commit 3fa8749e584b55f1180411ab1b51117190bac1e5 Author: Linus Torvalds Date: Thu Oct 9 15:13:53 2008 -0700 Linux 2.6.27 commit efc968d450e013049a662d22727cf132618dcb2f Author: Linus Torvalds Date: Thu Oct 9 14:04:54 2008 -0700 Don't allow splice() to files opened with O_APPEND This is debatable, but while we're debating it, let's disallow the combination of splice and an O_APPEND destination. It's not entirely clear what the semantics of O_APPEND should be, and POSIX apparently expects pwrite() to ignore O_APPEND, for example. So we could make up any semantics we want, including the old ones. But Miklos convinced me that we should at least give it some thought, and that accepting writes at arbitrary offsets is wrong at least for IS_APPEND() files (which always have O_APPEND set, even if the reverse isn't true: you can obviously have O_APPEND set on a regular file). So disallow O_APPEND entirely for now. I doubt anybody cares, and this way we have one less gray area to worry about. Reported-and-argued-for-by: Miklos Szeredi Acked-by: Jens Axboe Signed-off-by: Linus Torvalds commit 07f405541892bd9bab4cca6c12499091ef4dd556 Merge: 9283dfe... 5e5cddb... Author: Linus Torvalds Date: Thu Oct 9 12:23:54 2008 -0700 Merge branch 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6 * 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6: hwmon: (abituguru3) Enable DMI probing feature on Abit AT8 32X hwmon: (abituguru3) Enable reading from AUX3 fan on Abit AT8 32X hwmon: (adt7473) Fix some bogosity in documentation file hwmon: Define sysfs interface for energy consumption register hwmon: (it87) Prevent power-off on Shuttle SN68PT eeepc-laptop: Fix hwmon interface commit 9283dfed51b223eddf68bdf91c5cddc4a9abbdbe Merge: 70096a5... 8d59225... Author: Linus Torvalds Date: Thu Oct 9 12:23:35 2008 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq: [CPUFREQ] correct broken links and email addresses commit 70096a561d1e09120bae1f293f3632cedbfd5c68 Author: Matt Mackall Date: Wed Oct 8 14:51:57 2008 -0500 SLOB: fix bogus ksize calculation fix This fixes the previous fix, which was completely wrong on closer inspection. This version has been manually tested with a user-space test harness and generates sane values. A nearly identical patch has been boot-tested. The problem arose from changing how kmalloc/kfree handled alignment padding without updating ksize to match. This brings it in sync. Signed-off-by: Matt Mackall Signed-off-by: Linus Torvalds commit 8d5922572038bae9f7b16fcb974eee806727b44c Author: Németh Márton Date: Thu Oct 9 14:59:17 2008 +0200 [CPUFREQ] correct broken links and email addresses Replace the no longer working links and email address in the documentation and in source code. Signed-off-by: Márton Németh Signed-off-by: Dave Jones commit 5e5cddbc3f2936c9fefbae64633c522e242c350d Author: Alistair John Strachan Date: Thu Oct 9 15:33:59 2008 +0200 hwmon: (abituguru3) Enable DMI probing feature on Abit AT8 32X Enable driver checking of the DMI product name (when enabled) on an Abit AT8 32X, instead of falling back to a manual probe. This eliminates false negatives and eventually will help avoid unnecessary bus probes on unsupported mainboards. Signed-off-by: Alistair John Strachan Tested-by: Daniel Exner Acked-by: Hans de Goede Signed-off-by: Jean Delvare commit 8748a71e8c2d1310b66c2feed1632de8620cd2f1 Author: Alistair John Strachan Date: Thu Oct 9 15:33:59 2008 +0200 hwmon: (abituguru3) Enable reading from AUX3 fan on Abit AT8 32X The table for the Abit AT8 32X was incorrectly missing an entry for the sixth ("AUX3") fan. Add this entry, exporting the fan reading to userspace. Closes lm-sensors.org ticket #2339. Signed-off-by: Alistair John Strachan Tested-by: Daniel Exner Acked-by: Hans de Goede Signed-off-by: Jean Delvare commit c73c556c1ae3619d8a7c55254b0ddcf10034a914 Author: Darrick J. Wong Date: Thu Oct 9 15:33:58 2008 +0200 hwmon: (adt7473) Fix some bogosity in documentation file Signed-off-by: Darrick J. Wong Signed-off-by: Jean Delvare commit ddedc658fc56bb5b9b200d7f4df6e93e1d0d8048 Author: Darrick J. Wong Date: Thu Oct 9 15:33:58 2008 +0200 hwmon: Define sysfs interface for energy consumption register Describe the sysfs files that were introduced in the ibmaem driver. Signed-off-by: Darrick J. Wong Signed-off-by: Jean Delvare commit 98dd22c3e086d76058083432d4d8fb85f04bab90 Author: Jean Delvare Date: Thu Oct 9 15:33:58 2008 +0200 hwmon: (it87) Prevent power-off on Shuttle SN68PT On the Shuttle SN68PT, FAN_CTL2 is apparently not connected to a fan, but to something else. One user has reported instant system power-off when changing the PWM2 duty cycle, so we disable it. I use the board name string as the trigger in case the same board is ever used in other systems. This closes lm-sensors ticket #2349: pwmconfig causes a hard poweroff http://www.lm-sensors.org/ticket/2349 Signed-off-by: Jean Delvare commit 04dcd84bc79d9f756bf5b9fc16c7df3344823ca8 Author: Corentin Chary Date: Thu Oct 9 15:33:57 2008 +0200 eeepc-laptop: Fix hwmon interface Creates a name file in the sysfs directory, that is needed for the libsensors library to work. Also rename fan1_pwm to pwm1 and scale its value as needed. This fixes bug #11520: http://bugzilla.kernel.org/show_bug.cgi?id=11520 Signed-off-by: Corentin Chary Signed-off-by: Jean Delvare commit 69849375d6b13e94d08cdc94b49b11fbab454a0e Merge: 392eaef... 8806048... Author: Linus Torvalds Date: Wed Oct 8 11:41:10 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] Sibyte: Register PIO PATA device only for Swarm and Litte Sur commit 392eaef2e9f8e6527043ad8422d9cfea59ee6fb0 Merge: 85ba94b... 9d2c27e... Author: Linus Torvalds Date: Wed Oct 8 11:40:19 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: tcp: Fix tcp_hybla zero congestion window growth with small rho and large cwnd. net: Fix netdev_run_todo dead-lock tcp: Fix possible double-ack w/ user dma net: only invoke dev->change_rx_flags when device is UP netrom: Fix sock_orphan() use in nr_release ax25: Quick fix for making sure unaccepted sockets get destroyed. Revert "ax25: Fix std timer socket destroy handling." [Bluetooth] Add reset quirk for A-Link BlueUSB21 dongle [Bluetooth] Add reset quirk for new Targus and Belkin dongles [Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers commit 8806048878fce541afe1d72cd2320f092519f90a Author: Ralf Baechle Date: Wed Oct 8 19:14:33 2008 +0100 [MIPS] Sibyte: Register PIO PATA device only for Swarm and Litte Sur Symbol name spaghetti which is too complicated to cleanup on this stage of the release cycle breaks the build on BCM1480 platforms. Signed-off-by: Ralf Baechle commit 9d2c27e17b7574023b5adb5c6a50d7aaeb915543 Author: Daniele Lacamera Date: Tue Oct 7 15:58:17 2008 -0700 tcp: Fix tcp_hybla zero congestion window growth with small rho and large cwnd. Because of rounding, in certain conditions, i.e. when in congestion avoidance state rho is smaller than 1/128 of the current cwnd, TCP Hybla congestion control starves and the cwnd is kept constant forever. This patch forces an increment by one segment after #send_cwnd calls without increments(newreno behavior). Signed-off-by: Daniele Lacamera Signed-off-by: David S. Miller commit 58ec3b4db9eb5a28e3aec5f407a54e28f7039c19 Author: Herbert Xu Date: Tue Oct 7 15:50:03 2008 -0700 net: Fix netdev_run_todo dead-lock Benjamin Thery tracked down a bug that explains many instances of the error unregister_netdevice: waiting for %s to become free. Usage count = %d It turns out that netdev_run_todo can dead-lock with itself if a second instance of it is run in a thread that will then free a reference to the device waited on by the first instance. The problem is really quite silly. We were trying to create parallelism where none was required. As netdev_run_todo always follows a RTNL section, and that todo tasks can only be added with the RTNL held, by definition you should only need to wait for the very ones that you've added and be done with it. There is no need for a second mutex or spinlock. This is exactly what the following patch does. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 742201e7baf66c64995fdd033d706220e6208fab Merge: 53240c2... 1305e9e... Author: David S. Miller Date: Tue Oct 7 15:32:20 2008 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/holtmann/bluetooth-2.6 commit 53240c208776d557dba9d7afedbcdbf512774c16 Author: Ali Saidi Date: Tue Oct 7 15:31:19 2008 -0700 tcp: Fix possible double-ack w/ user dma From: Ali Saidi When TCP receive copy offload is enabled it's possible that tcp_rcv_established() will cause two acks to be sent for a single packet. In the case that a tcp_dma_early_copy() is successful, copied_early is set to true which causes tcp_cleanup_rbuf() to be called early which can send an ack. Further along in tcp_rcv_established(), __tcp_ack_snd_check() is called and will schedule a delayed ACK. If no packets are processed before the delayed ack timer expires the packet will be acked twice. Signed-off-by: David S. Miller commit b6c40d68ff6498b7f63ddf97cf0aa818d748dee7 Author: Patrick McHardy Date: Tue Oct 7 15:26:48 2008 -0700 net: only invoke dev->change_rx_flags when device is UP Jesper Dangaard Brouer reported a bug when setting a VLAN device down that is in promiscous mode: When the VLAN device is set down, the promiscous count on the real device is decremented by one by vlan_dev_stop(). When removing the promiscous flag from the VLAN device afterwards, the promiscous count on the real device is decremented a second time by the vlan_change_rx_flags() callback. The root cause for this is that the ->change_rx_flags() callback is invoked while the device is down. The synchronization is meant to mirror the behaviour of the ->set_rx_mode callbacks, meaning the ->open function is responsible for doing a full sync on open, the ->close() function is responsible for doing full cleanup on ->stop() and ->change_rx_flags() is meant to do incremental changes while the device is UP. Only invoke ->change_rx_flags() while the device is UP to provide the intended behaviour. Tested-by: Jesper Dangaard Brouer Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 85ba94ba0592296053f7f2846812173424afe1cb Author: Matt Mackall Date: Tue Oct 7 11:37:35 2008 -0500 SLOB: fix bogus ksize calculation SLOB's ksize calculation was braindamaged and generally harmlessly underreported the allocation size. But for very small buffers, it could in fact overreport them, leading code depending on krealloc to overrun the allocation and trample other data. Signed-off-by: Matt Mackall Tested-by: Peter Zijlstra Signed-off-by: Linus Torvalds commit e09e6e2b6a5daf653794926ab50a784b14b6de53 Author: Linus Torvalds Date: Tue Oct 7 07:54:34 2008 -0700 Revert "V4L/DVB (8904): cx88: add missing unlock_kernel" This reverts commit 135aedc38e812b922aa56096f36a3d72ffbcf2fb, as requested by Hans Verkuil. It was a patch for 2.6.28 where the BKL was pushed down from v4l core to the drivers, not for 2.6.27! Requested-by: Hans Verkuil Cc: Mauro Carvalho Chehab Signed-of-by: Linus Torvalds commit 4330ed8ed4da360ac1ca14b0fddff4c05b10de16 Author: Linus Torvalds Date: Mon Oct 6 16:39:58 2008 -0700 Linux 2.6.27-rc9 commit 87f3b6b6fbcbfa715f0d0db3e7a63e65716a6d4e Author: Mathieu Desnoyers Date: Mon Oct 6 09:30:12 2008 -0400 Marker depmod fix core kernel list * Theodore Ts'o (tytso@mit.edu) wrote: > > I've been playing with adding some markers into ext4 to see if they > could be useful in solving some problems along with Systemtap. It > appears, though, that as of 2.6.27-rc8, markers defined in code which is > compiled directly into the kernel (i.e., not as modules) don't show up > in Module.markers: > > kvm_trace_entryexit arch/x86/kvm/kvm-intel %u %p %u %u %u %u %u %u > kvm_trace_handler arch/x86/kvm/kvm-intel %u %p %u %u %u %u %u %u > kvm_trace_entryexit arch/x86/kvm/kvm-amd %u %p %u %u %u %u %u %u > kvm_trace_handler arch/x86/kvm/kvm-amd %u %p %u %u %u %u %u %u > > (Note the lack of any of the kernel_sched_* markers, and the markers I > added for ext4_* and jbd2_* are missing as wel.) > > Systemtap apparently depends on in-kernel trace_mark being recorded in > Module.markers, and apparently it's been claimed that it used to be > there. Is this a bug in systemtap, or in how Module.markers is getting > built? And is there a file that contains the equivalent information > for markers located in non-modules code? I think the problem comes from "markers: fix duplicate modpost entry" (commit d35cb360c29956510b2fe1a953bd4968536f7216) Especially : - add_marker(mod, marker, fmt); + if (!mod->skip) + add_marker(mod, marker, fmt); } return; fail: Here is a fix that should take care if this problem. Thanks for the bug report! Signed-off-by: Mathieu Desnoyers Tested-by: "Theodore Ts'o" CC: Greg KH CC: David Smith CC: Roland McGrath CC: Sam Ravnborg CC: Wenji Huang CC: Takashi Nishiie Signed-off-by: Linus Torvalds commit afed26d151ba90b08361d4af0223daa362136ebd Merge: 6106611... cc1e0f4... Author: Linus Torvalds Date: Mon Oct 6 14:30:02 2008 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb: kgdb: call touch_softlockup_watchdog on resume kgdb, x86: Avoid invoking kgdb_nmicallback twice per NMI commit 6106611e15b036bccfb4cfc0ed8bf83aab3ee226 Merge: f1ea725... d99e901... Author: Linus Torvalds Date: Mon Oct 6 14:29:16 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: gart iommu have direct mapping when agp is present too commit f1ea7254726d25a333056619ec6b1a8ee1b7358d Merge: ba9b0c1... ca09a23... Author: Linus Torvalds Date: Mon Oct 6 14:27:57 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: ide: workaround for bogus gcc warning in ide_sysfs_register_port() ide-cd: Optiarc DVD RW AD-7200A does play audio IDE: Fix platform device registration in Swarm IDE driver (v2) ide-dma: fix ide_build_dmatable() for TRM290 ide-cd: temporary tray close fix commit ba9b0c11285bcdaa3243c4123e924094b626c740 Merge: 11f9b02... fd3d276... Author: Linus Torvalds Date: Mon Oct 6 14:27:39 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] IP27: Fix build errors if CONFIG_MAPPED_KERNEL=y [MIPS] Fix CMP Kconfig configuration and mark as broken. commit 11f9b020fa921bb33fff65b947f6422fe15f4414 Merge: e683b42... db98fb8... Author: Linus Torvalds Date: Mon Oct 6 14:27:15 2008 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb: (33 commits) V4L/DVB (9103): em28xx: HVR-900 B3C0 - fix audio clicking issue V4L/DVB (9099): em28xx: Add detection for K-WORLD DVB-T 310U V4L/DVB (9092): gspca: Bad init values for sonixj ov7660. V4L/DVB (9080): gspca: Add a delay after writing to the sonixj sensors. V4L/DVB (9075): gspca: Bad check of returned status in i2c_read() spca561. V4L/DVB (9053): fix buffer overflow in uvc-video V4L/DVB (9043): S5H1420: Fix size of shadow-array to avoid overflow V4L/DVB (9037): Fix support for Hauppauge Nova-S SE V4L/DVB (9029): Fix deadlock in demux code V4L/DVB (8979): sms1xxx: Add new USB product ID for Hauppauge WinTV MiniStick V4L/DVB (8978): sms1xxx: fix product name for Hauppauge WinTV MiniStick V4L/DVB (8967): Use correct XC3028L firmware for AMD ATI TV Wonder 600 V4L/DVB (8963): s2255drv field count fix V4L/DVB (8961): zr36067: Fix RGBR pixel format V4L/DVB (8960): drivers/media/video/cafe_ccic.c needs mm.h V4L/DVB (8958): zr36067: Return proper bytes-per-line value V4L/DVB (8957): zr36067: Restore the default pixel format V4L/DVB (8955): bttv: Prevent NULL pointer dereference in radio_open V4L/DVB (8935): em28xx-cards: Remove duplicate entry (EM2800_BOARD_KWORLD_USB2800) V4L/DVB (8933): gspca: Disable light frquency for zc3xx cs2102 Kokom. ... commit e683b423007b9befec30c672c695d0e6abf87493 Author: Haavard Skinnemoen Date: Mon Oct 6 20:09:53 2008 +0200 atmel-mci: Initialize BLKR before sending data transfer command The atmel-mci driver sometimes fails data transfers like this: mmcblk0: error -5 transferring data end_request: I/O error, dev mmcblk0, sector 2749769 end_request: I/O error, dev mmcblk0, sector 2749777 It turns out that this might be caused by the BLKR register (which contains the block size and the number of blocks being transfered) being initialized too late. This patch moves the initialization of BLKR so that it contains the correct value before the block transfer command is sent. This error is difficult to reproduce, but if you insert a long delay (mdelay(10) or thereabouts) between the calls to atmci_start_command() and atmci_submit_data(), all transfers seem to fail without this patch, while I haven't seen any failures with this patch. Reported-by: Hein_Tibosch Signed-off-by: Haavard Skinnemoen Signed-off-by: Pierre Ossman Signed-off-by: Linus Torvalds commit 859f4c74d8de4dc344b3a115367d5e22a79bddaf Author: Jarek Poplawski Date: Mon Oct 6 12:54:57 2008 -0700 netrom: Fix sock_orphan() use in nr_release While debugging another bug it was found that NetRom socks are sometimes seen unorphaned in sk_free(). This patch moves sock_orphan() in nr_release() to the beginning (like in ax25, or rose). Reported-and-tested-by: Bernard Pidoux f6bvp Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller commit 33d1d2c52c3befa6c4df33b4ba58137d1c48894b Author: David S. Miller Date: Mon Oct 6 12:53:50 2008 -0700 ax25: Quick fix for making sure unaccepted sockets get destroyed. Since we reverted 30902dc3cb0ea1cfc7ac2b17bcf478ff98420d74 ("ax25: Fix std timer socket destroy handling.") we have to put some kind of fix in to cure the issue whereby unaccepted connections do not get destroyed. The approach used here is from Tihomir Heidelberg - 9a4gl Signed-off-by: David S. Miller commit 88a944eef8a4f9a2ca647eb16202a2b63f8ba7cd Author: David S. Miller Date: Mon Oct 6 12:48:29 2008 -0700 Revert "ax25: Fix std timer socket destroy handling." This reverts commit 30902dc3cb0ea1cfc7ac2b17bcf478ff98420d74. It causes all kinds of problems, based upon a report by Bernard (f6bvp) and analysis by Jarek Poplawski. Signed-off-by: David S. Miller commit cc1e0f4f7ad95a9eb81e1904cb16068af226180d Author: Jason Wessel Date: Mon Oct 6 13:50:59 2008 -0500 kgdb: call touch_softlockup_watchdog on resume The softlockup watchdog needs to be touched when resuming the from the kgdb stopped state to avoid the printk that a CPU is stuck if the debugger was active for longer than the softlockup threshold. Signed-off-by: Jason Wessel commit e85ceae9102f6e3c1d707e7ac88fa48d252e9cfa Author: Jan Kiszka Date: Mon Oct 6 13:50:59 2008 -0500 kgdb, x86: Avoid invoking kgdb_nmicallback twice per NMI Stress-testing KVM's latest NMI support with kgdbts inside an SMP guest, I came across spurious unhandled NMIs while running the singlestep test. Looking closer at the code path each NMI takes when KGDB is enabled, I noticed that kgdb_nmicallback is called twice per event: One time via DIE_NMI_IPI notification, the second time on DIE_NMI. Removing the first invocation cures the unhandled NMIs here. Signed-off-by: Jan Kiszka Signed-off-by: Jason Wessel commit e84956f92a846246b09b34f2a728329c386d250f Author: Rafael J. Wysocki Date: Mon Oct 6 11:59:29 2008 +0200 x86 ACPI: Blacklist two HP machines with buggy BIOSes There is a bug in the BIOSes of some HP boxes with AMD Turions which connects IO-APIC pins with ACPI thermal trip points in such a way that if the state of the IO-APIC is not as expected by the (buggy) BIOS, the thermal