --]
[-- Type: text/plain, Size: 2492 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Russell King <rmk+kernel@arm.linux.org.uk>

[SERIAL] Fix oops when removing suspended serial port

A serial card might have been removed when the system is resumed.
This results in a suspended port being shut down, which results in
the ports shutdown method being called twice in a row.  This causes
BUGs.  Avoid this by tracking the suspended state separately from
the initialised state.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: maximilian attems <maks@sternwelten.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/serial/serial_core.c |    9 +++++++--
 include/linux/serial_core.h  |    1 +
 2 files changed, 8 insertions(+), 2 deletions(-)

--- linux-2.6.18.1.orig/drivers/serial/serial_core.c
+++ linux-2.6.18.1/drivers/serial/serial_core.c
@@ -1932,6 +1932,9 @@ int uart_suspend_port(struct uart_driver
 	if (state->info && state->info->flags & UIF_INITIALIZED) {
 		const struct uart_ops *ops = port->ops;
 
+		state->info->flags = (state->info->flags & ~UIF_INITIALIZED)
+				     | UIF_SUSPENDED;
+
 		spin_lock_irq(&port->lock);
 		ops->stop_tx(port);
 		ops->set_mctrl(port, 0);
@@ -1991,7 +1994,7 @@ int uart_resume_port(struct uart_driver 
 		console_start(port->cons);
 	}
 
-	if (state->info && state->info->flags & UIF_INITIALIZED) {
+	if (state->info && state->info->flags & UIF_SUSPENDED) {
 		const struct uart_ops *ops = port->ops;
 		int ret;
 
@@ -2003,15 +2006,17 @@ int uart_resume_port(struct uart_driver 
 			ops->set_mctrl(port, port->mctrl);
 			ops->start_tx(port);
 			spin_unlock_irq(&port->lock);
+			state->info->flags |= UIF_INITIALIZED;
 		} else {
 			/*
 			 * Failed to resume - maybe hardware went away?
 			 * Clear the "initialized" flag so we won't try
 			 * to call the low level drivers shutdown method.
 			 */
-			state->info->flags &= ~UIF_INITIALIZED;
 			uart_shutdown(state);
 		}
+
+		state->info->flags &= ~UIF_SUSPENDED;
 	}
 
 	mutex_unlock(&state->mutex);
--- linux-2.6.18.1.orig/include/linux/serial_core.h
+++ linux-2.6.18.1/include/linux/serial_core.h
@@ -319,6 +319,7 @@ struct uart_info {
 #define UIF_CTS_FLOW		((__force uif_t) (1 << 26))
 #define UIF_NORMAL_ACTIVE	((__force uif_t) (1 << 29))
 #define UIF_INITIALIZED		((__force uif_t) (1 << 31))
+#define UIF_SUSPENDED		((__force uif_t) (1 << 30))
 
 	int			blocked_open;
 

--

[PATCH 21/61] Bluetooth: Check if DLC is still attached to the TTY

[Chris Wright]

[-- Attachment #1: bluetooth-check-if-dlc-is-still-attached-to-the-tty.patch --]
[-- Type: text/plain, Size: 933 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Marcel Holtmann <marcel@holtmann.org>

[Bluetooth] Check if DLC is still attached to the TTY

If the DLC device is no longer attached to the TTY device, then it
makes no sense to go through with changing the termios settings.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 net/bluetooth/rfcomm/tty.c |    3 +++
 1 file changed, 3 insertions(+)

--- linux-2.6.18.1.orig/net/bluetooth/rfcomm/tty.c
+++ linux-2.6.18.1/net/bluetooth/rfcomm/tty.c
@@ -748,6 +748,9 @@ static void rfcomm_tty_set_termios(struc
 
 	BT_DBG("tty %p termios %p", tty, old);
 
+	if (!dev)
+		return;
+
 	/* Handle turning off CRTSCTS */
 	if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS)) 
 		BT_DBG("Turning off CRTSCTS unsupported");

--

[PATCH 22/61] JFS: pageno needs to be long

[Chris Wright]

[-- Attachment #1: jfs-pageno-needs-to-be-long.patch --]
[-- Type: text/plain, Size: 1030 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Dave Kleikamp <shaggy@austin.ibm.com>

diRead and diWrite are representing the page number as an unsigned int.
This causes file system corruption on volumes larger than 16TB.

Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 fs/jfs/jfs_imap.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.18.1.orig/fs/jfs/jfs_imap.c
+++ linux-2.6.18.1/fs/jfs/jfs_imap.c
@@ -318,7 +318,7 @@ int diRead(struct inode *ip)
 	struct inomap *imap;
 	int block_offset;
 	int inodes_left;
-	uint pageno;
+	unsigned long pageno;
 	int rel_inode;
 
 	jfs_info("diRead: ino = %ld", ip->i_ino);
@@ -606,7 +606,7 @@ int diWrite(tid_t tid, struct inode *ip)
 	int block_offset;
 	int inodes_left;
 	struct metapage *mp;
-	uint pageno;
+	unsigned long pageno;
 	int rel_inode;
 	int dioffset;
 	struct inode *ipimap;

--

[PATCH 23/61] SPARC64: Fix central/FHC bus handling on Ex000 systems.

[Chris Wright]

[-- Attachment #1: sparc64-fix-central-fhc-bus-handling-on-ex000-systems.patch --]
[-- Type: text/plain, Size: 5364 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

1) probe_other_fhcs() wants to see only non-central FHC
   busses, so skip FHCs that don't sit off the root

2) Like SBUS, FHC can lack the appropriate address and
   size cell count properties, so add an of_busses[]
   entry and handlers for that.

3) Central FHC irq translator probing was buggy.  We
   were trying to use dp->child in irq_trans_init but
   that linkage is not setup at this point.

   So instead, pass in the parent of "dp" and look for
   the child "fhc" with parent "central".

Thanks to the tireless assistence of Ben Collins in tracking
down these problems and testing out these fixes.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 arch/sparc64/kernel/central.c   |    4 ++++
 arch/sparc64/kernel/of_device.c |   33 ++++++++++++++++++++++++---------
 arch/sparc64/kernel/prom.c      |   30 +++++++++++++++---------------
 3 files changed, 43 insertions(+), 24 deletions(-)

--- linux-2.6.18.1.orig/arch/sparc64/kernel/central.c
+++ linux-2.6.18.1/arch/sparc64/kernel/central.c
@@ -126,6 +126,10 @@ static void probe_other_fhcs(void)
 		int board;
 		u32 tmp;
 
+		if (dp->parent &&
+		    dp->parent->parent != NULL)
+			continue;
+
 		fhc = (struct linux_fhc *)
 			central_alloc_bootmem(sizeof(struct linux_fhc));
 		if (fhc == NULL)
--- linux-2.6.18.1.orig/arch/sparc64/kernel/of_device.c
+++ linux-2.6.18.1/arch/sparc64/kernel/of_device.c
@@ -398,16 +398,22 @@ static void of_bus_sbus_count_cells(stru
 		*sizec = 1;
 }
 
-static int of_bus_sbus_map(u32 *addr, const u32 *range, int na, int ns, int pna)
-{
-	return of_bus_default_map(addr, range, na, ns, pna);
-}
-
-static unsigned int of_bus_sbus_get_flags(u32 *addr)
+/*
+ * FHC/Central bus specific translator.
+ *
+ * This is just needed to hard-code the address and size cell
+ * counts.  'fhc' and 'central' nodes lack the #address-cells and
+ * #size-cells properties, and if you walk to the root on such
+ * Enterprise boxes all you'll get is a #size-cells of 2 which is
+ * not what we want to use.
+ */
+static int of_bus_fhc_match(struct device_node *np)
 {
-	return IORESOURCE_MEM;
+	return !strcmp(np->name, "fhc") ||
+		!strcmp(np->name, "central");
 }
 
+#define of_bus_fhc_count_cells of_bus_sbus_count_cells
 
 /*
  * Array of bus specific translators
@@ -429,8 +435,17 @@ static struct of_bus of_busses[] = {
 		.addr_prop_name = "reg",
 		.match = of_bus_sbus_match,
 		.count_cells = of_bus_sbus_count_cells,
-		.map = of_bus_sbus_map,
-		.get_flags = of_bus_sbus_get_flags,
+		.map = of_bus_default_map,
+		.get_flags = of_bus_default_get_flags,
+	},
+	/* FHC */
+	{
+		.name = "fhc",
+		.addr_prop_name = "reg",
+		.match = of_bus_fhc_match,
+		.count_cells = of_bus_fhc_count_cells,
+		.map = of_bus_default_map,
+		.get_flags = of_bus_default_get_flags,
 	},
 	/* Default */
 	{
--- linux-2.6.18.1.orig/arch/sparc64/kernel/prom.c
+++ linux-2.6.18.1/arch/sparc64/kernel/prom.c
@@ -1080,23 +1080,22 @@ static void sun4v_vdev_irq_trans_init(st
 
 static void irq_trans_init(struct device_node *dp)
 {
-	const char *model;
 #ifdef CONFIG_PCI
+	const char *model;
 	int i;
 #endif
 
+#ifdef CONFIG_PCI
 	model = of_get_property(dp, "model", NULL);
 	if (!model)
 		model = of_get_property(dp, "compatible", NULL);
-	if (!model)
-		return;
-
-#ifdef CONFIG_PCI
-	for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) {
-		struct irq_trans *t = &pci_irq_trans_table[i];
+	if (model) {
+		for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) {
+			struct irq_trans *t = &pci_irq_trans_table[i];
 
-		if (!strcmp(model, t->name))
-			return t->init(dp);
+			if (!strcmp(model, t->name))
+				return t->init(dp);
+		}
 	}
 #endif
 #ifdef CONFIG_SBUS
@@ -1104,8 +1103,9 @@ static void irq_trans_init(struct device
 	    !strcmp(dp->name, "sbi"))
 		return sbus_irq_trans_init(dp);
 #endif
-	if (!strcmp(dp->name, "central"))
-		return central_irq_trans_init(dp->child);
+	if (!strcmp(dp->name, "fhc") &&
+	    !strcmp(dp->parent->name, "central"))
+		return central_irq_trans_init(dp);
 	if (!strcmp(dp->name, "virtual-devices"))
 		return sun4v_vdev_irq_trans_init(dp);
 }
@@ -1517,7 +1517,7 @@ static char * __init get_one_property(ph
 	return buf;
 }
 
-static struct device_node * __init create_node(phandle node)
+static struct device_node * __init create_node(phandle node, struct device_node *parent)
 {
 	struct device_node *dp;
 
@@ -1526,6 +1526,7 @@ static struct device_node * __init creat
 
 	dp = prom_early_alloc(sizeof(*dp));
 	dp->unique_id = unique_id++;
+	dp->parent = parent;
 
 	kref_init(&dp->kref);
 
@@ -1544,12 +1545,11 @@ static struct device_node * __init build
 {
 	struct device_node *dp;
 
-	dp = create_node(node);
+	dp = create_node(node, parent);
 	if (dp) {
 		*(*nextp) = dp;
 		*nextp = &dp->allnext;
 
-		dp->parent = parent;
 		dp->path_component_name = build_path_component(dp);
 		dp->full_name = build_full_name(dp);
 
@@ -1565,7 +1565,7 @@ void __init prom_build_devicetree(void)
 {
 	struct device_node **nextp;
 
-	allnodes = create_node(prom_root_node);
+	allnodes = create_node(prom_root_node, NULL);
 	allnodes->path_component_name = "";
 	allnodes->full_name = "/";
 

--

[PATCH 24/61] SPARC64: Fix memory corruption in pci_4u_free_consistent().

[Chris Wright]

[-- Attachment #1: sparc64-fix-memory-corruption-in-pci_4u_free_consistent.patch --]
[-- Type: text/plain, Size: 896 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

The second argument to free_npages() was being incorrectly
calculated, which would thus access far past the end of the
arena->map[] bitmap.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 arch/sparc64/kernel/pci_iommu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/arch/sparc64/kernel/pci_iommu.c
+++ linux-2.6.18.1/arch/sparc64/kernel/pci_iommu.c
@@ -281,7 +281,7 @@ static void pci_4u_free_consistent(struc
 
 	spin_lock_irqsave(&iommu->lock, flags);
 
-	free_npages(iommu, dvma, npages);
+	free_npages(iommu, dvma - iommu->page_table_map_base, npages);
 
 	spin_unlock_irqrestore(&iommu->lock, flags);
 

--

[PATCH 25/61] bcm43xx: fix watchdog timeouts.

[Chris Wright]

[-- Attachment #1: bcm43xx-fix-watchdog-timeouts.patch --]
[-- Type: text/plain, Size: 2097 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Michael Buesch <mb@bu3sch.de>

This fixes a netdev watchdog timeout problem.
The problem is caused by a needed netif_tx_disable
in the hardware calibration code and can be shown by the
following timegraph.

|---5secs - ~10 jiffies time---|---|OOPS
^                              ^
last real TX                   periodic work stops netif

At OOPS, the following happens:
The watchdog timer triggers, because the timeout of 5secs
is over. The watchdog first checks for stopped TX.
_Usually_ TX is only stopped from the TX handler to indicate
a full TX queue. But this is different. We need to stop TX here,
regardless of the TX queue state. So the watchdog recognizes
the stopped device and assumes it is stopped due to full
TX queues (Which is a _wrong_ assumption in this case). It then
tests how far the last TX has been in the past. If it's more than
5secs (which is the case for low or no traffic), it will fire
a TX timeout.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/net/wireless/bcm43xx/bcm43xx_main.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- linux-2.6.18.1.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ linux-2.6.18.1/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -3165,7 +3165,15 @@ static void bcm43xx_periodic_work_handle
 
 	badness = estimate_periodic_work_badness(bcm->periodic_state);
 	mutex_lock(&bcm->mutex);
+
+	/* We must fake a started transmission here, as we are going to
+	 * disable TX. If we wouldn't fake a TX, it would be possible to
+	 * trigger the netdev watchdog, if the last real TX is already
+	 * some time on the past (slightly less than 5secs)
+	 */
+	bcm->net_dev->trans_start = jiffies;
 	netif_tx_disable(bcm->net_dev);
+
 	spin_lock_irqsave(&bcm->irq_lock, flags);
 	if (badness > BADNESS_LIMIT) {
 		/* Periodic work will take a long time, so we want it to

--

Re: [PATCH 25/61] bcm43xx: fix watchdog timeouts.

[John W. Linville]

On Tue, Oct 31, 2006 at 09:34:05PM -0800, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Michael Buesch <mb@bu3sch.de>
> 
> This fixes a netdev watchdog timeout problem.
> The problem is caused by a needed netif_tx_disable
> in the hardware calibration code and can be shown by the
> following timegraph.

ACK
-- 
John W. Linville
linville@tuxdriver.com

[PATCH 26/61] DVB: fix dvb_pll_attach for mt352/zl10353 in cx88-dvb, and nxt200x

[Chris Wright]

[-- Attachment #1: dvb-fix-dvb_pll_attach-for-mt352-zl10353-in-cx88-dvb-and-nxt200x.patch --]
[-- Type: text/plain, Size: 5279 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Michael Krufky <mkrufky@linuxtv.org>

Typical wiring of MT352, ZL10353, NXT2002 and NXT2004 based tuners
differ from dvb-pll's expectation that the PLL is directly accessible.
On these boards, the PLL is actually hidden behind the demodulator, and
as such can only be accessed via the demodulator's interface.  It was
failing to communicate with the PLL during an attach test and
subsequently not connecting the tuner ops.

By passing a NULL I2C bus handle to dvb_pll_attach, this accessibility
check can be bypassed.  Do this for the affected boards.  Also fix a
possible NULL dereference at sleep time, which would otherwise be
exposed by this change.

This patch has been backported to the 2.6.18.y stable kernel series
from the original changesets from Chris Pascoe and Michael Krufky,
already present in the upstream 2.6.19 kernel tree.

Signed-off-by: Chris Pascoe <c.pascoe@itee.uq.edu.au>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/media/dvb/b2c2/flexcop-fe-tuner.c |    2 +-
 drivers/media/dvb/frontends/dvb-pll.c     |    3 +++
 drivers/media/video/cx88/cx88-dvb.c       |   14 +++++++-------
 drivers/media/video/saa7134/saa7134-dvb.c |    4 ++--
 4 files changed, 13 insertions(+), 10 deletions(-)

--- linux-2.6.18.1.orig/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
+++ linux-2.6.18.1/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
@@ -527,7 +527,7 @@ int flexcop_frontend_init(struct flexcop
 	/* try the air atsc 2nd generation (nxt2002) */
 	if ((fc->fe = nxt200x_attach(&samsung_tbmv_config, &fc->i2c_adap)) != NULL) {
 		fc->dev_type          = FC_AIR_ATSC2;
-		dvb_pll_attach(fc->fe, 0x61, &fc->i2c_adap, &dvb_pll_samsung_tbmv);
+		dvb_pll_attach(fc->fe, 0x61, NULL, &dvb_pll_samsung_tbmv);
 		info("found the nxt2002 at i2c address: 0x%02x",samsung_tbmv_config.demod_address);
 	} else
 	/* try the air atsc 3nd generation (lgdt3303) */
--- linux-2.6.18.1.orig/drivers/media/dvb/frontends/dvb-pll.c
+++ linux-2.6.18.1/drivers/media/dvb/frontends/dvb-pll.c
@@ -493,6 +493,9 @@ static int dvb_pll_sleep(struct dvb_fron
 	int i;
 	int result;
 
+	if (priv->i2c == NULL)
+		return -EINVAL;
+
 	for (i = 0; i < priv->pll_desc->count; i++) {
 		if (priv->pll_desc->entries[i].limit == 0)
 			break;
--- linux-2.6.18.1.orig/drivers/media/video/cx88/cx88-dvb.c
+++ linux-2.6.18.1/drivers/media/video/cx88/cx88-dvb.c
@@ -576,7 +576,7 @@ static int dvb_register(struct cx8802_de
 						 &dev->core->i2c_adap);
 		if (dev->dvb.frontend != NULL) {
 			dvb_pll_attach(dev->dvb.frontend, 0x60,
-				       &dev->core->i2c_adap,
+				       NULL,
 				       &dvb_pll_thomson_dtt7579);
 			break;
 		}
@@ -587,7 +587,7 @@ static int dvb_register(struct cx8802_de
 						   &dev->core->i2c_adap);
 		if (dev->dvb.frontend != NULL) {
 			dvb_pll_attach(dev->dvb.frontend, 0x60,
-				       &dev->core->i2c_adap,
+				       NULL,
 				       &dvb_pll_thomson_dtt7579);
 		}
 #endif
@@ -600,7 +600,7 @@ static int dvb_register(struct cx8802_de
 						 &dev->core->i2c_adap);
 		if (dev->dvb.frontend != NULL) {
 			dvb_pll_attach(dev->dvb.frontend, 0x61,
-				       &dev->core->i2c_adap,
+				       NULL,
 				       &dvb_pll_thomson_dtt7579);
 			break;
 		}
@@ -611,7 +611,7 @@ static int dvb_register(struct cx8802_de
 						   &dev->core->i2c_adap);
 		if (dev->dvb.frontend != NULL) {
 			dvb_pll_attach(dev->dvb.frontend, 0x61,
-				       &dev->core->i2c_adap,
+				       NULL,
 				       &dvb_pll_thomson_dtt7579);
 		}
 #endif
@@ -623,7 +623,7 @@ static int dvb_register(struct cx8802_de
 						 &dev->core->i2c_adap);
 		if (dev->dvb.frontend != NULL) {
 			dvb_pll_attach(dev->dvb.frontend, 0x61,
-				       &dev->core->i2c_adap,
+				       NULL,
 				       &dvb_pll_lg_z201);
 		}
 		break;
@@ -634,7 +634,7 @@ static int dvb_register(struct cx8802_de
 						 &dev->core->i2c_adap);
 		if (dev->dvb.frontend != NULL) {
 			dvb_pll_attach(dev->dvb.frontend, 0x61,
-				       &dev->core->i2c_adap,
+				       NULL,
 				       &dvb_pll_unknown_1);
 		}
 		break;
@@ -757,7 +757,7 @@ static int dvb_register(struct cx8802_de
 						 &dev->core->i2c_adap);
 		if (dev->dvb.frontend != NULL) {
 			dvb_pll_attach(dev->dvb.frontend, 0x61,
-				       &dev->core->i2c_adap,
+				       NULL,
 				       &dvb_pll_tuv1236d);
 		}
 		break;
--- linux-2.6.18.1.orig/drivers/media/video/saa7134/saa7134-dvb.c
+++ linux-2.6.18.1/drivers/media/video/saa7134/saa7134-dvb.c
@@ -1158,13 +1158,13 @@ static int dvb_init(struct saa7134_dev *
 	case SAA7134_BOARD_AVERMEDIA_AVERTVHD_A180:
 		dev->dvb.frontend = nxt200x_attach(&avertvhda180, &dev->i2c_adap);
 		if (dev->dvb.frontend) {
-			dvb_pll_attach(dev->dvb.frontend, 0x61, &dev->i2c_adap, &dvb_pll_tdhu2);
+			dvb_pll_attach(dev->dvb.frontend, 0x61, NULL, &dvb_pll_tdhu2);
 		}
 		break;
 	case SAA7134_BOARD_KWORLD_ATSC110:
 		dev->dvb.frontend = nxt200x_attach(&kworldatsc110, &dev->i2c_adap);
 		if (dev->dvb.frontend) {
-			dvb_pll_attach(dev->dvb.frontend, 0x61, &dev->i2c_adap, &dvb_pll_tuv1236d);
+			dvb_pll_attach(dev->dvb.frontend, 0x61, NULL, &dvb_pll_tuv1236d);
 		}
 		break;
 #endif

--

[PATCH 27/61] ALSA: Fix re-use of va_list

[Chris Wright]

[-- Attachment #1: alsa-fix-re-use-of-va_list.patch --]
[-- Type: text/plain, Size: 1078 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: Fix re-use of va_list

The va_list is designed to be used only once.  The current code
may pass va_list arguments multiple times and may cause Oops.
Copy/release the arguments temporarily to avoid this problem.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 sound/core/info.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- linux-2.6.18.1.orig/sound/core/info.c
+++ linux-2.6.18.1/sound/core/info.c
@@ -119,7 +119,10 @@ int snd_iprintf(struct snd_info_buffer *
 	len = buffer->len - buffer->size;
 	va_start(args, fmt);
 	for (;;) {
-		res = vsnprintf(buffer->buffer + buffer->curr, len, fmt, args);
+		va_list ap;
+		va_copy(ap, args);
+		res = vsnprintf(buffer->buffer + buffer->curr, len, fmt, ap);
+		va_end(ap);
 		if (res < len)
 			break;
 		err = resize_info_buffer(buffer, buffer->len + PAGE_SIZE);

--

[PATCH 28/61] md: Fix bug where spares dont always get rebuilt properly when they become live.

