diff --git a/debian/changelog b/debian/changelog index c0299aab3..216c41e3c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -16,19 +16,7 @@ linux-2.6 (2.6.18-4) UNRELEASED; urgency=low sys_msgrcv() and compat_sys_msgrcv(), triggered every 5 seconds whenever fakeroot is running. - [ maximilian attems ] - * Add netpoll leak fix. - * Add sky2 lookup patch for the Marvell 88E803X Yukon-FE chip. - * Add upstream forcedeth swsusp support. - * r8169: PCI ID for Corega Gigabit network card. - * r8169: the MMIO region of the 8167 stands behin BAR#1. - * r8169: Add upstream fix for infinite loop during hotplug. - * Bump build-dependency on kernel-package to 10.063. - * [sparc64] Add davem fix memory corruption in pci_4u_free_consistent(). - * [sparc64] Add davem fix central/FHC bus handling on Ex000 systems. - * [ip6_tables] Add patches for protocol and extension header bypass bug. - - -- maximilian attems Thu, 26 Oct 2006 22:20:34 +0200 + -- Norbert Tretkowski Sat, 21 Oct 2006 18:52:12 +0200 linux-2.6 (2.6.18-3) unstable; urgency=low diff --git a/debian/patches/bugfix/net-ip6_tables_extension_header-bypass.patch b/debian/patches/bugfix/net-ip6_tables_extension_header-bypass.patch deleted file mode 100644 index d07d02e82..000000000 --- a/debian/patches/bugfix/net-ip6_tables_extension_header-bypass.patch +++ /dev/null @@ -1,174 +0,0 @@ -From git-commits-head-owner@vger.kernel.org Wed Oct 25 14:13:09 2006 -Date: Wed, 25 Oct 2006 05:59:05 GMT -Message-Id: <200610250559.k9P5x5tk014073@hera.kernel.org> -From: Linux Kernel Mailing List -To: git-commits-head@vger.kernel.org -Subject: [NETFILTER]: Fix ip6_tables extension header bypass bug - -commit 6d381634d213580d40d431e7664dfb45f641b884 -tree a8680dd059e9a4e115d17e54d4a8dcea4d196a3e -parent 51d8b1a65291a6956b79374b6adbbadc2263bcf6 -author Patrick McHardy 1161731710 -0700 -committer David S. Miller 1161731710 -0700 - -[NETFILTER]: Fix ip6_tables extension header bypass bug - -As reported by Mark Dowd , ip6_tables is susceptible -to a fragmentation attack causing false negatives on extension header matches. - -When extension headers occur in the non-first fragment after the fragment -header (possibly with an incorrect nexthdr value in the fragment header) -a rule looking for this extension header will never match. - -Drop fragments that are at offset 0 and don't contain the final protocol -header regardless of the ruleset, since this should not happen normally. -Since all extension headers are before the protocol header this makes sure -an extension header is either not present or in the first fragment, where -we can properly parse it. - -With help from Yasuyuki KOZAKAI . -Fixed reject in ip6t_hbh.c for stable. -maks - -Signed-off-by: Patrick McHardy -Signed-off-by: David S. Miller -Signed-off-by: maximilian attems - - net/ipv6/netfilter/ip6_tables.c | 11 +++++++---- - net/ipv6/netfilter/ip6t_ah.c | 7 ++++++- - net/ipv6/netfilter/ip6t_frag.c | 7 ++++++- - net/ipv6/netfilter/ip6t_hbh.c | 7 ++++++- - net/ipv6/netfilter/ip6t_rt.c | 7 ++++++- - 5 files changed, 31 insertions(+), 8 deletions(-) - -diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c -index f0328c7..53bf977 100644 ---- a/net/ipv6/netfilter/ip6_tables.c -+++ b/net/ipv6/netfilter/ip6_tables.c -@@ -1440,6 +1440,9 @@ static void __exit ip6_tables_fini(void) - * If target header is found, its offset is set in *offset and return protocol - * number. Otherwise, return -1. - * -+ * If the first fragment doesn't contain the final protocol header or -+ * NEXTHDR_NONE it is considered invalid. -+ * - * Note that non-1st