trip points are set to insanely low values (usually all of them become 16 degrees Celsius). As a result, thermal throttling kicks in and knock the system down to its shoes. Unfortunately some of the recent IO-APIC changes made the bug show up. To prevent this from happening, blacklist machines that are known to be affected (nx6115 and 6715b in this particular case). This fixes http://bugzilla.kernel.org/show_bug.cgi?id=11516 listed as a regression from 2.6.26. On my box it was caused by: commit 691874fa96d6349a8b60f8ea9c2bae52ece79941 Author: Maciej W. Rozycki Date: Tue May 27 21:19:51 2008 +0100 x86: I/O APIC: timer through 8259A second-chance Signed-off-by: Maciej W. Rozycki Signed-off-by: Ingo Molnar and the whole story is described in this (huge) thread: http://marc.info/?l=linux-kernel&m=121358440508410&w=4 Matthew Garrett told us about that happening on the nx6125: http://marc.info/?l=linux-kernel&m=121396307411930&w=4 and then Maciej analysed the breakage on the basis of a DSDT from the nx6325: http://marc.info/?l=linux-kernel&m=121401068718826&w=4 As far as the Dmitry's and Jason's boxes are concerned, I recognized the symptoms and asked them to verify that the blacklisting helped. It appears that the buggy BIOS code has been copy-pasted to the entire range of machines, for no good reason. Signed-off-by: Rafael J. Wysocki Tested-by: Dmitry Torokhov Tested-by: Jason Vas Dias Signed-off-by: Linus Torvalds commit 1305e9e7991d6c6b6aaa6e45f3f87363e6a66604 Author: Marcel Holtmann Date: Mon Oct 6 12:22:52 2008 +0200 [Bluetooth] Add reset quirk for A-Link BlueUSB21 dongle The new A-Link Bluetooth dongle is another one based on the BCM2046 chip from Broadcom and it also needs to send HCI_Reset before it becomes fully operational. Without the quirk it will show a lot of I/O errors. Signed-off-by: Marcel Holtmann commit 4f62f6cb93a58f77056daed73a7700fe467f7eb3 Author: Marcel Holtmann Date: Mon Oct 6 12:22:51 2008 +0200 [Bluetooth] Add reset quirk for new Targus and Belkin dongles Targus and Belkin have come out with new Bluetooth 2.1 capable dongles using the latest BCM2046 chip from Broadcom. Both of them are so called HID proxy dongles and they need to send HCI_Reset before they become fully operational. Signed-off-by: Marcel Holtmann commit 36010ff6788a058147ae15a1aebf97fd30fa51a9 Author: Marcel Holtmann Date: Mon Oct 6 12:22:51 2008 +0200 [Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers The transfer buffer of an URB will be automatically freed when using the URB_FREE_BUFFER transfer_flag. So the extra calls to kfree() will cause a double free. Reported-by: Justin Mattock Signed-off-by: Rabin Vincent Signed-off-by: Marcel Holtmann commit fd3d2764ee5aad862e51c21b8239561acdea8c2f Author: Ralf Baechle Date: Fri Oct 3 22:43:38 2008 +0100 [MIPS] IP27: Fix build errors if CONFIG_MAPPED_KERNEL=y Signed-off-by: Ralf Baechle commit 4a16ff4c692d49f0caeabe08e6d3ae28a0ad4d04 Author: Ralf Baechle Date: Sat Oct 4 00:06:29 2008 +0100 [MIPS] Fix CMP Kconfig configuration and mark as broken. Because sync-r4k.c doesn't build. Signed-off-by: Ralf Baechle commit ca09a237b8c6b053e101a4a83bc30d2c48435bd5 Author: Bartlomiej Zolnierkiewicz Date: Sun Oct 5 18:23:28 2008 +0200 ide: workaround for bogus gcc warning in ide_sysfs_register_port() Reported-by: "Steven Noonan" Suggested-by: "Elias Oltmanns" Cc: mingo@elte.hu Signed-off-by: Bartlomiej Zolnierkiewicz commit f3e85ee70a8dd18e6ffa933ae4065a7031837cf3 Author: Bodo Eggert <7eggert@gmx.de> Date: Sun Oct 5 18:23:28 2008 +0200 ide-cd: Optiarc DVD RW AD-7200A does play audio The Optiarc DVD RW AD-7200A can play audio, but tells it could not. Signed-off-by: Bodo Eggert <7eggert@gmx.de> Tested-by: Nick Warne Received-from: Borislav Petkov [bart: keep "audio" quirks together] Signed-off-by: Bartlomiej Zolnierkiewicz commit 2fef357cf391b56b8b6952a412f7324e50427a77 Author: Ralf Baechle Date: Sun Oct 5 18:23:28 2008 +0200 IDE: Fix platform device registration in Swarm IDE driver (v2) The Swarm IDE driver uses a release method which is defined in the driver itself thus potentially oopsable. The simple fix would be to just leak the device but this patch goes the full length and moves the entire handling of the platform device in the platform code and retains only the platform driver code in drivers/ide/mips/swarm.c. Signed-off-by: Ralf Baechle Cc: "Maciej W. Rozycki" Acked-by: Sergei Shtylyov [bart: remove no longer needed BLK_DEV_IDE_SWARM from ide/Kconfig] Signed-off-by: Bartlomiej Zolnierkiewicz commit 22e05b4549bf2405d6aca128540b20cd2dd33f1f Author: Sergei Shtylylov Date: Sun Oct 5 18:23:27 2008 +0200 ide-dma: fix ide_build_dmatable() for TRM290 Apparently, 'xcount' being 0 does not mean 0 bytes for TRM290; it means 4 bytes, judging from the code immediately preceding this check. So, we must never try to "split" the PRD for TRM290. This is probably never hit anyway -- with the DMA buffers aligned to at least 512 bytes and ATAPI DMA not being used for non block I/O commands... Signed-off-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit f20f258603ebc5da91e76884cf0c0d7ac9804b1c Author: Borislav Petkov Date: Sun Oct 5 18:23:27 2008 +0200 ide-cd: temporary tray close fix This one fixes http://bugzilla.kernel.org/show_bug.cgi?id=11602. A more generic fix for drives which cannot autoclose tray will follow. Signed-off-by: Borislav Petkov Cc: Jens Axboe [bart: add an extra parentheses for consistency with the rest of kernel code] Signed-off-by: Bartlomiej Zolnierkiewicz commit d99e90164e6cf2eb85fa94d547d6336f8127a107 Author: Yinghai Lu Date: Sat Oct 4 15:55:12 2008 -0700 x86: gart iommu have direct mapping when agp is present too move init_memory_mapping() out of init_k8_gatt. for: http://bugzilla.kernel.org/show_bug.cgi?id=11676 2.6.27-rc2 to rc8, apgart fails, iommu=soft works, regression This is needed because we need to map the GART aperture even if the GATT is not initialized. Signed-off-by: Yinghai Lu Signed-off-by: Ingo Molnar commit db98fb8b5b9210ba3b14fb984a26060e4afdb9f5 Author: Wiktor Grebla Date: Sun Sep 28 01:37:48 2008 -0300 V4L/DVB (9103): em28xx: HVR-900 B3C0 - fix audio clicking issue Fixed audio clicking problem which could be heard when using analog tv or composite input Signed-off-by: Wiktor Grebla Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit da3808e10faca68b064ac897753fa4e1707d29a4 Author: Darron Broad Date: Tue Sep 30 02:46:41 2008 -0300 V4L/DVB (9099): em28xx: Add detection for K-WORLD DVB-T 310U Correct firmware type to MTS Correct audio routing for composite/s-video Add DVB-T detection. This patch uses the eeprom hash method for detection as the vendor/product ids are also used for the DIGIVOX_AD. This may be a clone of the same product. Explanatory text has been added prior to the hask look-up in anticipation that it may help others. The following has been tested to work: Analogue TV (PAL-I) Composite In DVB-T (UK Crystal Palace) USB AUDIO The following has not been tested but probably works: S-Video In Signed-off-by: Darron Broad Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 674cbc691c5439134bb2ea064c0ee1311fc92384 Author: Jean-Francois Moine Date: Thu Oct 2 08:06:59 2008 -0300 V4L/DVB (9092): gspca: Bad init values for sonixj ov7660. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 8d768e14fc57160b35ac13e797a81163baab34d2 Author: Jean-Francois Moine Date: Sun Sep 21 03:28:55 2008 -0300 V4L/DVB (9080): gspca: Add a delay after writing to the sonixj sensors. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 05d3c1e2fb95d3233f6ec0f1d4b9bb07655636b2 Author: Shane Date: Sun Sep 14 04:17:46 2008 -0300 V4L/DVB (9075): gspca: Bad check of returned status in i2c_read() spca561. This makes auto gain functional on 04fc:0561. Signed-off-by: Shane Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit fe6c700ff34e68e1eb7991e9c5d18986d0005ac1 Author: Ralph Loader Date: Mon Sep 22 21:06:48 2008 -0300 V4L/DVB (9053): fix buffer overflow in uvc-video There is a buffer overflow in drivers/media/video/uvc/uvc_ctrl.c: INFO: 0xf2c5ce08-0xf2c5ce0b. First byte 0xa1 instead of 0xcc INFO: Allocated in uvc_query_v4l2_ctrl+0x3c/0x239 [uvcvideo] age=13 cpu=1 pid=4975 ... A fixed size 8-byte buffer is allocated, and a variable size field is read into it; there is no particular bound on the size of the field (it is dependent on hardware and configuration) and it can overflow [also verified by inserting printk's.] The patch attempts to size the buffer to the correctly. Signed-off-by: Andrew Morton Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit bda1cda54b7e1654e9416fec76e6342847b25216 Author: Patrick Boettcher Date: Sun Sep 7 16:04:38 2008 -0300 V4L/DVB (9043): S5H1420: Fix size of shadow-array to avoid overflow The array size of 'shadow' still needs to be fixed in order to not overflow when reading register 0x00. Thanks to Oliver Endriss for pointing that out. Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab commit c18c5ffe13e553cf670da521fe09150c36edeb61 Author: Patrick Boettcher Date: Sat Sep 6 13:31:58 2008 -0300 V4L/DVB (9037): Fix support for Hauppauge Nova-S SE Different backends have different input busses (saa7146, flexcop). To reflect that a config-option to the s5h1420-driver was added which makes the output mode selectable. Furthermore the s5h1420-driver is now doing the same i2c-method as it was done before adding support for other i2c-users. This patch needs to go into the current release of the kernel, as this driver is currently broken. (Thanks to Eberhard Kaltenhaeuser for helping out to debug this issue.) Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab commit dda06a8e4610757def753ee3a541a0b1a1feb36b Author: Andreas Oberritter Date: Wed Sep 24 05:00:37 2008 -0300 V4L/DVB (9029): Fix deadlock in demux code The functions dvb_dmxdev_section_callback, dvb_dmxdev_ts_callback, dvb_dmx_swfilter_packet, dvb_dmx_swfilter_packets, dvb_dmx_swfilter and dvb_dmx_swfilter_204 may be called from both interrupt and process context. Therefore they need to be protected by spin_lock_irqsave() instead of spin_lock(). This fixes a deadlock discovered by lockdep. Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab commit 3d843c92da5a1f1ab2cbc2b2e04f84d5ecedf5aa Author: Michael Krufky Date: Tue Sep 16 16:46:42 2008 -0300 V4L/DVB (8979): sms1xxx: Add new USB product ID for Hauppauge WinTV MiniStick 2040:5510 is the same hardware as 2040:5500 Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 7a9b5fc5fd9e30b58be767722e270f3df651f27c Author: Michael Krufky Date: Thu Sep 11 23:02:12 2008 -0300 V4L/DVB (8978): sms1xxx: fix product name for Hauppauge WinTV MiniStick Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 5ea7fe48a95084897786b0f20109d0611bdababc Author: Devin Heitmueller Date: Tue Sep 16 02:02:12 2008 -0300 V4L/DVB (8967): Use correct XC3028L firmware for AMD ATI TV Wonder 600 The AMD ATI TV Wonder 600 has an XC3028L and *not* an XC3028, so we need to load the proper firmware to prevent the device from overheating. Signed-off-by: Devin Heitmueller Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit a1c4530e4e5b73e60ed96c413902c6a46e812494 Author: Dean Anderson Date: Tue Sep 9 12:29:56 2008 -0300 V4L/DVB (8963): s2255drv field count fix Fixes videobuf field_count Signed-off-by: Dean Anderson Signed-off-by: Mauro Carvalho Chehab commit a30ee3c747728f9151664118ffcbdeefd202c332 Author: Jean Delvare Date: Fri Sep 5 10:39:27 2008 -0300 V4L/DVB (8961): zr36067: Fix RGBR pixel format The zr36067 driver is improperly declaring pixel format RGBP twice, once as "16-bit RGB LE" and once as "16-bit RGB BE". The latter is actually RGBR. Fix the code to properly map both pixel formats. Signed-off-by: Jean Delvare Acked-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit ec16d020836fd0a753312374a3277668ac4f8ee2 Author: Andrew Morton Date: Wed Sep 3 02:15:39 2008 -0300 V4L/DVB (8960): drivers/media/video/cafe_ccic.c needs mm.h sparc32 allmodconfig: drivers/media/video/cafe_ccic.c: In function 'cafe_setup_siobuf': drivers/media/video/cafe_ccic.c:1192: error: implicit declaration of function 'PAGE_ALIGN' drivers/media/video/cafe_ccic.c: At top level: drivers/media/video/cafe_ccic.c:1430: error: variable 'cafe_v4l_vm_ops' has initializer but incomplete type drivers/media/video/cafe_ccic.c:1431: error: unknown field 'open' specified in initializer drivers/media/video/cafe_ccic.c:1431: warning: excess elements in struct initializer drivers/media/video/cafe_ccic.c:1431: warning: (near initialization for 'cafe_v4l_vm_ops') drivers/media/video/cafe_ccic.c:1432: error: unknown field 'close' specified in initializer drivers/media/video/cafe_ccic.c:1433: warning: excess elements in struct initializer drivers/media/video/cafe_ccic.c:1433: warning: (near initialization for 'cafe_v4l_vm_ops') drivers/media/video/cafe_ccic.c: In function 'cafe_v4l_mmap': drivers/media/video/cafe_ccic.c:1444: error: 'VM_WRITE' undeclared (first use in this function) drivers/media/video/cafe_ccic.c:1444: error: (Each undeclared identifier is reported only once drivers/media/video/cafe_ccic.c:1444: error: for each function it appears in.) drivers/media/video/cafe_ccic.c:1444: error: 'VM_SHARED' undeclared (first use in this function) drivers/media/video/cafe_ccic.c:1461: error: 'VM_DONTEXPAND' undeclared (first use in this function) This build breakage is caused by some header file shuffle in linux-next. But I suggest that this patch be merged ahead of linux-next to avoid bisection breakage. Signed-off-by: Andrew Morton Signed-off-by: Mauro Carvalho Chehab commit bba4449c637660d5a8b2aee5ad0206df9fd6f334 Author: Jean Delvare Date: Sun Sep 7 05:56:55 2008 -0300 V4L/DVB (8958): zr36067: Return proper bytes-per-line value The zr36067 driver should return the actual bytes-per-line value when queried with ioctl VIDIOC_G_FMT, instead of 0. Otherwise user-space applications can get confused. Likewise, with ioctl VIDIOC_S_FMT, we are supposed to fill the bytes-per-line value. And we shouldn't fail if the caller sets the initial value to something different from 0. This is perfectly valid for applications to pre-fill this field with the value they expect. Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab commit c014ec90bc1b951e3fff89bc6ba826b8ef0f444b Author: Jean Delvare Date: Sun Sep 7 05:21:34 2008 -0300 V4L/DVB (8957): zr36067: Restore the default pixel format Restore the default pixel format to YUYV as it used to be before kernel 2.6.23. It was accidentally changed to BGR3 by commit 603d6f2c8f9f3604f9c6c1f8903efc2df30a000f. Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab commit c37396c19403e249f12626187d51e92c915f2bc9 Author: Jean Delvare Date: Sun Sep 7 13:47:03 2008 -0300 V4L/DVB (8955): bttv: Prevent NULL pointer dereference in radio_open Fix the following crash in the bttv driver: BUG: unable to handle kernel NULL pointer dereference at 000000000000036c IP: [] radio_open+0x3a/0x170 [bttv] This happens because radio_open assumes that all present bttv devices have a radio function. If a bttv device without radio and one with radio are installed on the same system, and the one without radio is registered first, then radio_open checks for the radio device number of a bttv device that has no radio function, and this breaks. All we have to do to fix it is to skip bttv devices without a radio function. Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab commit c737684b51e1edee16fbdf22e9a65ddad261e907 Author: Douglas Schilling Landgraf Date: Mon Sep 8 03:22:55 2008 -0300 V4L/DVB (8935): em28xx-cards: Remove duplicate entry (EM2800_BOARD_KWORLD_USB2800) Removed duplicated entry for EM2800_BOARD_KWORLD_USB2800 Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 5be8b73e121c8d293d7cfc698bbb084574fd8de2 Author: Costantino Leandro Date: Tue Sep 9 04:32:46 2008 -0300 V4L/DVB (8933): gspca: Disable light frquency for zc3xx cs2102 Kokom. CS2102K stop streaming on setlightfreq (50Hz & 60Hz). Disable it for now until a correct solution is found. Signed-off-by: Costantino Leandro Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 0d0548e67f0184704b7ecdf3c3ebf0e23c5af8c8 Author: Jean-Francois Moine Date: Fri Sep 5 12:49:54 2008 -0300 V4L/DVB (8926): gspca: Bad fix of leak memory (changeset 43d2ead315b1). Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 1167b2e495e42d757f9bb879c60bc0cf3391eaae Author: Hans Verkuil Date: Sat Sep 6 07:22:13 2008 -0300 V4L/DVB (8919): cx18: Fix tuner audio input for Compro H900 cards Earlier fixes to get the tuner audio working correctly broke the audio on the Compro VideoMate H900 cards. This is now fixed. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit fec6ed1d1f9b78a6acb4a3eb2c46c812ac2e96f0 Merge: b8ec322... 07454bf... Author: Linus Torvalds Date: Sat Oct 4 12:15:13 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: clockevents: check broadcast tick device not the clock events device commit b8ec322784f732562902503d70bf1f5e907b28c0 Merge: 2165f63... cc65f1e... Author: Linus Torvalds Date: Sat Oct 4 12:14:46 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86 setup: correct segfault in generation of 32-bit reloc kernel commit 07454bfff151d2465ada809bbaddf3548cc1097c Author: Thomas Gleixner Date: Sat Oct 4 10:51:07 2008 +0200 clockevents: check broadcast tick device not the clock events device Impact: jiffies increment too fast. Hugh Dickins noted that with NOHZ=n and HIGHRES=n jiffies get incremented too fast. The reason is a wrong check in the broadcast enter/exit code, which keeps the local apic timer in periodic mode when the switch happens. Signed-off-by: Thomas Gleixner commit 2165f631f0e1d4e9a1ee425ef05cb727352285e0 Merge: 76acae0... 