[Chris Wright]

[-- Attachment #1: md-fix-bug-where-spares-don-t-always-get-rebuilt-properly-when-they-become-live.patch --]
[-- Type: text/plain, Size: 778 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: NeilBrown <neilb@suse.de>

If save_raid_disk is >= 0, then the device could be a device that is 
already in sync that is being re-added.  So we need to default this
value to -1.


Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/md/md.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.18.1.orig/drivers/md/md.c
+++ linux-2.6.18.1/drivers/md/md.c
@@ -1994,6 +1994,7 @@ static mdk_rdev_t *md_import_device(dev_
 	kobject_init(&rdev->kobj);
 
 	rdev->desc_nr = -1;
+	rdev->saved_raid_disk = -1;
 	rdev->flags = 0;
 	rdev->data_offset = 0;
 	rdev->sb_events = 0;

--

[PATCH 29/61] md: Fix calculation of ->degraded for multipath and raid10

[Chris Wright]

[-- Attachment #1: md-fix-calculation-of-degraded-for-multipath-and-raid10.patch --]
[-- Type: text/plain, Size: 1275 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: NeilBrown <neilb@suse.de>

Two less-used md personalities have bugs in the calculation of 
 ->degraded (the extent to which the array is degraded).

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/md/multipath.c |    2 +-
 drivers/md/raid10.c    |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.18.1.orig/drivers/md/multipath.c
+++ linux-2.6.18.1/drivers/md/multipath.c
@@ -480,7 +480,7 @@ static int multipath_run (mddev_t *mddev
 			mdname(mddev));
 		goto out_free_conf;
 	}
-	mddev->degraded = conf->raid_disks = conf->working_disks;
+	mddev->degraded = conf->raid_disks - conf->working_disks;
 
 	conf->pool = mempool_create_kzalloc_pool(NR_RESERVED_BUFS,
 						 sizeof(struct multipath_bh));
--- linux-2.6.18.1.orig/drivers/md/raid10.c
+++ linux-2.6.18.1/drivers/md/raid10.c
@@ -2042,7 +2042,7 @@ static int run(mddev_t *mddev)
 		disk = conf->mirrors + i;
 
 		if (!disk->rdev ||
-		    !test_bit(In_sync, &rdev->flags)) {
+		    !test_bit(In_sync, &disk->rdev->flags)) {
 			disk->head_position = 0;
 			mddev->degraded++;
 		}

--

[PATCH 30/61] knfsd: Fix race that can disable NFS server.

[Chris Wright]

[-- Attachment #1: knfsd-fix-race-that-can-disable-nfs-server.patch --]
[-- Type: text/plain, Size: 1680 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: NeilBrown <neilb@suse.de>

This is a long standing bug that seems to have only recently become
apparent, presumably due to increasing use of NFS over TCP - many
distros seem to be making it the default.

The SK_CONN bit gets set when a listening socket may be ready
for an accept, just as SK_DATA is set when data may be available.

It is entirely possible for svc_tcp_accept to be called with neither
of these set.  It doesn't happen often but there is a small race in
svc_sock_enqueue as SK_CONN and SK_DATA are tested outside the
spin_lock.  They could be cleared immediately after the test and
before the lock is gained.

This normally shouldn't be a problem.  The sockets are non-blocking so
trying to read() or accept() when ther is nothing to do is not a problem.

However: svc_tcp_recvfrom makes the decision "Should I accept() or
should I read()" based on whether SK_CONN is set or not.  This usually
works but is not safe.  The decision should be based on whether it is
a TCP_LISTEN socket or a TCP_CONNECTED socket.


Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 net/sunrpc/svcsock.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/net/sunrpc/svcsock.c
+++ linux-2.6.18.1/net/sunrpc/svcsock.c
@@ -902,7 +902,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
 		return 0;
 	}
 
-	if (test_bit(SK_CONN, &svsk->sk_flags)) {
+	if (svsk->sk_sk->sk_state == TCP_LISTEN) {
 		svc_tcp_accept(svsk);
 		svc_sock_received(svsk);
 		return 0;

--

Re: [PATCH 30/61] knfsd: Fix race that can disable NFS server.

[Willy Tarreau]

On Tue, Oct 31, 2006 at 09:34:10PM -0800, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: NeilBrown <neilb@suse.de>
> 
> This is a long standing bug that seems to have only recently become
> apparent, presumably due to increasing use of NFS over TCP - many
> distros seem to be making it the default.
> 
> The SK_CONN bit gets set when a listening socket may be ready
> for an accept, just as SK_DATA is set when data may be available.
> 
> It is entirely possible for svc_tcp_accept to be called with neither
> of these set.  It doesn't happen often but there is a small race in
> svc_sock_enqueue as SK_CONN and SK_DATA are tested outside the
> spin_lock.  They could be cleared immediately after the test and
> before the lock is gained.
> 
> This normally shouldn't be a problem.  The sockets are non-blocking so
> trying to read() or accept() when ther is nothing to do is not a problem.
> 
> However: svc_tcp_recvfrom makes the decision "Should I accept() or
> should I read()" based on whether SK_CONN is set or not.  This usually
> works but is not safe.  The decision should be based on whether it is
> a TCP_LISTEN socket or a TCP_CONNECTED socket.
> 
> 
> Signed-off-by: Neil Brown <neilb@suse.de>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> 
> ---
>  net/sunrpc/svcsock.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> --- linux-2.6.18.1.orig/net/sunrpc/svcsock.c
> +++ linux-2.6.18.1/net/sunrpc/svcsock.c
> @@ -902,7 +902,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
>  		return 0;
>  	}
>  
> -	if (test_bit(SK_CONN, &svsk->sk_flags)) {
> +	if (svsk->sk_sk->sk_state == TCP_LISTEN) {
>  		svc_tcp_accept(svsk);
>  		svc_sock_received(svsk);
>  		return 0;

This one seems valid for 2.4 too. Neil, do you confirm ?

Willy

Re: [PATCH 30/61] knfsd: Fix race that can disable NFS server.

[Willy Tarreau]

Hi Neil, 

I don't know if you noticed my request for ACK as I did not get any
response. I think that your patch here is a good candidate for 2.4
too, I would just like to get your confirmation before merging it.

Thanks in advance,
willy

On Wed, Nov 01, 2006 at 08:11:11AM +0100, Willy Tarreau wrote:
On Tue, Oct 31, 2006 at 09:34:10PM -0800, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: NeilBrown <neilb@suse.de>
> 
> This is a long standing bug that seems to have only recently become
> apparent, presumably due to increasing use of NFS over TCP - many
> distros seem to be making it the default.
> 
> The SK_CONN bit gets set when a listening socket may be ready
> for an accept, just as SK_DATA is set when data may be available.
> 
> It is entirely possible for svc_tcp_accept to be called with neither
> of these set.  It doesn't happen often but there is a small race in
> svc_sock_enqueue as SK_CONN and SK_DATA are tested outside the
> spin_lock.  They could be cleared immediately after the test and
> before the lock is gained.
> 
> This normally shouldn't be a problem.  The sockets are non-blocking so
> trying to read() or accept() when ther is nothing to do is not a problem.
> 
> However: svc_tcp_recvfrom makes the decision "Should I accept() or
> should I read()" based on whether SK_CONN is set or not.  This usually
> works but is not safe.  The decision should be based on whether it is
> a TCP_LISTEN socket or a TCP_CONNECTED socket.
> 
> 
> Signed-off-by: Neil Brown <neilb@suse.de>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> 
> ---
>  net/sunrpc/svcsock.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> --- linux-2.6.18.1.orig/net/sunrpc/svcsock.c
> +++ linux-2.6.18.1/net/sunrpc/svcsock.c
> @@ -902,7 +902,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
>  		return 0;
>  	}
>  
> -	if (test_bit(SK_CONN, &svsk->sk_flags)) {
> +	if (svsk->sk_sk->sk_state == TCP_LISTEN) {
>  		svc_tcp_accept(svsk);
>  		svc_sock_received(svsk);
>  		return 0;

Re: [PATCH 30/61] knfsd: Fix race that can disable NFS server.

[Neil Brown]

On Saturday November 4, w@1wt.eu wrote:
> Hi Neil, 
> 
> I don't know if you noticed my request for ACK as I did not get any
> response. I think that your patch here is a good candidate for 2.4
> too, I would just like to get your confirmation before merging it.

Sorry, I went to grab a copy of the latest 2.4 to double-check and the
got distracted.

Yes: this patch is definitely appropriate for 2.4.

Thanks,
NeilBrown

> > ---
> >  net/sunrpc/svcsock.c |    2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > --- linux-2.6.18.1.orig/net/sunrpc/svcsock.c
> > +++ linux-2.6.18.1/net/sunrpc/svcsock.c
> > @@ -902,7 +902,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
> >  		return 0;
> >  	}
> >  
> > -	if (test_bit(SK_CONN, &svsk->sk_flags)) {
> > +	if (svsk->sk_sk->sk_state == TCP_LISTEN) {
> >  		svc_tcp_accept(svsk);
> >  		svc_sock_received(svsk);
> >  		return 0;
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH 30/61] knfsd: Fix race that can disable NFS server.

[Willy Tarreau]

On Mon, Nov 06, 2006 at 10:55:44AM +1100, Neil Brown wrote:
> On Saturday November 4, w@1wt.eu wrote:
> > Hi Neil, 
> > 
> > I don't know if you noticed my request for ACK as I did not get any
> > response. I think that your patch here is a good candidate for 2.4
> > too, I would just like to get your confirmation before merging it.
> 
> Sorry, I went to grab a copy of the latest 2.4 to double-check and the
> got distracted.

no problem :-)

> Yes: this patch is definitely appropriate for 2.4.

Thanks, I will merge it then.

Cheers,
Willy

[PATCH 31/61] SCSI: aic7xxx: avoid checking SBLKCTL register for certain cards

[Chris Wright]

[-- Attachment #1: scsi-aic7xxx-avoid-checking-sblkctl-register-for-certain-cards.patch --]
[-- Type: text/plain, Size: 1570 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: James Bottomley <James.Bottomley@steeleye.com>

[SCSI] aic7xxx: avoid checking SBLKCTL register for certain cards

For cards that don't support LVD, checking the SBLKCTL register to
determine the bus singalling doesn't work.  So, check that the card
supports LVD first (AHC_ULTRA2) before checking the register.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/scsi/aic7xxx/aic7xxx_osm.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- linux-2.6.18.1.orig/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ linux-2.6.18.1/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -2539,15 +2539,23 @@ static void ahc_linux_set_iu(struct scsi
 static void ahc_linux_get_signalling(struct Scsi_Host *shost)
 {
 	struct ahc_softc *ahc = *(struct ahc_softc **)shost->hostdata;
-	u8 mode = ahc_inb(ahc, SBLKCTL);
+	u8 mode;
 
-	if (mode & ENAB40)
-		spi_signalling(shost) = SPI_SIGNAL_LVD;
-	else if (mode & ENAB20)
+	if (!(ahc->features & AHC_ULTRA2)) {
+		/* non-LVD chipset, may not have SBLKCTL reg */
 		spi_signalling(shost) = 
 			ahc->features & AHC_HVD ?
 			SPI_SIGNAL_HVD :
 			SPI_SIGNAL_SE;
+		return;
+	}
+
+	mode = ahc_inb(ahc, SBLKCTL);
+
+	if (mode & ENAB40)
+		spi_signalling(shost) = SPI_SIGNAL_LVD;
+	else if (mode & ENAB20)
+		spi_signalling(shost) = SPI_SIGNAL_SE;
 	else
 		spi_signalling(shost) = SPI_SIGNAL_UNKNOWN;
 }

--

[PATCH 32/61] IPoIB: Rejoin all multicast groups after a port event

[Chris Wright]

[-- Attachment #1: ipoib-rejoin-all-multicast-groups-after-a-port-event.patch --]
[-- Type: text/plain, Size: 1405 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Eli Cohen <eli@mellanox.co.il>

When ipoib_ib_dev_flush() is called because of a port event, the
driver needs to rejoin all multicast groups, since the flush will call
ipoib_mcast_dev_flush() (via ipoib_ib_dev_down()).  Otherwise no
(non-broadcast) multicast groups will be rejoined until the networking
core calls ->set_multicast_list again, and so multicast reception will
be broken for potentially a long time.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/infiniband/ulp/ipoib/ipoib_ib.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- linux-2.6.18.1.orig/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ linux-2.6.18.1/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -619,8 +619,10 @@ void ipoib_ib_dev_flush(void *_dev)
 	 * The device could have been brought down between the start and when
 	 * we get here, don't bring it back up if it's not configured up
 	 */
-	if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
+	if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)) {
 		ipoib_ib_dev_up(dev);
+		ipoib_mcast_restart_task(dev);
+	}
 
 	mutex_lock(&priv->vlan_mutex);
 

--

[PATCH 33/61] IB/mthca: Use mmiowb after doorbell ring

[Chris Wright]

[-- Attachment #1: ib-mthca-use-mmiowb-after-doorbell-ring.patch --]
[-- Type: text/plain, Size: 3332 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Arthur Kepner <akepner@sgi.com>

We discovered a problem when running IPoIB applications on multiple
CPUs on an Altix system. Many messages such as:

ib_mthca 0002:01:00.0: SQ 000014 full (19941644 head, 19941707 tail, 64 max, 0 nreq)

appear in syslog, and the driver wedges up.

Apparently this is because writes to the doorbells from different CPUs
reach the device out of order. The following patch adds mmiowb() calls
after doorbell rings to ensure the doorbell writes are ordered.

Signed-off-by: Arthur Kepner <akepner@sgi.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/infiniband/hw/mthca/mthca_cq.c  |    7 +++++++
 drivers/infiniband/hw/mthca/mthca_qp.c  |   19 +++++++++++++++++++
 drivers/infiniband/hw/mthca/mthca_srq.c |    8 ++++++++
 3 files changed, 34 insertions(+)

--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_cq.c
+++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -39,6 +39,8 @@
 #include <linux/init.h>
 #include <linux/hardirq.h>
 
+#include <asm/io.h>
+
 #include <rdma/ib_pack.h>
 
 #include "mthca_dev.h"
@@ -210,6 +212,11 @@ static inline void update_cons_index(str
 		mthca_write64(doorbell,
 			      dev->kar + MTHCA_CQ_DOORBELL,
 			      MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+		/*
+		 * Make sure doorbells don't leak out of CQ spinlock
+		 * and reach the HCA out of order:
+		 */
+		mmiowb();
 	}
 }
 
--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_qp.c
+++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -39,6 +39,8 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 
+#include <asm/io.h>
+
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_cache.h>
 #include <rdma/ib_pack.h>
@@ -1730,6 +1732,11 @@ out:
 		mthca_write64(doorbell,
 			      dev->kar + MTHCA_SEND_DOORBELL,
 			      MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+		/*
+		 * Make sure doorbells don't leak out of SQ spinlock
+		 * and reach the HCA out of order:
+		 */
+		mmiowb();
 	}
 
 	qp->sq.next_ind = ind;
@@ -1849,6 +1856,12 @@ out:
 	qp->rq.next_ind = ind;
 	qp->rq.head    += nreq;
 
+	/*
+	 * Make sure doorbells don't leak out of RQ spinlock and reach
+	 * the HCA out of order:
+	 */
+	mmiowb();
+
 	spin_unlock_irqrestore(&qp->rq.lock, flags);
 	return err;
 }
@@ -2110,6 +2123,12 @@ out:
 			      MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
 	}
 
+	/*
+	 * Make sure doorbells don't leak out of SQ spinlock and reach
+	 * the HCA out of order:
+	 */
+	mmiowb();
+
 	spin_unlock_irqrestore(&qp->sq.lock, flags);
 	return err;
 }
--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_srq.c
+++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -35,6 +35,8 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 
+#include <asm/io.h>
+
 #include "mthca_dev.h"
 #include "mthca_cmd.h"
 #include "mthca_memfree.h"
@@ -593,6 +595,12 @@ int mthca_tavor_post_srq_recv(struct ib_
 			      MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
 	}
 
+	/*
+	 * Make sure doorbells don't leak out of SRQ spinlock and
+	 * reach the HCA out of order:
+	 */
+	mmiowb();
+
 	spin_unlock_irqrestore(&srq->lock, flags);
 	return err;
 }

--

[PATCH 34/61] fuse: fix hang on SMP

[Chris Wright]

[-- Attachment #1: fuse-fix-hang-on-smp.patch --]
[-- Type: text/plain, Size: 4810 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Miklos Szeredi <miklos@szeredi.hu>

Fuse didn't always call i_size_write() with i_mutex held which caused
rare hangs on SMP/32bit.  This bug has been present since fuse-2.2,
well before being merged into mainline.

The simplest solution is to protect i_size_write() with the
per-connection spinlock.  Using i_mutex for this purpose would require
some restructuring of the code and I'm not even sure it's always safe
to acquire i_mutex in all places i_size needs to be set.

Since most of vmtruncate is already duplicated for other reasons,
duplicate the remaining part as well, making all i_size_write() calls
internal to fuse.

Using i_size_write() was unnecessary in fuse_init_inode(), since this
function is only called on a newly created locked inode.