fragment is special case that "the protocol number - * of last header" is "next header" field in Fragment header. In this case, - * *offset is meaningless and fragment offset is stored in *fragoff if fragoff -@@ -1463,12 +1466,12 @@ int ipv6_find_hdr(const struct sk_buff * - if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) { - if (target < 0) - break; -- return -1; -+ return -ENOENT; - } - - hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr); - if (hp == NULL) -- return -1; -+ return -EBADMSG; - if (nexthdr == NEXTHDR_FRAGMENT) { - unsigned short _frag_off, *fp; - fp = skb_header_pointer(skb, -@@ -1477,7 +1480,7 @@ int ipv6_find_hdr(const struct sk_buff * - sizeof(_frag_off), - &_frag_off); - if (fp == NULL) -- return -1; -+ return -EBADMSG; - - _frag_off = ntohs(*fp) & ~0x7; - if (_frag_off) { -@@ -1488,7 +1491,7 @@ int ipv6_find_hdr(const struct sk_buff * - *fragoff = _frag_off; - return hp->nexthdr; - } -- return -1; -+ return -ENOENT; - } - hdrlen = 8; - } else if (nexthdr == NEXTHDR_AUTH) -diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c -index ec1b160..4648664 100644 ---- a/net/ipv6/netfilter/ip6t_ah.c -+++ b/net/ipv6/netfilter/ip6t_ah.c -@@ -54,9 +54,14 @@ match(const struct sk_buff *skb, - const struct ip6t_ah *ahinfo = matchinfo; - unsigned int ptr; - unsigned int hdrlen = 0; -+ int err; - -- if (ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL) < 0) -+ err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL); -+ if (err < 0) { -+ if (err != -ENOENT) -+ *hotdrop = 1; - return 0; -+ } - - ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah); - if (ah == NULL) { -diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c -index 78d9c8b..cd22eaa 100644 ---- a/net/ipv6/netfilter/ip6t_frag.c -+++ b/net/ipv6/netfilter/ip6t_frag.c -@@ -52,9 +52,14 @@ match(const struct sk_buff *skb, - struct frag_hdr _frag, *fh; - const struct ip6t_frag *fraginfo = matchinfo; - unsigned int ptr; -+ int err; - -- if (ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL) < 0) -+ err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL); -+ if (err < 0) { -+ if (err != -ENOENT) -+ *hotdrop = 1; - return 0; -+ } - - fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag); - if (fh == NULL) { ---- a/net/ipv6/netfilter/ip6t_hbh.c.orig 2006-10-26 22:11:31.000000000 +0200 -+++ b/net/ipv6/netfilter/ip6t_hbh.c 2006-10-26 22:13:06.000000000 +0200 -@@ -72,11 +72,15 @@ match(const struct sk_buff *skb, - unsigned int optlen; - - #if HOPBYHOP -- if (ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP, NULL) < 0) -+ err = ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP, NULL); - #else -- if (ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST, NULL) < 0) -+ err = ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST, NULL); - #endif -+ if (err < 0) { -+ if (err != -ENOENT) -+ *hotdrop = 1; - return 0; -+ } - - oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh); - if (oh == NULL) { -diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c -index bcb2e16..54d7d14 100644 ---- a/net/ipv6/netfilter/ip6t_rt.c -+++ b/net/ipv6/netfilter/ip6t_rt.c -@@ -58,9 +58,14 @@ match(const struct sk_buff *skb, - unsigned int hdrlen = 0; - unsigned int ret = 0; - struct in6_addr *ap, _addr; -+ int err; - -- if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL) < 0) -+ err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL); -+ if (err < 0) { -+ if (err != -ENOENT) -+ *hotdrop = 1; - return 0; -+ } - - rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route); - if (rh == NULL) { -- -To unsubscribe from