3040a6d... Author: Linus Torvalds Date: Fri Oct 3 18:22:36 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: selinux: Fix an uninitialized variable BUG/panic in selinux_secattr_to_sid() commit 76acae04c892287949e1191e99600f3e952e43f7 Author: Rafael J. Wysocki Date: Fri Oct 3 15:23:49 2008 -0700 ACPI: Make /proc/acpi/wakeup interface handle PCI devices (again) Make the ACPI /proc/acpi/wakeup interface set the appropriate wake-up bits of physical devices corresponding to the ACPI devices and make those bits be set initially for devices that are enabled to wake up by default. This is needed to restore the 2.6.26 and earlier behavior for the PCI devices that were previously handled correctly with the help of the /proc/acpi/wakeup interface. Signed-off-by: Rafael J. Wysocki Cc: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 95bf14bff58fd200f0c2147c84582cc2488367d0 Author: Sven Wegener Date: Fri Oct 3 15:23:48 2008 -0700 leds-pca955x: add proper error handling and fix bogus memory handling Check the return value of led_classdev_register and unregister all registered devices, if registering one device fails. Also the dynamic memory handling is totally bogus. You can't allocate multiple chunks via kzalloc() and expect them to be in order later. I wonder how this ever worked. Signed-off-by: Sven Wegener Acked-by: Nate Case Tested-by: Nate Case Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 07f696c7772fb3501e9531de38333c49143a8d52 Author: Sven Wegener Date: Fri Oct 3 15:23:47 2008 -0700 leds-fsg: change order of initialization and deinitialization On initialization, we first do the ioremap and then register the led devices. On deinitialization, we do it in reverse order. This prevents someone calling into the brightness_set functions with an invalid latch_address. Signed-off-by: Sven Wegener Acked-by: Rod Whitby Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7fe7b2f4ec14d6517078c5bc32b04301b468041c Author: Haavard Skinnemoen Date: Fri Oct 3 15:23:46 2008 -0700 dw_dmac: fix copy/paste bug in tasklet The tasklet checks RAW.BLOCK twice, and does not check RAW.XFER. This is obviously wrong, and could theoretically cause the driver to hang. Reported-by: Nicolas Ferre Signed-off-by: Haavard Skinnemoen Acked-by: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09b05f5ee04cd2e2af3384d50646f53c76712f10 Author: Michael Kerrisk Date: Fri Oct 3 15:23:45 2008 -0700 Documentation/HOWTO: info about interface changes should CC linux-api@vger The "Documentation" section of this file mentions that when an interface change is made, I should be CCed with info about the change (so that man-pages can document it). Additionally request that this info be CCed to the new linux-api@vger.kernel.org list. Signed-off-by: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1d992ce905c838c2ca26fff8f2417cd31f667fd5 Author: Michael Kerrisk Date: Fri Oct 3 15:23:44 2008 -0700 SubmitChecklist: interfaces changes should CC linux-api@ Mention that patches that change the kernel-userland interface should be CCed to the new list linux-api@vger.kernel.org. Signed-off-by: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bd7ebec64d65ccf72a955a50fec27caf0f2458f1 Author: Michael Kerrisk Date: Fri Oct 3 15:23:44 2008 -0700 MAINTAINERS: add mailing list for man-pages Nowadays, man-pages has an associated mailing list. Mention that list in MAINTAINERS. Signed-off-by: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c222817f6add85197790e0071f6e511eff14ba25 Author: Paul Jackson Date: Fri Oct 3 15:23:42 2008 -0700 cpusets: remove pj from cpuset maintainers Remove myself from the kernel MAINTAINERS file for cpusets. I am leaving SGI and probably will not be active in Linux kernel work. I can be reached at . Contact Derek Fults for future SGI+cpuset related issues. I'm off to the next chapter of this good life. Signed-off-by: Paul Jackson Cc: Paul Menage Cc: Derek Fults Cc: John Hesterberg Cc: Paul Jackson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 897312bd240357c88ce906633703c324c6f0a5cd Author: Andrew Morton Date: Fri Oct 3 15:23:41 2008 -0700 include/linux/stacktrace.h: declare struct task_struct include/linux/stacktrace.h:13: warning: 'struct task_struct' declared inside parameter list (This might be a hard error on sparc64, which uses this header and has -Werror) Reported-by: "Randy.Dunlap" Acked-by: Ingo Molnar Cc: Peter Zijlstra Cc: Arjan van de Ven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f2fe1638f624467ae583b1a41a01804405f29eee Author: Lennert Buytenhek Date: Fri Oct 3 15:23:39 2008 -0700 orion_spi: fix handling of default transfer speed Accept zero (the default!) as a per-transfer clock speed override. Signed-off-by: Lennert Buytenhek Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aef7db4bd5a3b6068dfa05919a3d685199eed116 Author: Krzysztof Helt Date: Fri Oct 3 15:23:38 2008 -0700 fbdev: fix recursive notifier and locking when fbdev console is blanked Fix infinite recursive notifier in the fbdev layer. This causes recursive locking. Dmitry Baryshkov found the problem and confirmed that the patch fixes the bug. After doing # echo 1 > /sys/class/graphics/fb0/blank I got the following in my kernel log: ============================================= [ INFO: possible recursive locking detected ] 2.6.27-rc6-00086-gda63874-dirty #97 --------------------------------------------- echo/1564 is trying to acquire lock: ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c but task is already holding lock: ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c other info that might help us debug this: 2 locks held by echo/1564: #0: (&buffer->mutex){--..}, at: [] sysfs_write_file+0x30/0x80 #1: ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c stack backtrace: [] (dump_stack+0x0/0x14) from [] (print_deadlock_bug+0xa4/0xd0) [] (print_deadlock_bug+0x0/0xd0) from [] (check_deadlock+0x148/0x17c) r6:c397a1e0 r5:c397a530 r4:c04fcf98 [] (check_deadlock+0x0/0x17c) from [] (validate_chain+0x3c4/0x4f0) [] (validate_chain+0x0/0x4f0) from [] (__lock_acquire+0x5e8/0x6b4) [] (__lock_acquire+0x0/0x6b4) from [] (lock_acquire+0x64/0x78) [] (lock_acquire+0x0/0x78) from [] (down_read+0x4c/0x60) r7:00000009 r6:ffffffff r5:c0427a40 r4:c005a384 [] (down_read+0x0/0x60) from [] (__blocking_notifier_call_chain+0x38/0x6c) r5:c0427a40 r4:c0427a74 [] (__blocking_notifier_call_chain+0x0/0x6c) from [] (blocking_notifier_call_chain+0x20/0x28) r8:00000009 r7:c086d640 r6:c3967940 r5:00000000 r4:c38984b8 [] (blocking_notifier_call_chain+0x0/0x28) from [] (fb_notifier_call_chain+0x1c/0x24) [] (fb_notifier_call_chain+0x0/0x24) from [] (fb_blank+0x64/0x70) [] (fb_blank+0x0/0x70) from [] (fbcon_blank+0x114/0x1bc) r5:00000001 r4:c38984b8 [] (fbcon_blank+0x0/0x1bc) from [] (do_blank_screen+0x1e0/0x2a0) [] (do_blank_screen+0x0/0x2a0) from [] (fbcon_fb_blanked+0x74/0x94) r5:c3967940 r4:00000001 [] (fbcon_fb_blanked+0x0/0x94) from [] (fbcon_event_notify+0x100/0x12c) r5:fffffffe r4:c39bc194 [] (fbcon_event_notify+0x0/0x12c) from [] (notifier_call_chain+0x38/0x7c) [] (notifier_call_chain+0x0/0x7c) from [] (__blocking_notifier_call_chain+0x54/0x6c) r8:c3b51ea0 r7:00000009 r6:ffffffff r5:c0427a40 r4:c0427a74 [] (__blocking_notifier_call_chain+0x0/0x6c) from [] (blocking_notifier_call_chain+0x20/0x28) r8:00000001 r7:c3a7e000 r6:00000000 r5:00000000 r4:c38984b8 [] (blocking_notifier_call_chain+0x0/0x28) from [] (fb_notifier_call_chain+0x1c/0x24) [] (fb_notifier_call_chain+0x0/0x24) from [] (fb_blank+0x64/0x70) [] (fb_blank+0x0/0x70) from [] (store_blank+0x54/0x7c) r5:c38984b8 r4:c3b51ec4 [] (store_blank+0x0/0x7c) from [] (dev_attr_store+0x28/0x2c) r8:00000001 r7:c042bf80 r6:c39eba10 r5:c3967c30 r4:c38e0140 [] (dev_attr_store+0x0/0x2c) from [] (flush_write_buffer+0x54/0x68) [] (flush_write_buffer+0x0/0x68) from [] (sysfs_write_file+0x58/0x80) r8:c3b51f78 r7:c3bcb070 r6:c39eba10 r5:00000001 r4:00000001 [] (sysfs_write_file+0x0/0x80) from [] (vfs_write+0xb8/0x148) [] (vfs_write+0x0/0x148) from [] (sys_write+0x44/0x70) r7:00000004 r6:c3bcb070 r5:00000000 r4:00000000 [] (sys_write+0x0/0x70) from [] (ret_fast_syscall+0x0/0x2c) r6:4001b000 r5:00000001 r4:401dc658 Signed-off-by: Krzysztof Helt Reported-by: Dmitry Baryshkov Testted-by: Dmitry Baryshkov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e4a75cdcb89ff53bb182dda3a6dcdc14befe007 Author: Marcin Slusarz Date: Fri Oct 3 15:23:36 2008 -0700 rtc: fix kernel panic on second use of SIGIO nofitication When userspace uses SIGIO notification and forgets to disable it before closing file descriptor, rtc->async_queue contains stale pointer to struct file. When user space enables again SIGIO notification in different process, kernel dereferences this (poisoned) pointer and crashes. So disable SIGIO notification on close. Kernel panic: (second run of qemu (requires echo 1024 > /sys/class/rtc/rtc0/max_user_freq)) general protection fault: 0000 [1] PREEMPT CPU 0 Modules linked in: af_packet snd_pcm_oss snd_mixer_oss snd_seq_oss snd_seq_midi_event snd_seq usbhid tuner tea5767 tda8290 tuner_xc2028 xc5000 tda9887 tuner_simple tuner_types mt20xx tea5761 tda9875 uhci_hcd ehci_hcd usbcore bttv snd_via82xx snd_ac97_codec ac97_bus snd_pcm snd_timer ir_common compat_ioctl32 snd_page_alloc videodev v4l1_compat snd_mpu401_uart snd_rawmidi v4l2_common videobuf_dma_sg videobuf_core snd_seq_device snd btcx_risc soundcore tveeprom i2c_viapro Pid: 5781, comm: qemu-system-x86 Not tainted 2.6.27-rc6 #363 RIP: 0010:[] [] __lock_acquire+0x3db/0x73f RSP: 0000:ffffffff80674cb8 EFLAGS: 00010002 RAX: ffff8800224c62f0 RBX: 0000000000000046 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800224c62f0 RBP: ffffffff80674d08 R08: 0000000000000002 R09: 0000000000000001 R10: ffffffff80238941 R11: 0000000000000001 R12: 0000000000000000 R13: 6b6b6b6b6b6b6b6b R14: ffff88003a450080 R15: 0000000000000000 FS: 00007f98b69516f0(0000) GS:ffffffff80623200(0000) knlGS:00000000f7cc86d0 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000a87000 CR3: 0000000022598000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process qemu-system-x86 (pid: 5781, threadinfo ffff880028812000, task ffff88003a450080) Stack: ffffffff80674cf8 0000000180238440 0000000200000002 0000000000000000 ffff8800224c62f0 0000000000000046 0000000000000000 0000000000000002 0000000000000002 0000000000000000 ffffffff80674d68 ffffffff8024fc7a Call Trace: [] lock_acquire+0x85/0xa9 [] ? send_sigio+0x2a/0x184 [] _read_lock+0x3e/0x4a [] ? send_sigio+0x2a/0x184 [] send_sigio+0x2a/0x184 [] ? __lock_acquire+0x6e1/0x73f [] ? kill_fasync+0x2c/0x4e [] __kill_fasync+0x54/0x65 [] kill_fasync+0x3a/0x4e [] rtc_update_irq+0x9c/0xa5 [] cmos_interrupt+0xae/0xc0 [] handle_IRQ_event+0x25/0x5a [] handle_edge_irq+0xdd/0x123 [] do_IRQ+0xe4/0x144 [] ret_from_intr+0x0/0xf [] ? __alloc_pages_internal+0xe7/0x3ad [] ? clear_page_c+0x7/0x10 [] ? get_page_from_freelist+0x385/0x450 [] ? __alloc_pages_internal+0xe7/0x3ad [] ? anon_vma_prepare+0x2e/0xf6 [] ? handle_mm_fault+0x227/0x6a5 [] ? do_page_fault+0x494/0x83f [] ? error_exit+0x0/0xa9 Code: cc 41 39 45 28 74 24 e8 5e 1d 0f 00 85 c0 0f 84 6a 03 00 00 83 3d 8f a9 aa 00 00 be 47 03 00 00 0f 84 6a 02 00 00 e9 53 03 00 00 <41> ff 85 38 01 00 00 45 8b be 90 06 00 00 41 83 ff 2f 76 24 e8 RIP [] __lock_acquire+0x3db/0x73f RSP ---[ end trace 431877d860448760 ]--- Kernel panic - not syncing: Aiee, killing interrupt handler! Signed-off-by: Marcin Slusarz Acked-by: Alessandro Zummo Acked-by: David Brownell Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3040a6d5a2655c7967bd42b5fb4903d48daa747f Author: Paul Moore Date: Fri Oct 3 10:51:15 2008 -0400 selinux: Fix an uninitialized variable BUG/panic in selinux_secattr_to_sid() At some point during the 2.6.27 development cycle two new fields were added to the SELinux context structure, a string pointer and a length field. The code in selinux_secattr_to_sid() was not modified and as a result these two fields were left uninitialized which could result in erratic behavior, including kernel panics, when NetLabel is used. This patch fixes the problem by fully initializing the context in selinux_secattr_to_sid() before use and reducing the level of direct context manipulation done to help prevent future problems. Please apply this to the 2.6.27-rcX release stream. Signed-off-by: Paul Moore Signed-off-by: James Morris commit e105eabb5b843c6c59f921f54122221f82ca09e6 Merge: 1db9b83... 8531a35... Author: Linus Torvalds Date: Fri Oct 3 14:11:43 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] SMTC: Fix SMTC dyntick support. [MIPS] SMTC: Close tiny holes in the SMTC IPI replay system. [MIPS] SMTC: Fix holes in SMTC and FPU affinity support. [MIPS] SMTC: Build fix: Fix filename in Makefile [MIPS] Build fix: Fix irq flags type commit 1db9b8373821f200dd71f4896ca7323c371620fe Merge: 96d746c... 75f6276... Author: Linus Torvalds Date: Fri Oct 3 13:43:05 2008 -0700 Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6: [S390] qdio: prevent stack clobber [S390] nohz: Fix __udelay. commit cc65f1ec192dc54de57483194502e9fa00934c39 Author: H. Peter Anvin Date: Fri Oct 3 13:00:56 2008 -0700 x86 setup: correct segfault in generation of 32-bit reloc kernel Impact: segfault on build of a 32-bit relocatable kernel When converting arch/x86/boot/compressed/relocs.c to support unlimited sections, the computation of sym_strtab in walk_relocs() was done incorrectly. This causes a segfault for some people when building the relocatable 32-bit kernel. Pointed out by Anonymous . Signed-off-by: H. Peter Anvin commit 96d746c68fae9a1e3167caab04c22fd0f677f62d Author: Linus Torvalds Date: Fri Oct 3 13:38:07 2008 -0700 Fix init/main.c to use regular printk with '%pF' for initcall fn .. small detail, but the silly e1000e initcall warning debugging caused me to look at this code. Rather than gouge my eyes out with a spoon, I just fixed it. Signed-off-by: Linus Torvalds commit 75f6276187e5ce5a312a0619fba2fe56c9290b48 Author: Jan Glauber Date: Fri Oct 3 21:55:00 2008 +0200 [S390] qdio: prevent stack clobber Don't print more information than fits into the string on the stack. Combine the informational output of qdio to fit into one line. Signed-off-by: Jan Glauber Signed-off-by: Martin Schwidefsky commit d3d238c7744d08c36a114a59cb537d4c0c6c9a86 Author: Heiko Carstens Date: Fri Oct 3 21:54:59 2008 +0200 [S390] nohz: Fix __udelay. This fixes a regression that came with 934b2857cc576ae53c92a66e63fce7ddcfa74691 ("[S390] nohz/sclp: disable timer on synchronous waits."). If udelay() gets called from a disabled context it sets the clock comparator to a value where it expects the next interrupt. When the interrupt happens the clock comparator gets not reset and therefore the interrupt condition doesn't get cleared. The result is an endless timer interrupt loop. In addition this patch fixes also the following: rcutorture reveals that our __udelay implementation is still buggy, since it might schedule tasklets, but prevents their execution: NOHZ: local_softirq_pending 42 NOHZ: local_softirq_pending 02 NOHZ: local_softirq_pending 142 NOHZ: local_softirq_pending 02 To fix this we make sure that only the clock comparator interrupt is enabled when the enabled wait psw is loaded. Also no code gets called anymore which might schedule tasklets. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 8531a35e5e275b17c57c39b7911bc2b37025f28c Author: Kevin D. Kissell Date: Tue Sep 9 21:48:52 2008 +0200 [MIPS] SMTC: Fix SMTC dyntick support. Rework of SMTC support to make it work with the new clock event system, allowing "tickless" operation, and to make it compatible with the use of the "wait_irqoff" idle loop. The new clocking scheme means that the previously optional IPI instant replay mechanism is now required, and has been made more robust. Signed-off-by: Kevin D. Kissell Signed-off-by: Ralf Baechle commit d2bb01b042a38219fbddaafc214c5beb96248d2f Author: Kevin D. Kissell Date: Tue Sep 9 21:35:01 2008 +0200 [MIPS] SMTC: Close tiny holes in the SMTC IPI replay system. Signed-off-by: Kevin D. Kissell Signed-off-by: Ralf Baechle commit 9cc123631b6630948eb5059d218f44424888daa7 Author: Kevin D. Kissell Date: Tue Sep 9 21:33:36 2008 +0200 [MIPS] SMTC: Fix holes in SMTC and FPU affinity support. Signed-off-by: Kevin D. Kissell Signed-off-by: Ralf Baechle commit 498a863fdfb3e60d2e0e964cd202c2030bda1005 Author: Ralf Baechle Date: Wed Oct 1 22:23:52 2008 +0100 [MIPS] SMTC: Build fix: Fix filename in Makefile Signed-off-by: Ralf Baechle commit b7e4226e4f427b59dc8e9c45a2a1a1ed1353a140 Author: Ralf Baechle Date: Wed Oct 1 21:52:41 2008 +0100 [MIPS] Build fix: Fix irq flags type Though from a hardware perspective it would be sensible to use only a 32-bit unsigned int type Linux defines interrupt flags to be stored in an unsigned long and nothing else. Signed-off-by: Ralf Baechle commit 95b866d5afcafee00fc9ad70665e48c86d8c4e0f Author: Linus Torvalds Date: Fri Oct 3 09:18:17 2008 -0700 e1000e: Fix incorrect debug warning Doing 'WARN_ON(preempt_count())' was horribly horribly wrong, and would cause tons of warnings at bootup if PREEMPT was enabled because the initcalls currently run with the kernel lock, which increments the preempt count. At the same time, the warning was also insufficient, since it didn't check that interrupts were enabled. The proper debug function to use for something that can sleep and wants a warning if it's called in the wrong context is 'might_sleep()'. Reported-by: Christian Borntraeger Signed-off-by: Linus Torvalds commit b5ff7df3df9efab511244d5a299fce706c71af48 Author: Linus Torvalds Date: Thu Oct 2 18:52:51 2008 -0700 Check mapped ranges on sysfs resource files This is loosely based on a patch by Jesse Barnes to check the user-space PCI mappings though the sysfs interfaces. Quoting Jesse's original explanation: It's fairly common for applications to map PCI resources through sysfs. However, with the current implementation, it's possible for an application to map far more than the range corresponding to the resourceN file it opened. This patch plugs that hole by checking the range at mmap time, similar to what is done on platforms like sparc64 in their lower level PCI remapping routines. It was initially put together to help debug the e1000e NVRAM corruption problem, since we initially thought an X driver might be walking past the end of one of its mappings and clobbering the NVRAM. It now looks like that's not the case, but doing the check is still important for obvious reasons. and this version of the patch differs in that it uses a helper function to clarify the code, and does all the checks in pages (instead of bytes) in order to avoid overflows when doing "<< PAGE_SHIFT" etc. Acked-by: Jesse Barnes Signed-off-by: Linus Torvalds commit 6f92a6a7ddba5ae7ca0f0255d46410465dcf2ba6 Author: Jesse Brandeburg Date: Thu Oct 2 16:33:45 2008 -0700 e1000e: update version from k4 to k6 Signed-off-by: Jesse Brandeburg Signed-off-by: Linus Torvalds commit 717d438d1fde94decef874b9808379d1f4523453 Author: Thomas Gleixner Date: Thu Oct 2 16:33:40 2008 -0700 e1000e: debug contention on NVM SWFLAG This patch adds a mutex to the e1000e driver that would help catch any collisions of two e1000e threads accessing hardware at the same time. description and patch updated by Jesse Signed-off-by: Thomas Gleixner Signed-off-by: Jesse Brandeburg Signed-off-by: Linus Torvalds commit 4fa7553a075918e1e02a6039f9e826c8872b7049 Author: Jesse Brandeburg Date: Thu Oct 2 16:33:35 2008 -0700 e1000e: drop stats lock the stats lock is left over from e1000, e1000e no longer has the adjust tbi stats function that required the addition of the stats lock to begin with. adding a mutex to acquire_swflag helped catch this one too. Signed-off-by: Jesse Brandeburg Acked-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 23033fad5be0a2c7838cb9e1579919b64af713f6 Author: Jesse Brandeburg Date: Thu Oct 2 16:33:30 2008 -0700 e1000e: remove phy read from inside spinlock thanks to tglx, we're finding some interesting reentrancy issues. this patch removes the phy read from inside a spinlock, paving the way for removing the spinlock completely. The phy read was only feeding a statistic that wasn't used. Signed-off-by: Jesse Brandeburg Acked-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit a8f88ff5a5abc2ce9f7d7d2694178b2c617d713a Author: Jesse Brandeburg Date: Thu Oct 2 16:33:25 2008 -0700 e1000e: do not ever sleep in interrupt context e1000e was apparently calling two functions that attempted to reserve the SWFLAG bit for exclusive (to hardware and firmware) access to the PHY and NVM (aka eeprom). These accesses could possibly call msleep to wait for the resource which is not allowed from interrupt context. Signed-off-by: Jesse Brandeburg Acked-by: Thomas Gleixner Tested-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 37f40239f49fbc0b489d0327a700fee5b3898ac2 Author: Jesse Brandeburg Date: Thu Oct 2 16:33:20 2008 -0700 e1000e: reset swflag after resetting