Reported by a few people over the years, but special thanks to Dana
Henriksen who was persistent enough in helping me debug it.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 fs/fuse/dir.c   |   30 +++++++++++++++++++++---------
 fs/fuse/file.c  |   12 +++++++++---
 fs/fuse/inode.c |    5 ++++-
 3 files changed, 34 insertions(+), 13 deletions(-)

--- linux-2.6.18.1.orig/fs/fuse/dir.c
+++ linux-2.6.18.1/fs/fuse/dir.c
@@ -935,14 +935,30 @@ static void iattr_to_fattr(struct iattr 
 	}
 }
 
+static void fuse_vmtruncate(struct inode *inode, loff_t offset)
+{
+	struct fuse_conn *fc = get_fuse_conn(inode);
+	int need_trunc;
+
+	spin_lock(&fc->lock);
+	need_trunc = inode->i_size > offset;
+	i_size_write(inode, offset);
+	spin_unlock(&fc->lock);
+
+	if (need_trunc) {
+		struct address_space *mapping = inode->i_mapping;
+		unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
+		truncate_inode_pages(mapping, offset);
+	}
+}
+
 /*
  * Set attributes, and at the same time refresh them.
  *
  * Truncation is slightly complicated, because the 'truncate' request
  * may fail, in which case we don't want to touch the mapping.
- * vmtruncate() doesn't allow for this case.  So do the rlimit
- * checking by hand and call vmtruncate() only after the file has
- * actually been truncated.
+ * vmtruncate() doesn't allow for this case, so do the rlimit checking
+ * and the actual truncation by hand.
  */
 static int fuse_setattr(struct dentry *entry, struct iattr *attr)
 {
@@ -993,12 +1009,8 @@ static int fuse_setattr(struct dentry *e
 			make_bad_inode(inode);
 			err = -EIO;
 		} else {
-			if (is_truncate) {
-				loff_t origsize = i_size_read(inode);
-				i_size_write(inode, outarg.attr.size);
-				if (origsize > outarg.attr.size)
-					vmtruncate(inode, outarg.attr.size);
-			}
+			if (is_truncate)
+				fuse_vmtruncate(inode, outarg.attr.size);
 			fuse_change_attributes(inode, &outarg.attr);
 			fi->i_time = time_to_jiffies(outarg.attr_valid,
 						     outarg.attr_valid_nsec);
--- linux-2.6.18.1.orig/fs/fuse/file.c
+++ linux-2.6.18.1/fs/fuse/file.c
@@ -481,8 +481,10 @@ static int fuse_commit_write(struct file
 		err = -EIO;
 	if (!err) {
 		pos += count;
-		if (pos > i_size_read(inode))
+		spin_lock(&fc->lock);
+		if (pos > inode->i_size)
 			i_size_write(inode, pos);
+		spin_unlock(&fc->lock);
 
 		if (offset == 0 && to == PAGE_CACHE_SIZE) {
 			clear_page_dirty(page);
@@ -586,8 +588,12 @@ static ssize_t fuse_direct_io(struct fil
 	}
 	fuse_put_request(fc, req);
 	if (res > 0) {
-		if (write && pos > i_size_read(inode))
-			i_size_write(inode, pos);
+		if (write) {
+			spin_lock(&fc->lock);
+			if (pos > inode->i_size)
+				i_size_write(inode, pos);
+			spin_unlock(&fc->lock);
+		}
 		*ppos = pos;
 	}
 	fuse_invalidate_attr(inode);
--- linux-2.6.18.1.orig/fs/fuse/inode.c
+++ linux-2.6.18.1/fs/fuse/inode.c
@@ -109,6 +109,7 @@ static int fuse_remount_fs(struct super_
 
 void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
 {
+	struct fuse_conn *fc = get_fuse_conn(inode);
 	if (S_ISREG(inode->i_mode) && i_size_read(inode) != attr->size)
 		invalidate_inode_pages(inode->i_mapping);
 
@@ -117,7 +118,9 @@ void fuse_change_attributes(struct inode
 	inode->i_nlink   = attr->nlink;
 	inode->i_uid     = attr->uid;
 	inode->i_gid     = attr->gid;
+	spin_lock(&fc->lock);
 	i_size_write(inode, attr->size);
+	spin_unlock(&fc->lock);
 	inode->i_blksize = PAGE_CACHE_SIZE;
 	inode->i_blocks  = attr->blocks;
 	inode->i_atime.tv_sec   = attr->atime;
@@ -131,7 +134,7 @@ void fuse_change_attributes(struct inode
 static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr)
 {
 	inode->i_mode = attr->mode & S_IFMT;
-	i_size_write(inode, attr->size);
+	inode->i_size = attr->size;
 	if (S_ISREG(inode->i_mode)) {
 		fuse_init_common(inode);
 		fuse_init_file_inode(inode);

--

[PATCH 35/61] Fix potential interrupts during alternative patching

[Chris Wright]

[-- Attachment #1: fix-potential-interrupts-during-alternative-patching.patch --]
[-- Type: text/plain, Size: 1536 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Zachary Amsden <zach@vmware.com>

Interrupts must be disabled during alternative instruction patching.
On systems with high timer IRQ rates, or when running in an emulator,
timing differences can result in random kernel panics because of
running partially patched instructions.  This doesn't yet fix NMIs,
which requires extricating the patch code from the late bug checking
and is logically separate (and also less likely to cause problems).

Signed-off-by: Zachary Amsden <zach@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 arch/i386/kernel/alternative.c |    4 ++++
 1 file changed, 4 insertions(+)

--- linux-2.6.18.1.orig/arch/i386/kernel/alternative.c
+++ linux-2.6.18.1/arch/i386/kernel/alternative.c
@@ -344,6 +344,7 @@ void alternatives_smp_switch(int smp)
 
 void __init alternative_instructions(void)
 {
+	unsigned long flags;
 	if (no_replacement) {
 		printk(KERN_INFO "(SMP-)alternatives turned off\n");
 		free_init_pages("SMP alternatives",
@@ -351,6 +352,8 @@ void __init alternative_instructions(voi
 				(unsigned long)__smp_alt_end);
 		return;
 	}
+
+	local_irq_save(flags);
 	apply_alternatives(__alt_instructions, __alt_instructions_end);
 
 	/* switch to patch-once-at-boottime-only mode and free the
@@ -386,4 +389,5 @@ void __init alternative_instructions(voi
 		alternatives_smp_switch(0);
 	}
 #endif
+	local_irq_restore(flags);
 }

--

[PATCH 36/61] sky2: 88E803X transmit lockup (2.6.18)

[Chris Wright]

[-- Attachment #1: sky2-88e803x-transmit-lockup.patch --]
[-- Type: text/plain, Size: 2705 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Stephen Hemminger <shemminger@osdl.org>

The reason sky2 driver was locking up on transmit on the Yukon-FE chipset
is that it was misconfiguring the internal RAM buffer so the transmitter
and receiver were sharing the same space.  It is a wonder it worked at all!

This patch addresses this, and fixes an easily reproducible hang on Transmit.
Only the Yukon-FE chip is Marvell 88E803X (10/100 only) are affected.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/net/sky2.c |   33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

--- linux-2.6.18.1.orig/drivers/net/sky2.c
+++ linux-2.6.18.1/drivers/net/sky2.c
@@ -690,16 +690,10 @@ static void sky2_mac_init(struct sky2_hw
 
 }
 
-/* Assign Ram Buffer allocation.
- * start and end are in units of 4k bytes
- * ram registers are in units of 64bit words
- */
-static void sky2_ramset(struct sky2_hw *hw, u16 q, u8 startk, u8 endk)
+/* Assign Ram Buffer allocation in units of 64bit (8 bytes) */
+static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 end)
 {
-	u32 start, end;
-
-	start = startk * 4096/8;
-	end = (endk * 4096/8) - 1;
+	pr_debug(PFX "q %d %#x %#x\n", q, start, end);
 
 	sky2_write8(hw, RB_ADDR(q, RB_CTRL), RB_RST_CLR);
 	sky2_write32(hw, RB_ADDR(q, RB_START), start);
@@ -708,7 +702,7 @@ static void sky2_ramset(struct sky2_hw *
 	sky2_write32(hw, RB_ADDR(q, RB_RP), start);
 
 	if (q == Q_R1 || q == Q_R2) {
-		u32 space = (endk - startk) * 4096/8;
+		u32 space = end - start + 1;
 		u32 tp = space - space/4;
 
 		/* On receive queue's set the thresholds
@@ -1090,19 +1084,16 @@ static int sky2_up(struct net_device *de
 
 	sky2_mac_init(hw, port);
 
-	/* Determine available ram buffer space (in 4K blocks).
-	 * Note: not sure about the FE setting below yet
-	 */
-	if (hw->chip_id == CHIP_ID_YUKON_FE)
-		ramsize = 4;
-	else
-		ramsize = sky2_read8(hw, B2_E_0);
+	/* Determine available ram buffer space in qwords.  */
+	ramsize = sky2_read8(hw, B2_E_0) * 4096/8;
 
-	/* Give transmitter one third (rounded up) */
-	rxspace = ramsize - (ramsize + 2) / 3;
+	if (ramsize > 6*1024/8)
+		rxspace = ramsize - (ramsize + 2) / 3;
+	else
+		rxspace = ramsize / 2;
 
-	sky2_ramset(hw, rxqaddr[port], 0, rxspace);
-	sky2_ramset(hw, txqaddr[port], rxspace, ramsize);
+	sky2_ramset(hw, rxqaddr[port], 0, rxspace-1);
+	sky2_ramset(hw, txqaddr[port], rxspace, ramsize-1);
 
 	/* Make sure SyncQ is disabled */
 	sky2_write8(hw, RB_ADDR(port == 0 ? Q_XS1 : Q_XS2, RB_CTRL),

--

[PATCH 37/61] SCSI: aic7xxx: pause sequencer before touching SBLKCTL

[Chris Wright]

[-- Attachment #1: scsi-aic7xxx-pause-sequencer-before-touching-sblkctl.patch --]
[-- Type: text/plain, Size: 1330 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Doug Ledford <dledford@redhat.com>

[SCSI] aic7xxx: pause sequencer before touching SBLKCTL

Some cards need to pause the sequencer before the SBLKCTL register is
touched.  This fixes a PCI related oops seen on powerpc macs with this
card caused by trying to ascertain the bus signalling before beginning
domain validation.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/scsi/aic7xxx/aic7xxx_osm.c |    5 +++++
 1 file changed, 5 insertions(+)

--- linux-2.6.18.1.orig/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ linux-2.6.18.1/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -2539,6 +2539,7 @@ static void ahc_linux_set_iu(struct scsi
 static void ahc_linux_get_signalling(struct Scsi_Host *shost)
 {
 	struct ahc_softc *ahc = *(struct ahc_softc **)shost->hostdata;
+	unsigned long flags;
 	u8 mode;
 
 	if (!(ahc->features & AHC_ULTRA2)) {
@@ -2550,7 +2551,11 @@ static void ahc_linux_get_signalling(str
 		return;
 	}
 
+	ahc_lock(ahc, &flags);
+	ahc_pause(ahc);
 	mode = ahc_inb(ahc, SBLKCTL);
+	ahc_unpause(ahc);
+	ahc_unlock(ahc, &flags);
 
 	if (mode & ENAB40)
 		spi_signalling(shost) = SPI_SIGNAL_LVD;

--

[PATCH 38/61] Audit: fix missing ifdefs in syscall classes hookup for generic targets

[Chris Wright]

[-- Attachment #1: audit-fix-missing-ifdefs-in-syscall-classes-hookup-for-generic-targets.patch --]
[-- Type: text/plain, Size: 1925 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Al Viro <viro@ftp.linux.org.uk>

[PATCH] fix missing ifdefs in syscall classes hookup for generic targets

several targets have no ....at() family and m32r calls its only chown variant
chown32(), with __NR_chown being undefined.  creat(2) is also absent in some
targets.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 include/asm-generic/audit_change_attr.h |    4 ++++
 include/asm-generic/audit_dir_write.h   |    4 ++++
 lib/audit.c                             |    2 ++
 3 files changed, 10 insertions(+)

--- linux-2.6.18.1.orig/include/asm-generic/audit_change_attr.h
+++ linux-2.6.18.1/include/asm-generic/audit_change_attr.h
@@ -1,16 +1,20 @@
 __NR_chmod,
 __NR_fchmod,
+#ifdef __NR_chown
 __NR_chown,
 __NR_fchown,
 __NR_lchown,
+#endif
 __NR_setxattr,
 __NR_lsetxattr,
 __NR_fsetxattr,
 __NR_removexattr,
 __NR_lremovexattr,
 __NR_fremovexattr,
+#ifdef __NR_fchownat
 __NR_fchownat,
 __NR_fchmodat,
+#endif
 #ifdef __NR_chown32
 __NR_chown32,
 __NR_fchown32,
--- linux-2.6.18.1.orig/include/asm-generic/audit_dir_write.h
+++ linux-2.6.18.1/include/asm-generic/audit_dir_write.h
@@ -1,14 +1,18 @@
 __NR_rename,
 __NR_mkdir,
 __NR_rmdir,
+#ifdef __NR_creat
 __NR_creat,
+#endif
 __NR_link,
 __NR_unlink,
 __NR_symlink,
 __NR_mknod,
+#ifdef __NR_mkdirat
 __NR_mkdirat,
 __NR_mknodat,
 __NR_unlinkat,
 __NR_renameat,
 __NR_linkat,
 __NR_symlinkat,
+#endif
--- linux-2.6.18.1.orig/lib/audit.c
+++ linux-2.6.18.1/lib/audit.c
@@ -28,8 +28,10 @@ int audit_classify_syscall(int abi, unsi
 	switch(syscall) {
 	case __NR_open:
 		return 2;
+#ifdef __NR_openat
 	case __NR_openat:
 		return 3;
+#endif
 #ifdef __NR_socketcall
 	case __NR_socketcall:
 		return 4;

--

[PATCH 39/61] NET: Fix skb_segment() handling of fully linear SKBs

[Chris Wright]

[-- Attachment #1: net-fix-skb_segment-handling-of-fully-linear-skbs.patch --]
[-- Type: text/plain, Size: 1689 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

[NET]: Fix segmentation of linear packets

skb_segment fails to segment linear packets correctly because it
tries to write all linear parts of the original skb into each
segment.  This will always panic as each segment only contains
enough space for one MSS.

This was not detected earlier because linear packets should be
rare for GSO.  In fact it still remains to be seen what exactly
created the linear packets that triggered this bug.  Basically
the only time this should happen is if someone enables GSO
emulation on an interface that does not support SG.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 net/core/skbuff.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

--- linux-2.6.18.1.orig/net/core/skbuff.c
+++ linux-2.6.18.1/net/core/skbuff.c
@@ -1945,7 +1945,7 @@ struct sk_buff *skb_segment(struct sk_bu
 	do {
 		struct sk_buff *nskb;
 		skb_frag_t *frag;
-		int hsize, nsize;
+		int hsize;
 		int k;
 		int size;
 
@@ -1956,11 +1956,10 @@ struct sk_buff *skb_segment(struct sk_bu
 		hsize = skb_headlen(skb) - offset;
 		if (hsize < 0)
 			hsize = 0;
-		nsize = hsize + doffset;
-		if (nsize > len + doffset || !sg)
-			nsize = len + doffset;
+		if (hsize > len || !sg)
+			hsize = len;
 
-		nskb = alloc_skb(nsize + headroom, GFP_ATOMIC);
+		nskb = alloc_skb(hsize + doffset + headroom, GFP_ATOMIC);
 		if (unlikely(!nskb))
 			goto err;
 

--

[PATCH 40/61] SCTP: Always linearise packet on input

[Chris Wright]

[-- Attachment #1: sctp-always-linearise-packet-on-input.patch --]
[-- Type: text/plain, Size: 1334 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

I was looking at a RHEL5 bug report involving Xen and SCTP
(https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212550).
It turns out that SCTP wasn't written to handle skb fragments at
all.  The absence of any calls to skb_may_pull is testament to
that.

It just so happens that Xen creates fragmented packets more often
than other scenarios (header & data split when going from domU to
dom0).  That's what caused this bug to show up.

Until someone has the time sits down and audits the entire net/sctp
directory, here is a conservative and safe solution that simply
linearises all packets on input.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 net/sctp/input.c |    3 +++
 1 file changed, 3 insertions(+)

--- linux-2.6.18.1.orig/net/sctp/input.c
+++ linux-2.6.18.1/net/sctp/input.c
@@ -135,6 +135,9 @@ int sctp_rcv(struct sk_buff *skb)
 
 	SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS);
 
+	if (skb_linearize(skb))
+		goto discard_it;
+
 	sh = (struct sctphdr *) skb->h.raw;
 
 	/* Pull up the IP and SCTP headers. */

--

Re: [PATCH 40/61] SCTP: Always linearise packet on input

[Willy Tarreau]

On Tue, Oct 31, 2006 at 09:34:20PM -0800, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Herbert Xu <herbert@gondor.apana.org.au>
> 
> I was looking at a RHEL5 bug report involving Xen and SCTP
> (https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212550).
> It turns out that SCTP wasn't written to handle skb fragments at
> all.  The absence of any calls to skb_may_pull is testament to
> that.
> 
> It just so happens that Xen creates fragmented packets more often
> than other scenarios (header & data split when going from domU to
> dom0).  That's what caused this bug to show up.
> 
> Until someone has the time sits down and audits the entire net/sctp
> directory, here is a conservative and safe solution that simply
> linearises all packets on input.
> 
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> 
> ---
>  net/sctp/input.c |    3 +++
>  1 file changed, 3 insertions(+)
> 
> --- linux-2.6.18.1.orig/net/sctp/input.c
> +++ linux-2.6.18.1/net/sctp/input.c
> @@ -135,6 +135,9 @@ int sctp_rcv(struct sk_buff *skb)
>  
>  	SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS);
>  
> +	if (skb_linearize(skb))
> +		goto discard_it;
> +
>  	sh = (struct sctphdr *) skb->h.raw;
>  
>  	/* Pull up the IP and SCTP headers. */


Herbert, David,

This one seems to be valid for 2.4 too. Should I merge it or is it
unneeded ?

Willy

Re: [PATCH 40/61] SCTP: Always linearise packet on input

[David Miller]

From: Willy Tarreau <w@1wt.eu>
Date: Wed, 1 Nov 2006 08:17:22 +0100

> This one seems to be valid for 2.4 too. Should I merge it or is it
> unneeded ?

Indeed it appears that the problem can be triggered via IP
fragmentation on input even in 2.4.x, so yes it would be good
to put the fix there too.

Thanks for noticing this Willy.

[PATCH 41/61] x86-64: Fix C3 timer test

[Chris Wright]

[-- Attachment #1: x86-64-fix-c3-timer-test.patch --]
[-- Type: text/plain, Size: 999 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Andi Kleen <ak@suse.de>

There was a typo in the C3 latency test to decide of the TSC
should be used or not. It used the C2 latency threshold, not the
C3 one. Fix that.

This should fix the time on various dual core laptops.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 arch/x86_64/kernel/time.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/arch/x86_64/kernel/time.c
+++ linux-2.6.18.1/arch/x86_64/kernel/time.c
@@ -960,7 +960,7 @@ __cpuinit int unsynchronized_tsc(void)
  	if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
 #ifdef CONFIG_ACPI
 		/* But TSC doesn't tick in C3 so don't use it there */
-		if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 100)
+		if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 1000)
 			return 1;
 #endif
  		return 0;

--

Re: [PATCH 41/61] x86-64: Fix C3 timer test

[Len Brown]

Acked-by: Len Brown <len.brown@intel.com>

On Wednesday 01 November 2006 00:34, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Andi Kleen <ak@suse.de>
> 
> There was a typo in the C3 latency test to decide of the TSC
> should be used or not. It used the C2 latency threshold, not the
> C3 one. Fix that.
> 
> This should fix the time on various dual core laptops.
> 
> Signed-off-by: Andi Kleen <ak@suse.de>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> 
> ---
>  arch/x86_64/kernel/time.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> --- linux-2.6.18.1.orig/arch/x86_64/kernel/time.c
> +++ linux-2.6.18.1/arch/x86_64/kernel/time.c
> @@ -960,7 +960,7 @@ __cpuinit int unsynchronized_tsc(void)
>   	if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
>  #ifdef CONFIG_ACPI
>  		/* But TSC doesn't tick in C3 so don't use it there */
> -		if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 100)
> +		if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 1000)
>  			return 1;
>  #endif
>   		return 0;
> 
> --
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 

[PATCH 42/61] uml: make Uml compile on FC6 kernel headers

[Chris Wright]

[-- Attachment #1: uml-make-uml-compile-on-fc6-kernel-headers.patch --]
[-- Type: text/plain, Size: 1371 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Ulrich Drepper <drepper@redhat.com>

I need this patch to get a UML kernel to compile.  This is with the kernel
headers in FC6 which are automatically generated from the kernel tree. 
Some headers are missing but those files don't need them.  At least it
appears so since the resulting kernel works fine.