this list: send the line "unsubscribe git-commits-head" in -the body of a message to majordomo@vger.kernel.org -More majordomo info at http://vger.kernel.org/majordomo-info.html - diff --git a/debian/patches/bugfix/net-ip6_tables_protocol-bypass.patch b/debian/patches/bugfix/net-ip6_tables_protocol-bypass.patch deleted file mode 100644 index 3d50b8e9d..000000000 --- a/debian/patches/bugfix/net-ip6_tables_protocol-bypass.patch +++ /dev/null @@ -1,75 +0,0 @@ -From git-commits-head-owner@vger.kernel.org Tue Jun 6 18:56:24 2006 -Message-Id: <200610250559.k9P5x4BG014065@hera.kernel.org> -From: Linux Kernel Mailing List -To: git-commits-head@vger.kernel.org -Subject: [NETFILTER]: Fix ip6_tables protocol bypass bug - -commit 51d8b1a65291a6956b79374b6adbbadc2263bcf6 -tree d6b8cbd6628c11d1c3e9c8c8e9ca048acf723a71 -parent 2fab22f2d3290ff7c602fe62f22e825c48e97a06 -author Patrick McHardy 1161731644 -0700 -committer David S. Miller 1161731644 -0700 - -[NETFILTER]: Fix ip6_tables protocol bypass bug - -As reported by Mark Dowd , ip6_tables is susceptible -to a fragmentation attack causing false negatives on protocol matches. - -When the protocol header doesn't follow the fragment header immediately, -the fragment header contains the protocol number of the next extension -header. When the extension header and the protocol header are sent in -a second fragment a rule like "ip6tables .. -p udp -j DROP" will never -match. - -Drop fragments that are at offset 0 and don't contain the final protocol -header regardless of the ruleset, since this should not happen normally. - -With help from Yasuyuki KOZAKAI . - -Signed-off-by: Patrick McHardy -Signed-off-by: David S. Miller - - net/ipv6/netfilter/ip6_tables.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c -index 4ab368f..f0328c7 100644 ---- a/net/ipv6/netfilter/ip6_tables.c -+++ b/net/ipv6/netfilter/ip6_tables.c -@@ -111,7 +111,7 @@ ip6_packet_match(const struct sk_buff *s - const char *outdev, - const struct ip6t_ip6 *ip6info, - unsigned int *protoff, -- int *fragoff) -+ int *fragoff, int *hotdrop) - { - size_t i; - unsigned long ret; -@@ -169,9 +169,11 @@ #define FWINV(bool,invflg) ((bool) ^ !!( - unsigned short _frag_off; - - protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off); -- if (protohdr < 0) -+ if (protohdr < 0) { -+ if (_frag_off == 0) -+ *hotdrop = 1; - return 0; -- -+ } - *fragoff = _frag_off; - - dprintf("Packet protocol %hi ?= %s%hi.\n", -@@ -290,7 +292,7 @@ ip6t_do_table(struct sk_buff **pskb, - IP_NF_ASSERT(e); - IP_NF_ASSERT(back); - if (ip6_packet_match(*pskb, indev, outdev, &e->ipv6, -- &protoff, &offset)) { -+ &protoff, &offset, &hotdrop)) { - struct ip6t_entry_target *t; - - if (IP6T_MATCH_ITERATE(e, do_match, -- -To unsubscribe from this list: send the line "unsubscribe git-commits-head" in -the body of a message to majordomo@vger.kernel.org -More majordomo info at http://vger.kernel.org/majordomo-info.html - diff --git a/debian/patches/bugfix/net-netpoll.patch b/debian/patches/bugfix/net-netpoll.patch deleted file mode 100644 index baec43318..000000000 --- a/debian/patches/bugfix/net-netpoll.patch +++ /dev/null @@ -1,42 +0,0 @@ -From netdev-owner@vger.kernel.org Wed Oct 18 23:31:05 2006 -From: Stephen Hemminger - -If netpoll uses up it's retries, it should drop the skb -not leak memory. - -Signed-off-by: Stephen Hemminger ---- - net/core/netpoll.c | 8 ++++---- - 1 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index ead5920..c375fde 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -273,10 +273,8 @@ static void netpoll_send_skb(struct netp - int status; - struct netpoll_info *npinfo; - -- if (!np || !np->dev || !netif_running(np->dev)) { -- __kfree_skb(skb); -- return; -- } -+ if (!np || !np->dev || !netif_running(np->dev)) -+ goto free_skb; - - npinfo = np->dev->npinfo; - -@@ -314,6 +312,8 @@ static void netpoll_send_skb(struct netp - netpoll_poll(np); - udelay(50); - } while (npinfo->tries > 0); -+free_skb: -+ __kfree_skb(skb); - } - - void netpoll_send_udp(struct netpoll *np, const char *msg, int len) --- -1.4.2.3 - - - diff --git a/debian/patches/bugfix/net-r8169-hotplug_loop.patch b/debian/patches/bugfix/net-r8169-hotplug_loop.patch deleted file mode 100644 index ae0b11049..000000000 --- a/debian/patches/bugfix/net-r8169-hotplug_loop.patch +++ /dev/null @@ -1,36 +0,0 @@ -From netdev-owner@vger.kernel.org Fri Oct 13 07:35:57 2006 -Date: Thu, 12 Oct 2006 22:30:46 +0200 -From: Francois Romieu - -Arnaud Patard: - r8169: fix infinite loop during hotplug - -diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c -index 4c47c5b..c2c9a86 100644 ---- a/drivers/net/r8169.c -+++ b/drivers/net/r8169.c -@@ -2701,6 +2702,7 @@ static void rtl8169_down(struct net_devi - struct rtl8169_private *tp = netdev_priv(dev); - void __iomem *ioaddr = tp->mmio_addr; - unsigned int poll_locked = 0; -+ unsigned int intrmask; - - rtl8169_delete_timer(dev); - -@@ -2739,8 +2741,11 @@ core_down: - * 2) dev->change_mtu - * -> rtl8169_poll can not be issued again and re-enable the - * interruptions. Let's simply issue the IRQ down sequence again. -+ * -+ * No loop if hotpluged or major error (0xffff). - */ -- if (RTL_R16(IntrMask)) -+ intrmask = RTL_R16(IntrMask); -+ if (intrmask && (intrmask != 0xffff)) - goto core_down; - - rtl8169_tx_clear(tp); --- -Ueimor - - diff --git a/debian/patches/bugfix/net-r8169-mmio8167.patch b/debian/patches/bugfix/net-r8169-mmio8167.patch deleted file mode 100644 index f0fe9b073..000000000 --- a/debian/patches/bugfix/net-r8169-mmio8167.patch +++ /dev/null @@ -1,23 +0,0 @@ -From netdev-owner@vger.kernel.org Fri Sep 22 15:58:36 2006 -From: Francois Romieu - - r8169: the MMIO region of the 8167 stands behin BAR#1 - - -diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c -index 805562b..93cd1f4 100644 ---- a/drivers/net/r8169.c -+++ b/drivers/net/r8169.c -@@ -210,7 +210,7 @@ static const struct { - static struct pci_device_id rtl8169_pci_tbl[] = { - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8129), 0, 0, RTL_CFG_0 }, - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8136), 0, 0, RTL_CFG_2 }, -- { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8167), 0, 0, RTL_CFG_1 }, -+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8167), 0, 0, RTL_CFG_0 }, - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_2 }, - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 }, - { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4300), 0, 0, RTL_CFG_0 }, - --- -Ueimor - diff --git a/debian/patches/bugfix/net-sky2-lockup.patch b/debian/patches/bugfix/net-sky2-lockup.patch deleted file mode 100644 index 3d9da9a6f..000000000 --- a/debian/patches/bugfix/net-sky2-lockup.patch +++ /dev/null @@ -1,78 +0,0 @@ -From netdev-owner@vger.kernel.org Mon Oct 23 10:15:13 2006 -From: Stephen Hemminger -Subject: [PATCH] sky2: 88E803X transmit lockup - -The reason sky2 driver was locking up on transmit on the Yukon-FE chipset -is that it was misconfiguring the internal RAM buffer so the transmitter -and receiver were sharing the same space. - -The code assumed there was 16K of RAM on Yukon-FE (taken from vendor driver -sk98lin which is even more f*cked up on