hardware in the process of debugging things, noticed that the swflag is not reset by the driver after reset, and the swflag is probably not reset unless management firmware clears it after 100ms. Signed-off-by: Jesse Brandeburg Signed-off-by: Linus Torvalds commit 6babc32c41e3642d875372cb6afbd9ade7a9f311 Author: Andy Whitcroft Date: Thu Oct 2 14:50:18 2008 -0700 mm: handle initialising compound pages at orders greater than MAX_ORDER When we initialise a compound page we initialise the page flags and head page pointer for all base pages spanned by that page. When we initialise a gigantic page (a page of order greater than or equal to MAX_ORDER) we have to initialise more than MAX_ORDER_NR_PAGES pages. Currently we assume that all elements of the mem_map in this page are contigious in memory. However this is only guarenteed out to MAX_ORDER_NR_PAGES pages, and with SPARSEMEM enabled they will not be contigious. This leads us to walk off the end of the first section and scribble on everything which follows, BAD. When we reach a MAX_ORDER_NR_PAGES boundary we much locate the next section of the mem_map. As gigantic pages can only be maximally aligned we know this will occur at exact multiple of MAX_ORDER_NR_PAGES pages from the start of the page. This is a bug fix for the gigantic page support in hugetlbfs. Credit to Mel Gorman for spotting the issue. Signed-off-by: Andy Whitcroft Cc: Mel Gorman Cc: Jon Tollefson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b19de6d1cb07c8bcb6778e771f9cfd5bcfdfd3e Author: Nick Piggin Date: Thu Oct 2 14:50:16 2008 -0700 mm: tiny-shmem nommu fix The previous patch db203d53d474aa068984e409d807628f5841da1b ("mm: tiny-shmem fix lock ordering: mmap_sem vs i_mutex") to fix the lock ordering in tiny-shmem breaks shared anonymous and IPC memory on NOMMU architectures because it was using the expanding truncate to signal ramfs to allocate a physically contiguous RAM backing the inode (otherwise it is unusable for "memory mapping" it to userspace). However do_truncate is what caused the lock ordering error, due to it taking i_mutex. In this case, we can actually just call ramfs directly to allocate memory for the mapping, rather than go via truncate. Acked-by: David Howells Acked-by: Hugh Dickins Signed-off-by: Nick Piggin Cc: Matt Mackall Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c1b7f680dd4f550fa6f91f148cc6fa2c4bd0737 Author: Gerald Schaefer Date: Thu Oct 2 14:50:16 2008 -0700 memory hotplug: missing zone->lock in test_pages_isolated() __test_page_isolated_in_pageblock() in mm/page_isolation.c has a comment saying that the caller must hold zone->lock. But the only caller of that function, test_pages_isolated(), does not hold zone->lock and the lock is also not acquired anywhere before. This patch adds the missing zone->lock to test_pages_isolated(). We reproducibly run into BUG_ON(!PageBuddy(page)) in __offline_isolated_pages() during memory hotplug stress test, see trace below. This patch fixes that problem, it would be good if we could have it in 2.6.27. kernel BUG at /home/autobuild/BUILD/linux-2.6.26-20080909/mm/page_alloc.c:4561! illegal operation: 0001 [#1] PREEMPT SMP Modules linked in: dm_multipath sunrpc bonding qeth_l3 dm_mod qeth ccwgroup vmur CPU: 1 Not tainted 2.6.26-29.x.20080909-s390default #1 Process memory_loop_all (pid: 10025, task: 2f444028, ksp: 2b10dd28) Krnl PSW : 040c0000 801727ea (__offline_isolated_pages+0x18e/0x1c4) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:0 CC:0 PM:0 Krnl GPRS: 00000000 7e27fc00 00000000 7e27fc00 00000000 00000400 00014000 7e27fc01 00606f00 7e27fc00 00013fe0 2b10dd28 00000005 80172662 801727b2 2b10dd28 Krnl Code: 801727de: 5810900c l %r1,12(%r9) 801727e2: a7f4ffb3 brc 15,80172748 801727e6: a7f40001 brc 15,801727e8 >801727ea: a7f4ffbc brc 15,80172762 801727ee: a7f40001 brc 15,801727f0 801727f2: a7f4ffaf brc 15,80172750 801727f6: 0707 bcr 0,%r7 801727f8: 0017 unknown Call Trace: ([<0000000000172772>] __offline_isolated_pages+0x116/0x1c4) [<00000000001953a2>] offline_isolated_pages_cb+0x22/0x34 [<000000000013164c>] walk_memory_resource+0xcc/0x11c [<000000000019520e>] offline_pages+0x36a/0x498 [<00000000001004d6>] remove_memory+0x36/0x44 [<000000000028fb06>] memory_block_change_state+0x112/0x150 [<000000000028ffb8>] store_mem_state+0x90/0xe4 [<0000000000289c00>] sysdev_store+0x34/0x40 [<00000000001ee048>] sysfs_write_file+0xd0/0x178 [<000000000019b1a8>] vfs_write+0x74/0x118 [<000000000019b9ae>] sys_write+0x46/0x7c [<000000000011160e>] sysc_do_restart+0x12/0x16 [<0000000077f3e8ca>] 0x77f3e8ca Signed-off-by: Gerald Schaefer Acked-by: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa94fbd5ccd840c8ab26d02439ec799b03a72547 Author: Dan Carpenter Date: Thu Oct 2 14:50:14 2008 -0700 fix error-path NULL deref in alloc_posix_timer() Found by static checker (http://repo.or.cz/w/smatch.git). Signed-off-by: Dan Carpenter Acked-by: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c0c9209ddd96bc4f1d70a8b9958710671e076080 Author: Pascal Terjan Date: Thu Oct 2 14:50:13 2008 -0700 braille_console: only register notifiers when the braille console is used Only register the braille driver VT and keyboard notifiers when the braille console is used. Avoids eating insert or backspace keys. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11242 Signed-off-by: Pascal Terjan Signed-off-by: Samuel Thibault Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 16dbc6c9616363fe53811abcbd935336dc0a0f01 Author: Nick Piggin Date: Thu Oct 2 14:50:12 2008 -0700 inotify: fix lock ordering wrt do_page_fault's mmap_sem Fix inotify lock order reversal with mmap_sem due to holding locks over copy_to_user. Signed-off-by: Nick Piggin Reported-by: "Daniel J Blueman" Tested-by: "Daniel J Blueman" Cc: Ingo Molnar Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 08650869e0ec581f8d88cfdb563d37f5383abfe2 Author: David Winn Date: Thu Oct 2 14:50:11 2008 -0700 fbcon: fix monochrome color value calculation Commit 22af89aa0c0b4012a7431114a340efd3665a7617 ("fbcon: replace mono_col macro with static inline") changed the order of operations for computing monochrome color values. This generates 0xffff000f instead of 0x0000000f for a 4 bit monochrome color, leading to image corruption if it is passed to cfb_imageblit or other similar functions. Fix it up. Cc: Harvey Harrison Cc: "Antonino A. Daplas" Cc: Krzysztof Helt Cc: [2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 550ac958791399266c20e15e8048cd12bfce08ae Merge: 1fce2d0... 591d8a2... Author: Linus Torvalds Date: Thu Oct 2 07:54:32 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: snd-powermac: HP detection for 1st iMac G3 SL ALSA: snd-powermac: mixers for PowerMac G4 AGP ASoC: Set correct name for WM8753 rec mixer output commit 591d8a25c7c242f6b00be120ed378e585a5afb47 Merge: 030b655... 4037314... Author: Takashi Iwai Date: Thu Oct 2 12:50:50 2008 +0200 Merge branch 'asoc-fixes' into for-linus commit 030b655b062fe5190fc490e0091ea50307d7a86f Author: Risto Suominen Date: Mon Aug 25 08:04:23 2008 +0200 ALSA: snd-powermac: HP detection for 1st iMac G3 SL Correct headphone detection for 1st generation iMac G3 Slot-loading (Screamer). This patch fixes the regression in the recent snd-powermac which doesn't support some G3/G4 PowerMacs: http://lkml.org/lkml/2008/10/1/220 Signed-off-by: Risto Suominen Tested-by: Mariusz Kozlowski Cc: stable@kernel.org Signed-off-by: Takashi Iwai commit 4dbf95ba6c344186ec6d38ff514dc675da464bec Author: Risto Suominen Date: Mon Aug 25 08:02:12 2008 +0200 ALSA: snd-powermac: mixers for PowerMac G4 AGP Add mixer controls for PowerMac G4 AGP (Screamer). This patch fixes the regression in the recent snd-powermac which doesn't support some G3/G4 PowerMacs: http://lkml.org/lkml/2008/10/1/220 Signed-off-by: Risto Suominen Tested-by: Mariusz Kozlowski Cc: stable@kernel.org Signed-off-by: Takashi Iwai commit 4037314afc6eea3eab7e0447884c12b57a081f63 Author: Rob Sims Date: Wed Oct 1 21:47:31 2008 +0200 ASoC: Set correct name for WM8753 rec mixer output Rob Sims wrote: "I can't seem to turn on register 0x17, bit 3 in the sound chip, except by codec_reg_write; the mixer lacks direct or indirect control. It seems there are two names for the output of the rec mixer: Capture ST Mixer Playback Mixer Would the following do the trick?" I confirm that this solves the audio problems I was having. Signed-off-by: Jonas Bonn Signed-off-by: Mark Brown Signed-off-by: Takashi Iwai commit 1fce2d01dff65a76cd08c1b145acd9d3c20021d2 Author: Kumar Gala Date: Thu Oct 2 00:58:49 2008 -0500 powerpc: Fix boot hang regression on MPC8544DS Commit 00c5372d37a78990c1530184a9c792ee60a30067 caused the MPC8544DS board to hang at boot. The MPC8544DS is unique in that it doesn't use the PCI slots on the ULI (unlike the MPC8572DS or MPC8610HPCD). So the dummy read at the end of the address space causes us to hang. We can detect the situation by comparing the bridge's BARs versus the root complex. Signed-off-by: Kumar Gala commit 4a7703582836f55a1cbad0e2c1c6ebbee3f9b3a7 Author: Bruce Allan Date: Wed Oct 1 17:18:35 2008 -0700 e1000e: write protect ICHx NVM to prevent malicious write/erase Set the hardware to ignore all write/erase cycles to the GbE region in the ICHx NVM. This feature can be disabled by the WriteProtectNVM module parameter (enabled by default) only after a hardware reset, but the machine must be power cycled before trying to enable writes. Signed-off-by: Bruce Allan Signed-off-by: Jesse Brandeburg CC: arjan@linux.intel.com Signed-off-by: Linus Torvalds commit 20b918dc77b383e9779dafceee3f2198a6f7b0e5 Author: Mike Rapoport Date: Wed Oct 1 10:39:24 2008 -0700 pxa2xx_spi: fix build breakage This patch fixes a build error in the pxa2xx-spi driver, introduced by commit 7e96445533ac3f4f7964646a202ff3620602fab4 ("pxa2xx_spi: dma bugfixes") CC drivers/spi/pxa2xx_spi.o drivers/spi/pxa2xx_spi.c: In function 'map_dma_buffers': drivers/spi/pxa2xx_spi.c:331: error: invalid operands to binary & drivers/spi/pxa2xx_spi.c:331: error: invalid operands to binary & drivers/spi/pxa2xx_spi.c: In function 'pump_transfers': drivers/spi/pxa2xx_spi.c:897: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'unsigned int' [dbrownell@users.sourceforge.net: fix warning too ] Signed-off-by: Mike Rapoport Acked-by: Eric Miao Signed-off-by: Andrew Morton Signed-off-by: David Brownell Signed-off-by: Linus Torvalds commit edfd222fc54664b789cec01e78d442ce9461e79b Merge: d6478fa... dc63b52... Author: Linus Torvalds Date: Wed Oct 1 12:26:49 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, vmi: fix broken LDT access x86: fix typo in enable_mtrr_cleanup early parameter commit d6478fad430e37148b56f642c87301ba72476675 Author: David Howells Date: Wed Oct 1 13:47:06 2008 +0100 MN10300: Fix IRQ handling Fix the IRQ handling on the MN10300 arch. This patch makes a number of significant changes: (1) It separates the irq_chip definition for edge-triggered interrupts from the one for level-triggered interrupts. This is necessary because the MN10300 PIC latches the IRQ channel's interrupt request bit (GxICR_REQUEST), even after the device has ceased to assert its interrupt line and the interrupt channel has been disabled in the PIC. So for level-triggered interrupts we need to clear this bit when we re-enable - which is achieved by setting GxICR_DETECT but not GxICR_REQUEST when writing to the register. Not doing this results in spurious interrupts occurring because calling mask_ack() at the start of handle_level_irq() is insufficient - it fails to clear the REQUEST latch because the device that caused the interrupt is still asserting its interrupt line at this point. (2) IRQ disablement [irq_chip::disable_irq()] shouldn't clear the interrupt request flag for edge-triggered interrupts lest it lose an interrupt. (3) IRQ unmasking [irq_chip::unmask_irq()] also shouldn't clear the interrupt request flag for edge-triggered interrupts lest it lose an interrupt. (4) The end() operation is now left to the default (no-operation) as __do_IRQ() is compiled out. This may affect misrouted_irq(), but according to Thomas Gleixner it's the correct thing to do. (5) handle_level_irq() is used for edge-triggered interrupts rather than handle_edge_irq() as the MN10300 PIC latches interrupt events even on masked IRQ channels, thus rendering IRQ_PENDING unnecessary. It is sufficient to call mask_ack() at the start and unmask() at the end. (6) For level-triggered interrupts, ack() is now NULL as it's not used, and there is no effective ACK function on the PIC. mask_ack() is now the same as mask() as the latch continues to latch, even when the channel is masked. Further, the patch discards the disable() op implementation as its now the same as the mask() op implementation, which is used instead. It also discards the enable() op implementations as they're now the same as the unmask() op implementations, which are used instead. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 7ac9c1c24c0e68bdb89524e8c99e13fffcb2fcfb Merge: ae1cfb1... 7253a33... Author: Linus Torvalds Date: Wed Oct 1 09:37:23 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm * git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm: dm mpath: add missing path switching locking dm: cope with access beyond end of device in dm_merge_bvec dm: always allow one page in dm_merge_bvec commit ae1cfb1174c87b43b0639e35e782b7b2c95fb4ff Merge: de59985... 0523820... Author: Linus Torvalds Date: Wed Oct 1 09:37:04 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: af_key: Free dumping state on socket close XFRM,IPv6: initialize ip6_dst_blackhole_ops.kmem_cachep ipv6: NULL pointer dereferrence in tcp_v6_send_ack tcp: Fix NULL dereference in tcp_4_send_ack() sctp: Fix kernel panic while process protocol violation parameter iucv: Fix mismerge again. ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space commit 7253a33434245ee8243897559188186df65f3611 Author: Chandra Seetharaman Date: Wed Oct 1 14:39:27 2008 +0100 dm mpath: add missing path switching locking Moving the path activation to workqueue along with scsi_dh patches introduced a race. It is due to the fact that the current_pgpath (in the multipath data structure) can be modified if changes happen in any of the paths leading to the lun. If the changes lead to current_pgpath being set to NULL, then it leads to the invalid access which results in the panic below. This patch fixes that by storing the pgpath to activate in the multipath data structure and properly protecting it. Note that if activate_path is called twice in succession with different pgpath, with the second one being called before the first one is done, then activate path will be called twice for the second pgpath, which is fine. Unable to handle kernel paging request for data at address 0x00000020 Faulting instruction address: 0xd000000000aa1844 cpu 0x1: Vector: 300 (Data Access) at [c00000006b987a80] pc: d000000000aa1844: .activate_path+0x30/0x218 [dm_multipath] lr: c000000000087a2c: .run_workqueue+0x114/0x204 sp: c00000006b987d00 msr: 8000000000009032 dar: 20 dsisr: 40000000 current = 0xc0000000676bb3f0 paca = 0xc0000000006f3680 pid = 2528, comm = kmpath_handlerd enter ? for help [c00000006b987da0] c000000000087a2c .run_workqueue+0x114/0x204 [c00000006b987e40] c000000000088b58 .worker_thread+0x120/0x144 [c00000006b987f00] c00000000008ca70 .kthread+0x78/0xc4 [c00000006b987f90] c000000000027cc8 .kernel_thread+0x4c/0x68 Signed-off-by: Chandra Seetharaman Signed-off-by: Alasdair G Kergon commit b01cd5ac43b00c49759c126c21e7d22c7e80b245 Author: Mikulas Patocka Date: Wed Oct 1 14:39:24 2008 +0100 dm: cope with access beyond end of device in dm_merge_bvec If for any reason dm_merge_bvec() is given an offset beyond the end of the device, avoid an oops and always allow one page to be added to an empty bio. We'll reject the I/O later after the bio is submitted. Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 5037108acd4dc40c210321cc83b0bf8352eda95a Author: Mikulas Patocka Date: Wed Oct 1 14:39:17 2008 +0100 dm: always allow one page in dm_merge_bvec Some callers assume they can always add at least one page to an empty bio, so dm_merge_bvec should not return 0 in this case: we'll reject the I/O later after the bio is submitted. Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 0523820482dcb42784572ffd2296c2f08c275a2b Author: Timo Teras Date: Wed Oct 1 05:17:54 2008 -0700 af_key: Free dumping state on socket close Fix a xfrm_{state,policy}_walk leak if pfkey socket is closed while dumping is on-going. Signed-off-by: Timo Teras Signed-off-by: David S. Miller commit 5dc121e9a7a8a3721cefeb07f3559f50fbedc67e Author: Arnaud Ebalard Date: Wed Oct 1 02:37:56 2008 -0700 XFRM,IPv6: initialize ip6_dst_blackhole_ops.kmem_cachep ip6_dst_blackhole_ops.kmem_cachep is not expected to be NULL (i.e. to be initialized) when dst_alloc() is called from ip6_dst_blackhole(). Otherwise, it results in the following (xfrm_larval_drop is now set to 1 by default): [ 78.697642] Unable to handle kernel paging request for data at address 0x0000004c [ 78.703449] Faulting instruction address: 0xc0097f54 [ 78.786896] Oops: Kernel access of bad area, sig: 11 [#1] [ 78.792791] PowerMac [ 78.798383] Modules linked in: btusb usbhid bluetooth b43 mac80211 cfg80211 ehci_hcd ohci_hcd sungem sungem_phy usbcore ssb [ 78.804263] NIP: c0097f54 LR: c0334a28 CTR: c002d430 [ 78.809997] REGS: eef19ad0 TRAP: 0300 Not tainted (2.6.27-rc5) [ 78.815743] MSR: 00001032 CR: 22242482 XER: 20000000 [ 78.821550] DAR: 0000004c, DSISR: 40000000 [ 78.827278] TASK = eef0df40[3035] 'mip6d' THREAD: eef18000 [ 78.827408] GPR00: 00001032 eef19b80 eef0df40 00000000 00008020 eef19c30 00000001 00000000 [ 78.833249] GPR08: eee5101c c05a5c10 ef9ad500 00000000 24242422 1005787c 00000000 1004f960 [ 78.839151] GPR16: 00000000 10024e90 10050040 48030018 0fe44150 00000000 00000000 eef19c30 [ 78.845046] GPR24: eef19e44 00000000 eef19bf8 efb37c14 eef19bf8 00008020 00009032 c0596064 [ 78.856671] NIP [c0097f54] kmem_cache_alloc+0x20/0x94 [ 78.862581] LR [c0334a28] dst_alloc+0x40/0xc4 [ 78.868451] Call Trace: [ 78.874252] [eef19b80] [c03c1810] ip6_dst_lookup_tail+0x1c8/0x1dc (unreliable) [ 78.880222] [eef19ba0] [c0334a28] dst_alloc+0x40/0xc4 [ 78.886164] [eef19bb0] [c03cd698] ip6_dst_blackhole+0x28/0x1cc [ 78.892090] [eef19be0] [c03d9be8] rawv6_sendmsg+0x75c/0xc88 [ 78.897999] [eef19cb0] [c038bca4] inet_sendmsg+0x4c/0x78 [ 78.903907] [eef19cd0] [c03207c8] sock_sendmsg+0xac/0xe4 [ 78.909734] [eef19db0] [c03209e4] sys_sendmsg+0x1e4/0x2a0 [ 78.915540] [eef19f00] [c03220a8] sys_socketcall+0xfc/0x210 [ 78.921406] [eef19f40] [c0014b3c] ret_from_syscall+0x0/0x38 [ 78.927295] --- Exception: c01 at 0xfe2d730 [ 78.927297] LR = 0xfe2d71c [ 78.939019] Instruction dump: [ 78.944835] 91640018 9144001c 900a0000 4bffff44 9421ffe0 7c0802a6 bf810010 7c9d2378 [ 78.950694] 90010024 7fc000a6 57c0045e 7c000124 <83e3004c> 8383005c 2f9f0000 419e0050 [ 78.956464] ---[ end trace 05fa1ed7972487a1 ]--- As commented by Benjamin Thery, the bug was introduced by f2fc6a54585a1be6669613a31fbaba2ecbadcd36, while adding network namespaces support to ipv6 routes. Signed-off-by: Arnaud Ebalard Acked-by: Benjamin Thery Signed-off-by: David S. Miller commit 2a5b82751f73a0bf6f604ce56d34adba6da1b246 Author: Denis V. Lunev Date: Wed Oct 1 02:13:16 2008 -0700 ipv6: NULL pointer dereferrence in tcp_v6_send_ack The following actions are possible: tcp_v6_rcv skb->dev = NULL; tcp_v6_do_rcv tcp_v6_hnd_req tcp_check_req req->rsk_ops->send_ack == tcp_v6_send_ack So, skb->dev can be NULL in tcp_v6_send_ack. We must obtain namespace from dst entry. Thanks to Vitaliy Gusev for initial problem finding in IPv4 code. Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller commit 4dd7972d1204c3851a4092cecd2207e05eb29b09 Author: Vitaliy Gusev Date: Wed Oct 1 01:51:39 2008 -0700 tcp: Fix NULL dereference in tcp_4_send_ack() Fix NULL dereference in tcp_4_send_ack(). As skb->dev is reset to NULL in tcp_v4_rcv() thus OOPS occurs: BUG: unable to handle kernel NULL pointer dereference at 00000000000004d0 IP: [] tcp_v4_send_ack+0x203/0x250 Stack: ffff810005dbb000 ffff810015c8acc0 e77b2c6e5f861600 a01610802e90cb6d 0a08010100000000 88afffff88afffff 0000000080762be8 0000000115c872e8 0004122000000000 0000000000000001 ffffffff80762b88 0000000000000020 Call Trace: [] tcp_v4_reqsk_send_ack+0x20/0x22 [] tcp_check_req+0x108/0x14c [] ? rt_intern_hash+0x322/0x33c [] tcp_v4_do_rcv+0x399/0x4ec [] ? skb_checksum+0x4f/0x272 [] ? __inet_lookup_listener+0x14a/0x15c [] tcp_v4_rcv+0x6a1/0x701 [] ip_local_deliver_finish+0x157/0x24a [] ip_local_deliver+0x72/0x7c [] ip_rcv_finish+0x38d/0x3b2 [] ? scsi_io_completion+0x19d/0x39e [] ip_rcv+0x2a2/0x2e5 [] netif_receive_skb+0x293/0x303 [] process_backlog+0x80/0xd0 [] ? __rcu_process_callbacks+0x125/0x1b4 [] net_rx_action+0xb9/0x17f [] __do_softirq+0xa3/0x164 [] call_softirq+0x1c/0x28 [] do_softirq+0x34/0x72 [] local_bh_enable_ip+0x3f/0x50 [] _spin_unlock_bh+0x12/0x14 [] release_sock+0xb8/0xc1 [] inet_stream_connect+0x146/0x25c [] ? autoremove_wake_function+0x0/0x38 [] sys_connect+0x68/0x8e [] ? fd_install+0x5f/0x68 [] ? sock_map_fd+0x55/0x62 [] system_call_after_swapgs+0x7b/0x80 Code: 41 10 11 d0 83 d0 00 4d 85 ed 89 45 c0 c7 45 c4 08 00 00 00 74 07 41 8b 45 04 89 45 c8 48 8b 43 20 8b 4d b8 48 8d 55 b0 48 89 de <48> 8b 80 d0 04 00 00 48 8b b8 60 01 00 00 e8 20 ae fe ff 65 48 RIP [] tcp_v4_send_ack+0x203/0x250 RSP CR2: 00000000000004d0 Signed-off-by: Vitaliy Gusev Signed-off-by: David S. Miller commit dc63b52673d71f9d49b9d72d263a9f32df18c3ee Author: Zachary Amsden Date: Tue Sep 30 11:02:12 2008 -0700 x86, vmi: fix broken LDT access This one took a long time to rear up because LDT usage is not very common, but the bug is quite serious. It got introduced along with another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be After investigating a JRE failure, I found this bug was introduced a long time ago, and had already managed to survive another bugfix which occurred on the same line. The result is a total failure of the JRE due to LDT selectors not working properly. Signed-off-by: Zachary Amsden Cc: Glauber de Oliveira Costa Cc: stable@kernel.org Signed-off-by: Ingo Molnar commit de59985e3a623d4d5d6207f1777398ca0606ab1c Author: Zachary Amsden Date: Tue Sep 30 11:02:12 2008 -0700 x86: Fix broken LDT access in VMI After investigating a JRE failure, I found this bug was introduced a long time ago, and had already managed to survive another bugfix which occurred on the same line. The result is a total failure of the JRE due to LDT selectors not working properly. This one took a long time to rear up because LDT usage is not very common, but the bug is quite serious. It got introduced along with another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be Signed-off-by: Zachary Amsden Cc: Ingo Molnar Cc: Glauber de Oliveira Costa Cc: Signed-off-by: Linus Torvalds commit d3a47e82b6bc3724dd60f3ee4e84fe4479104382 Merge: 99c3563... c459ce8... Author: Linus Torvalds Date: Tue Sep 30 09:47:16 2008 -0700 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6: [IA64] Put the space for cpu0 per-cpu area into .data section commit 99c3563e64cf887cca0b181149c0f85c39569276 Merge: 022d5bc... 24918b6... Author: Linus Torvalds Date: Tue Sep 30 09:38:42 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Fix model for Dell Inspiron 1525 ALSA: ASoC: Fix cs4270 error path commit 022d5bcd49e0b3c3a3fde60491837414f96cc20e Merge: 95237b8... 6cac6e8... Author: Linus Torvalds Date: Tue Sep 30 08:42:21 2008 -0700 Merge branch 'for-linus' of git://git.o-hand.com/linux-mfd * 'for-linus' of git://git.o-hand.com/linux-mfd: mfd: Fix asic3 compilation mfd: Fix Kconfig accroding to the new gpiolib symbols commit 95237b80a3021ce5abb4d9ad330355549026f9c3 Merge: cf4b0b2... 61e9916... Author: Linus Torvalds Date: Tue Sep 30 08:40:46 2008 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc: Fix failure to shutdown with CPU hotplug powerpc: Fix PCI in Holly device tree commit cf4b0b2c9520728e170f7a3061e24dbae0b56ed4 Merge: 94aca1d... ccc7dad... Author: Linus Torvalds Date: Tue Sep 30 08:39:18 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: hrtimer: prevent migration of per CPU hrtimers hrtimer: mark migration state hrtimer: fix migration of CB_IRQSAFE_NO_SOFTIRQ hrtimers hrtimer: migrate pending list on cpu offline Acked-by: Paul E. McKenney Acked-by: Benjamin Herrenschmidt Tested-by: Paul E. McKenney commit ba0166708ef4da7eeb61dd92bbba4d5a749d6561 Author: Wei Yongjun Date: Tue Sep 30 05:32:24 2008 -0700 sctp: Fix kernel panic while process protocol violation parameter Since call to function sctp_sf_abort_violation() need paramter 'arg' with 'struct sctp_chunk' type, it will read the chunk type and chunk length from the chunk_hdr member of chunk. But call to sctp_sf_violation_paramlen() always with 'struct sctp_paramhdr' type's parameter, it will be passed to sctp_sf_abort_violation(). This may cause kernel panic. sctp_sf_violation_paramlen() |-- sctp_sf_abort_violation() |-- sctp_make_abort_violation() This patch fixed this problem. This patch also fix two place which called sctp_sf_violation_paramlen() with wrong paramter type. Signed-off-by: Wei Yongjun Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit 24918b61b55c21e09a3e07cd82e1b3a8154782dc Author: Takashi Iwai Date: Tue Sep 30 12:58:54 2008 +0200 ALSA: hda - Fix model for Dell Inspiron 1525 Dell Inspiron 1525 seems to have a buggy BIOS setup and screws up the recent codec parser, as reported by Oleksandr Natalenko: http://lkml.org/lkml/2008/9/12/203 This patch adds the working model, dell-3stack, statically. Signed-off-by: Takashi Iwai Cc: commit e3145dfb7b4262fa55907006b75da799de8c1be3 Author: Jean Delvare Date: Tue Sep 30 11:40:37 2008 +0200 ALSA: ASoC: Fix cs4270 error path The error path in cs4270_probe/cs4270_remove is pretty broken: * If cs4270_probe fails, codec is leaked. * If snd_soc_register_card fails, cs4270_i2c_driver stays registered. * If I2C support is enabled but no I2C device is found, i2c_del_driver is never called (neither in cs4270_probe nor in cs4270_remove. Fix all 3 problems by implementing a clean error path in cs4270_probe and jumping to its labels as needed. Signed-off-by: Jean Delvare Acked-by: Timur Tabi Signed-off-by: Takashi Iwai commit 8b122efd13a227d35d5ca242561770db1b5e3658 Author: Heiko Carstens Date: Tue Sep 30 03:03:35 2008 -0700 iucv: Fix mismerge again. fb65a7c091529bfffb1262515252c0d0f6241c5c ("iucv: Fix bad merging.") fixed a merge error, but in a wrong way. We now end up with the bug below. This patch corrects the mismerge like it was intended. BUG: scheduling while atomic: swapper/1/0x00000000 Modules linked in: CPU: 1 Not tainted 2.6.27-rc7-00094-gc0f4d6d #9 Process swapper (pid: 1, task: 000000003fe7d988, ksp: 000000003fe838c0) 0000000000000000 000000003fe839b8 0000000000000002 0000000000000000 000000003fe83a58 000000003fe839d0 000000003fe839d0 0000000000390de6 000000000058acd8 00000000000000d0 000000003fe7dcd8 0000000000000000 000000000000000c 000000000000000d 0000000000000000 000000003fe83a28 000000000039c5b8 0000000000015e5e 000000003fe839b8 000000003fe83a00 Call Trace: ([<0000000000015d6a>] show_trace+0xe6/0x134) [<0000000000039656>] __schedule_bug+0xa2/0xa8 [<0000000000391744>] schedule+0x49c/0x910 [<0000000000391f64>] schedule_timeout+0xc4/0x114 [<00000000003910d4>] wait_for_common+0xe8/0x1b4 [<00000000000549ae>] call_usermodehelper_exec+0xa6/0xec [<00000000001af7b8>] kobject_uevent_env+0x418/0x438 [<00000000001d08fc>] bus_add_driver+0x1e4/0x298 [<00000000001d1ee4>] driver_register+0x90/0x18c [<0000000000566848>] netiucv_init+0x168/0x2c8 [<00000000000120be>] do_one_initcall+0x3e/0x17c [<000000000054a31a>] kernel_init+0x1ce/0x248 [<000000000001a97a>] kernel_thread_starter+0x6/0xc [<000000000001a974>] kernel_thread_starter+0x0/0xc iucv: NETIUCV driver initialized initcall netiucv_init+0x0/0x2c8 returned with preemption imbalance Signed-off-by: Heiko Carstens Signed-off-by: David S. Miller commit d01dbeb6af7a0848063033f73c3d146fec7451f3 Author: Herbert Xu Date: Tue Sep 30 02:03:19 2008 -0700 ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space We're never supposed to shrink the headroom or tailroom. In fact, shrinking the headroom is a fatal action. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 3dcd7e269d2223126f6ee9bc893f5a6166e1770d Author: J.A. Magallón Date: Tue Sep 30 10:02:52 2008 +0200 x86: fix typo in enable_mtrr_cleanup early parameter Correct typo for 'enable_mtrr_cleanup' early boot param name. Signed-off-by: J.A. Magallon Signed-off-by: Ingo Molnar commit 6cac6e8489af6c419cb6af6911535a280e6b6c2e Author: Samuel Ortiz Date: Thu Sep 25 00:43:59 2008 +0200 mfd: Fix asic3 compilation map_size was declared from the wrong place. Signed-off-by: Samuel Ortiz commit 2eedd6047b050f82f4e596a50704686ec989c1c8 Author: Samuel Ortiz Date: Thu Sep 25 00:39:05 2008 +0200 mfd: Fix Kconfig accroding to the new gpiolib symbols HAVE_GPIO_LIB has basically been replaced by GPIOLIB Signed-off-by: Samuel Ortiz commit 61e9916eba35dfb76d38013a5aae9a59cc50877a Author: Johannes Berg Date: Wed Sep 24 22:56:25 2008 +0000 powerpc: Fix failure to shutdown with CPU hotplug I tracked down the shutdown regression to CPUs not dying when being shut down during power-off. This turns out to be due to the system_state being SYSTEM_POWER_OFF, which this code doesn't take as a valid state for shutting off CPUs in. This has never made sense to me, but when I added hotplug code to implement hibernate I only "made it work" and did not question the need to check the system_state. Thomas Gleixner helped me dig, but the only thing we found is that it was added with the original commit that added CPU hotplug support. Signed-off-by: Johannes Berg Acked-by: Joel Schopp Signed-off-by: Benjamin Herrenschmidt commit ad611045ce5d059af84a9855b22ca3f7a99d47be Author: David Gibson Date: Wed Sep 24 16:39:04 2008 +0000 powerpc: Fix PCI in Holly device tree The PCI bridge on the Holly board is incorrectly represented in the device tree. The current device tree node for the PCI bridge sits under the tsi-bridge node. That's not obviously wrong, but the PCI bridge translates some PCI spaces into CPU address ranges which were not translated by the "ranges" property in tsi-bridge node. We used to get away with this problem because the PCI bridge discovery code was also buggy, assuming incorrectly that PCI host bridge nodes were always directly under the root bus and treating the translated addresses as raw CPU addresses, rather than parent bus addresses. This has since been fixed, thus breaking Holly. This could be fixed by adding extra translations to the tsi-bridge node, but this patch instead moves the Holly PCI bridge out of the tsi-bridge node to the root bus. This makes the tsi-bridge node represent only the built-in IO devices in the bridge, with a more-or-less contiguous address range. This is the same convention used on Freescale SoC chips, where the "soc" node represents only the IMMR region, and the PCI and other bus bridges are separate nodes under the root bus. Signed-off-by: David Gibson Acked-by: Josh Boyer Signed-off-by: Benjamin Herrenschmidt commit c459ce8b5a7d933a3bcf6915ab17ac1e036e2ac4 Author: Tony Luck Date: Mon Sep 29 16:39:19 2008 -0700 [IA64] Put the space for cpu0 per-cpu area into .data section Initial fix for making sure that we can access percpu variables in all C code (commit: 10617bbe84628eb18ab5f723d3ba35005adde143) inadvertantly allocated the memory in the "percpu" section of the vmlinux ELF executable. This confused kexec/dump. Signed-off-by: Tony Luck commit 94aca1dac6f6d21f4b07e4864baf7768cabcc6e7 Author: Linus Torvalds Date: Mon Sep 29 15:24:02 2008 -0700 Linux 2.6.27-rc8 commit 31a78f23bac0069004e69f98808b6988baccb6b6 Author: Balbir Singh Date: Sun Sep 28 23:09:31 2008 +0100 mm owner: fix race between swapoff and exit There's a race between mm->owner assignment and swapoff, more easily seen when task slab poisoning is turned on. The condition occurs when try_to_unuse() runs in parallel with an exiting task. A similar race can occur with callers of get_task_mm(), such as /proc// or ptrace or page migration. CPU0 CPU1 try_to_unuse looks at mm = task0->mm increments mm->mm_users task 0 exits mm->owner needs to be updated, but no new owner is found (mm_users > 1, but no other task has task->mm = task0->mm) mm_update_next_owner() leaves mmput(mm) decrements mm->mm_users task0 freed dereferencing mm->owner fails The fix is to notify the subsystem via mm_owner_changed callback(), if no new owner is found, by specifying the new task as NULL. Jiri Slaby: mm->owner was set to NULL prior to calling cgroup_mm_owner_callbacks(), but must be set after that, so as not to pass NULL as old owner causing oops. Daisuke Nishimura: mm_update_next_owner() may set mm->owner to NULL, but mem_cgroup_from_task() and its callers need to take account of this situation to avoid oops. Hugh Dickins: Lockdep warning and hang below exec_mmap() when testing these patches. exit_mm() up_reads mmap_sem before calling mm_update_next_owner(), so exec_mmap() now needs to do the same. And with that repositioning, there's now no point in mm_need_new_owner() allowing for NULL mm. Reported-by: Hugh Dickins Signed-off-by: Balbir Singh Signed-off-by: Jiri Slaby Signed-off-by: Daisuke Nishimura Signed-off-by: Hugh Dickins Cc: KAMEZAWA Hiroyuki Cc: Paul Menage Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bf5cb66447e7d9f7f111c1d0ebb6d7c90ec24b4d Merge: 4efb686... 77a9a76... Author: Linus Torvalds Date: Mon Sep 29 08:39:59 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: disable apm on the olpc commit 4efb686205d5065f4e488e20fc858446b8ad7bb7 Merge: 0f873d5... d0eb406... Author: Linus Torvalds Date: Mon Sep 29 08:37:29 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: cdrom: update ioctl documentation ide: note that IDE generic may prevent other drivers from attaching ide-tape: fix vendor strings Swarm: Fix crash due to missing initialization commit 0f873d5fb68a6aea9519c9cd613ddf4e7e2378d4 Merge: df45edd... ac82da3... Author: Linus Torvalds Date: Mon Sep 29 08:31:52 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [SSB] Initialise dma_mask for SSB_BUSTYPE_SSB devices [MIPS] BCM47xx: Fix build error due to missing PCI functions [MIPS] IP27: Switch to dynamic interrupt routing avoding panic on error. [MIPS] au1000: Make sure GPIO value is zero or one commit df45eddc60e1ab4c81b61e240271eabb4fb176e8 Merge: 929675d... 81e4807... Author: Linus Torvalds Date: Mon Sep 29 08:30:47 2008 -0700 Merge branch 'linux-m32r' of git://www.linux-m32r.org/git/takata/linux-2.6_dev * 'linux-m32r' of git://www.linux-m32r.org/git/takata/linux-2.6_dev: m32r/kernel/: cleanups m32r: export __ndelay m32r: export empty_zero_page m32r: don't offer CONFIG_ISA m32r: remove the unused NOHIGHMEM option commit 929675d58c5b4883050804f2b48de2293803862d Merge: 6612000... 0dca0fd... Author: Linus Torvalds Date: Mon Sep 29 08:30:11 2008 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb: kgdboc,tty: Fix tty polling search to use name correctly kgdb, x86_64: fix PS CS SS registers in gdb serial kgdb, x86_64: gdb serial has BX and DX reversed kgdb, x86, arm, mips, powerpc: ignore user space single stepping kgdb: could not write to the last of valid memory with kgdb commit ccc7dadf736639da86f3e0c86832c11a66fc8221 Author: Thomas Gleixner Date: Mon Sep 29 15:47:42 2008 +0200 hrtimer: prevent migration of per CPU hrtimers Impact: per CPU hrtimers can be migrated from a dead CPU The hrtimer code has no knowledge about per CPU timers, but we need to prevent the migration of such timers and warn when such a timer is active at migration time. Explicitely mark the timers as per CPU and use a more understandable mode descriptor for the interrupts safe unlocked callback mode, which is used by hrtimer_sleeper and the scheduler code. Signed-off-by: Thomas Gleixner commit b00c1a99e7758f794923c61e5cd55268d61c9469 Author: Thomas Gleixner Date: Mon Sep 29 15:44:46 2008 +0200 hrtimer: mark migration state Impact: during migration active hrtimers can be seen as inactive The migration code removes the hrtimers from the queues of the dead CPU and sets the state temporary to INACTIVE. The enqueue code sets it to ACTIVE/PENDING again. Prevent that the wrong state can be seen by using a separate migration state bit. Signed-off-by: Thomas Gleixner commit 41e1022eae71707f1ce6801a746f70b1e57b7567 Author: Thomas Gleixner Date: Mon Sep 29 14:09:39 2008 +0200 hrtimer: fix migration of CB_IRQSAFE_NO_SOFTIRQ hrtimers Impact: Stale timers after a CPU went offline. commit 37bb6cb4097e29ffee970065b74499cbf10603a3 hrtimer: unlock hrtimer_wakeup changed the hrtimer sleeper callback mode to CB_IRQSAFE_NO_SOFTIRQ due to locking problems. A result of this change is that when enqueue is called for an already expired hrtimer the callback function is not longer called directly from the enqueue code. The normal callers have been fixed in the code, but the migration code which moves hrtimers from a dead CPU to a live CPU was not made aware of this. This can be fixed by checking the timer state after the call to enqueue in the migration code. Signed-off-by: Thomas Gleixner commit 7659e349672bb0d378ef8d7d62bae4c53d2bdd18 Author: Thomas Gleixner Date: Mon Sep 29 14:06:45 2008 +0200 hrtimer: migrate pending list on cpu offline Impact: hrtimers which are on the pending list are not migrated at cpu offline and can be stale forever Add the pending list migration when CONFIG_HIGH_RES_TIMERS is enabled Signed-off-by: Thomas Gleixner commit 66120005e65eed8a05b14a36ab448bdec42f0d6b Merge: 0d0f3ef... 9778e9a... Author: Linus Torvalds Date: Mon Sep 29 08:08:16 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: ASoC: Fix another cs4270 error path ALSA: make the CS4270 driver a new-style I2C driver commit 0d0f3ef248e359b7363830fbd6df23897bbd1ceb Merge: 17c0d2a... c9eeb24... Author: Linus Torvalds Date: Mon Sep 29 08:07:46 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] qlogicpti: fix sg list traversal error in continuation entries [SCSI] Fix hang with split requests [SCSI] qla2xxx: Defer enablement of RISC interrupts until ISP initialization completes. commit 17c0d2a1d5a562982f1f2177b8270fbfaa42508c Merge: 3c1370a... 7e6cfb5... Author: Linus Torvalds Date: Mon Sep 29 08:07:04 2008 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: scsi: fix fall out of sg-chaining patch in qlogicpti commit 3c1370a3f6ba8e4813269ddbf950d59f997338bc Merge: 661b068... 