Tested on x86-64.

Signed-off-by: Ulrich Drepper <drepper@redhat.com>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 arch/um/include/kern_util.h    |    1 -
 arch/um/sys-x86_64/stub_segv.c |    1 -
 2 files changed, 2 deletions(-)

--- linux-2.6.18.1.orig/arch/um/include/kern_util.h
+++ linux-2.6.18.1/arch/um/include/kern_util.h
@@ -6,7 +6,6 @@
 #ifndef __KERN_UTIL_H__
 #define __KERN_UTIL_H__
 
-#include "linux/threads.h"
 #include "sysdep/ptrace.h"
 #include "sysdep/faultinfo.h"
 
--- linux-2.6.18.1.orig/arch/um/sys-x86_64/stub_segv.c
+++ linux-2.6.18.1/arch/um/sys-x86_64/stub_segv.c
@@ -5,7 +5,6 @@
 
 #include <stddef.h>
 #include <signal.h>
-#include <linux/compiler.h>
 #include <asm/unistd.h>
 #include "uml-config.h"
 #include "sysdep/sigcontext.h"

--

[PATCH 43/61] uml: remove warnings added by previous -stable patch

[Chris Wright]

[-- Attachment #1: uml-remove-warnings-added-by-previous-stable-patch.patch --]
[-- Type: text/plain, Size: 1191 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>

Add needed includes for syscall() function, also to remove warnings spit out by
GCC; they were added by previous -stable patch, and at least on my system
(Ubuntu x86-64) these warnings do show up.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 arch/um/os-Linux/sys-i386/tls.c |    2 ++
 arch/um/os-Linux/tls.c          |    2 ++
 2 files changed, 4 insertions(+)

--- linux-2.6.18.1.orig/arch/um/os-Linux/sys-i386/tls.c
+++ linux-2.6.18.1/arch/um/os-Linux/sys-i386/tls.c
@@ -1,4 +1,6 @@
 #include <errno.h>
+#include <sys/syscall.h>
+#include <unistd.h>
 #include <linux/unistd.h>
 #include "sysdep/tls.h"
 #include "user_util.h"
--- linux-2.6.18.1.orig/arch/um/os-Linux/tls.c
+++ linux-2.6.18.1/arch/um/os-Linux/tls.c
@@ -1,6 +1,8 @@
 #include <errno.h>
 #include <sys/ptrace.h>
+#include <sys/syscall.h>
 #include <asm/ldt.h>
+#include <unistd.h>
 #include "sysdep/tls.h"
 #include "uml-config.h"
 

--

[PATCH 44/61] ALSA: snd_rtctimer: handle RTC interrupts with a tasklet

[Chris Wright]

[-- Attachment #1: alsa-snd_rtctimer-handle-rtc-interrupts-with-a-tasklet.patch --]
[-- Type: text/plain, Size: 2194 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From:  <clemens@ladisch.de>

The calls to rtc_control() from inside the interrupt handler can
deadlock the RTC code, so move our interrupt handling code to a tasklet.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 sound/core/rtctimer.c |   17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

--- linux-2.6.18.1.orig/sound/core/rtctimer.c
+++ linux-2.6.18.1/sound/core/rtctimer.c
@@ -50,7 +50,9 @@ static int rtctimer_stop(struct snd_time
  * The hardware dependent description for this timer.
  */
 static struct snd_timer_hardware rtc_hw = {
-	.flags =	SNDRV_TIMER_HW_FIRST|SNDRV_TIMER_HW_AUTO,
+	.flags =	SNDRV_TIMER_HW_AUTO |
+			SNDRV_TIMER_HW_FIRST |
+			SNDRV_TIMER_HW_TASKLET,
 	.ticks =	100000000L,		/* FIXME: XXX */
 	.open =		rtctimer_open,
 	.close =	rtctimer_close,
@@ -60,6 +62,7 @@ static struct snd_timer_hardware rtc_hw 
 
 static int rtctimer_freq = RTC_FREQ;		/* frequency */
 static struct snd_timer *rtctimer;
+static struct tasklet_struct rtc_tasklet;
 static rtc_task_t rtc_task;
 
 
@@ -81,6 +84,7 @@ rtctimer_close(struct snd_timer *t)
 	rtc_task_t *rtc = t->private_data;
 	if (rtc) {
 		rtc_unregister(rtc);
+		tasklet_kill(&rtc_tasklet);
 		t->private_data = NULL;
 	}
 	return 0;
@@ -105,12 +109,17 @@ rtctimer_stop(struct snd_timer *timer)
 	return 0;
 }
 
+static void rtctimer_tasklet(unsigned long data)
+{
+	snd_timer_interrupt((struct snd_timer *)data, 1);
+}
+
 /*
  * interrupt
  */
 static void rtctimer_interrupt(void *private_data)
 {
-	snd_timer_interrupt(private_data, 1);
+	tasklet_hi_schedule(private_data);
 }
 
 
@@ -139,9 +148,11 @@ static int __init rtctimer_init(void)
 	timer->hw = rtc_hw;
 	timer->hw.resolution = NANO_SEC / rtctimer_freq;
 
+	tasklet_init(&rtc_tasklet, rtctimer_tasklet, (unsigned long)timer);
+
 	/* set up RTC callback */
 	rtc_task.func = rtctimer_interrupt;
-	rtc_task.private_data = timer;
+	rtc_task.private_data = &rtc_tasklet;
 
 	err = snd_timer_global_register(timer);
 	if (err < 0) {

--

[PATCH 45/61] Watchdog: sc1200wdt - fix missing pnp_unregister_driver()

[Chris Wright]

[-- Attachment #1: watchdog-sc1200wdt-fix-missing-pnp_unregister_driver.patch --]
[-- Type: text/plain, Size: 1474 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Akinobu Mita <akinobu.mita@gmail.com>

[WATCHDOG] sc1200wdt.c pnp unregister fix.

If no devices found or invalid parameter is specified,
scl200wdt_pnp_driver is left unregistered.
It breaks global list of pnp drivers.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/char/watchdog/sc1200wdt.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- linux-2.6.18.1.orig/drivers/char/watchdog/sc1200wdt.c
+++ linux-2.6.18.1/drivers/char/watchdog/sc1200wdt.c
@@ -392,7 +392,7 @@ static int __init sc1200wdt_init(void)
 	if (io == -1) {
 		printk(KERN_ERR PFX "io parameter must be specified\n");
 		ret = -EINVAL;
-		goto out_clean;
+		goto out_pnp;
 	}
 
 #if defined CONFIG_PNP
@@ -405,7 +405,7 @@ static int __init sc1200wdt_init(void)
 	if (!request_region(io, io_len, SC1200_MODULE_NAME)) {
 		printk(KERN_ERR PFX "Unable to register IO port %#x\n", io);
 		ret = -EBUSY;
-		goto out_clean;
+		goto out_pnp;
 	}
 
 	ret = sc1200wdt_probe();
@@ -435,6 +435,11 @@ out_rbt:
 out_io:
 	release_region(io, io_len);
 
+out_pnp:
+#if defined CONFIG_PNP
+	if (isapnp)
+		pnp_unregister_driver(&scl200wdt_pnp_driver);
+#endif
 	goto out_clean;
 }
 

--

Re: [PATCH 45/61] Watchdog: sc1200wdt - fix missing pnp_unregister_driver()

[Willy Tarreau]

On Tue, Oct 31, 2006 at 09:34:25PM -0800, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Akinobu Mita <akinobu.mita@gmail.com>
> 
> [WATCHDOG] sc1200wdt.c pnp unregister fix.
> 
> If no devices found or invalid parameter is specified,
> scl200wdt_pnp_driver is left unregistered.
> It breaks global list of pnp drivers.
> 
> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
> Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> 
> ---
>  drivers/char/watchdog/sc1200wdt.c |    9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> --- linux-2.6.18.1.orig/drivers/char/watchdog/sc1200wdt.c
> +++ linux-2.6.18.1/drivers/char/watchdog/sc1200wdt.c
> @@ -392,7 +392,7 @@ static int __init sc1200wdt_init(void)
>  	if (io == -1) {
>  		printk(KERN_ERR PFX "io parameter must be specified\n");
>  		ret = -EINVAL;
> -		goto out_clean;
> +		goto out_pnp;
>  	}
>  
>  #if defined CONFIG_PNP
> @@ -405,7 +405,7 @@ static int __init sc1200wdt_init(void)
>  	if (!request_region(io, io_len, SC1200_MODULE_NAME)) {
>  		printk(KERN_ERR PFX "Unable to register IO port %#x\n", io);
>  		ret = -EBUSY;
> -		goto out_clean;
> +		goto out_pnp;
>  	}
>  
>  	ret = sc1200wdt_probe();
> @@ -435,6 +435,11 @@ out_rbt:
>  out_io:
>  	release_region(io, io_len);
>  
> +out_pnp:
> +#if defined CONFIG_PNP
> +	if (isapnp)
> +		pnp_unregister_driver(&scl200wdt_pnp_driver);
> +#endif
>  	goto out_clean;
>  }

The first hunk seems to be valid for 2.4 too. The 2nd and 3rd ones
were already in 2.4. Wim, I'm going to merge it. No objection ?

Willy

Re: [PATCH 45/61] Watchdog: sc1200wdt - fix missing pnp_unregister_driver()

[Wim Van Sebroeck]

Willy,

> > From: Akinobu Mita <akinobu.mita@gmail.com>
> > 
> > [WATCHDOG] sc1200wdt.c pnp unregister fix.
...
> 
> The first hunk seems to be valid for 2.4 too. The 2nd and 3rd ones
> were already in 2.4. Wim, I'm going to merge it. No objection ?

No objections. Please go ahead :-).

Greetings,
Wim.

[PATCH 46/61] fix Intel RNG detection

[Chris Wright]

[-- Attachment #1: fix-intel-rng-detection.patch --]
[-- Type: text/plain, Size: 9017 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jan Beulich <jbeulich@novell.com>

[PATCH] fix Intel RNG detection

Previously, since determination whether there was an Intel random number
generator was based on a single bit, on systems with a matching bridge
device but without a firmware hub, there was a 50% chance that the code
would incorrectly decide that the system had an RNG.  This patch adds
detection of the firmware hub to better qualify the existence of an RNG.

There is one issue with the patch: I was unable to determine the LPC
equivalent for the PCI bridge 8086:2430 (since the old code didn't care
about which of the many devices provided by the ICH/ESB it was chose to use
the PCI bridge device, but the FWH settings live in the LPC device, so the
device list needed to be changed).

Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/char/hw_random/intel-rng.c |  186 +++++++++++++++++++++++++++++++++++--
 1 file changed, 177 insertions(+), 9 deletions(-)

--- linux-2.6.18.1.orig/drivers/char/hw_random/intel-rng.c
+++ linux-2.6.18.1/drivers/char/hw_random/intel-rng.c
@@ -50,6 +50,43 @@
 #define INTEL_RNG_ADDR_LEN			3
 
 /*
+ * LPC bridge PCI config space registers
+ */
+#define FWH_DEC_EN1_REG_OLD			0xe3
+#define FWH_DEC_EN1_REG_NEW			0xd9 /* high byte of 16-bit register */
+#define FWH_F8_EN_MASK				0x80
+
+#define BIOS_CNTL_REG_OLD			0x4e
+#define BIOS_CNTL_REG_NEW			0xdc
+#define BIOS_CNTL_WRITE_ENABLE_MASK		0x01
+#define BIOS_CNTL_LOCK_ENABLE_MASK		0x02
+
+/*
+ * Magic address at which Intel Firmware Hubs get accessed
+ */
+#define INTEL_FWH_ADDR				0xffff0000
+#define INTEL_FWH_ADDR_LEN			2
+
+/*
+ * Intel Firmware Hub command codes (write to any address inside the device)
+ */
+#define INTEL_FWH_RESET_CMD			0xff /* aka READ_ARRAY */
+#define INTEL_FWH_READ_ID_CMD			0x90
+
+/*
+ * Intel Firmware Hub Read ID command result addresses
+ */
+#define INTEL_FWH_MANUFACTURER_CODE_ADDRESS	0x000000
+#define INTEL_FWH_DEVICE_CODE_ADDRESS		0x000001
+
+/*
+ * Intel Firmware Hub Read ID command result values
+ */
+#define INTEL_FWH_MANUFACTURER_CODE		0x89
+#define INTEL_FWH_DEVICE_CODE_8M		0xac
+#define INTEL_FWH_DEVICE_CODE_4M		0xad
+
+/*
  * Data for PCI driver interface
  *
  * This data only exists for exporting the supported
@@ -58,12 +95,50 @@
  * want to register another driver on the same PCI id.
  */
 static const struct pci_device_id pci_tbl[] = {
-	{ 0x8086, 0x2418, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
-	{ 0x8086, 0x2428, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
-	{ 0x8086, 0x2430, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
-	{ 0x8086, 0x2448, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
-	{ 0x8086, 0x244e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
-	{ 0x8086, 0x245e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
+/* AA
+	{ 0x8086, 0x2418, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, */
+	{ 0x8086, 0x2410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* AA */
+/* AB
+	{ 0x8086, 0x2428, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, */
+	{ 0x8086, 0x2420, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* AB */
+/* ??
+	{ 0x8086, 0x2430, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, */
+/* BAM, CAM, DBM, FBM, GxM
+	{ 0x8086, 0x2448, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, */
+	{ 0x8086, 0x244c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* BAM */
+	{ 0x8086, 0x248c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* CAM */
+	{ 0x8086, 0x24cc, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* DBM */
+	{ 0x8086, 0x2641, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* FBM */
+	{ 0x8086, 0x27b9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* GxM */
+	{ 0x8086, 0x27bd, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* GxM DH */
+/* BA, CA, DB, Ex, 6300, Fx, 631x/632x, Gx
+	{ 0x8086, 0x244e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, */
+	{ 0x8086, 0x2440, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* BA */
+	{ 0x8086, 0x2480, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* CA */
+	{ 0x8086, 0x24c0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* DB */
+	{ 0x8086, 0x24d0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* Ex */
+	{ 0x8086, 0x25a1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 6300 */
+	{ 0x8086, 0x2640, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* Fx */
+	{ 0x8086, 0x2670, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2671, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2672, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2673, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2674, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2675, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2676, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2677, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2678, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x2679, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x267a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x267b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x267c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x267d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x267e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x267f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* 631x/632x */
+	{ 0x8086, 0x27b8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* Gx */
+/* E
+	{ 0x8086, 0x245e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, */
+	{ 0x8086, 0x2450, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, /* E  */
 	{ 0, },	/* terminate list */
 };
 MODULE_DEVICE_TABLE(pci, pci_tbl);
@@ -138,22 +213,115 @@ static struct hwrng intel_rng = {
 };
 
 
+#ifdef CONFIG_SMP
+static char __initdata waitflag;
+
+static void __init intel_init_wait(void *unused)
+{
+	while (waitflag)
+		cpu_relax();
+}
+#endif
+
 static int __init mod_init(void)
 {
 	int err = -ENODEV;
+	unsigned i;
+	struct pci_dev *dev = NULL;
 	void __iomem *mem;
-	u8 hw_status;
+	unsigned long flags;
+	u8 bios_cntl_off, fwh_dec_en1_off;
+	u8 bios_cntl_val = 0xff, fwh_dec_en1_val = 0xff;
+	u8 hw_status, mfc, dvc;
+
+	for (i = 0; !dev && pci_tbl[i].vendor; ++i)
+		dev = pci_get_device(pci_tbl[i].vendor, pci_tbl[i].device, NULL);
 
-	if (!pci_dev_present(pci_tbl))
+	if (!dev)
 		goto out; /* Device not found. */
 
+	/* Check for Intel 82802 */
+	if (dev->device < 0x2640) {
+		fwh_dec_en1_off = FWH_DEC_EN1_REG_OLD;
+		bios_cntl_off = BIOS_CNTL_REG_OLD;
+	} else {
+		fwh_dec_en1_off = FWH_DEC_EN1_REG_NEW;
+		bios_cntl_off = BIOS_CNTL_REG_NEW;
+	}
+
+	pci_read_config_byte(dev, fwh_dec_en1_off, &fwh_dec_en1_val);
+	pci_read_config_byte(dev, bios_cntl_off, &bios_cntl_val);
+
+	mem = ioremap_nocache(INTEL_FWH_ADDR, INTEL_FWH_ADDR_LEN);
+	if (mem == NULL) {
+		pci_dev_put(dev);
+		err = -EBUSY;
+		goto out;
+	}
+
+	/*
+	 * Since the BIOS code/data is going to disappear from its normal
+	 * location with the Read ID command, all activity on the system
+	 * must be stopped until the state is back to normal.
+	 */
+#ifdef CONFIG_SMP
+	set_mb(waitflag, 1);
+	if (smp_call_function(intel_init_wait, NULL, 1, 0) != 0) {
+		set_mb(waitflag, 0);
+		pci_dev_put(dev);
+		printk(KERN_ERR PFX "cannot run on all processors\n");
+		err = -EAGAIN;
+		goto err_unmap;
+	}
+#endif
+	local_irq_save(flags);
+
+	if (!(fwh_dec_en1_val & FWH_F8_EN_MASK))
+		pci_write_config_byte(dev,
+		                      fwh_dec_en1_off,
+		                      fwh_dec_en1_val | FWH_F8_EN_MASK);
+	if (!(bios_cntl_val &
+	      (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK)))
+		pci_write_config_byte(dev,
+		                      bios_cntl_off,
+		                      bios_cntl_val | BIOS_CNTL_WRITE_ENABLE_MASK);
+
+	writeb(INTEL_FWH_RESET_CMD, mem);
+	writeb(INTEL_FWH_READ_ID_CMD, mem);
+	mfc = readb(mem + INTEL_FWH_MANUFACTURER_CODE_ADDRESS);
+	dvc = readb(mem + INTEL_FWH_DEVICE_CODE_ADDRESS);
+	writeb(INTEL_FWH_RESET_CMD, mem);
+
+	if (!(bios_cntl_val &
+	      (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK)))
+		pci_write_config_byte(dev, bios_cntl_off, bios_cntl_val);
+	if (!(fwh_dec_en1_val & FWH_F8_EN_MASK))
+		pci_write_config_byte(dev, fwh_dec_en1_off, fwh_dec_en1_val);
+
+	local_irq_restore(flags);
+#ifdef CONFIG_SMP
+	/* Tell other CPUs to resume. */
+	set_mb(waitflag, 0);
+#endif
+
+	iounmap(mem);
+	pci_dev_put(dev);
+
+	if (mfc != INTEL_FWH_MANUFACTURER_CODE ||
+	    (dvc != INTEL_FWH_DEVICE_CODE_8M &&
+	     dvc != INTEL_FWH_DEVICE_CODE_4M)) {
+		printk(KERN_ERR PFX "FWH not detected\n");
+		err = -ENODEV;
+		goto out;
+	}
+
 	err = -ENOMEM;
 	mem = ioremap(INTEL_RNG_ADDR, INTEL_RNG_ADDR_LEN);
 	if (!mem)
 		goto out;
 	intel_rng.priv = (unsigned long)mem;
 
-	/* Check for Intel 82802 */
+	/* Check for Random Number Generator */
 	err = -ENODEV;
 	hw_status = hwstatus_get(mem);
 	if ((hw_status & INTEL_RNG_PRESENT) == 0)

--

Re: [PATCH 46/61] fix Intel RNG detection

[Dave Jones]

On Tue, Oct 31, 2006 at 09:34:26PM -0800, Chris Wright wrote:
 
 > From: Jan Beulich <jbeulich@novell.com>
 > 
 > [PATCH] fix Intel RNG detection
 > 
 > Previously, since determination whether there was an Intel random number
 > generator was based on a single bit, on systems with a matching bridge
 > device but without a firmware hub, there was a 50% chance that the code
 > would incorrectly decide that the system had an RNG.  This patch adds
 > detection of the firmware hub to better qualify the existence of an RNG.
 > 
 > There is one issue with the patch: I was unable to determine the LPC
 > equivalent for the PCI bridge 8086:2430 (since the old code didn't care
 > about which of the many devices provided by the ICH/ESB it was chose to use
 > the PCI bridge device, but the FWH settings live in the LPC device, so the
 > device list needed to be changed).
 > 
 > Signed-off-by: Jan Beulich <jbeulich@novell.com>
 > Signed-off-by: Michael Buesch <mb@bu3sch.de>
 > Signed-off-by: Andrew Morton <akpm@osdl.org>
 > Signed-off-by: Linus Torvalds <torvalds@osdl.org>
 > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
 > Signed-off-by: Chris Wright <chrisw@sous-sol.org>


Since I pushed an update to our Fedora users based on 2.6.18.2, a few people
have reported they no longer have their RNG's detected.
Here's one report: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=215144

		Dave

-- 
http://www.codemonkey.org.uk

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Chris Wright]

* Dave Jones (davej@redhat.com) wrote:
> Since I pushed an update to our Fedora users based on 2.6.18.2, a few people
> have reported they no longer have their RNG's detected.
> Here's one report: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=215144

Hmm, I wonder if the report is valid?  Jan's patch would have the correct
side effect of disabling false positives (for RNG identification).
Be good to check that it actually used to work.