this). Then it assigned based on that. -The giveaway was that the registers would only hold 9bits so both RX/TX -had 0..1ff for space. It is a wonder it worked at all! - -This patch addresses this, and fixes an easily reproducible hang on Transmit. -Only the Yukon-FE chip is Marvell 88E803X (10/100 only) are affected. - -Signed-off-by: Stephen Hemminger - ---- sky2.orig/drivers/net/sky2.c 2006-10-20 16:37:56.000000000 -0700 -+++ sky2/drivers/net/sky2.c 2006-10-20 16:38:16.000000000 -0700 -@@ -699,16 +699,10 @@ - - } - --/* Assign Ram Buffer allocation. -- * start and end are in units of 4k bytes -- * ram registers are in units of 64bit words -- */ --static void sky2_ramset(struct sky2_hw *hw, u16 q, u8 startk, u8 endk) -+/* Assign Ram Buffer allocation in units of 64bit (8 bytes) */ -+static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 end) - { -- u32 start, end; -- -- start = startk * 4096/8; -- end = (endk * 4096/8) - 1; -+ pr_debug(PFX "q %d %#x %#x\n", q, start, end); - - sky2_write8(hw, RB_ADDR(q, RB_CTRL), RB_RST_CLR); - sky2_write32(hw, RB_ADDR(q, RB_START), start); -@@ -717,7 +711,7 @@ - sky2_write32(hw, RB_ADDR(q, RB_RP), start); - - if (q == Q_R1 || q == Q_R2) { -- u32 space = (endk - startk) * 4096/8; -+ u32 space = end - start + 1; - u32 tp = space - space/4; - - /* On receive queue's set the thresholds -@@ -1199,19 +1193,16 @@ - - sky2_mac_init(hw, port); - -- /* Determine available ram buffer space (in 4K blocks). -- * Note: not sure about the FE setting below yet -- */ -- if (hw->chip_id == CHIP_ID_YUKON_FE) -- ramsize = 4; -- else -- ramsize = sky2_read8(hw, B2_E_0); -+ /* Determine available ram buffer space in qwords. */ -+ ramsize = sky2_read8(hw, B2_E_0) * 4096/8; - -- /* Give transmitter one third (rounded up) */ -- rxspace = ramsize - (ramsize + 2) / 3; -+ if (ramsize > 6*1024/8) -+ rxspace = ramsize - (ramsize + 2) / 3; -+ else -+ rxspace = ramsize / 2; - -- sky2_ramset(hw, rxqaddr[port], 0, rxspace); -- sky2_ramset(hw, txqaddr[port], rxspace, ramsize); -+ sky2_ramset(hw, rxqaddr[port], 0, rxspace-1); -+ sky2_ramset(hw, txqaddr[port], rxspace, ramsize-1); - - /* Make sure SyncQ is disabled */ - sky2_write8(hw, RB_ADDR(port == 0 ? Q_XS1 : Q_XS2, RB_CTRL), - diff --git a/debian/patches/bugfix/sparc/central_fhc_bus-Ex000.patch b/debian/patches/bugfix/sparc/central_fhc_bus-Ex000.patch deleted file mode 100644 index de8e80541..000000000 --- a/debian/patches/bugfix/sparc/central_fhc_bus-Ex000.patch +++ /dev/null @@ -1,196 +0,0 @@ -From git-commits-head-owner@vger.kernel.org Thu Oct 26 20:34:25 2006 -Date: Thu, 26 Oct 2006 15:59:07 GMT -Message-Id: <200610261559.k9QFx78p003484@hera.kernel.org> -From: Linux Kernel Mailing List -To: git-commits-head@vger.kernel.org -Subject: [SPARC64]: Fix central/FHC bus handling on Ex000 systems. - -commit 4130a4b206e7c628482aa12ec30949382c8cdc5e -tree bae99205682ec6db943fc8271dddc980646254d8 -parent 291b58d663862c3d42d2e8092f8b0dd3f15a94f8 -author David S. Miller 1161840666 -0700 -committer David S. Miller 1161841155 -0700 - -[SPARC64]: Fix central/FHC bus handling on Ex000 systems. - -1) probe_other_fhcs() wants to see only non-central FHC - busses, so skip FHCs that don't sit off the root - -2) Like SBUS, FHC can lack the appropriate address and - size cell count properties, so add an of_busses[] - entry and handlers for that. - -3) Central FHC irq translator probing was buggy. We - were trying to use dp->child in irq_trans_init but - that linkage is not setup at this point. - - So instead, pass in the parent of "dp" and look for - the child "fhc" with parent "central". - -Thanks to the tireless assistence of Ben Collins in tracking -down these problems and testing out these fixes. - -Signed-off-by: David S. Miller - - arch/sparc64/kernel/central.c | 4 ++++ - arch/sparc64/kernel/of_device.c | 33 ++++++++++++++++++++++++--------- - arch/sparc64/kernel/prom.c | 30 +++++++++++++++--------------- - 3 files changed, 43 insertions(+), 24 deletions(-) - -diff --git a/arch/sparc64/kernel/central.c b/arch/sparc64/kernel/central.c -index b66336d..e724c54 100644 ---- a/arch/sparc64/kernel/central.c -+++ b/arch/sparc64/kernel/central.c -@@ -126,6 +126,10 @@ static void probe_other_fhcs(void) - int board; - u32 tmp; - -+ if (dp->parent && -+ dp->parent->parent != NULL) -+ continue; -+ - fhc = (struct linux_fhc *) - central_alloc_bootmem(sizeof(struct linux_fhc)); - if (fhc == NULL) -diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c -index d3dfb2a..983ca5f 100644 ---- a/arch/sparc64/kernel/of_device.c -+++ b/arch/sparc64/kernel/of_device.c -@@ -402,16 +402,22 @@ static void of_bus_sbus_count_cells(stru - *sizec = 1; - } - --static int of_bus_sbus_map(u32 *addr, const u32 *range, int na, int ns, int pna) --{ -- return of_bus_default_map(addr, range, na, ns, pna); --} -- --static unsigned int of_bus_sbus_get_flags(u32 *addr) -+/* -+ * FHC/Central bus specific translator. -+ * -+ * This is just needed to hard-code the address and size cell -+ * counts. 'fhc' and 'central' nodes lack the #address-cells and -+ * #size-cells properties, and if you walk to the root on such -+ * Enterprise boxes all you'll get is a #size-cells of 2 which is -+ * not what we want to use. -+ */ -+static int of_bus_fhc_match(struct device_node *np) - { -- return IORESOURCE_MEM; -+ return !strcmp(np->name, "fhc") || -+ !strcmp(np->name, "central"); - } - -+#define of_bus_fhc_count_cells of_bus_sbus_count_cells - - /* - * Array of bus specific translators -@@ -433,8 +439,17 @@ static struct of_bus of_busses[] = { - .addr_prop_name = "reg", - .match = of_bus_sbus_match, - .count_cells = of_bus_sbus_count_cells, -- .map = of_bus_sbus_map, -- .get_flags = of_bus_sbus_get_flags, -+ .map = of_bus_default_map, -+ .get_flags = of_bus_default_get_flags, -+ }, -+ /* FHC */ -+ { -+ .name = "fhc", -+ .addr_prop_name = "reg", -+ .match = of_bus_fhc_match, -+ .count_cells = of_bus_fhc_count_cells, -+ .map = of_bus_default_map, -+ .get_flags = of_bus_default_get_flags, - }, - /* Default */ - { -diff --git a/arch/sparc64/kernel/prom.c b/arch/sparc64/kernel/prom.c -index e21cd6a..c60efb3 100644 ---- a/arch/sparc64/kernel/prom.c -+++ b/arch/sparc64/kernel/prom.c -@@ -1079,23 +1079,22 @@ static void sun4v_vdev_irq_trans_init(st - - static void irq_trans_init(struct device_node *dp) - { -- const char *model; - #ifdef CONFIG_PCI -+ const char *model; - int i; - #endif - -+#ifdef CONFIG_PCI - model = of_get_property(dp, "model", NULL); - if (!model) - model = of_get_property(dp, "compatible", NULL); -- if (!model) -- return; -- --#ifdef CONFIG_PCI -- for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) { -- struct irq_trans *t = &pci_irq_trans_table[i]; -+ if (model) { -+ for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) { -+ struct irq_trans *t = &pci_irq_trans_table[i]; - -- if (!strcmp(model, t->name)) -- return t->init(dp); -+ if (!strcmp(model, t->name)) -+ return t->init(dp); -+ } - } - #endif - #ifdef CONFIG_SBUS -@@ -1103,8 +1102,9 @@ static void irq_trans_init(struct device - !strcmp(dp->name, "sbi")) - return sbus_irq_trans_init(dp); - #endif -- if (!strcmp(dp->name, "central")) -- return