4c1eb90... Author: Linus Torvalds Date: Mon Sep 29 08:05:55 2008 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: sata_nv: reinstate nv_hardreset() for non generic controllers commit 661b0680f736e628a6da1cc030c201646587d658 Author: zippel@linux-m68k.org Date: Mon Sep 29 05:27:11 2008 +0200 kconfig: readd lost change count Commit f072181e6403b0fe2e2aa800a005497b748fd284 ("kconfig: drop the ""trying to assign nonexistent symbol" warning") simply dropped the warnings, but it does a little more than that, it also marks the current .config as needed saving, so add this back. Signed-off-by: Roman Zippel Signed-off-by: Linus Torvalds commit 204c96f609045a8ce84d1dca3e758ee9b0b2a95c Author: zippel@linux-m68k.org Date: Mon Sep 29 05:27:10 2008 +0200 kconfig: fix silentoldconfig Recent changes to oldconfig have mixed up the silentoldconfig handling, so this fixes that by clearly separating that special mode, e.g. KCONFIG_NOSILENTUPDATE is only relevant here, the .config is written as needed. This will also properly close Bug 11230. Signed-off-by: Roman Zippel Signed-off-by: Linus Torvalds commit d0185c0882d76b8126d4a099c7ac82b3b216d103 Author: Linus Torvalds Date: Mon Sep 29 07:42:57 2008 -0700 Fix NULL pointer dereference in proc_sys_compare The VFS interface for the 'd_compare()' is a bit special (read: 'odd'), because it really just essentially replaces a memcmp(). The filesystem is supposed to just compare the two names with whatever case-independent or other function. And when I say 'is supposed to', I obviously mean that 'procfs does odd things, and actually looks at the dentry that we don't even pass down, rather than just the name'. Which results in problems, because we actually call d_compare before we have even verified that the dentry is still hashed at all. And that causes a problm since the inode that procfs looks at may have been free'd and the d_inode pointer is NULL. procfs just assumes that all dentries are positive, since procfs itself never generates a negative one. But memory pressure will still result in the dentry getting torn down, and as it is removed by RCU, it still remains visible on some lists - and to d_compare. If the filesystem just did a name comparison, we wouldn't care. And we could just fix procfs to know about negative dentries too. But rather than have the low-level filesystems know about internal VFS details, just move the check for a unhashed dentry up a bit, so that we will only call d_compare on dentries that are still active. The actual oops this caused didn't look like a NULL pointer dereference because procfs did a 'container_of(inode, struct proc_inode, vfs_inode)' to get at its internal proc_inode information from the inode pointer, and accessed a field below the inode. So the oops would look something like BUG: unable to handle kernel paging request at fffffffffffffff0 IP: [] proc_sys_compare+0x36/0x50 and was seen on both x86-64 (Alexey Dobriyan and Hugh Dickins) and ppc64 (Hugh Dickins). Reported-by: Alexey Dobriyan Acked-by: Hugh Dickins Cc: Al Viro Reviewed-by: "Eric W. Biederman" Signed-of-by: Linus Torvalds commit 40f17a7981f1d8baf0ad13233e5e7632754d931a Author: Hans de Goede Date: Thu Sep 4 03:57:01 2008 -0300 V4L/DVB (8909): gspca: PAC 7302 webcam 093a:262a added. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 92762abc3dfb10c9cb41a12271b8c7513a4fce20 Author: Hans Verkuil Date: Tue Sep 2 19:02:32 2008 -0300 V4L/DVB (8905): ov511: fix exposure sysfs attribute bug Exposure was always 0. Thanks to sparse for finding this. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 135aedc38e812b922aa56096f36a3d72ffbcf2fb Author: Hans Verkuil Date: Tue Sep 2 19:00:21 2008 -0300 V4L/DVB (8904): cx88: add missing unlock_kernel sparse found an unbalanced BKL usage. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit b675c0526e3d07742cbd62a22256a731ea6d5176 Author: Mike Isely Date: Sat Aug 30 15:08:28 2008 -0300 V4L/DVB (8892): pvrusb2: Handle USB ID 2040:2950 same as 2040:2900 The device 2040:2950 is a really old variant of the PVR USB2 hardware. I have just learned of its existence. For the purposes of the pvrusb2 driver, it is functionally identical to the well known 29xxx series (2040:2900). Amazing that this went undetected for 3+ years. Signed-off-by: Mike Isely Signed-off-by: Mauro Carvalho Chehab commit adf8c021d527b9c0247070513a8fa8cfd50668ed Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:23:06 2008 -0300 V4L/DVB (8887): gspca: fix memory leak Free allocated memory Cc: Jean-Francois Moine Cc: Hans de Goede Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit dc2b80c191a67de8191f6323d532132fb257e402 Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:21:58 2008 -0300 V4L/DVB (8886): ov511: fix memory leak Free allocated memory Cc: Luca Risolia Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit beeb82becc5cdd88766b4ec21f13952e2af03324 Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:21:03 2008 -0300 V4L/DVB (8885): cpia2_usb: fix memory leak Free allocated memory Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit ff9b3e430b04e00dd2d29a26ae9438d7044a51db Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:20:20 2008 -0300 V4L/DVB (8884): em28xx-audio: fix memory leak Free allocated memory Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit ff41efcff635717ebe032437c4d6ee22badc9960 Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:19:27 2008 -0300 V4L/DVB (8883): w9968cf: Fix order of usb_alloc_urb validation Fixed order of usb_alloc_urb pointer validation. Cc: Luca Risolia Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 9778e9a0eafe796c2affcd1fa1fa8a3765e026e6 Author: Jean Delvare Date: Sat Sep 27 20:30:52 2008 +0200 ALSA: ASoC: Fix another cs4270 error path Conversion to new-style i2c driver missed the error path of the probe function. Fix it. Signed-off-by: Jean Delvare Cc: Timur Tabi Signed-off-by: Takashi Iwai commit ec2cd95f340fb07b905839ee219b3846ecf58396 Author: Timur Tabi Date: Tue Jul 29 16:35:52 2008 -0500 ALSA: make the CS4270 driver a new-style I2C driver Update the CS4270 ALSA device driver to use the new-style I2C interface. Starting with the 2.6.27 PowerPC kernel, I2C devices that have entries in the device trees can no longer be probed by old-style I2C drivers. The device tree for Freescale MPC8610 HPCD has included an entry for the CS4270 since 2.6.25, but that entry was previously ignored by the PowerPC I2C subsystem. Since that's no longer the case, the best solution is to update the CS4270 driver to a new-style interface, rather than try to revert the behavior of new PowerPC I2C subsystem. Signed-off-by: Timur Tabi Signed-off-by: Takashi Iwai commit 7e6cfb54b1ff4b64d74aa8cd191204c9598c073d Author: Boaz Harrosh Date: Mon Sep 29 09:38:55 2008 +0200 scsi: fix fall out of sg-chaining patch in qlogicpti Boaz writes: "I've reviewed all patches since Matthew's, and I find one small problem. In the load_cmd() there is a compound loop where the first 4 sg's are set then the rest are set into a memory structure in group of 7 sg's. Well the second 7-group and on is a bug because sg pointer does not advance. This is a fall out from Jens's patch." The reporter, Meelis Roos , verified that this patch does indeed fix his problem with qlogicpti. Signed-off-by: Jens Axboe commit 4c1eb90a0908c0c60db2169dce08fb672e7582f1 Author: Tejun Heo Date: Sun Sep 28 07:39:01 2008 +0900 sata_nv: reinstate nv_hardreset() for non generic controllers Commit 2fd673ecf0378ddeeeb87b3605e50212e0c0ddc6 which tried to remove hardreset for generic accidentally removed it for all flavors as all others were inheriting from nv_generic_ops. This patch reinstates nv_hardreset() and puts it into nv_common_ops which all flavors inherit from. nv_generic_ops now inherits from nv_common_ops and overrides .hardreset to ATA_OP_NULL. While at it, explain why nv_hardreset and ATA_OP_NULL override are necessary. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit c9eeb248f3b44939532a9716bc06413383aa5d63 Author: Boaz Harrosh Date: Wed Sep 24 12:00:22 2008 +0300 [SCSI] qlogicpti: fix sg list traversal error in continuation entries The current sg list traversal logic for the continuation entries doesn't advance the list pointer once all seven slots are used, so the next continuation entry (if there is one) wrongly begins again at the start of the sg list. Fix by advancing the sg pointer after the for_each_sg(). Reported-by: Meelis Roos Cc: David Miller Signed-off-by: James Bottomley commit d0eb40628e29c2bb3b5f8242b1d2f50b1a88d9da Author: Márton Németh Date: Sat Sep 27 19:32:17 2008 +0200 cdrom: update ioctl documentation Correct copy-paste problem: CDROMCLOSETRAY is about closing the tray, not opening it. Signed-off-by: Márton Németh Signed-off-by: Andrew Morton Cc: Jens Axboe Signed-off-by: Bartlomiej Zolnierkiewicz commit 278ecfb8f4100c0edc2bc77695b591ea16388829 Author: Tejun Heo Date: Sat Sep 27 19:32:17 2008 +0200 ide: note that IDE generic may prevent other drivers from attaching Enabling IDE generic may prevent ATA controllers located on legacy ports from being attached to more proper driver or can prevent other controllers which share the IRQ from working. Note it in the help message. Signed-off-by: Tejun Heo Cc: xerces8 Cc: Jeff Garzik Cc: stein@hermes.si [bart: s/will grab/may grab/ since Borislav has fixed PCI-case for .28] Signed-off-by: Bartlomiej Zolnierkiewicz commit 801bd32e205ca6ef78dcaf80121f1eccb89b8c1e Author: Borislav Petkov Date: Sat Sep 27 19:32:17 2008 +0200 ide-tape: fix vendor strings Remove superfluous two bytes from each string buffer and add proper length format specifiers. Signed-off-by: Borislav Petkov Tested-by: Mark de Wever Acked-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit 3d977760b9478538821a75dd5eb74d0f2a2b01e3 Author: Ralf Baechle Date: Sat Sep 27 19:32:16 2008 +0200 Swarm: Fix crash due to missing initialization If things are just right this will result in the hws[0]->parent being passed to ide_host_add() being non-zero and an ooops a little later. Signed-off-by: Ralf Baechle Signed-off-by: Bartlomiej Zolnierkiewicz commit ac82da3381fc663dbda31612a0bff60bc41676a3 Author: Aurelien Jarno Date: Fri Sep 26 22:27:11 2008 +0200 [SSB] Initialise dma_mask for SSB_BUSTYPE_SSB devices For SSB_BUSTYPE_SSB type devices, we need to initialize dma_mask using coherent_dma_mask so that calls to dma_set_mask() succeed. It fixes the regression on the b44 driver introduced by commit f225763a7d6c92c4932dbd528437997078496fcc Signed-off-by: Aurelien Jarno Signed-off-by: Ralf Baechle commit 2dc42b47a7886bdc87514990c68ecdf8de61e653 Author: Aurelien Jarno Date: Sat Sep 27 16:06:16 2008 +0200 [MIPS] BCM47xx: Fix build error due to missing PCI functions This patch defines pcibios_map_irq() and pcibios_plat_dev_init() for the BCM47xx platform. It fixes the regression introduced by commit aab547ce0d1493d400b6468c521a0137cd8c1edf. Signed-off-by: Aurelien Jarno Signed-off-by: Ralf Baechle commit f4d15f1c877644a604f8c8c3d094c13f9f8bdcf2 Author: Ralf Baechle Date: Sat Sep 27 15:05:06 2008 +0100 [MIPS] IP27: Switch to dynamic interrupt routing avoding panic on error. pcibios_map_irq is no way of returning an error but on IP27 an interrupt is possibly not routable when running out of resources. So do the interrupt routing at pcibios_enable_device time. Signed-off-by: Ralf Baechle commit 19506fc51852e859bb08ab5abbdb8fd02b7392f2 Author: Bruno Randolf Date: Thu Sep 25 16:45:10 2008 +0200 [MIPS] au1000: Make sure GPIO value is zero or one David Brownell wrote: > The problem is that "value" is zero-or-nonzero. > This code wrongly assumes it's zero-or-one. > Possible fix: "((!!value) << gpio)". Signed-off-by: Bruno Randolf Signed-off-by: Ralf Baechle commit 81e4807303c416a0defdce8b23a6204416d33280 Author: Adrian Bunk Date: Wed Sep 24 15:01:47 2008 +0900 m32r/kernel/: cleanups This patch contains the following cleanups: - make the following needlessly global code static: - entry.S: resume_userspace - process.c: pm_idle - process.c: default_idle() - smp.c: send_IPI_allbutself() - time.c: timer_interrupt() - time.c: struct irq0 - traps.c: set_eit_vector_entries() - traps.c: kstack_depth_to_print - traps.c: show_trace() - traps.c: die_lock - remove the following unused code: - head.S: startup_32 - process.c: hlt_counter - process.c: disable_hlt() - process.c: enable_hlt() - process.c: dump_task_regs() - remove the following variables and their usages since they were always 0: - irq.c: irq_err_count - irq.c: irq_mis_count Signed-off-by: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Hirokazu Takata commit 4b65fd41807dec1484003a7618c492477511509e Author: Adrian Bunk Date: Wed Sep 24 15:01:15 2008 +0900 m32r: export __ndelay ERROR: "__ndelay" [drivers/spi/spi_bitbang.ko] undefined! Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Hirokazu Takata commit affa6b120fa895e2bed0e131282fe89c05da1008 Author: Adrian Bunk Date: Wed Sep 24 14:59:57 2008 +0900 m32r: export empty_zero_page ERROR: "empty_zero_page" [fs/ext4/ext4dev.ko] undefined! Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Hirokazu Takata commit 1b20b093e7f81ff8cb322773684b260d1487b610 Author: Adrian Bunk Date: Wed Sep 24 14:58:54 2008 +0900 m32r: don't offer CONFIG_ISA As far as I know no M32R hardware actually has ISA slots. And ISA drivers don't compile on M32R. Signed-off-by: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Hirokazu Takata commit 1575da9ee4804ca889f32f8567dd7965e6fe4abc Author: Adrian Bunk Date: Wed Sep 24 14:57:11 2008 +0900 m32r: remove the unused NOHIGHMEM option Remove the unused NOHIGHMEM option. Reviewed-by: Robert P. J. Day Signed-off-by: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Hirokazu Takata commit 94715da3633d8abd63376b47c7120df59a69055e Merge: ec4d902... 24e8fc4... Author: Linus Torvalds Date: Fri Sep 26 09:16:32 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: remove unneeded power_mutex lock in snd_pcm_drop ALSA: fix locking in snd_pcm_open*() and snd_rawmidi_open*() commit ec4d90287eae900e4041890f7b53fe055fb71c3b Merge: bc173c5... 71a8c87... Author: Linus Torvalds Date: Fri Sep 26 08:49:34 2008 -0700 Merge git://oss.sgi.com:8090/xfs/linux-2.6 * git://oss.sgi.com:8090/xfs/linux-2.6: [XFS] Remove xfs_iext_irec_compact_full() [XFS] Fix extent list corruption in xfs_iext_irec_compact_full(). commit bc173c5789e1fc6065fd378edc815914b40ee86b Author: David Howells Date: Fri Sep 26 16:22:58 2008 +0100 ARM: Delete ARM's own cnt32_to_63.h Delete ARM's own cnt32_to_63.h as the copy in include/linux/ should now be used instead. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 0dca0fd2bfeb99738708d6c9117994ebf398e72c Author: Jason Wessel Date: Fri Sep 26 10:36:42 2008 -0500 kgdboc,tty: Fix tty polling search to use name correctly The tty_find_polling_driver() routine did not correctly check the base part of the tty name. This can lead to kgdboc selecting an incorrect driver, as well as accepting a completely invalid tty such as "echo ffff0 > /sys/module/kgdboc/parameters/kgdboc". Signed-off-by: Jason Wessel commit 703a1edcd1534468fc18f733c03bd91a65c8c6f0 Author: Jason Wessel Date: Fri Sep 26 10:36:42 2008 -0500 kgdb, x86_64: fix PS CS SS registers in gdb serial On x86_64 the gdb serial register structure defines the PS (also known as eflags), CS and SS registers as 4 bytes entities. This patch splits the x86_64 regnames enum into a 32 and 64 version to account for the 32 bit entities in the gdb serial packets. Also the program counter is properly filled in for the sleeping threads. Signed-off-by: Jason Wessel commit 95dbf1dbe39ed336a3e72116c95cfa98dd3457e6 Author: Jason Wessel Date: Fri Sep 26 10:36:42 2008 -0500 kgdb, x86_64: gdb serial has BX and DX reversed The BX and DX registers in the gdb serial register packet need to be flipped for gdb to receive the correct data. Signed-off-by: Jason Wessel commit d7161a65341556bacb5e6654e133803f46f51063 Author: Jason Wessel Date: Fri Sep 26 10:36:41 2008 -0500 kgdb, x86, arm, mips, powerpc: ignore user space single stepping On the x86 arch, user space single step exceptions should be ignored if they occur in the kernel space, such as ptrace stepping through a system call. First check if it is kgdb that is executing a single step, then ensure it is not an accidental traversal into the user space, while in kgdb, any other time the TIF_SINGLESTEP is set, kgdb should ignore the exception. On x86, arm, mips and powerpc, the kgdb_contthread usage was inconsistent with the way single stepping is implemented in the kgdb core. The arch specific stub should always set the kgdb_cpu_doing_single_step correctly if it is single stepping. This allows kgdb to correctly process an instruction steps if ptrace happens to be requesting an instruction step over a system call. Signed-off-by: Jason Wessel commit 18d6522b86d21a04c8ac1ea79747e2e434a956d9 Author: Atsuo Igarashi Date: Fri Sep 26 10:36:41 2008 -0500 kgdb: could not write to the last of valid memory with kgdb On the ARM architecture, kgdb will crash the kernel if the last byte of valid memory is written due to a flush_icache_range flushing beyond the memory boundary. Signed-off-by: Atsuo Igarashi Signed-off-by: Jason Wessel commit bde40fe071e327857b478a440c599f54d4fc14dd Merge: 6ef190c... 7424bac... Author: Linus Torvalds Date: Fri Sep 26 08:20:26 2008 -0700 Merge branch 'linux-next' of git://git.infradead.org/~dedekind/ubifs-2.6 * 'linux-next' of git://git.infradead.org/~dedekind/ubifs-2.6: UBIFS: fix printk format warnings UBIFS: remove incorrect assert UBIFS: TNC / GC race fixes UBIFS: create the name of the background thread in every case commit 71a8c87fb300b601eacf7a86cc6c6322fe827bfd Author: Lachlan McIlroy Date: Fri Sep 26 12:17:57 2008 +1000 [XFS] Remove xfs_iext_irec_compact_full() Yet another bug was found in xfs_iext_irec_compact_full() and while the source of the bug was found it wasn't an easy task to track it down because the conditions are very difficult to reproduce. A HUGE thank-you goes to Russell Cattelan and Eric Sandeen for their significant effort in tracking down the source of this corruption. xfs_iext_irec_compact_full() and xfs_iext_irec_compact_pages() are almost identical - they both compact indirect extent lists by moving extents from subsequent buffers into earlier ones. xfs_iext_irec_compact_pages() only moves extents if all of the extents in the next buffer will fit into the empty space in the buffer before it. xfs_iext_irec_compact_full() will go a step further and move part of the next buffer if all the extents wont fit. It will then shift the remaining extents in the next buffer up to the start of the buffer. The bug here was that we did not update er_extoff and this caused extent list corruption. It does not appear that this extra functionality gains us much. Calling xfs_iext_irec_compact_pages() instead will do a good enough job at compacting the indirect list and will be quicker too. For the case in xfs_iext_indirect_to_direct() the total number of extents in the indirect list will fit into one buffer so we will never need the extra functionality of xfs_iext_irec_compact_full() there. Also xfs_iext_irec_compact_pages() doesn't need to do a memmove() (the buffers will never overlap) so we don't want the performance hit that can incur. SGI-PV: 987159 SGI-Modid: xfs-linux-melb:xfs-kern:32166a Signed-off-by: Lachlan McIlroy Signed-off-by: Eric Sandeen commit f1ccd2955157e1aff992f6aaaba0944209076220 Author: Lachlan McIlroy Date: Fri Sep 26 12:16:46 2008 +1000 [XFS] Fix extent list corruption in xfs_iext_irec_compact_full(). If we don't move all the records from the next buffer into the current buffer then we need to update the er_extoff field of the next buffer as we shift the remaining records to the start of the buffer. SGI-PV: 987159 SGI-Modid: xfs-linux-melb:xfs-kern:32165a Signed-off-by: Lachlan McIlroy Signed-off-by: Eric Sandeen Signed-off-by: Russell Cattelan commit 6ef190cc92e33565accff6a320f0e7d90480bfe7 Author: Roland Dreier Date: Thu Sep 25 15:28:08 2008 -0700 IPoIB: Fix crash when path record fails after path flush Commit ee1e2c82 ("IPoIB: Refresh paths instead of flushing them on SM change events") changed how paths are flushed on an SM event. This change introduces a problem if the path record query triggered by fails, causing path->ah to become NULL. A later successful path query will then trigger WARN_ON() in path_rec_completion(), and crash because path->ah has already been freed, so the ipoib_put_ah() inside the lock in path_rec_completion() may actually drop the last reference (contrary to the comment that claims this is safe). Fix this by updating path->ah and freeing old_ah only when the path record query is successful. This prevents the neighbour AH and that path AH from getting out of sync. This fixes Reported-by: Rabah Salem Debugged-by: Eli Cohen Signed-off-by: Roland Dreier Signed-off-by: Linus Torvalds commit 24e8fc498e9618338854bfbcf8d1d737e0bf1775 Author: Takashi Iwai Date: Thu Sep 25 17:51:11 2008 +0200 ALSA: remove unneeded power_mutex lock in snd_pcm_drop The power_mutex lock in snd_pcm_drop may cause a possible deadlock chain, and above all, it's unneeded. Let's get rid of it. Signed-off-by: Takashi Iwai commit 399ccdc1cd4e92e541d4dacbbf18c52bd693418b Author: Takashi Iwai Date: Thu Sep 25 14:51:03 2008 +0200 ALSA: fix locking in snd_pcm_open*() and snd_rawmidi_open*() The PCM and rawmidi open callbacks have a lock against card->controls_list but it takes a wrong one, card->controls_rwsem, instead of a right one card->ctl_files_rwlock. This patch fixes them. This change also fixes automatically the potential deadlocks due to mm->mmap_sem in munmap and copy_from/to_user, reported by Sitsofe Wheeler: A: snd_ctl_elem_user_tlv(): card->controls_rwsem => mm->mmap_sem B: snd_pcm_open(): card->open_mutex => card->controls_rwsem C: munmap: mm->mmap_sem => snd_pcm_release(): card->open_mutex The patch breaks the chain. Signed-off-by: Takashi Iwai commit efba91bd9066890ae93270eb3d0e55de43368f0b Merge: 2659118... 