Having said that, Jan the datasheet recommendation is looser than your
implementation.  It only recommends checking for manufacturer code,
you check device code as well.  Do you know of any scenarios where that
would matter (I can't conceive of any)?

thanks,
-chris

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Jan Beulich]

>>> Chris Wright <chrisw@sous-sol.org> 21.11.06 03:21 >>>
>* Dave Jones (davej@redhat.com) wrote:
>> Since I pushed an update to our Fedora users based on 2.6.18.2, a few people
>> have reported they no longer have their RNG's detected.
>> Here's one report: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=215144 
>
>Hmm, I wonder if the report is valid?  Jan's patch would have the correct
>side effect of disabling false positives (for RNG identification).
>Be good to check that it actually used to work.

Indeed, that is quite significant to know here.

>Having said that, Jan the datasheet recommendation is looser than your
>implementation.  It only recommends checking for manufacturer code,
>you check device code as well.  Do you know of any scenarios where that
>would matter (I can't conceive of any)?

Since Intel doesn't list any other device codes, I suppose there are none.
But of course, it's not entirely impossible that there are others, but I
wouldn't want to relax the already weak check; I'd rather want to add
other device codes if we have proof that these are valid.

Jan

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Chris Wright]

* Jan Beulich (jbeulich@novell.com) wrote:
> >>> Chris Wright <chrisw@sous-sol.org> 21.11.06 03:21 >>>
> >Hmm, I wonder if the report is valid?  Jan's patch would have the correct
> >side effect of disabling false positives (for RNG identification).
> >Be good to check that it actually used to work.
> 
> Indeed, that is quite significant to know here.

It does appear to work w/out the patch.  I've asked for a small bit
of diagnostics (below), perhaps you've got something you'd rather see?
I expect this to be a 24C0 LPC Bridge.


diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
index 8efbc9c..c655f57 100644
--- a/drivers/char/hw_random/intel-rng.c
+++ b/drivers/char/hw_random/intel-rng.c
@@ -304,6 +304,10 @@ #ifdef CONFIG_SMP
 	set_mb(waitflag, 0);
 #endif
 
+	printk(PFX "pci vendor:device %hx:%hx fwh_dec_en1 %x bios_cntl_val %x "
+	       "mfc %x dvc %x\n", dev->vendor, dev->device,
+	       fwh_dec_en1_val, bios_cntl_val, mfc, dvc);
+
 	iounmap(mem);
 	pci_dev_put(dev);
 

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Jan Beulich]

>It does appear to work w/out the patch.  I've asked for a small bit
>of diagnostics (below), perhaps you've got something you'd rather see?
>I expect this to be a 24C0 LPC Bridge.

Yes, that's what I'd have asked for. If it works, I expect the device
code to be different, or both manufacturer and device code to be
invalid. Depending on the outcome, perhaps we'll need an override
option so that this test can be partially (i.e. just the device code
part) or entirely (all the FWH detection) skipped.
The base problem is the vague documentation of the whole
detection mechanism - a lot of this I had to read between the lines.

Jan

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Dave Jones]

On Wed, Nov 22, 2006 at 08:53:08AM +0100, Jan Beulich wrote:
 > >It does appear to work w/out the patch.  I've asked for a small bit
 > >of diagnostics (below), perhaps you've got something you'd rather see?
 > >I expect this to be a 24C0 LPC Bridge.
 > 
 > Yes, that's what I'd have asked for. If it works, I expect the device
 > code to be different, or both manufacturer and device code to be
 > invalid. Depending on the outcome, perhaps we'll need an override
 > option so that this test can be partially (i.e. just the device code
 > part) or entirely (all the FWH detection) skipped.
 > The base problem is the vague documentation of the whole
 > detection mechanism - a lot of this I had to read between the lines.

The bug report I referenced came back with this from that debug patch..

intel_rng: no version for "struct_module" found: kernel tainted.
intel_rng: pci vendor:device 8086:24c0 fwh_dec_en1 80 bios_cntl_val 2 mfc cb dvc 88
intel_rng: FWH not detected

		Dave

-- 
http://www.codemonkey.org.uk

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Jan Beulich]

>>> Dave Jones <davej@redhat.com> 24.11.06 21:27 >>>
>On Wed, Nov 22, 2006 at 08:53:08AM +0100, Jan Beulich wrote:
> > >It does appear to work w/out the patch.  I've asked for a small bit
> > >of diagnostics (below), perhaps you've got something you'd rather see?
> > >I expect this to be a 24C0 LPC Bridge.
> > 
> > Yes, that's what I'd have asked for. If it works, I expect the device
> > code to be different, or both manufacturer and device code to be
> > invalid. Depending on the outcome, perhaps we'll need an override
> > option so that this test can be partially (i.e. just the device code
> > part) or entirely (all the FWH detection) skipped.
> > The base problem is the vague documentation of the whole
> > detection mechanism - a lot of this I had to read between the lines.
>
>The bug report I referenced came back with this from that debug patch..
>
>intel_rng: no version for "struct_module" found: kernel tainted.
>intel_rng: pci vendor:device 8086:24c0 fwh_dec_en1 80 bios_cntl_val 2 mfc cb dvc 88
>intel_rng: FWH not detected

Okay, this means the lock is being set by the BIOS, which disallows
disabling BIOS (and thus accessing the FWH). By default, I think it
is correct to consider the RNG not present in this case, however as
previously indicated I think we should provide a way to force
skipping the FWH test (with three levels - carry out, skip always, or
skip if BIOS locked).
I'll prepare a patch as soon as I can, but it might take a few days
until I get to it.

Jan

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Jan Beulich]

>>> Dave Jones <davej@redhat.com> 24.11.06 21:27 >>>
>On Wed, Nov 22, 2006 at 08:53:08AM +0100, Jan Beulich wrote:
> > >It does appear to work w/out the patch.  I've asked for a small bit
> > >of diagnostics (below), perhaps you've got something you'd rather see?
> > >I expect this to be a 24C0 LPC Bridge.
> > 
> > Yes, that's what I'd have asked for. If it works, I expect the device
> > code to be different, or both manufacturer and device code to be
> > invalid. Depending on the outcome, perhaps we'll need an override
> > option so that this test can be partially (i.e. just the device code
> > part) or entirely (all the FWH detection) skipped.
> > The base problem is the vague documentation of the whole
> > detection mechanism - a lot of this I had to read between the lines.
>
>The bug report I referenced came back with this from that debug patch..
>
>intel_rng: no version for "struct_module" found: kernel tainted.
>intel_rng: pci vendor:device 8086:24c0 fwh_dec_en1 80 bios_cntl_val 2 mfc cb dvc 88
>intel_rng: FWH not detected

Any chance you could have them test below patch (perhaps before I
actually submit it)? They should see the warning message added when
not using any options, and they should then be able to use the
no_fwh_detect option to get the thing to work again.

I'll meanwhile ask Intel about how they suppose to follow the RNG
detection sequence when the BIOS locks out write access to the
FWH interface.

Jan

Index: head-2006-11-21/drivers/char/hw_random/intel-rng.c
===================================================================
--- head-2006-11-21.orig/drivers/char/hw_random/intel-rng.c	2006-11-21 10:36:15.000000000 +0100
+++ head-2006-11-21/drivers/char/hw_random/intel-rng.c	2006-11-29 09:09:21.000000000 +0100
@@ -143,6 +143,8 @@ static const struct pci_device_id pci_tb
 };
 MODULE_DEVICE_TABLE(pci, pci_tbl);
 
+static __initdata int no_fwh_detect;
+module_param(no_fwh_detect, int, 0);
 
 static inline u8 hwstatus_get(void __iomem *mem)
 {
@@ -240,6 +242,11 @@ static int __init mod_init(void)
 	if (!dev)
 		goto out; /* Device not found. */
 
+	if (no_fwh_detect < 0) {
+		pci_dev_put(dev);
+		goto fwh_done;
+	}
+
 	/* Check for Intel 82802 */
 	if (dev->device < 0x2640) {
 		fwh_dec_en1_off = FWH_DEC_EN1_REG_OLD;
@@ -252,6 +259,23 @@ static int __init mod_init(void)
 	pci_read_config_byte(dev, fwh_dec_en1_off, &fwh_dec_en1_val);
 	pci_read_config_byte(dev, bios_cntl_off, &bios_cntl_val);
 
+	if ((bios_cntl_val &
+	     (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK))
+	    == BIOS_CNTL_LOCK_ENABLE_MASK) {
+		static __initdata /*const*/ char warning[] =
+			KERN_WARNING PFX "Firmware space is locked read-only. If you can't or\n"
+			KERN_WARNING PFX "don't want to disable this in firmware setup, and if\n"
+			KERN_WARNING PFX "you are certain that your system has a functional\n"
+			KERN_WARNING PFX "RNG, try using the 'no_fwh_detect' option.\n";
+
+		pci_dev_put(dev);
+		if (no_fwh_detect)
+			goto fwh_done;
+		printk(warning);
+		err = -EBUSY;
+		goto out;
+	}
+
 	mem = ioremap_nocache(INTEL_FWH_ADDR, INTEL_FWH_ADDR_LEN);
 	if (mem == NULL) {
 		pci_dev_put(dev);
@@ -280,8 +304,7 @@ static int __init mod_init(void)
 		pci_write_config_byte(dev,
 		                      fwh_dec_en1_off,
 		                      fwh_dec_en1_val | FWH_F8_EN_MASK);
-	if (!(bios_cntl_val &
-	      (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK)))
+	if (!(bios_cntl_val & BIOS_CNTL_WRITE_ENABLE_MASK))
 		pci_write_config_byte(dev,
 		                      bios_cntl_off,
 		                      bios_cntl_val | BIOS_CNTL_WRITE_ENABLE_MASK);
@@ -315,6 +338,8 @@ static int __init mod_init(void)
 		goto out;
 	}
 
+fwh_done:
+
 	err = -ENOMEM;
 	mem = ioremap(INTEL_RNG_ADDR, INTEL_RNG_ADDR_LEN);
 	if (!mem)

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[dean gaudet]

On Wed, 29 Nov 2006, Jan Beulich wrote:

> >>> Dave Jones <davej@redhat.com> 24.11.06 21:27 >>>
> >On Wed, Nov 22, 2006 at 08:53:08AM +0100, Jan Beulich wrote:
> > > >It does appear to work w/out the patch.  I've asked for a small bit
> > > >of diagnostics (below), perhaps you've got something you'd rather see?
> > > >I expect this to be a 24C0 LPC Bridge.
> > > 
> > > Yes, that's what I'd have asked for. If it works, I expect the device
> > > code to be different, or both manufacturer and device code to be
> > > invalid. Depending on the outcome, perhaps we'll need an override
> > > option so that this test can be partially (i.e. just the device code
> > > part) or entirely (all the FWH detection) skipped.
> > > The base problem is the vague documentation of the whole
> > > detection mechanism - a lot of this I had to read between the lines.
> >
> >The bug report I referenced came back with this from that debug patch..
> >
> >intel_rng: no version for "struct_module" found: kernel tainted.
> >intel_rng: pci vendor:device 8086:24c0 fwh_dec_en1 80 bios_cntl_val 2 mfc cb dvc 88
> >intel_rng: FWH not detected
> 
> Any chance you could have them test below patch (perhaps before I
> actually submit it)? They should see the warning message added when
> not using any options, and they should then be able to use the
> no_fwh_detect option to get the thing to work again.
> 
> I'll meanwhile ask Intel about how they suppose to follow the RNG
> detection sequence when the BIOS locks out write access to the
> FWH interface.

just for the public record (i already communicated with Jan in private 
mail on this one)... i have a box which hangs hard starting at 2.6.18.2 
and 2.6.19 -- hangs hard during the intel hw rng tests (no sysrq 
response).  and the hang occurs prior to the printk so it took some 
digging to figure out which module was taking out the system.

Jan's patch gets the box past the hang... it seems like this should be in 
at least the next 2.6.19.x stable (and if there's going to be another 
2.6.18.x stable then it should be included there as well).

there is apparently no hw rng on this box (returns all 0xff).

thanks
-dean

> 
> Jan
> 
> Index: head-2006-11-21/drivers/char/hw_random/intel-rng.c
> ===================================================================
> --- head-2006-11-21.orig/drivers/char/hw_random/intel-rng.c	2006-11-21 10:36:15.000000000 +0100
> +++ head-2006-11-21/drivers/char/hw_random/intel-rng.c	2006-11-29 09:09:21.000000000 +0100
> @@ -143,6 +143,8 @@ static const struct pci_device_id pci_tb
>  };
>  MODULE_DEVICE_TABLE(pci, pci_tbl);
>  
> +static __initdata int no_fwh_detect;
> +module_param(no_fwh_detect, int, 0);
>  
>  static inline u8 hwstatus_get(void __iomem *mem)
>  {
> @@ -240,6 +242,11 @@ static int __init mod_init(void)
>  	if (!dev)
>  		goto out; /* Device not found. */
>  
> +	if (no_fwh_detect < 0) {
> +		pci_dev_put(dev);
> +		goto fwh_done;
> +	}
> +
>  	/* Check for Intel 82802 */
>  	if (dev->device < 0x2640) {
>  		fwh_dec_en1_off = FWH_DEC_EN1_REG_OLD;
> @@ -252,6 +259,23 @@ static int __init mod_init(void)
>  	pci_read_config_byte(dev, fwh_dec_en1_off, &fwh_dec_en1_val);
>  	pci_read_config_byte(dev, bios_cntl_off, &bios_cntl_val);
>  
> +	if ((bios_cntl_val &
> +	     (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK))
> +	    == BIOS_CNTL_LOCK_ENABLE_MASK) {
> +		static __initdata /*const*/ char warning[] =
> +			KERN_WARNING PFX "Firmware space is locked read-only. If you can't or\n"
> +			KERN_WARNING PFX "don't want to disable this in firmware setup, and if\n"
> +			KERN_WARNING PFX "you are certain that your system has a functional\n"
> +			KERN_WARNING PFX "RNG, try using the 'no_fwh_detect' option.\n";
> +
> +		pci_dev_put(dev);
> +		if (no_fwh_detect)
> +			goto fwh_done;
> +		printk(warning);
> +		err = -EBUSY;
> +		goto out;
> +	}
> +
>  	mem = ioremap_nocache(INTEL_FWH_ADDR, INTEL_FWH_ADDR_LEN);
>  	if (mem == NULL) {
>  		pci_dev_put(dev);
> @@ -280,8 +304,7 @@ static int __init mod_init(void)
>  		pci_write_config_byte(dev,
>  		                      fwh_dec_en1_off,
>  		                      fwh_dec_en1_val | FWH_F8_EN_MASK);
> -	if (!(bios_cntl_val &
> -	      (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK)))
> +	if (!(bios_cntl_val & BIOS_CNTL_WRITE_ENABLE_MASK))
>  		pci_write_config_byte(dev,
>  		                      bios_cntl_off,
>  		                      bios_cntl_val | BIOS_CNTL_WRITE_ENABLE_MASK);
> @@ -315,6 +338,8 @@ static int __init mod_init(void)
>  		goto out;
>  	}
>  
> +fwh_done:
> +
>  	err = -ENOMEM;
>  	mem = ioremap(INTEL_RNG_ADDR, INTEL_RNG_ADDR_LEN);
>  	if (!mem)
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Chris Wright]

* dean gaudet (dean@arctic.org) wrote:
> just for the public record (i already communicated with Jan in private 
> mail on this one)... i have a box which hangs hard starting at 2.6.18.2 
> and 2.6.19 -- hangs hard during the intel hw rng tests (no sysrq 
> response).  and the hang occurs prior to the printk so it took some 
> digging to figure out which module was taking out the system.
> 
> Jan's patch gets the box past the hang... it seems like this should be in 
> at least the next 2.6.19.x stable (and if there's going to be another 
> 2.6.18.x stable then it should be included there as well).

Thanks for the data point.  I wonder if you get SMI and never come back.
Do you boot with no_fwh_detect=1 or -1?

thanks,
-chris

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[dean gaudet]

On Wed, 13 Dec 2006, Chris Wright wrote:

> * dean gaudet (dean@arctic.org) wrote:
> > just for the public record (i already communicated with Jan in private 
> > mail on this one)... i have a box which hangs hard starting at 2.6.18.2 
> > and 2.6.19 -- hangs hard during the intel hw rng tests (no sysrq 
> > response).  and the hang occurs prior to the printk so it took some 
> > digging to figure out which module was taking out the system.
> > 
> > Jan's patch gets the box past the hang... it seems like this should be in 
> > at least the next 2.6.19.x stable (and if there's going to be another 
> > 2.6.18.x stable then it should be included there as well).
> 
> Thanks for the data point.  I wonder if you get SMI and never come back.
> Do you boot with no_fwh_detect=1 or -1?

with the patch it boots perfectly without any command-line args.

without the patch it crashes after the "4" and before the "5" in this 
hacked up segment of the code:

        if (!(fwh_dec_en1_val & FWH_F8_EN_MASK))
                pci_write_config_byte(dev,
                                      fwh_dec_en1_off,
                                      fwh_dec_en1_val | FWH_F8_EN_MASK);
        if (!(bios_cntl_val &
              (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK)))
                pci_write_config_byte(dev,
                                      bios_cntl_off,
                                      bios_cntl_val | BIOS_CNTL_WRITE_ENABLE_MASK);

        printk(KERN_INFO "intel-rng: 4\n");
        writeb(INTEL_FWH_RESET_CMD, mem);
        printk(KERN_INFO "intel-rng: 5\n");

-dean

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Jan Beulich]

>with the patch it boots perfectly without any command-line args.

Are you getting the 'Firmware space is locked read-only' message then?

Thanks, Jan

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[dean gaudet]

On Thu, 14 Dec 2006, Jan Beulich wrote:

> >with the patch it boots perfectly without any command-line args.
> 
> Are you getting the 'Firmware space is locked read-only' message then?

yep...

so let me ask a naive question... don't we want the firmware locked 
read-only because that protects the bios from viruses?  honestly i'm naive 
in this area of pc hardware, but i'm kind of confused why we'd want 
unlocked firmware just so we can detect a RNG.

-dean

Re: [stable] [PATCH 46/61] fix Intel RNG detection

[Jan Beulich]

>>> dean gaudet <dean@arctic.org> 14.12.06 09:40 >>>
>On Thu, 14 Dec 2006, Jan Beulich wrote:
>
>> >with the patch it boots perfectly without any command-line args.
>> 
>> Are you getting the 'Firmware space is locked read-only' message then?
>
>yep...
>
>so let me ask a naive question... don't we want the firmware locked 
>read-only because that protects the bios from viruses?  honestly i'm naive 
>in this area of pc hardware, but i'm kind of confused why we'd want 
>unlocked firmware just so we can detect a RNG.