central_irq_trans_init(dp->child); -+ if (!strcmp(dp->name, "fhc") && -+ !strcmp(dp->parent->name, "central")) -+ return central_irq_trans_init(dp); - if (!strcmp(dp->name, "virtual-devices")) - return sun4v_vdev_irq_trans_init(dp); - } -@@ -1516,7 +1516,7 @@ static char * __init get_one_property(ph - return buf; - } - --static struct device_node * __init create_node(phandle node) -+static struct device_node * __init create_node(phandle node, struct device_node *parent) - { - struct device_node *dp; - -@@ -1525,6 +1525,7 @@ static struct device_node * __init creat - - dp = prom_early_alloc(sizeof(*dp)); - dp->unique_id = unique_id++; -+ dp->parent = parent; - - kref_init(&dp->kref); - -@@ -1543,12 +1544,11 @@ static struct device_node * __init build - { - struct device_node *dp; - -- dp = create_node(node); -+ dp = create_node(node, parent); - if (dp) { - *(*nextp) = dp; - *nextp = &dp->allnext; - -- dp->parent = parent; - dp->path_component_name = build_path_component(dp); - dp->full_name = build_full_name(dp); - -@@ -1564,7 +1564,7 @@ void __init prom_build_devicetree(void) - { - struct device_node **nextp; - -- allnodes = create_node(prom_root_node); -+ allnodes = create_node(prom_root_node, NULL); - allnodes->path_component_name = ""; - allnodes->full_name = "/"; - diff --git a/debian/patches/bugfix/sparc/mem_corruption-pci_4u_free_consistent.patch b/debian/patches/bugfix/sparc/mem_corruption-pci_4u_free_consistent.patch deleted file mode 100644 index fe480423c..000000000 --- a/debian/patches/bugfix/sparc/mem_corruption-pci_4u_free_consistent.patch +++ /dev/null @@ -1,37 +0,0 @@ -From git-commits-head-owner@vger.kernel.org Thu Oct 26 20:34:26 2006 -Date: Thu, 26 Oct 2006 15:59:09 GMT -Message-Id: <200610261559.k9QFx9tC003499@hera.kernel.org> -From: Linux Kernel Mailing List -To: git-commits-head@vger.kernel.org -Subject: [SPARC64]: Fix memory corruption in pci_4u_free_consistent(). - -commit 012d64ff68f304df1c35ce5902f5023dc14b643f -tree da1e6691c0c9a4d087b441762ce9df8974178339 -parent 4130a4b206e7c628482aa12ec30949382c8cdc5e -author David S. Miller 1161840787 -0700 -committer David S. Miller 1161841156 -0700 - -[SPARC64]: Fix memory corruption in pci_4u_free_consistent(). - -The second argument to free_npages() was being incorrectly -calculated, which would thus access far past the end of the -arena->map[] bitmap. - -Signed-off-by: David S. Miller - - arch/sparc64/kernel/pci_iommu.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/sparc64/kernel/pci_iommu.c b/arch/sparc64/kernel/pci_iommu.c -index 82e5455..2e7f142 100644 ---- a/arch/sparc64/kernel/pci_iommu.c -+++ b/arch/sparc64/kernel/pci_iommu.c -@@ -281,7 +281,7 @@ static void pci_4u_free_consistent(struc - - spin_lock_irqsave(&iommu->lock, flags); - -- free_npages(iommu, dvma, npages); -+ free_npages(iommu, dvma - iommu->page_table_map_base, npages); - - spin_unlock_irqrestore(&iommu->lock, flags); - diff --git a/debian/patches/features/net-forcedeth-swsusp.patch b/debian/patches/features/net-forcedeth-swsusp.patch deleted file mode 100644 index 87465b0de..000000000 --- a/debian/patches/features/net-forcedeth-swsusp.patch +++ /dev/null @@ -1,66 +0,0 @@ - -Francois Romieu: - forcedeth: restore network after swsup/resume or ACPI S3 - - -diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c -index 35467e0..c41a886 100644 ---- a/drivers/net/forcedeth.c -+++ b/drivers/net/forcedeth.c -@@ -4603,6 +4603,47 @@ static void __devexit nv_remove(struct p - pci_set_drvdata(pci_dev, NULL); - } - -+ -+static int nv_suspend(struct pci_dev *pdev, pm_message_t state) -+{ -+ struct