Indeed, these are contradicting requirements. The RNG detection, as
outlined by Intel documentation, requires being able to write to firmware
hub space (which in turn is hidden behind BIOS space). But I agree that
this is not a good solution (and even without that, it is not good to
require temporarily making invisible the entire BIOS code/data in order
to detect a non-essential device like an RNG).

Jan

Re: [PATCH 46/61] fix Intel RNG detection

[Michael Buesch]

On Tuesday 21 November 2006 00:45, Dave Jones wrote:
> On Tue, Oct 31, 2006 at 09:34:26PM -0800, Chris Wright wrote:
>  
>  > From: Jan Beulich <jbeulich@novell.com>
>  > 
>  > [PATCH] fix Intel RNG detection
>  > 
>  > Previously, since determination whether there was an Intel random number
>  > generator was based on a single bit, on systems with a matching bridge
>  > device but without a firmware hub, there was a 50% chance that the code
>  > would incorrectly decide that the system had an RNG.  This patch adds
>  > detection of the firmware hub to better qualify the existence of an RNG.
>  > 
>  > There is one issue with the patch: I was unable to determine the LPC
>  > equivalent for the PCI bridge 8086:2430 (since the old code didn't care
>  > about which of the many devices provided by the ICH/ESB it was chose to use
>  > the PCI bridge device, but the FWH settings live in the LPC device, so the
>  > device list needed to be changed).
>  > 
>  > Signed-off-by: Jan Beulich <jbeulich@novell.com>
>  > Signed-off-by: Michael Buesch <mb@bu3sch.de>
>  > Signed-off-by: Andrew Morton <akpm@osdl.org>
>  > Signed-off-by: Linus Torvalds <torvalds@osdl.org>
>  > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>  > Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> 
> 
> Since I pushed an update to our Fedora users based on 2.6.18.2, a few people
> have reported they no longer have their RNG's detected.
> Here's one report: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=215144

Well, this patch should acutally fix false detections.
Did these people actually have a _working_ rng before?
I saw a report of a mac user, for which the rng disappeared. But
the previously "detected" rng didn't work either. (Work as in produces
sane random numbers). So there actually wasn't a rng available all the time.

-- 
Greetings Michael.

[PATCH 47/61] posix-cpu-timers: prevent signal delivery starvation

[Chris Wright]

[-- Attachment #1: posix-cpu-timers-prevent-signal-delivery-starvation.patch --]
[-- Type: text/plain, Size: 5180 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Thomas Gleixner <tglx@linutronix.de>

The integer divisions in the timer accounting code can round the result
down to 0.  Adding 0 is without effect and the signal delivery stops.

Clamp the division result to minimum 1 to avoid this.

Problem was reported by Seongbae Park <spark@google.com>, who provided
also an inital patch.

Roland sayeth:

  I have had some more time to think about the problem, and to reproduce it
  using Toyo's test case.  For the record, if my understanding of the problem
  is correct, this happens only in one very particular case.  First, the
  expiry time has to be so soon that in cputime_t units (usually 1s/HZ ticks)
  it's < nthreads so the division yields zero.  Second, it only affects each
  thread that is so new that its CPU time accumulation is zero so now+0 is
  still zero and ->it_*_expires winds up staying zero.  For the VIRT and PROF
  clocks when cputime_t is tick granularity (or the SCHED clock on
  configurations where sched_clock's value only advances on clock ticks), this
  is not hard to arrange with new threads starting up and blocking before they
  accumulate a whole tick of CPU time.  That's what happens in Toyo's test
  case.

  Note that in general it is fine for that division to round down to zero,
  and set each thread's expiry time to its "now" time.  The problem only
  arises with thread's whose "now" value is still zero, so that now+0 winds up
  0 and is interpreted as "not set" instead of ">= now".  So it would be a
  sufficient and more precise fix to just use max(ticks, 1) inside the loop
  when setting each it_*_expires value.

  But, it does no harm to round the division up to one and always advance
  every thread's expiry time.  If the thread didn't already fire timers for
  the expiry time of "now", there is no expectation that it will do so before
  the next tick anyway.  So I followed Thomas's patch in lifting the max out
  of the loops.

  This patch also covers the reload cases, which are harder to write a test
  for (and I didn't try).  I've tested it with Toyo's case and it fixes that.


[toyoa@mvista.com: fix: min_t -> max_t]
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Roland McGrath <roland@redhat.com>
Cc: Daniel Walker <dwalker@mvista.com>
Cc: Toyo Abe <toyoa@mvista.com>
Cc: john stultz <johnstul@us.ibm.com>
Cc: Roman Zippel <zippel@linux-m68k.org>
Cc: Seongbae Park <spark@google.com>
Cc: Peter Mattis <pmattis@google.com>
Cc: Rohit Seth <rohitseth@google.com>
Cc: Martin Bligh <mbligh@google.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 kernel/posix-cpu-timers.c |   27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

--- linux-2.6.18.1.orig/kernel/posix-cpu-timers.c
+++ linux-2.6.18.1/kernel/posix-cpu-timers.c
@@ -88,6 +88,19 @@ static inline union cpu_time_count cpu_t
 }
 
 /*
+ * Divide and limit the result to res >= 1
+ *
+ * This is necessary to prevent signal delivery starvation, when the result of
+ * the division would be rounded down to 0.
+ */
+static inline cputime_t cputime_div_non_zero(cputime_t time, unsigned long div)
+{
+	cputime_t res = cputime_div(time, div);
+
+	return max_t(cputime_t, res, 1);
+}
+
+/*
  * Update expiry time from increment, and increase overrun count,
  * given the current clock sample.
  */
@@ -483,8 +496,8 @@ static void process_timer_rebalance(stru
 		BUG();
 		break;
 	case CPUCLOCK_PROF:
-		left = cputime_div(cputime_sub(expires.cpu, val.cpu),
-				   nthreads);
+		left = cputime_div_non_zero(cputime_sub(expires.cpu, val.cpu),
+				       nthreads);
 		do {
 			if (likely(!(t->flags & PF_EXITING))) {
 				ticks = cputime_add(prof_ticks(t), left);
@@ -498,8 +511,8 @@ static void process_timer_rebalance(stru
 		} while (t != p);
 		break;
 	case CPUCLOCK_VIRT:
-		left = cputime_div(cputime_sub(expires.cpu, val.cpu),
-				   nthreads);
+		left = cputime_div_non_zero(cputime_sub(expires.cpu, val.cpu),
+				       nthreads);
 		do {
 			if (likely(!(t->flags & PF_EXITING))) {
 				ticks = cputime_add(virt_ticks(t), left);
@@ -515,6 +528,7 @@ static void process_timer_rebalance(stru
 	case CPUCLOCK_SCHED:
 		nsleft = expires.sched - val.sched;
 		do_div(nsleft, nthreads);
+		nsleft = max_t(unsigned long long, nsleft, 1);
 		do {
 			if (likely(!(t->flags & PF_EXITING))) {
 				ns = t->sched_time + nsleft;
@@ -1159,12 +1173,13 @@ static void check_process_timers(struct 
 
 		prof_left = cputime_sub(prof_expires, utime);
 		prof_left = cputime_sub(prof_left, stime);
-		prof_left = cputime_div(prof_left, nthreads);
+		prof_left = cputime_div_non_zero(prof_left, nthreads);
 		virt_left = cputime_sub(virt_expires, utime);
-		virt_left = cputime_div(virt_left, nthreads);
+		virt_left = cputime_div_non_zero(virt_left, nthreads);
 		if (sched_expires) {
 			sched_left = sched_expires - sched_time;
 			do_div(sched_left, nthreads);
+			sched_left = max_t(unsigned long long, sched_left, 1);
 		} else {
 			sched_left = 0;
 		}

--

[PATCH 48/61] rtc-max6902: month conversion fix

[Chris Wright]

[-- Attachment #1: rtc-max6902-month-conversion-fix.patch --]
[-- Type: text/plain, Size: 1031 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Francisco Larramendi <flarramendi@gmail.com>

Fix October-only BCD-to-binary conversion bug:

	0x08 -> 7
	0x09 -> 8
	0x10 -> 15 (!)
	0x11 -> 19

Fixes http://bugzilla.kernel.org/show_bug.cgi?id=7361

Cc: Raphael Assenat <raph@raphnet.net>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/rtc/rtc-max6902.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/drivers/rtc/rtc-max6902.c
+++ linux-2.6.18.1/drivers/rtc/rtc-max6902.c
@@ -137,7 +137,7 @@ static int max6902_get_datetime(struct d
 	dt->tm_min	= BCD2BIN(chip->buf[2]);
 	dt->tm_hour	= BCD2BIN(chip->buf[3]);
 	dt->tm_mday	= BCD2BIN(chip->buf[4]);
-	dt->tm_mon	= BCD2BIN(chip->buf[5] - 1);
+	dt->tm_mon	= BCD2BIN(chip->buf[5]) - 1;
 	dt->tm_wday	= BCD2BIN(chip->buf[6]);
 	dt->tm_year = BCD2BIN(chip->buf[7]);
 

--

[PATCH 49/61] ISDN: fix drivers, by handling errors thrown by ->readstat()

[Chris Wright]

[-- Attachment #1: isdn-fix-drivers-by-handling-errors-thrown-by-readstat.patch --]
[-- Type: text/plain, Size: 1851 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jeff Garzik <jeff@garzik.org>

This is a particularly ugly on-failure bug, possibly security, since the
lack of error handling here is covering up another class of bug: failure to
handle copy_to_user() return values.

The I4L API function ->readstat() returns an integer, and by looking at
several existing driver implementations, it is clear that a negative return
value was meant to indicate an error.

Given that several drivers already return a negative value indicating an
errno-style error, the current code would blindly accept that [negative]
value as a valid amount of bytes read.  Obvious damage ensues.

Correcting ->readstat() handling to properly notice errors fixes the
existing code to work correctly on error, and enables future patches to
more easily indicate errors during operation.

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Cc: Karsten Keil <kkeil@suse.de>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/isdn/i4l/isdn_common.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- linux-2.6.18.1.orig/drivers/isdn/i4l/isdn_common.c
+++ linux-2.6.18.1/drivers/isdn/i4l/isdn_common.c
@@ -1134,9 +1134,12 @@ isdn_read(struct file *file, char __user
 		if (dev->drv[drvidx]->interface->readstat) {
 			if (count > dev->drv[drvidx]->stavail)
 				count = dev->drv[drvidx]->stavail;
-			len = dev->drv[drvidx]->interface->
-				readstat(buf, count, drvidx,
-					 isdn_minor2chan(minor));
+			len = dev->drv[drvidx]->interface->readstat(buf, count,
+						drvidx, isdn_minor2chan(minor));
+			if (len < 0) {
+				retval = len;
+				goto out;
+			}
 		} else {
 			len = 0;
 		}

--

Re: [PATCH 49/61] ISDN: fix drivers, by handling errors thrown by ->readstat()

[Jeff Garzik]

Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Jeff Garzik <jeff@garzik.org>
> 
> This is a particularly ugly on-failure bug, possibly security, since the
> lack of error handling here is covering up another class of bug: failure to
> handle copy_to_user() return values.
> 
> The I4L API function ->readstat() returns an integer, and by looking at
> several existing driver implementations, it is clear that a negative return
> value was meant to indicate an error.
> 
> Given that several drivers already return a negative value indicating an
> errno-style error, the current code would blindly accept that [negative]
> value as a valid amount of bytes read.  Obvious damage ensues.
> 
> Correcting ->readstat() handling to properly notice errors fixes the
> existing code to work correctly on error, and enables future patches to
> more easily indicate errors during operation.
> 
> Signed-off-by: Jeff Garzik <jeff@garzik.org>
> Cc: Karsten Keil <kkeil@suse.de>
> Cc: <stable@kernel.org>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>

No objection, but I would think that you would also want the companion 
patch:

commit 7786ce192fc4917fb9b789dd823476ff8fd6cf66
Author: Jeff Garzik <jeff@garzik.org>
Date:   Tue Oct 17 00:10:40 2006 -0700

     [PATCH] ISDN: check for userspace copy faults

     Most of the ISDN ->readstat() implementations needed to check
     copy_to_user() and put_user() return values.

Re: [PATCH 49/61] ISDN: fix drivers, by handling errors thrown by ->readstat()

[Willy Tarreau]

On Tue, Oct 31, 2006 at 09:34:29PM -0800, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Jeff Garzik <jeff@garzik.org>
> 
> This is a particularly ugly on-failure bug, possibly security, since the
> lack of error handling here is covering up another class of bug: failure to
> handle copy_to_user() return values.
> 
> The I4L API function ->readstat() returns an integer, and by looking at
> several existing driver implementations, it is clear that a negative return
> value was meant to indicate an error.
> 
> Given that several drivers already return a negative value indicating an
> errno-style error, the current code would blindly accept that [negative]
> value as a valid amount of bytes read.  Obvious damage ensues.
> 
> Correcting ->readstat() handling to properly notice errors fixes the
> existing code to work correctly on error, and enables future patches to
> more easily indicate errors during operation.
> 
> Signed-off-by: Jeff Garzik <jeff@garzik.org>
> Cc: Karsten Keil <kkeil@suse.de>
> Cc: <stable@kernel.org>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> ---
>  drivers/isdn/i4l/isdn_common.c |    9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> --- linux-2.6.18.1.orig/drivers/isdn/i4l/isdn_common.c
> +++ linux-2.6.18.1/drivers/isdn/i4l/isdn_common.c
> @@ -1134,9 +1134,12 @@ isdn_read(struct file *file, char __user
>  		if (dev->drv[drvidx]->interface->readstat) {
>  			if (count > dev->drv[drvidx]->stavail)
>  				count = dev->drv[drvidx]->stavail;
> -			len = dev->drv[drvidx]->interface->
> -				readstat(buf, count, drvidx,
> -					 isdn_minor2chan(minor));
> +			len = dev->drv[drvidx]->interface->readstat(buf, count,
> +						drvidx, isdn_minor2chan(minor));
> +			if (len < 0) {
> +				retval = len;
> +				goto out;
> +			}
>  		} else {
>  			len = 0;
>  		}

Seems appropriate for 2.4 too. Jeff, Karsten, no objection ?

Willy

Re: [PATCH 49/61] ISDN: fix drivers, by handling errors thrown by ->readstat()

[Karsten Keil]

On Wed, Nov 01, 2006 at 08:49:22AM +0100, Willy Tarreau wrote:
> On Tue, Oct 31, 2006 at 09:34:29PM -0800, Chris Wright wrote:
> > -stable review patch.  If anyone has any objections, please let us know.
> > ------------------
> > 
> > From: Jeff Garzik <jeff@garzik.org>
> > 
> > This is a particularly ugly on-failure bug, possibly security, since the
> > lack of error handling here is covering up another class of bug: failure to
> > handle copy_to_user() return values.
> > 
> > The I4L API function ->readstat() returns an integer, and by looking at
> > several existing driver implementations, it is clear that a negative return
> > value was meant to indicate an error.
> > 
> > Given that several drivers already return a negative value indicating an
> > errno-style error, the current code would blindly accept that [negative]
> > value as a valid amount of bytes read.  Obvious damage ensues.
> > 
> > Correcting ->readstat() handling to properly notice errors fixes the
> > existing code to work correctly on error, and enables future patches to
> > more easily indicate errors during operation.
> > 
> > Signed-off-by: Jeff Garzik <jeff@garzik.org>
> > Cc: Karsten Keil <kkeil@suse.de>
> > Cc: <stable@kernel.org>
> > Signed-off-by: Andrew Morton <akpm@osdl.org>
> > Signed-off-by: Linus Torvalds <torvalds@osdl.org>
> > Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> > ---
> >  drivers/isdn/i4l/isdn_common.c |    9 ++++++---
> >  1 file changed, 6 insertions(+), 3 deletions(-)
> > 
> > --- linux-2.6.18.1.orig/drivers/isdn/i4l/isdn_common.c
> > +++ linux-2.6.18.1/drivers/isdn/i4l/isdn_common.c
> > @@ -1134,9 +1134,12 @@ isdn_read(struct file *file, char __user
> >  		if (dev->drv[drvidx]->interface->readstat) {
> >  			if (count > dev->drv[drvidx]->stavail)
> >  				count = dev->drv[drvidx]->stavail;
> > -			len = dev->drv[drvidx]->interface->
> > -				readstat(buf, count, drvidx,
> > -					 isdn_minor2chan(minor));
> > +			len = dev->drv[drvidx]->interface->readstat(buf, count,
> > +						drvidx, isdn_minor2chan(minor));
> > +			if (len < 0) {
> > +				retval = len;
> > +				goto out;
> > +			}
> >  		} else {
> >  			len = 0;
> >  		}
> 
> Seems appropriate for 2.4 too. Jeff, Karsten, no objection ?
> 

Yes, OK for me.

-- 
Karsten Keil
SuSE Labs
ISDN development

[PATCH 50/61] SPARC64: Fix PCI memory space root resource on Hummingbird.

[Chris Wright]

[-- Attachment #1: sparc64-fix-pci-memory-space-root-resource-on-hummingbird.patch --]
[-- Type: text/plain, Size: 4757 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

For Hummingbird PCI controllers, we should create the root
PCI memory space resource as the full 4GB area, and then
allocate the IOMMU DMA translation window out of there.

The old code just assumed that the IOMMU DMA translation base
to the top of the 4GB area was unusable.  This is not true on
many systems such as SB100 and SB150, where the IOMMU DMA
translation window sits at 0xc0000000->0xdfffffff.

So what would happen is that any device mapped by the firmware
at the top section 0xe0000000->0xffffffff would get remapped
by Linux somewhere else leading to all kinds of problems and
boot failures.

While we're here, report more cases of OBP resource assignment
conflicts.  The only truly valid ones are ROM resource conflicts.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/sparc64/kernel/pci_common.c |   29 ++++++++++-------------------
 arch/sparc64/kernel/pci_sabre.c  |   23 +++++++++++++++++++----
 2 files changed, 29 insertions(+), 23 deletions(-)

--- linux-2.6.18.1.orig/arch/sparc64/kernel/pci_common.c
+++ linux-2.6.18.1/arch/sparc64/kernel/pci_common.c
@@ -330,19 +330,6 @@ __init get_device_resource(struct linux_
 	return res;
 }
 
-static int __init pdev_resource_collisions_expected(struct pci_dev *pdev)
-{
-	if (pdev->vendor != PCI_VENDOR_ID_SUN)
-		return 0;
-
-	if (pdev->device == PCI_DEVICE_ID_SUN_RIO_EBUS ||
-	    pdev->device == PCI_DEVICE_ID_SUN_RIO_1394 ||
-	    pdev->device == PCI_DEVICE_ID_SUN_RIO_USB)
-		return 1;
-
-	return 0;
-}
-
 static void __init pdev_record_assignments(struct pci_pbm_info *pbm,
 					   struct pci_dev *pdev)
 {
@@ -400,19 +387,23 @@ static void __init pdev_record_assignmen
 		pbm->parent->resource_adjust(pdev, res, root);
 
 		if (request_resource(root, res) < 0) {
+			int rnum;
+
 			/* OK, there is some conflict.  But this is fine
 			 * since we'll reassign it in the fixup pass.
 			 *
-			 * We notify the user that OBP made an error if it
-			 * is a case we don't expect.
+			 * Do not print the warning for ROM resources
+			 * as such a conflict is quite common and
+			 * harmless as the ROM bar is disabled.
 			 */
-			if (!pdev_resource_collisions_expected(pdev)) {
-				printk(KERN_ERR "PCI: Address space collision on region %ld "
+			rnum = (res - &pdev->resource[0]);
+			if (rnum != PCI_ROM_RESOURCE)
+				printk(KERN_ERR "PCI: Resource collision, "
+				       "region %d "
 				       "[%016lx:%016lx] of device %s\n",
-				       (res - &pdev->resource[0]),
+				       rnum,
 				       res->start, res->end,
 				       pci_name(pdev));
-			}
 		}
 	}
 }
--- linux-2.6.18.1.orig/arch/sparc64/kernel/pci_sabre.c
+++ linux-2.6.18.1/arch/sparc64/kernel/pci_sabre.c
@@ -1196,7 +1196,7 @@ static void pbm_register_toplevel_resour
 					    &pbm->mem_space);
 }
 
-static void sabre_pbm_init(struct pci_controller_info *p, struct device_node *dp, u32 dma_begin)
+static void sabre_pbm_init(struct pci_controller_info *p, struct device_node *dp, u32 dma_start, u32 dma_end)
 {
 	struct pci_pbm_info *pbm;
 	struct device_node *node;
@@ -1261,6 +1261,8 @@ static void sabre_pbm_init(struct pci_co
 		node = node->sibling;
 	}
 	if (simbas_found == 0) {
+		struct resource *rp;
+
 		/* No APBs underneath, probably this is a hummingbird
 		 * system.
 		 */
@@ -1302,8 +1304,10 @@ static void sabre_pbm_init(struct pci_co
 		pbm->io_space.end   = pbm->io_space.start + (1UL << 24) - 1UL;
 		pbm->io_space.flags = IORESOURCE_IO;
 
-		pbm->mem_space.start = p->pbm_A.controller_regs + SABRE_MEMSPACE;
-		pbm->mem_space.end   = pbm->mem_space.start + (unsigned long)dma_begin - 1UL;
+		pbm->mem_space.start =
+			(p->pbm_A.controller_regs + SABRE_MEMSPACE);
+		pbm->mem_space.end =
+			(pbm->mem_space.start + ((1UL << 32UL) - 1UL));
 		pbm->mem_space.flags = IORESOURCE_MEM;
 
 		if (request_resource(&ioport_resource, &pbm->io_space) < 0) {
@@ -1315,6 +1319,17 @@ static void sabre_pbm_init(struct pci_co
 			prom_halt();
 		}
 
+		rp = kmalloc(sizeof(*rp), GFP_KERNEL);
+		if (!rp) {
+			prom_printf("Cannot allocate IOMMU resource.\n");
+			prom_halt();
+		}
+		rp->name = "IOMMU";
+		rp->start = pbm->mem_space.start + (unsigned long) dma_start;
+		rp->end = pbm->mem_space.start + (unsigned long) dma_end - 1UL;
+		rp->flags = IORESOURCE_BUSY;
+		request_resource(&pbm->mem_space, rp);
+
 		pci_register_legacy_regions(&pbm->io_space,
 					    &pbm->mem_space);
 	}
@@ -1450,5 +1465,5 @@ void sabre_init(struct device_node *dp, 
 	/*
 	 * Look for APB underneath.
 	 */
-	sabre_pbm_init(p, dp, vdma[0]);
+	sabre_pbm_init(p, dp, vdma[0], vdma[0] + vdma[1]);
 }

--

[PATCH 51/61] PCI: Remove quirk_via_abnormal_poweroff

[Chris Wright]

[-- Attachment #1: pci-remove-quirk_via_abnormal_poweroff.patch --]
[-- Type: text/plain, Size: 2453 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Karsten Wiese <annabellesgarden@yahoo.de>

My K8T800 mobo resumes fine from suspend to ram with and without patch
applied against 2.6.18.

quirk_via_abnormal_poweroff makes some boards not boot 2.6.18, so IMO patch
should go to head, 2.6.18.2 and everywhere "ACPI: ACPICA 20060623" has been
applied.


Remove quirk_via_abnormal_poweroff

Obsoleted by "ACPI: ACPICA 20060623":
<snip>
    Implemented support for "ignored" bits in the ACPI
    registers.  According to the ACPI specification, these
    bits should be preserved when writing the registers via
    a read/modify/write cycle. There are 3 bits preserved
    in this manner: PM1_CONTROL[0] (SCI_EN), PM1_CONTROL[9],
    and PM1_STATUS[11].
    http://bugzilla.kernel.org/show_bug.cgi?id=3691
</snip>

Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de>
Cc: Bob Moore <robert.moore@intel.com>
Cc: Len Brown <len.brown@intel.com>
Acked-by: Dave Jones <davej@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/pci/quirks.c |   27 ---------------------------
 1 file changed, 27 deletions(-)

--- linux-2.6.18.1.orig/drivers/pci/quirks.c
+++ linux-2.6.18.1/drivers/pci/quirks.c
@@ -685,33 +685,6 @@ static void __devinit quirk_vt82c598_id(
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,	PCI_DEVICE_ID_VIA_82C597_0,	quirk_vt82c598_id );
 
-#ifdef CONFIG_ACPI_SLEEP
-
-/*
- * Some VIA systems boot with the abnormal status flag set. This can cause
- * the BIOS to re-POST the system on resume rather than passing control
- * back to the OS.  Clear the flag on boot
- */
-static void __devinit quirk_via_abnormal_poweroff(struct pci_dev *dev)
-{
-	u32 reg;
-
-	acpi_hw_register_read(ACPI_MTX_DO_NOT_LOCK, ACPI_REGISTER_PM1_STATUS,
-				&reg);
-
-	if (reg & 0x800) {
-		printk("Clearing abnormal poweroff flag\n");
-		acpi_hw_register_write(ACPI_MTX_DO_NOT_LOCK,
-					ACPI_REGISTER_PM1_STATUS,
-					(u16)0x800);
-	}
-}
-
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8235, quirk_via_abnormal_poweroff);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, quirk_via_abnormal_poweroff);
-
-#endif
-
 /*
  * CardBus controllers have a legacy base address that enables them
  * to respond as i82365 pcmcia controllers.  We don't want them to

--

Re: [PATCH 51/61] PCI: Remove quirk_via_abnormal_poweroff

[Len Brown]

Acked-by: Len Brown <len.brown@intel.com>

On Wednesday 01 November 2006 00:34, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Karsten Wiese <annabellesgarden@yahoo.de>
> 
> My K8T800 mobo resumes fine from suspend to ram with and without patch
> applied against 2.6.18.
> 
> quirk_via_abnormal_poweroff makes some boards not boot 2.6.18, so IMO patch
> should go to head, 2.6.18.2 and everywhere "ACPI: ACPICA 20060623" has been
> applied.
> 
> 
> Remove quirk_via_abnormal_poweroff
> 
> Obsoleted by "ACPI: ACPICA 20060623":
> <snip>
>     Implemented support for "ignored" bits in the ACPI
>     registers.  According to the ACPI specification, these
>     bits should be preserved when writing the registers via
>     a read/modify/write cycle. There are 3 bits preserved
>     in this manner: PM1_CONTROL[0] (SCI_EN), PM1_CONTROL[9],
>     and PM1_STATUS[11].
>     http://bugzilla.kernel.org/show_bug.cgi?id=3691
> </snip>
> 
> Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de>
> Cc: Bob Moore <robert.moore@intel.com>
> Cc: Len Brown <len.brown@intel.com>
> Acked-by: Dave Jones <davej@redhat.com>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> ---
>  drivers/pci/quirks.c |   27 ---------------------------
>  1 file changed, 27 deletions(-)
> 
> --- linux-2.6.18.1.orig/drivers/pci/quirks.c
> +++ linux-2.6.18.1/drivers/pci/quirks.c
> @@ -685,33 +685,6 @@ static void __devinit quirk_vt82c598_id(
>  }
>  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,	PCI_DEVICE_ID_VIA_82C597_0,	quirk_vt82c598_id );
>  
> -#ifdef CONFIG_ACPI_SLEEP
> -
> -/*
> - * Some VIA systems boot with the abnormal status flag set. This can cause
> - * the BIOS to re-POST the system on resume rather than passing control
> - * back to the OS.  Clear the flag on boot
> - */
> -static void __devinit quirk_via_abnormal_poweroff(struct pci_dev *dev)
> -{
> -	u32 reg;
> -
> -	acpi_hw_register_read(ACPI_MTX_DO_NOT_LOCK, ACPI_REGISTER_PM1_STATUS,
> -				&reg);
> -
> -	if (reg & 0x800) {
> -		printk("Clearing abnormal poweroff flag\n");
> -		acpi_hw_register_write(ACPI_MTX_DO_NOT_LOCK,
> -					ACPI_REGISTER_PM1_STATUS,
> -					(u16)0x800);
> -	}
> -}
> -
> -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8235, quirk_via_abnormal_poweroff);
> -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, quirk_via_abnormal_poweroff);
> -
> -#endif
> -
>  /*
>   * CardBus controllers have a legacy base address that enables them
>   * to respond as i82365 pcmcia controllers.  We don't want them to
> 
> --
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 

[PATCH 52/61] Reintroduce NODES_SPAN_OTHER_NODES for powerpc

[Chris Wright]

[-- Attachment #1: reintroduce-nodes_span_other_nodes-for-powerpc.patch --]
[-- Type: text/plain, Size: 2933 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Andy Whitcroft <apw@shadowen.org>

Revert "[PATCH] Remove SPAN_OTHER_NODES config definition"
    This reverts commit f62859bb6871c5e4a8e591c60befc8caaf54db8c.
Revert "[PATCH] mm: remove arch independent NODES_SPAN_OTHER_NODES"
    This reverts commit a94b3ab7eab4edcc9b2cb474b188f774c331adf7.

Also update the comments to indicate that this is still required
and where its used.

Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Mike Kravetz <kravetz@us.ibm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Mel Gorman <mel@csn.ul.ie>
Acked-by: Will Schmidt <will_schmidt@vnet.ibm.com>
Cc: Christoph Lameter <clameter@sgi.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/powerpc/Kconfig                   |    9 +++++++++
 arch/powerpc/configs/pseries_defconfig |    1 +
 include/linux/mmzone.h                 |    6 ++++++
 mm/page_alloc.c                        |    2 ++
 4 files changed, 18 insertions(+)

--- linux-2.6.18.1.orig/arch/powerpc/Kconfig
+++ linux-2.6.18.1/arch/powerpc/Kconfig
@@ -729,6 +729,15 @@ config ARCH_MEMORY_PROBE
 	def_bool y
 	depends on MEMORY_HOTPLUG
 
+# Some NUMA nodes have memory ranges that span
+# other nodes.  Even though a pfn is valid and
+# between a node's start and end pfns, it may not
+# reside on that node.  See memmap_init_zone()
+# for details.
+config NODES_SPAN_OTHER_NODES
+	def_bool y
+	depends on NEED_MULTIPLE_NODES
+
 config PPC_64K_PAGES
 	bool "64k page size"
 	depends on PPC64
--- linux-2.6.18.1.orig/arch/powerpc/configs/pseries_defconfig
+++ linux-2.6.18.1/arch/powerpc/configs/pseries_defconfig
@@ -184,6 +184,7 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
 CONFIG_RESOURCES_64BIT=y
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
+CONFIG_NODES_SPAN_OTHER_NODES=y
 # CONFIG_PPC_64K_PAGES is not set
 CONFIG_SCHED_SMT=y
 CONFIG_PROC_DEVICETREE=y
--- linux-2.6.18.1.orig/include/linux/mmzone.h
+++ linux-2.6.18.1/include/linux/mmzone.h
@@ -632,6 +632,12 @@ void sparse_init(void);
 #define sparse_index_init(_sec, _nid)  do {} while (0)
 #endif /* CONFIG_SPARSEMEM */
 
+#ifdef CONFIG_NODES_SPAN_OTHER_NODES
+#define early_pfn_in_nid(pfn, nid)	(early_pfn_to_nid(pfn) == (nid))
+#else
+#define early_pfn_in_nid(pfn, nid)	(1)
+#endif
+
 #ifndef early_pfn_valid
 #define early_pfn_valid(pfn)	(1)
 #endif
--- linux-2.6.18.1.orig/mm/page_alloc.c
+++ linux-2.6.18.1/mm/page_alloc.c
@@ -1673,6 +1673,8 @@ void __meminit memmap_init_zone(unsigned
 	for (pfn = start_pfn; pfn < end_pfn; pfn++) {
 		if (!early_pfn_valid(pfn))
 			continue;
+		if (!early_pfn_in_nid(pfn, nid))
+			continue;
 		page = pfn_to_page(pfn);
 		set_page_links(page, zone, nid, pfn);
 		init_page_count(page);

--

[PATCH 53/61] NFS: nfs_lookup - dont hash dentry when optimising away the lookup

[Chris Wright]

[-- Attachment #1: nfs-nfs_lookup-don-t-hash-dentry-when-optimising-away-the-lookup.patch --]
[-- Type: text/plain, Size: 1775 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Trond Myklebust <Trond.Myklebust@netapp.com>

If the open intents tell us that a given lookup is going to result in a,
exclusive create, we currently optimize away the lookup call itself. The
reason is that the lookup would not be atomic with the create RPC call, so
why do it in the first place?

A problem occurs, however, if the VFS aborts the exclusive create operation
after the lookup, but before the call to create the file/directory: in this
case we will end up with a hashed negative dentry in the dcache that has
never been looked up.
Fix this by only actually hashing the dentry once the create operation has
been successfully completed.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 fs/nfs/dir.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

--- linux-2.6.18.1.orig/fs/nfs/dir.c
+++ linux-2.6.18.1/fs/nfs/dir.c
@@ -902,9 +902,15 @@ static struct dentry *nfs_lookup(struct 
 
 	lock_kernel();
 
-	/* If we're doing an exclusive create, optimize away the lookup */
-	if (nfs_is_exclusive_create(dir, nd))
-		goto no_entry;
+	/*
+	 * If we're doing an exclusive create, optimize away the lookup
+	 * but don't hash the dentry.
+	 */
+	if (nfs_is_exclusive_create(dir, nd)) {
+		d_instantiate(dentry, NULL);
+		res = NULL;
+		goto out_unlock;
+	}
 
 	error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, &fhandle, &fattr);
 	if (error == -ENOENT)
@@ -1156,6 +1162,8 @@ int nfs_instantiate(struct dentry *dentr
 	if (IS_ERR(inode))
 		goto out_err;
 	d_instantiate(dentry, inode);
+	if (d_unhashed(dentry))
+		d_rehash(dentry);
 	return 0;
 out_err:
 	d_drop(dentry);

--

[PATCH 54/61] vmscan: Fix temp_priority race

[Chris Wright]

[-- Attachment #1: vmscan-fix-temp_priority-race.patch --]
[-- Type: text/plain, Size: 7852 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Andrew Morton <akpm@osdl.org>

The temp_priority field in zone is racy, as we can walk through a reclaim
path, and just before we copy it into prev_priority, it can be overwritten
(say with DEF_PRIORITY) by another reclaimer.

The same bug is contained in both try_to_free_pages and balance_pgdat, but
it is fixed slightly differently.  In balance_pgdat, we keep a separate
priority record per zone in a local array.  In try_to_free_pages there is
no need to do this, as the priority level is the same for all zones that we
reclaim from.

Impact of this bug is that temp_priority is copied into prev_priority, and
setting this artificially high causes reclaimers to set distress
artificially low.  They then fail to reclaim mapped pages, when they are,
in fact, under severe memory pressure (their priority may be as low as 0).
This causes the OOM killer to fire incorrectly.

From: Andrew Morton <akpm@osdl.org>

__zone_reclaim() isn't modifying zone->prev_priority.  But zone->prev_priority
is used in the decision whether or not to bring mapped pages onto the inactive
list.  Hence there's a risk here that __zone_reclaim() will fail because
zone->prev_priority ir large (ie: low urgency) and lots of mapped pages end up
stuck on the active list.

Fix that up by decreasing (ie making more urgent) zone->prev_priority as
__zone_reclaim() scans the zone's pages.

This bug perhaps explains why ZONE_RECLAIM_PRIORITY was created.  It should be
possible to remove that now, and to just start out at DEF_PRIORITY?

Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Cc: Christoph Lameter <clameter@engr.sgi.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
[chrisw: minor wiggle to fit -stable]
---
 include/linux/mmzone.h |    6 -----
 mm/page_alloc.c        |    2 -
 mm/vmscan.c            |   55 ++++++++++++++++++++++++++++++++++++-------------
 mm/vmstat.c            |    2 -
 4 files changed, 43 insertions(+), 22 deletions(-)

--- linux-2.6.18.1.orig/include/linux/mmzone.h
+++ linux-2.6.18.1/include/linux/mmzone.h
@@ -200,13 +200,9 @@ struct zone {
 	 * under - it drives the swappiness decision: whether to unmap mapped
 	 * pages.
 	 *
-	 * temp_priority is used to remember the scanning priority at which
-	 * this zone was successfully refilled to free_pages == pages_high.
-	 *
-	 * Access to both these fields is quite racy even on uniprocessor.  But
+	 * Access to both this field is quite racy even on uniprocessor.  But
 	 * it is expected to average out OK.
 	 */
-	int temp_priority;
 	int prev_priority;
 
 
--- linux-2.6.18.1.orig/mm/page_alloc.c
+++ linux-2.6.18.1/mm/page_alloc.c
@@ -2021,7 +2021,7 @@ static void __meminit free_area_init_cor
 		zone->zone_pgdat = pgdat;
 		zone->free_pages = 0;
 
-		zone->temp_priority = zone->prev_priority = DEF_PRIORITY;
+		zone->prev_priority = DEF_PRIORITY;
 
 		zone_pcp_init(zone);
 		INIT_LIST_HEAD(&zone->active_list);
--- linux-2.6.18.1.orig/mm/vmscan.c
+++ linux-2.6.18.1/mm/vmscan.c
@@ -696,6 +696,20 @@ done:
 }
 
 /*
+ * We are about to scan this zone at a certain priority level.  If that priority
+ * level is smaller (ie: more urgent) than the previous priority, then note
+ * that priority level within the zone.  This is done so that when the next
+ * process comes in to scan this zone, it will immediately start out at this
+ * priority level rather than having to build up its own scanning priority.
+ * Here, this priority affects only the reclaim-mapped threshold.
+ */
+static inline void note_zone_scanning_priority(struct zone *zone, int priority)
+{
+	if (priority < zone->prev_priority)
+		zone->prev_priority = priority;
+}
+
+/*
  * This moves pages from the active list to the inactive list.
  *
  * We move them the other way if the page is referenced by one or more
@@ -934,9 +948,7 @@ static unsigned long shrink_zones(int pr
 		if (!cpuset_zone_allowed(zone, __GFP_HARDWALL))
 			continue;
 
-		zone->temp_priority = priority;
-		if (zone->prev_priority > priority)
-			zone->prev_priority = priority;
+		note_zone_scanning_priority(zone, priority);
 
 		if (zone->all_unreclaimable && priority != DEF_PRIORITY)
 			continue;	/* Let kswapd poll it */
@@ -984,7 +996,6 @@ unsigned long try_to_free_pages(struct z
 		if (!cpuset_zone_allowed(zone, __GFP_HARDWALL))
 			continue;
 
-		zone->temp_priority = DEF_PRIORITY;
 		lru_pages += zone->nr_active + zone->nr_inactive;
 	}
 
@@ -1022,13 +1033,22 @@ unsigned long try_to_free_pages(struct z
 			blk_congestion_wait(WRITE, HZ/10);
 	}
 out:
+	/*
+	 * Now that we've scanned all the zones at this priority level, note
+	 * that level within the zone so that the next thread which performs
+	 * scanning of this zone will immediately start out at this priority
+	 * level.  This affects only the decision whether or not to bring
+	 * mapped pages onto the inactive list.
+	 */
+	if (priority < 0)
+		priority = 0;
 	for (i = 0; zones[i] != 0; i++) {
 		struct zone *zone = zones[i];
 
 		if (!cpuset_zone_allowed(zone, __GFP_HARDWALL))
 			continue;
 
-		zone->prev_priority = zone->temp_priority;
+		zone->prev_priority = priority;
 	}
 	return ret;
 }
@@ -1068,6 +1088,11 @@ static unsigned long balance_pgdat(pg_da
 		.swap_cluster_max = SWAP_CLUSTER_MAX,
 		.swappiness = vm_swappiness,
 	};
+	/*
+	 * temp_priority is used to remember the scanning priority at which
+	 * this zone was successfully refilled to free_pages == pages_high.
+	 */
+	int temp_priority[MAX_NR_ZONES];
 
 loop_again:
 	total_scanned = 0;
@@ -1075,11 +1100,8 @@ loop_again:
 	sc.may_writepage = !laptop_mode;
 	count_vm_event(PAGEOUTRUN);
 