net_device *dev = pci_get_drvdata(pdev); -+ struct fe_priv *np = netdev_priv(dev); -+ int rc = 0; -+ -+ if (!netif_running(dev)) -+ goto out; -+ -+ netif_device_detach(dev); -+ -+ /* Gross. */ -+ rc = nv_close(dev); -+ -+ pci_save_state(pdev); -+ pci_enable_wake(pdev, pci_choose_state(pdev, state), np->wolenabled); -+ pci_set_power_state(pdev, pci_choose_state(pdev, state)); -+out: -+ return rc; -+} -+ -+static int nv_resume(struct pci_dev *pdev) -+{ -+ struct net_device *dev = pci_get_drvdata(pdev); -+ int rc = 0; -+ -+ if (!netif_running(dev)) -+ goto out; -+ -+ netif_device_attach(dev); -+ -+ pci_set_power_state(pdev, PCI_D0); -+ pci_restore_state(pdev); -+ pci_enable_wake(pdev, PCI_D0, 0); -+ -+ rc = nv_open(dev); -+out: -+ return rc; -+} -+ - static struct pci_device_id pci_tbl[] = { - { /* nForce Ethernet Controller */ - PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_1), -@@ -4704,6 +4745,8 @@ static struct pci_driver driver = { - .id_table = pci_tbl, - .probe = nv_probe, - .remove = __devexit_p(nv_remove), -+ .suspend = nv_suspend, -+ .resume = nv_resume, - }; - - diff --git a/debian/patches/features/net-r8169-pci_id-corega.patch b/debian/patches/features/net-r8169-pci_id-corega.patch deleted file mode 100644 index 45d1b71cb..000000000 --- a/debian/patches/features/net-r8169-pci_id-corega.patch +++ /dev/null @@ -1,18 +0,0 @@ - -Andrew Morton: - r8169: PCI ID for Corega Gigabit network card - - -diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c -index 4c47c5b..c7309e9 100644 ---- a/drivers/net/r8169.c -+++ b/drivers/net/r8169.c -@@ -214,6 +214,7 @@ static struct pci_device_id rtl8169_pci_ - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_2 }, - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 }, - { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4300), 0, 0, RTL_CFG_0 }, -+ { PCI_DEVICE(0x1259, 0xc107), 0, 0, RTL_CFG_0 }, - { PCI_DEVICE(0x16ec, 0x0116), 0, 0, RTL_CFG_0 }, - { PCI_VENDOR_ID_LINKSYS, 0x1032, - PCI_ANY_ID, 0x0024, 0, 0, RTL_CFG_0 }, - diff --git a/debian/patches/series/4 b/debian/patches/series/4 index 17f67eabc..8e423a166 100644 --- a/debian/patches/series/4 +++ b/debian/patches/series/4 @@ -1,13 +1,3 @@ - sparc64-atyfb-xl-gr.patch + bugfix/sparc/sunblade-clock-hang.patch + bugfix/sparc/compat-alloc-user-space-alignment.patch -+ bugfix/net-netpoll.patch -+ bugfix/net-sky2-lockup.patch -+ features/net-forcedeth-swsusp.patch -+ bugfix/net-r8169-mmio8167.patch -+ features/net-r8169-pci_id-corega.patch -+ bugfix/net-r8169-hotplug_loop.patch -+ bugfix/sparc/mem_corruption-pci_4u_free_consistent.patch -+ bugfix/sparc/central_fhc_bus-Ex000.patch -+ bugfix/net-ip6_tables_extension_header-bypass.patch -+ bugfix/net-ip6_tables_protocol-bypass.patch diff --git a/debian/templates/control.source.in b/debian/templates/control.source.in index b70b000c0..3d2257998 100644 --- a/debian/templates/control.source.in +++ b/debian/templates/control.source.in @@ -4,5 +4,5 @@ Priority: optional Maintainer: Debian Kernel Team Uploaders: Andres Salomon , Bastian Blank , Simon Horman , Sven Luther , Jonas Smedegaard , Norbert Tretkowski , Frederik Schüler Standards-Version: 3.6.1.0 -Build-Depends: debhelper (>= 4.1.0), module-init-tools, dpkg-dev (>= 1.10.23), debianutils (>= 1.6), bzip2, sparc-utils [sparc], kernel-package (>= 10.063), python, python2.4-minimal +Build-Depends: debhelper (>= 4.1.0), module-init-tools, dpkg-dev (>= 1.10.23), debianutils (>= 1.6), bzip2, sparc-utils [sparc], kernel-package (>= 10.054), python, python2.4-minimal Build-Depends-Indep: docbook-utils, gs, transfig, xmlto