-	for (i = 0; i < pgdat->nr_zones; i++) {
-		struct zone *zone = pgdat->node_zones + i;
-
-		zone->temp_priority = DEF_PRIORITY;
-	}
+	for (i = 0; i < pgdat->nr_zones; i++)
+		temp_priority[i] = DEF_PRIORITY;
 
 	for (priority = DEF_PRIORITY; priority >= 0; priority--) {
 		int end_zone = 0;	/* Inclusive.  0 = ZONE_DMA */
@@ -1140,10 +1162,9 @@ scan:
 			if (!zone_watermark_ok(zone, order, zone->pages_high,
 					       end_zone, 0))
 				all_zones_ok = 0;
-			zone->temp_priority = priority;
-			if (zone->prev_priority > priority)
-				zone->prev_priority = priority;
+			temp_priority[i] = priority;
 			sc.nr_scanned = 0;
+			note_zone_scanning_priority(zone, priority);
 			nr_reclaimed += shrink_zone(priority, zone, &sc);
 			reclaim_state->reclaimed_slab = 0;
 			nr_slab = shrink_slab(sc.nr_scanned, GFP_KERNEL,
@@ -1183,10 +1204,15 @@ scan:
 			break;
 	}
 out:
+	/*
+	 * Note within each zone the priority level at which this zone was
+	 * brought into a happy state.  So that the next thread which scans this
+	 * zone will start out at that priority level.
+	 */
 	for (i = 0; i < pgdat->nr_zones; i++) {
 		struct zone *zone = pgdat->node_zones + i;
 
-		zone->prev_priority = zone->temp_priority;
+		zone->prev_priority = temp_priority[i];
 	}
 	if (!all_zones_ok) {
 		cond_resched();
@@ -1570,6 +1596,7 @@ static int __zone_reclaim(struct zone *z
 		 */
 		priority = ZONE_RECLAIM_PRIORITY;
 		do {
+			note_zone_scanning_priority(zone, priority);
 			nr_reclaimed += shrink_zone(priority, zone, &sc);
 			priority--;
 		} while (priority >= 0 && nr_reclaimed < nr_pages);
--- linux-2.6.18.1.orig/mm/vmstat.c
+++ linux-2.6.18.1/mm/vmstat.c
@@ -586,11 +586,9 @@ static int zoneinfo_show(struct seq_file
 		seq_printf(m,
 			   "\n  all_unreclaimable: %u"
 			   "\n  prev_priority:     %i"
-			   "\n  temp_priority:     %i"
 			   "\n  start_pfn:         %lu",
 			   zone->all_unreclaimable,
 			   zone->prev_priority,
-			   zone->temp_priority,
 			   zone->zone_start_pfn);
 		spin_unlock_irqrestore(&zone->lock, flags);
 		seq_putc(m, '\n');

--

[PATCH 55/61] Use min of two prio settings in calculating distress for reclaim

[Chris Wright]

[-- Attachment #1: use-min-of-two-prio-settings-in-calculating-distress-for-reclaim.patch --]
[-- Type: text/plain, Size: 2533 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Martin Bligh <mbligh@google.com>

If try_to_free_pages / balance_pgdat are called with a gfp_mask specifying
GFP_IO and/or GFP_FS, they will reclaim the requisite number of pages, and the
reset prev_priority to DEF_PRIORITY (or to some other high (ie: unurgent)
value).

However, another reclaimer without those gfp_mask flags set (say, GFP_NOIO)
may still be struggling to reclaim pages.  The concurrent overwrite of
zone->prev_priority will cause this GFP_NOIO thread to unexpectedly cease
deactivating mapped pages, thus causing reclaim difficulties.

Fix this is to key the distress calculation not off zone->prev_priority, but
also take into account the local caller's priority by using
min(zone->prev_priority, sc->priority)

Signed-off-by: Martin J. Bligh <mbligh@google.com>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 mm/vmscan.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- linux-2.6.18.1.orig/mm/vmscan.c
+++ linux-2.6.18.1/mm/vmscan.c
@@ -727,7 +727,7 @@ static inline void note_zone_scanning_pr
  * But we had to alter page->flags anyway.
  */
 static void shrink_active_list(unsigned long nr_pages, struct zone *zone,
-				struct scan_control *sc)
+				struct scan_control *sc, int priority)
 {
 	unsigned long pgmoved;
 	int pgdeactivate = 0;
@@ -748,7 +748,7 @@ static void shrink_active_list(unsigned 
 		 * `distress' is a measure of how much trouble we're having
 		 * reclaiming pages.  0 -> no problems.  100 -> great trouble.
 		 */
-		distress = 100 >> zone->prev_priority;
+		distress = 100 >> min(zone->prev_priority, priority);
 
 		/*
 		 * The point of this algorithm is to decide when to start
@@ -899,7 +899,7 @@ static unsigned long shrink_zone(int pri
 			nr_to_scan = min(nr_active,
 					(unsigned long)sc->swap_cluster_max);
 			nr_active -= nr_to_scan;
-			shrink_active_list(nr_to_scan, zone, sc);
+			shrink_active_list(nr_to_scan, zone, sc, priority);
 		}
 
 		if (nr_inactive) {
@@ -1341,7 +1341,7 @@ static unsigned long shrink_all_zones(un
 			if (zone->nr_scan_active >= nr_pages || pass > 3) {
 				zone->nr_scan_active = 0;
 				nr_to_scan = min(nr_pages, zone->nr_active);
-				shrink_active_list(nr_to_scan, zone, sc);
+				shrink_active_list(nr_to_scan, zone, sc, prio);
 			}
 		}
 

--

[PATCH 56/61] fill_tgid: fix task_struct leak and possible oops

[Chris Wright]

[-- Attachment #1: fill_tgid-fix-task_struct-leak-and-possible-oops.patch --]
[-- Type: text/plain, Size: 1823 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Oleg Nesterov <oleg@tv-sign.ru>

1. fill_tgid() forgets to do put_task_struct(first).

2. release_task(first) can happen after fill_tgid() drops tasklist_lock,
   it is unsafe to dereference first->signal.

This is a temporary fix, imho the locking should be reworked.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Shailabh Nagar <nagar@watson.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Jay Lan <jlan@sgi.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 kernel/taskstats.c |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

--- linux-2.6.18.1.orig/kernel/taskstats.c
+++ linux-2.6.18.1/kernel/taskstats.c
@@ -229,14 +229,17 @@ static int fill_tgid(pid_t tgid, struct 
 	} else
 		get_task_struct(first);
 
-	/* Start with stats from dead tasks */
-	spin_lock_irqsave(&first->signal->stats_lock, flags);
-	if (first->signal->stats)
-		memcpy(stats, first->signal->stats, sizeof(*stats));
-	spin_unlock_irqrestore(&first->signal->stats_lock, flags);
 
 	tsk = first;
 	read_lock(&tasklist_lock);
+	/* Start with stats from dead tasks */
+	if (first->signal) {
+		spin_lock_irqsave(&first->signal->stats_lock, flags);
+		if (first->signal->stats)
+			memcpy(stats, first->signal->stats, sizeof(*stats));
+		spin_unlock_irqrestore(&first->signal->stats_lock, flags);
+	}
+
 	do {
 		if (tsk->exit_state == EXIT_ZOMBIE && thread_group_leader(tsk))
 			continue;
@@ -256,7 +259,7 @@ static int fill_tgid(pid_t tgid, struct 
 	 * Accounting subsytems can also add calls here to modify
 	 * fields of taskstats.
 	 */
-
+	put_task_struct(first);
 	return 0;
 }
 

--

[PATCH 57/61] JMB 368 PATA detection

[Chris Wright]

[-- Attachment #1: jmb-368-pata-detection.patch --]
[-- Type: text/plain, Size: 1118 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Alan Cox <alan@lxorguk.ukuu.org.uk>

The Jmicron JMB368 is PATA only so has the PATA on function zero.  Don't
therefore skip function zero on this device when probing

Signed-off-by: Alan Cox <alan@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/ide/pci/generic.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.18.1.orig/drivers/ide/pci/generic.c
+++ linux-2.6.18.1/drivers/ide/pci/generic.c
@@ -242,8 +242,10 @@ static int __devinit generic_init_one(st
 	    (!(PCI_FUNC(dev->devfn) & 1)))
 		goto out;
 
-	if (dev->vendor == PCI_VENDOR_ID_JMICRON && PCI_FUNC(dev->devfn) != 1)
-		goto out;
+	if (dev->vendor == PCI_VENDOR_ID_JMICRON) {
+		if (dev->device != PCI_DEVICE_ID_JMICRON_JMB368 && PCI_FUNC(dev->devfn) != 1)
+			goto out;
+	}
 
 	if (dev->vendor != PCI_VENDOR_ID_JMICRON) {
 		pci_read_config_word(dev, PCI_COMMAND, &command);

--

[PATCH 58/61] tcp: cubic scaling error

[Chris Wright]

[-- Attachment #1: tcp-cubic-scaling-error.patch --]
[-- Type: text/plain, Size: 1959 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Stephen Hemminger <shemminger@osdl.org>

Doug Leith observed a discrepancy between the version of CUBIC described
in the papers and the version in 2.6.18. A math error related to scaling
causes Cubic to grow too slowly.

Patch is from "Sangtae Ha" <sha2@ncsu.edu>. I validated that
it does fix the problems.

See the following to show behavior over 500ms 100 Mbit link.

Sender (2.6.19-rc3) ---  Bridge (2.6.18-rt7) ------- Receiver (2.6.19-rc3)
                    1G      [netem]           100M

	http://developer.osdl.org/shemminger/tcp/2.6.19-rc3/cubic-orig.png
	http://developer.osdl.org/shemminger/tcp/2.6.19-rc3/cubic-fix.png

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 net/ipv4/tcp_cubic.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.18.1.orig/net/ipv4/tcp_cubic.c
+++ linux-2.6.18.1/net/ipv4/tcp_cubic.c
@@ -190,7 +190,7 @@ static inline void bictcp_update(struct 
          */
 
 	/* change the unit from HZ to bictcp_HZ */
-        t = ((tcp_time_stamp + ca->delay_min - ca->epoch_start)
+        t = ((tcp_time_stamp + (ca->delay_min>>3) - ca->epoch_start)
 	     << BICTCP_HZ) / HZ;
 
         if (t < ca->bic_K)		/* t - K */
@@ -259,7 +259,7 @@ static inline void measure_delay(struct 
 	    (s32)(tcp_time_stamp - ca->epoch_start) < HZ)
 		return;
 
-	delay = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
+	delay = (tcp_time_stamp - tp->rx_opt.rcv_tsecr)<<3;
 	if (delay == 0)
 		delay = 1;
 
@@ -366,7 +366,7 @@ static int __init cubictcp_register(void
 
 	beta_scale = 8*(BICTCP_BETA_SCALE+beta)/ 3 / (BICTCP_BETA_SCALE - beta);
 
-	cube_rtt_scale = (bic_scale << 3) / 10;	/* 1024*c/rtt */
+	cube_rtt_scale = (bic_scale * 10);	/* 1024*c/rtt */
 
 	/* calculate the "K" for (wmax-cwnd) = c/rtt * K^3
 	 *  so K = cubic_root( (wmax-cwnd)*rtt/c )

--

[PATCH 59/61] IPV6: fix lockup via /proc/net/ip6_flowlabel [CVE-2006-5619]

[Chris Wright]

[-- Attachment #1: ipv6-fix-lockup-via-proc-net-ip6_flowlabel.patch --]
[-- Type: text/plain, Size: 1060 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: James Morris <jmorris@namei.org>

There's a bug in the seqfile handling for /proc/net/ip6_flowlabel, where, 
after finding a flowlabel, the code will loop forever not finding any 
further flowlabels, first traversing the rest of the hash bucket then just 
looping.

This patch fixes the problem by breaking after the hash bucket has been 
traversed.

Note that this bug can cause lockups and oopses, and is trivially invoked 
by an unpriveleged user.

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 net/ipv6/ip6_flowlabel.c |    2 ++
 1 file changed, 2 insertions(+)

--- linux-2.6.18.1.orig/net/ipv6/ip6_flowlabel.c
+++ linux-2.6.18.1/net/ipv6/ip6_flowlabel.c
@@ -587,6 +587,8 @@ static struct ip6_flowlabel *ip6fl_get_n
 	while (!fl) {
 		if (++state->bucket <= FL_HASH_MASK)
 			fl = fl_ht[state->bucket];
+		else
+			break;
 	}
 	return fl;
 }

--

[PATCH 60/61] md: check bio address after mapping through partitions.

[Chris Wright]

[-- Attachment #1: check-bio-address-after-mapping-through-partitions.patch --]
[-- Type: text/plain, Size: 2049 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: NeilBrown <neilb@suse.de>

Partitions are not limited to live within a device.  So
we should range check after partition mapping.

Note that 'maxsector' was being used for two different things.  I have
split off the second usage into 'old_sector' so that maxsector can be
still be used for it's primary usage later in the function.

Cc: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 block/ll_rw_blk.c |   24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

--- linux-2.6.18.1.orig/block/ll_rw_blk.c
+++ linux-2.6.18.1/block/ll_rw_blk.c
@@ -3021,6 +3021,7 @@ void generic_make_request(struct bio *bi
 {
 	request_queue_t *q;
 	sector_t maxsector;
+	sector_t old_sector;
 	int ret, nr_sectors = bio_sectors(bio);
 	dev_t old_dev;
 
@@ -3049,7 +3050,7 @@ void generic_make_request(struct bio *bi
 	 * NOTE: we don't repeat the blk_size check for each new device.
 	 * Stacking drivers are expected to know what they are doing.
 	 */
-	maxsector = -1;
+	old_sector = -1;
 	old_dev = 0;
 	do {
 		char b[BDEVNAME_SIZE];
@@ -3083,15 +3084,30 @@ end_io:
 		 */
 		blk_partition_remap(bio);
 
-		if (maxsector != -1)
+		if (old_sector != -1)
 			blk_add_trace_remap(q, bio, old_dev, bio->bi_sector, 
-					    maxsector);
+					    old_sector);
 
 		blk_add_trace_bio(q, bio, BLK_TA_QUEUE);
 
-		maxsector = bio->bi_sector;
+		old_sector = bio->bi_sector;
 		old_dev = bio->bi_bdev->bd_dev;
 
+		maxsector = bio->bi_bdev->bd_inode->i_size >> 9;
+		if (maxsector) {
+			sector_t sector = bio->bi_sector;
+
+			if (maxsector < nr_sectors || maxsector - nr_sectors < sector) {
+				/*
+				 * This may well happen - partitions are not checked
+				 * to make sure they are within the size of the
+				 * whole device.
+				 */
+				handle_bad_sector(bio);
+				goto end_io;
+			}
+		}
+
 		ret = q->make_request_fn(q, bio);
 	} while (ret);
 }

--

[PATCH 61/61] usbfs: private mutex for open, release, and remove

[Chris Wright]

[-- Attachment #1: usbfs-private-mutex-for-open-release-and-remove.patch --]
[-- Type: text/plain, Size: 4681 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Alan Stern <stern@rowland.harvard.edu>

The usbfs code doesn't provide sufficient mutual exclusion among open,
release, and remove.  Release vs. remove is okay because they both
acquire the device lock, but open is not exclusive with either one.  All
three routines modify the udev->filelist linked list, so they must not
run concurrently.

Apparently someone gave this a minimum amount of thought in the past by
explicitly acquiring the BKL at the start of the usbdev_open routine.
Oddly enough, there's a comment pointing out that locking is unnecessary
because chrdev_open already has acquired the BKL.

But this ignores the point that the files in /proc/bus/usb/* are not
char device files; they are regular files and so they don't get any
special locking.  Furthermore it's necessary to acquire the same lock in
the release and remove routines, which the code does not do.

Yet another problem arises because the same file_operations structure is
accessible through both the /proc/bus/usb/* and /dev/usb/usbdev* file
nodes.  Even when one of them has been removed, it's still possible for
userspace to open the other.  So simple locking around the individual
remove routines is insufficient; we need to lock the entire
usb_notify_remove_device notifier chain.

Rather than rely on the BKL, this patch (as723) introduces a new private
mutex for the purpose.  Holding the BKL while invoking a notifier chain
doesn't seem like a good idea.


Cc: Dave Jones <davej@redhat.com>
[https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212952]
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/usb/core/devio.c  |   26 +++++++++++++++-----------
 drivers/usb/core/notify.c |    3 +++
 drivers/usb/core/usb.h    |    1 +
 3 files changed, 19 insertions(+), 11 deletions(-)

--- linux-2.6.18.1.orig/drivers/usb/core/devio.c
+++ linux-2.6.18.1/drivers/usb/core/devio.c
@@ -59,6 +59,9 @@
 #define USB_DEVICE_MAX			USB_MAXBUS * 128
 static struct class *usb_device_class;
 
+/* Mutual exclusion for removal, open, and release */
+DEFINE_MUTEX(usbfs_mutex);
+
 struct async {
 	struct list_head asynclist;
 	struct dev_state *ps;
@@ -541,15 +544,13 @@ static int usbdev_open(struct inode *ino
 	struct dev_state *ps;
 	int ret;
 
-	/* 
-	 * no locking necessary here, as chrdev_open has the kernel lock
-	 * (still acquire the kernel lock for safety)
-	 */
+	/* Protect against simultaneous removal or release */
+	mutex_lock(&usbfs_mutex);
+
 	ret = -ENOMEM;
 	if (!(ps = kmalloc(sizeof(struct dev_state), GFP_KERNEL)))
-		goto out_nolock;
+		goto out;
 
-	lock_kernel();
 	ret = -ENOENT;
 	/* check if we are called from a real node or usbfs */
 	if (imajor(inode) == USB_DEVICE_MAJOR)
@@ -579,9 +580,8 @@ static int usbdev_open(struct inode *ino
 	list_add_tail(&ps->list, &dev->filelist);
 	file->private_data = ps;
  out:
-	unlock_kernel();
- out_nolock:
-        return ret;
+	mutex_unlock(&usbfs_mutex);
+	return ret;
 }
 
 static int usbdev_release(struct inode *inode, struct file *file)
@@ -591,7 +591,12 @@ static int usbdev_release(struct inode *
 	unsigned int ifnum;
 
 	usb_lock_device(dev);
+
+	/* Protect against simultaneous open */
+	mutex_lock(&usbfs_mutex);
 	list_del_init(&ps->list);
+	mutex_unlock(&usbfs_mutex);
+
 	for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
 			ifnum++) {
 		if (test_bit(ifnum, &ps->ifclaimed))
@@ -600,9 +605,8 @@ static int usbdev_release(struct inode *
 	destroy_all_async(ps);
 	usb_unlock_device(dev);
 	usb_put_dev(dev);
-	ps->dev = NULL;
 	kfree(ps);
-        return 0;
+	return 0;
 }
 
 static int proc_control(struct dev_state *ps, void __user *arg)
--- linux-2.6.18.1.orig/drivers/usb/core/notify.c
+++ linux-2.6.18.1/drivers/usb/core/notify.c
@@ -50,8 +50,11 @@ void usb_notify_add_device(struct usb_de
 
 void usb_notify_remove_device(struct usb_device *udev)
 {
+	/* Protect against simultaneous usbfs open */
+	mutex_lock(&usbfs_mutex);
 	blocking_notifier_call_chain(&usb_notifier_list,
 			USB_DEVICE_REMOVE, udev);
+	mutex_unlock(&usbfs_mutex);
 }
 
 void usb_notify_add_bus(struct usb_bus *ubus)
--- linux-2.6.18.1.orig/drivers/usb/core/usb.h
+++ linux-2.6.18.1/drivers/usb/core/usb.h
@@ -59,6 +59,7 @@ static inline int is_active(struct usb_i
 extern const char *usbcore_name;
 
 /* usbfs stuff */
+extern struct mutex usbfs_mutex;
 extern struct usb_driver usbfs_driver;
 extern struct file_operations usbfs_devices_fops;
 extern struct file_operations usbfs_device_file_operations;

--