8c65859... Author: Linus Torvalds Date: Wed Sep 24 16:45:07 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion ath9k: disable MIB interrupts to fix interrupt storm [Bluetooth] Fix USB disconnect handling of btusb driver [Bluetooth] Fix wrong URB handling of btusb driver [Bluetooth] Fix I/O errors on MacBooks with Broadcom chips commit 26591188d69192d5babeadde129dcfb6cbf9e6b7 Merge: c0f4d6d... 17a172f... Author: Linus Torvalds Date: Wed Sep 24 16:43:44 2008 -0700 Merge branch 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6 * 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6: i2c: Fix mailing lists in two MAINTAINERS entries i2c-dev: Return correct error code on class_create() failure i2c-powermac: Fix section for probe and remove functions commit c0f4d6d4b14a75a341d972ff73fb9740e1ceb634 Merge: 1126388... 1eda814... Author: Linus Torvalds Date: Wed Sep 24 16:39:50 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: prevent stale state of c1e_mask across CPU offline/online, fix commit 1126388609dee3f2aca2a64de7b0709d0fede785 Merge: 08ec3c2... 5291925... Author: Linus Torvalds Date: Wed Sep 24 16:38:52 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] Fixe the definition of PTRS_PER_PGD [MIPS] au1000: Fix gpio direction commit 08ec3c2d45bac41c782acb4e3331ac5881b2c68a Author: David Howells Date: Wed Sep 24 17:48:31 2008 +0100 MN10300: Make sched_clock() report time since boot Make sched_clock() report time since boot rather than time since last timer interrupt. Make sched_clock() expand and scale the 32-bit TSC value running at IOCLK speed (~33MHz) to a 64-bit nanosecond counter, using cnt32_to_63() acquired from the ARM arch and without using slow DIVU instructions every call. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit b4f151ff899362fec952c45d166252c9912c041f Author: David Howells Date: Wed Sep 24 17:48:26 2008 +0100 MN10300: Move asm-arm/cnt32_to_63.h to include/linux/ Move asm-arm/cnt32_to_63.h to include/linux/ so that MN10300 can make use of it too. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 8c65859473baee85e806ec8ebc0ff5e3a181969e Merge: 8ca31ce... 92cccc2... Author: David S. Miller Date: Wed Sep 24 16:21:56 2008 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 8ca31ce52a5cfd03b960fd81a49197ae85d25347 Author: Yasuyuki Kozakai Date: Wed Sep 24 15:53:39 2008 -0700 netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion The current code ignores rules for internal options in HBH/DST options header in packet processing if 'Not strict' mode is specified (which is not implemented). Clearly it is not expected by user. Kernel should reject HBH/DST rule insertion with 'Not strict' mode in the first place. Signed-off-by: Yasuyuki Kozakai Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 7a528159b93bc52c14aedff55d53e741227fc846 Merge: fb478da... 16ec470... Author: Linus Torvalds Date: Wed Sep 24 15:33:50 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: 9p: fix put_data error handling 9p: use an IS_ERR test rather than a NULL test 9p: introduce missing kfree 9p-trans_fd: fix and clean up module init/exit paths 9p-trans_fd: don't do fs segment mangling in p9_fd_poll() 9p-trans_fd: clean up p9_conn_create() 9p-trans_fd: fix trans_fd::p9_conn_destroy() 9p: implement proper trans module refcounting and unregistration commit 16ec4700127d479143c77fd9128dfa17ab572963 Author: Eric Van Hensbergen Date: Wed Sep 24 16:22:22 2008 -0500 9p: fix put_data error handling Abhishek Kulkarni pointed out an inconsistency in the way errors are returned from p9_put_data. On deeper exploration it seems the error handling for this path was completely wrong. This patch adds checks for allocation problems and propagates errors correctly. Signed-off-by: Eric Van Hensbergen commit 62aa528e0299ffef8e138d9d92d13e631d06c5ff Author: Julien Brunel Date: Wed Sep 24 16:22:22 2008 -0500 9p: use an IS_ERR test rather than a NULL test In case of error, the function p9_client_walk returns an ERR pointer, but never returns a NULL pointer. So a NULL test that comes after an IS_ERR test should be deleted. The semantic match that finds this problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @match_bad_null_test@ expression x, E; statement S1,S2; @@ x = p9_client_walk(...) ... when != x = E * if (x != NULL) S1 else S2 // Signed-off-by: Julien Brunel Signed-off-by: Julia Lawall Signed-off-by: Eric Van Hensbergen Signed-off-by: Andrew Morton commit 620678244bc7b83287e2e283ed4fe6b959e94b7d Author: Julia Lawall Date: Wed Sep 24 16:22:22 2008 -0500 9p: introduce missing kfree Error handling code following a kmalloc should free the allocated data. The semantic match that finds the problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @r exists@ local idexpression x; statement S; expression E; identifier f,l; position p1,p2; expression *ptr != NULL; @@ ( if ((x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...)) == NULL) S | x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...); ... if (x == NULL) S ) <... when != x when != if (...) { <+...x...+> } x->f = E ...> ( return \(0\|<+...x...+>\|ptr\); | return@p2 ...; ) @script:python@ p1 << r.p1; p2 << r.p2; @@ print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line) // Signed-off-by: Julia Lawall Signed-off-by: Eric Van Hensbergen Signed-off-by: Andrew Morton commit 206ca50de77033c6cc17d0e14fbb12d119a67b01 Author: Tejun Heo Date: Wed Sep 24 16:22:23 2008 -0500 9p-trans_fd: fix and clean up module init/exit paths trans_fd leaked p9_mux_wq on module unload. Fix it. While at it, collapse p9_mux_global_init() into p9_trans_fd_init(). It's easier to follow this way and the global poll_tasks array is about to removed anyway. Signed-off-by: Tejun Heo Signed-off-by: Eric Van Hensbergen commit ec3c68f232f6d98b4596c05c1c7551b44c617c5f Author: Tejun Heo Date: Wed Sep 24 16:22:23 2008 -0500 9p-trans_fd: don't do fs segment mangling in p9_fd_poll() p9_fd_poll() is never called with user pointers and f_op->poll() doesn't expect its arguments to be from userland. There's no need to set kernel ds before calling f_op->poll() from p9_fd_poll(). Remove it. Signed-off-by: Tejun Heo Signed-off-by: Eric Van Hensbergen commit 571ffeafffbfdd0b8f2f9d3b991028797ec87e42 Author: Tejun Heo Date: Wed Sep 24 16:22:23 2008 -0500 9p-trans_fd: clean up p9_conn_create() * Use kzalloc() to allocate p9_conn and remove 0/NULL initializations. * Clean up error return paths. Signed-off-by: Tejun Heo Signed-off-by: Eric Van Hensbergen commit 7dc5d24be06a5ed874af035d52a083a7b61ef1bd Author: Tejun Heo Date: Wed Sep 24 16:22:23 2008 -0500 9p-trans_fd: fix trans_fd::p9_conn_destroy() p9_conn_destroy() first kills all current requests by calling p9_conn_cancel(), then waits for the request list to be cleared by waiting on p9_conn->equeue. After that, polling is stopped and the trans is destroyed. This sequence has a few problems. * Read and write works were never cancelled and the p9_conn can be destroyed while the works are running as r/w works remove requests from the list and dereference the p9_conn from them. * The list emptiness wait using p9_conn->equeue wouldn't trigger because p9_conn_cancel() always clears all the lists and the only way the wait can be triggered is to have another task to issue a request between the slim window between p9_conn_cancel() and the wait, which isn't safe under the current implementation with or without the wait. This patch fixes the problem by first stopping poll, which can schedule r/w works, first and cancle r/w works which guarantees that r/w works are not and will not run from that point and then calling p9_conn_cancel() and do the rest of destruction. Signed-off-by: Tejun Heo Signed-off-by: Eric Van Hensbergen commit 72029fe85d8d060b3f966f2dbc36b3c75b5a6532 Author: Tejun Heo Date: Wed Sep 24 16:22:23 2008 -0500 9p: implement proper trans module refcounting and unregistration 9p trans modules aren't refcounted nor were they unregistered properly. Fix it. * Add 9p_trans_module->owner and reference the module on each trans instance creation and put it on destruction. * Protect v9fs_trans_list with a spinlock. This isn't strictly necessary as the list is manipulated only during module loading / unloading but it's a good idea to make the API safe. * Unregister trans modules when the corresponding module is being unloaded. * While at it, kill unnecessary EXPORT_SYMBOL on p9_trans_fd_init(). Signed-off-by: Tejun Heo Signed-off-by: Eric Van Hensbergen commit 92cccc2cda9a744326bbd9f16c635187af7f8a09 Author: Luis R. Rodriguez Date: Tue Sep 23 14:28:16 2008 -0700 ath9k: disable MIB interrupts to fix interrupt storm Enabling the MIB interrupts has proven to cause an interrupt storm after 7 hours of run. We will make use of the MIB interrupt once we have ANI supported added so for now to cure this we disable the interrupt. The interrupt storm can be seen as follows after 7 hours of run as reported by Steven Noonan : 18:28:38 sum 1106.00 18:28:39 sum 1037.62 18:28:40 sum 1069.00 18:28:41 sum 1167.00 18:28:42 sum 1155.00 18:28:43 sum 1339.00 18:28:44 sum 18355.00 18:28:45 sum 17845.45 18:28:46 sum 15285.00 18:28:47 sum 17511.00 18:28:48 sum 17568.69 18:28:49 sum 17704.04 18:28:50 sum 18566.67 18:28:51 sum 18913.13 at 18:28:44 the MIB interrupt kicked off and caused huge latency which can be seen even on a video he submitted: http://www.youtube.com/watch?v=4GeCx1gZMpA Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit 17a172fe112a15dc9cd694d84983c51e1dc6bf34 Author: Jean Delvare Date: Wed Sep 24 13:39:22 2008 +0200 i2c: Fix mailing lists in two MAINTAINERS entries Two MAINTAINER entries (I2C/SMBUS STUB DRIVER and SIS 96X I2C/SMBUS DRIVER) were improperly pointing to the lm-sensors mailing list instead of the i2c mailing list. Fix them. Signed-off-by: Jean Delvare Cc: Mark M. Hoffman commit e74783ec3cb981211689bd2cfd3248f8dc48ec01 Author: Sven Wegener Date: Wed Sep 24 13:39:21 2008 +0200 i2c-dev: Return correct error code on class_create() failure We need to convert the error pointer from class_create(), else we'll return the successful return code from register_chrdev() on failure. Signed-off-by: Sven Wegener Signed-off-by: Jean Delvare commit 4ebb52d34fac2904e541ccfa8e32126db836fa92 Author: Uwe Kleine-Koenig Date: Wed Sep 24 13:39:21 2008 +0200 i2c-powermac: Fix section for probe and remove functions __devexit for i2c_powermac_probe is obviously wrong. In the definition of struct platform_driver i2c_powermac_driver the remove function i2c_powermac_remove is wrapped in __devexit_p, so it should be defined using __devexit. Signed-off-by: Uwe Kleine-Koenig Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Signed-off-by: Jean Delvare commit 77a9a768b7374cd23d1f400097eede9f1547f508 Author: Jeremy Katz Date: Tue Sep 23 21:54:00 2008 -0400 x86: disable apm on the olpc The OLPC doesn't support APM but also doesn't have DMI, so we can't detect and disable it based on DMI data. So, just disable based on machine_is_olpc() Signed-off-by: Jeremy Katz Signed-off-by: Ingo Molnar commit 1eda81495a49a4ee91d8863b0a441a624375efea Author: Marc Dionne Date: Tue Sep 23 22:40:02 2008 -0400 x86: prevent stale state of c1e_mask across CPU offline/online, fix Fix build error introduced by commit 4faac97d44ac27 ("x86: prevent stale state of c1e_mask across CPU offline/online"). process_32.c needs to include idle.h to get the prototype for c1e_remove_cpu() Signed-off-by: Marc Dionne Signed-off-by: Ingo Molnar commit 5291925a9a65ea334f6e887d0f01dd119b8e2b2e Author: Jack Tan Date: Tue Sep 23 22:52:34 2008 +0800 [MIPS] Fixe the definition of PTRS_PER_PGD When we use > 4KB's page size the original definition is not consistent with PGDIR_SIZE. For exeample, if we use 16KB page size the PGDIR_SHIFT is (14-2) + 14 = 26, PGDIR_SIZE is 2^26，so the PTRS_PER_PGD should be: 2^32/2^26 = 2^6 but the original definition of PTRS_PER_PGD is 4096 (PGDIR_ORDER = 0). So, this definition needs to be consistent with the PGDIR_SIZE. And the new definition is consistent with the PGD init in pagetable_init(). Signed-off-by: Dajie Tan Signed-off-by: Ralf Baechle commit 44ce17192a01218b242e032237e1d2e52ef50429 Author: Bruno Randolf Date: Tue Sep 23 19:48:36 2008 +0200 [MIPS] au1000: Fix gpio direction When setting the direction of one GPIO pin we have to keep the state of the other pins, hence use binary OR. Also gpio_direction_output() wants to set an initial value, so add that too. This fixes a problem with the USB power switch on mtx-1 boards. Signed-off-by: Bruno Randolf Signed-off-by: Ralf Baechle commit fb478da5ba69ecf40729ae8ab37ca406b1e5be48 Merge: 8553f32... 5257d97... Author: Linus Torvalds Date: Tue Sep 23 14:58:51 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (23 commits) USB: revert recovery from transient errors usb: unusual devs patch for Nokia 5310 Music Xpress usb: ftdi_sio: add support for Domintell devices USB: drivers/usb/musb/: disable it on SuperH USB Serial: Sierra: Add MC8785 VID/PID USB: serial: add ZTE CDMA Tech id to option driver USB: ftdi_sio: Add 0x5050/0x0900 USB IDs (Papouch Quido USB 4/4) usb serial: ti_usb_3410_5052 obviously broken by firmware changes USB: fsl_usb2_udc: fix VDBG() format string USB: unusual_devs addition for RockChip MP3 player USB: SERIAL CP2101 add device IDs usb-serial: Add Siemens EF81 to PL-2303 hack triggers USB: fix EHCI periodic transfers usb: musb: fix include path USB: Fixing Nokia 3310c in storage mode usb gadget: fix omap_udc DMA regression USB: update of Documentation/usb/anchors.txt USB: fix hcd interrupt disabling USB: Correct Sierra Wireless USB EVDO Modem Device ID USB: Fix the Nokia 6300 storage-mode. ... commit 8553f321e0fd29821135ac4797b5f37bf80ae2e9 Merge: be3be89... f8e256c... Author: Linus Torvalds Date: Tue Sep 23 14:57:36 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: timers: fix build error in !oneshot case x86: c1e_idle: don't mark TSC unstable if CPU has invariant TSC x86: prevent C-states hang on AMD C1E enabled machines clockevents: prevent mode mismatch on cpu online clockevents: check broadcast device not tick device clockevents: prevent stale tick_next_period for onlining CPUs x86: prevent stale state of c1e_mask across CPU offline/online clockevents: prevent cpu online to interfere with nohz commit be3be8905854d2fcf6030f1da9ebc221e9e2c5f1 Merge: 9c38c7e... fa74820... Author: Linus Torvalds Date: Tue Sep 23 14:57:22 2008 -0700 Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: fix init_hrtick() section mismatch warning commit 9c38c7e573ec44e4a10f735c048b40eb00ccc29c Merge: e002bcc... 05e12e1... Author: Linus Torvalds Date: Tue Sep 23 14:56:45 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: fix 27-rc crash on vsmp due to paravirt during module load x86, oprofile: BUG scheduling while atomic AMD IOMMU: protect completion wait loop with iommu lock AMD IOMMU: set iommu sunc flag after command queuing commit 5257d97a219e17abf8188f136e1189da3b3af33c Author: Alan Stern Date: Mon Sep 22 14:43:08 2008 -0400 USB: revert recovery from transient errors This patch (as1135) essentially reverts the major parts of two earlier patches to usbcore, because they ended up causing a regression. Trying to recover from transient communication errors can lead to other problems, because operations that failed during the error period are not always retried. The simplest example is the initial Set-Config request sent after device enumeration; if it gets lost then it will not be retried and the device will remain unconfigured. This patch restores the old behavior in which any port disconnect or port disable causes the entire device structure to be removed, fixing a reported regression. Signed-off-by: Alan Stern Tested-by: Frans Pop Signed-off-by: Greg Kroah-Hartman commit af747c460b663a4b7795dc3f6897b5506fde6888 Author: David Almaroad Date: Mon Sep 22 15:00:11 2008 -0700 usb: unusual devs patch for Nokia 5310 Music Xpress The Nokia 5310 Music Xpress phone reports one too many sectors in usb-storage mode. This patch resolves that. Signed-off-by: David Almaroad Cc: Matthew Dharm Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 96285cb885b445b03b22849f2536af23c7454a11 Author: Gaetan Carlier Date: Mon Sep 22 15:00:09 2008 -0700 usb: ftdi_sio: add support for Domintell devices Support for Domintell devices (FTDI FT232BM based) : DGQG and DUSB01 module. PIDs were missing. Signed-off-by: Gaetan Carlier Cc: Greg Kroah-Hartman Cc: Ian Abbott Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 09fa14aa9273ca5cf5459b2057eb79e83e81e6be Author: Andrew Morton Date: Mon Sep 22 15:00:08 2008 -0700 USB: drivers/usb/musb/: disable it on SuperH In file included from drivers/usb/musb/musb_core.h:59, from drivers/usb/musb/musb_core.c:108: drivers/usb/musb/musb_io.h:42: error: conflicting types for '__raw_readsl' /usr/src/devel/arch/sh/include/asm/io.h:112: error: previous declaration of '__raw_readsl' was here drivers/usb/musb/musb_io.h:42: error: conflicting types for '__raw_readsl' /usr/src/devel/arch/sh/include/asm/io.h:112: error: previous declaration of '__raw_readsl' was here drivers/usb/musb/musb_io.h:44: error: conflicting types for 'readsw' /usr/src/devel/arch/sh/include/asm/io.h:164: error: previous definition of 'readsw' was here drivers/usb/musb/musb_io.h:46: error: conflicting types for 'readsb' /usr/src/devel/arch/sh/include/asm/io.h:163: error: previous definition of 'readsb' was here drivers/usb/musb/musb_io.h:49: error: conflicting types for '__raw_writesl' /usr/src/devel/arch/sh/include/asm/io.h:111: error: previous declaration of '__raw_writesl' was here drivers/usb/musb/musb_io.h:49: error: conflicting types for '__raw_writesl' /usr/src/devel/arch/sh/include/asm/io.h:111: error: previous declaration of '__raw_writesl' was here drivers/usb/musb/musb_io.h:51: error: conflicting types for 'writesw' /usr/src/devel/arch/sh/include/asm/io.h:164: error: previous definition of 'writesw' was here drivers/usb/musb/musb_io.h:53: error: conflicting types for 'writesb' /usr/src/devel/arch/sh/include/asm/io.h:163: error: previous definition of 'writesb' was here Cc: Karsten Keil Cc: Paul Mundt Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit b77a5c7040643e658622148bb7d7dad63e8d0158 Author: Kevin Lloyd Date: Wed Sep 17 09:03:38 2008 -0700 USB Serial: Sierra: Add MC8785 VID/PID Add another MC8785 VID/PID Signed-off-by: Kevin Lloyd Signed-off-by: Greg Kroah-Hartman commit 884579d03a3e1e9ac8b7f32a1c36387cac3eb80b Author: Otavio Salvador Date: Wed Sep 17 14:40:46 2008 -0300 USB: serial: add ZTE CDMA Tech id to option driver Signed-off-by: Otavio Salvador Signed-off-by: Greg Kroah-Hartman commit a18f80b4e2fdbc7b88d412c3deb533b9f1f30c30 Author: Jaroslav Kysela Date: Tue Sep 16 15:46:50 2008 +0200 USB: ftdi_sio: Add 0x5050/0x0900 USB IDs (Papouch Quido USB 4/4) USB: ftdi_sio: Add 0x5050/0x0900 USB IDs (Papouch Quido USB 4/4) Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 2bcbe4c199ec012169f938d2c6b543f50c4925ed Author: Chris Adams Date: Wed Sep 10 14:11:38 2008 -0700 usb serial: ti_usb_3410_5052 obviously broken by firmware changes While making some other changes to ti_usb_3410_5052, I noticed that the changes made to move the firmware loading to a separate function are broken (in ti_download_firmware(), status is set to -ENOMEM and never changed). This means the driver will never initialize the device properly. It looks like status was supposed to get the result of ti_do_download(). Signed-off-by: Chris Adams Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 6ef65a7fb609a7aca72730dfb9890f30fcd723bf Author: Peter Korsgaard Date: Mon Sep 8 10:08:59 2008 +0200 USB: fsl_usb2_udc: fix VDBG() format string Fixes: drivers/usb/gadget/fsl_usb2_udc.c: In function 'dr_controller_setup': drivers/usb/gadget/fsl_usb2_udc.c:229: warning: format '%p' expects type 'void *', but argument 3 has type 'int' Signed-off-by: Peter Korsgaard Signed-off-by: Greg Kroah-Hartman commit fe1926a0f549741ed0ca778aa1c7d3e208895dee Author: Alan Stern Date: Thu Sep 4 09:56:35 2008 -0400 USB: unusual_devs addition for RockChip MP3 player This patch (as1136) adds an unusual_devs entry for a version of the RockChip MP3 player which can't handle the MODE SENSE command used for write-protect detection. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit ba0f332c413796925ce322d311d75269689a9e5d Author: Craig Shelley Date: Thu Sep 4 21:28:21 2008 +0100 USB: SERIAL CP2101 add device IDs Signed-off-by: Craig Shelley Signed-off-by: Greg Kroah-Hartman commit ce816cf9c917435cd2e3b68acc7cfe2c1f4a814f Author: Andreas Bombe Date: Sun Sep 14 01:58:55 2008 +0200 usb-serial: Add Siemens EF81 to PL-2303 hack triggers This hardware needs the pl2303 hack in order to work properly :( Signed-off-by: Andreas Bombe Signed-off-by: Greg Kroah-Hartman commit 01c17142659c02d8cd4c67acdd8358180c5c4fb6 Author: David Brownell Date: Tue Aug 26 23:35:04 2008 -0700 USB: fix EHCI periodic transfers As noted by Stefan Neis , we had a recent regression with EHCI periodic transfers, in some (seemingly not all that common) cases. The root cause was that the schedule activation was only loosely coupled to the addition or removal of transfers, so two different execution contexts could both think they had to deactivate (or conversely activate) the schedule. So this fix tightens that coupling, managing it more like a refcount. Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 0590d5875e3a5dc6586fb16354037f115628896d Author: Felipe Balbi Date: Sat Aug 30 19:42:02 2008 +0300 usb: musb: fix include path headers were moved, fixing. Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 49cd2480baeb377f91e66ba682f81cac2a1feaa1 Author: Filip Joelsson Date: Sun Aug 31 08:22:16 2008 +0200 USB: Fixing Nokia 3310c in storage mode I had trouble connecting my cell phone as a storage device - so I added it to the unusual_devs.h list. I had trouble with the bcdDeviceMin and Max values - so after some experimenting I made it pretty inclusive. From: Filip Joelsson Signed-off-by: Greg Kroah-Hartman commit c3e3208e4b0cf4ed69cbcaa5e059e5cf64437c9a Author: David Brownell Date: Sun Aug 31 18:04:27 2008 -0700 usb gadget: fix omap_udc DMA regression This resolves another regression caused by the "use omap_read/write instead of __REG" patch: the hardware address used for DMA to/from the UDC became wrong. Bug noted by Russell King. Reported-by: Russell King Signed-off-by: David Brownell Acked-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 697e04db5678fadf96d437806b676403ebee806d Author: Oliver Neukum Date: Tue Sep 2 10:52:08 2008 +0200 USB: update of Documentation/usb/anchors.txt The extended anchor API is documented Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 83a798207361cc26385187b2e71efa2b5d75de7f Author: Geoff Levand Date: Fri Aug 22 14:13:00 2008 -0700 USB: fix hcd interrupt disabling Commit de85422b94ddb23c021126815ea49414047c13dc, 'USB: fix interrupt disabling for HCDs with shared interrupt handlers' changed usb_add_hcd() to strip IRQF_DISABLED from irqflags prior to calling request_irq() with the justification that such a removal was necessary for shared interrupts to work properly. Unfortunately, the change in that commit unconditionally removes the IRQF_DISABLED flag, causing problems on platforms that don't use a shared interrupt but require IRQF_DISABLED. This change adds a check for IRQF_SHARED prior to removing the IRQF_DISABLED flag. Fixes the PS3 system startup hang reported with recent Fedora and OpenSUSE kernels. Note that this problem is hidden when CONFIG_LOCKDEP=y (ps3_defconfig), as local_irq_enable_in_hardirq() is defined as a null statement for that config. CC: stable Signed-off-by: Geoff Levand Cc: Alan Stern Cc: Stefan Becker Signed-off-by: Greg Kroah-Hartman commit f8834f1febb8f56cdcfeb35485e0cc7a8d547818 Author: Tony Murray Date: Fri Aug 22 17:30:44 2008 -0500 USB: Correct Sierra Wireless USB EVDO Modem Device ID I was trying to figure out why my device wasn't supported by the drivers/usb/serial/sierra.c driver, while looking throught the device IDs I spotted what I believe to be a typo in the device IDs. Please apply the following patch If you look down further, there is another HP wireless broadband card, which has a vendor ID of 03f0, like my device. Below is my "lsusb -v -d 03f0:1b1d". Bus 001 Device 005: ID 03f0:1b1d Hewlett-Packard Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 1.10 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x03f0 Hewlett-Packard idProduct 0x1b1d bcdDevice 0.01 iManufacturer 1 HP iProduct 2 HP ev2200 1xEV-DO Broadband Wireless Module iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 67 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xe0 Self Powered Remote Wakeup MaxPower 0mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 7 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 255 Vendor Specific Subclass bInterfaceProtocol 255 Vendor Specific Protocol iInterface 3 Data Interface Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0010 1x 16 bytes bInterval 128 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x04 EP 4 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x05 EP 5 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Device Status: 0x0000 (Bus Powered) From: Tony Murray Cc: Kevin Lloyd Signed-off-by: Greg Kroah-Hartman commit 0a4d7f45ac173862796eb81942afc843d6244798 Author: Richard Nauber Date: Tue Aug 26 23:34:11 2008 +0200 USB: Fix the Nokia 6300 storage-mode. This patch fixes that behavior: ... Aug 26 22:39:23 rnauber sd 2:0:0:0: [sda] Sense Key : 0x0 [current] Aug 26 22:39:23 rnauber sd 2:0:0:0: [sda] ASC=0x0 ASCQ=0x0 Aug 26 22:39:23 rnauber sd 2:0:0:0: [sda] Sense Key : 0x0 [current] Aug 26 22:39:23 rnauber sd 2:0:0:0: [sda] ASC=0x0 ASCQ=0x0 Aug 26 22:39:23 rnauber sd 2:0:0:0: [sda] Sense Key : 0x0 [current] Aug 26 22:39:23 rnauber sd 2:0:0:0: [sda] ASC=0x0 ASCQ=0x0 Aug 26 22:39:23 rnauber sd 2:0:0:0: [sda] Sense Key : 0x0 [current] ... cat /proc/bus/usb/devices ... T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0421 ProdID=04fa Rev= 6.01 S: Manufacturer=Nokia S: Product=Nokia 6300 S: SerialNumber=35XXXXXXXX C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms ... From: Richard Nauber Signed-off-by: Greg Kroah-Hartman commit 0bcfeb3ec9467a8dfae3e906925ec28fe788afcf Author: David Brownell Date: Tue Aug 26 14:43:46 2008 -0700 USB: ehci: fix some ehci hangs and crashes I noticed that the "Refactor "if (handshake()) state = HC_STATE_HALT" patch from earlier this year perpetuated a potential problem: it can mark the controller as halted when it's still running (but not acting as, perhaps wrongly, expected). That caused some hangs and crashes, rather than more polite failure modes of a truly halted controller. This patch forces a true halt, and emits a (previously missing) diagnostic. Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 73b2c2057579314c4fea1a37e35a501fbb8b9916 Author: Kevin Lloyd Date: Mon Aug 25 19:20:40 2008 -0700 USB Serial: Sierra: Device addition & version rev This patch adds devices to the sierra driver and rev's the driver version. Signed-off-by: Kevin Lloyd Signed-off-by: Greg Kroah-Hartman commit c9bab96bbfdda59fa8a35ba536c22e66055669e5 Author: Kevin Lloyd Date: Tue Aug 26 18:30:45 2008 -0700 USB Storage: Sierra: Non-configurable TRU-Install This patch alters the Sierra Mass Storage patch so that it is non-configurable. Signed-off-by: Kevin Lloyd Signed-off-by: Greg Kroah-Hartman commit 44ea91c597ae4641d9ac21b8bbba0795d2f4261e Author: James Bottomley Date: Sat Sep 20 00:31:50 2008 +0000 [SCSI] Fix hang with split requests Sometimes, particularly for USB devices with the last sector bug, requests get completed in chunks. There's a bug in this in that if one of the chunks gets an error, we complete that chunk with an error but never move on to the remaining ones, leading to the request hanging (because it's not fully completed). Fix this by completing all remaining chunks if an error is encountered. Cc: Alan Stern Signed-off-by: James Bottomley commit e002bcc2f8e766a96472379e3b4a8a4e8938a93e Merge: 75f5002... b08508c... Author: Linus Torvalds Date: Tue Sep 23 12:15:50 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI: fix compiler warnings in pci_get_subsys() PCI: Fix pcie_aspm=force commit 75f500204c645787c27d6085d39291946c928e02 Merge: 42e7b09... d3758f8... Author: Linus Torvalds Date: Tue Sep 23 10:21:58 2008 -0700 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6: [IA64] kexec fails on systems with blocks of uncached memory [IA64] Ski simulator doesn't need check_sal_cache_flush commit 42e7b09e688bf86c032ca36ddb65cc548bb6147f Merge: 3bd1911... b0b8daf... Author: Linus Torvalds Date: Tue Sep 23 10:21:45 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: ASoC: maintainers - update email address for Liam Girdwood commit 3bd1911b134ce4a669ea6cf531a36440753b0aaa Merge: 1910e02... 7275fc8... Author: Linus Torvalds Date: Tue Sep 23 08:18:17 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: [WATCHDOG] unlocked_ioctl changes [WATCHDOG] wdt285: fix sparse warnings [WATCHDOG] ibmasr: remove unnecessary spin_unlock() commit 1910e021f2249402c3f103a5a1a15ebda211d1da Merge: 74c7a09... 44b50e5... Author: Linus Torvalds Date: Tue Sep 23 08:14:14 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Fix missing devices due to PCI bridge test in of_create_pci_dev(). sparc64: Fix disappearing PCI devices on e3500. commit 74c7a09aeeaa59984d8487a44b08f66add8b9813 Merge: f05596d... 4c07ab0... Author: Linus Torvalds Date: Tue Sep 23 08:14:04 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: ath9k: Fix IRQ nobody cared issue with ath9k wireless: zd1211rw: add device ID fix wifi dongle "trust nw-3100" ath9k: connectivity is lost after Group rekeying is done commit f05596dbc922276ed675c713519220bae8042e32 Author: Anti Sullin Date: Mon Sep 22 13:57:54 2008 -0700 atmel_serial: update the powersave handler to match serial core This problem seems to be unnoticed so far: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b3b708fa2780cd2b5d8266a8f0c3a1cab364d4d2 has changed the serial core behavior to not to suspend the port if the device is enabled as a wakeup source. If the AT91 system goes to slow clock mode, the port should be suspended always and the clocks should be switched off. The patch attached updates the atmel_serial driver to match the changes in serial core. Also, the interrupts are disabled when the clock is disabled. If we disable the clock with interrupts enabled, an interrupt may get stuck. If this is the DBGU interrupt, this blocks the OR logic at system controller and thus all other sysc interrupts. Signed-off-by: Anti Sullin Signed-off-by: Haavard Skinnemoen Cc: Michael Trimarchi Cc: Andrew Victor Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a10cebf56ca7e7c034d1b6646230c6553e478967 Author: Daisuke Nishimura Date: Mon Sep 22 13:57:52 2008 -0700 memcg: check under limit at shrink_usage Current memory cgroup(both in mainline and -mm) doesn't account swap caches as memory(swap cache support is dropped temporarily now). So try_to_free_mem_cgroup_pages doesn't reflect the count of pages that have been moved to swap cache. But this makes mem_cgroup_shrink_usage fail easily if most of the pages are anon/shmem, and then shmem_getpage returns -ENOMEM and the process will be killed. This patch adds res_counter_check_under_limit to avoid these cases. BTW, even if swap cache support is enabled again, if a process is moved to another cgroup, which has been just made, between precharge and shrink_usage in shmem_getpage, shrink_usage may fail just because there is no pages to reclaim. So this change would make sense anyway. Signed-off-by: Daisuke Nishimura Cc: Balbir Singh Cc: Pavel Emelyanov Cc: KAMEZAWA Hiroyuki Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b4d19cc84e8e6838f4aa0b26b3afcdc8c7f71505 Author: Andrew Morton Date: Mon Sep 22 13:57:51 2008 -0700 Documentation/sysctl/kernel.txt: fix softlockup_thresh description - s/s/seconds/ - s/10 seconds/60 seconds/ - Mention the zero-disables-it feature. Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit db203d53d474aa068984e409d807628f5841da1b Author: Nick Piggin Date: Mon Sep 22 13:57:50 2008 -0700 mm: tiny-shmem fix lock ordering: mmap_sem vs i_mutex tiny-shmem calls do_truncate in shmem_file_setup. do_truncate takes i_mutex, and shmem_file_setup is called with mmap_sem held. However i_mutex nests outside mmap_sem. Copy the code in shmem.c to avoid this problem. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Nick Piggin Reported-and-tested-by: Ingo Molnar Cc: Peter Zijlstra Cc: Matt Mackall Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2d4c8266774188cda7f7e612e6dfb8ad12c579d5 Author: Michael Kerrisk Date: Mon Sep 22 13:57:49 2008 -0700 sys_paccept: disable paccept() until API design is resolved The reasons for disabling paccept() are as follows: * The API is more complex than needed. There is AFAICS no demonstrated use case that the sigset argument of this syscall serves that couldn't equally be served by the use of pselect/ppoll/epoll_pwait + traditional accept(). Roland seems to concur with this opinion (http://thread.gmane.org/gmane.linux.kernel/723953/focus=732255). I have (more than once) asked Ulrich to explain otherwise (http://thread.gmane.org/gmane.linux.kernel/723952/focus=731018), but he does not respond, so one is left to assume that he doesn't know of such a case. * The use of a sigset argument is not consistent with other I/O APIs that can block on a single file descriptor (e.g., read(), recv(), connect()). * The behavior of paccept() when interrupted by a signal is IMO strange: the kernel restarts the system call if SA_RESTART was set for the handler. I think that it should not do this -- that it should behave consistently with paccept()/ppoll()/epoll_pwait(), which never restart, regardless of SA_RESTART. The reasoning here is that the very purpose of paccept() is to wait for a connection or a signal, and that restarting in the latter case is probably never useful. (Note: Roland disagrees on this point, believing that rather paccept() should be consistent with accept() in its behavior wrt EINTR (http://thread.gmane.org/gmane.linux.kernel/723953/focus=732255).) I believe that instead, a simpler API, consistent with Ulrich's other recent additions, is preferable: accept4(int fd, struct sockaddr *sa, socklen_t *salen, ind flags); (This simpler API was originally proposed by Ulrich: http://thread.gmane.org/gmane.linux.network/92072) If this simpler API is added, then if we later decide that the sigset argument really is required, then a suitable bit in 'flags' could be added to indicate the presence of the sigset argument. At this point, I am hoping we either will get a counter-argument from Ulrich about why we really do need paccept()'s sigset argument, or that he will resubmit the original accept4() patch. Signed-off-by: Michael Kerrisk Cc: David Miller Cc: Davide Libenzi Cc: Alan Cox Cc: Ulrich Drepper Cc: Jakub Jelinek Cc: Roland McGrath Cc: Oleg Nesterov Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6675ce13ed783f88ea5d82f0d855462b76ff0dad Author: Marin Mitov Date: Mon Sep 22 13:57:46 2008 -0700 Documentation/DMA-mapping.txt: update for pci_dma_mapping_error() changes Make the example code consistent with changed API. Signed-off-by: Marin Mitov Acked-by: FUJITA Tomonori Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f9092f358bc2ec5367621478811f046f82873376 Author: Jonathan Steel Date: Mon Sep 22 13:57:45 2008 -0700 kexec: fix segmentation fault in kimage_add_entry A segmentation fault can occur in kimage_add_entry in kexec.c when loading a kernel image into memory. The fault occurs because a page is requested by calling kimage_alloc_page with gfp_mask GFP_KERNEL and the function may actually return a page with gfp_mask GFP_HIGHUSER. The high mem page is returned because it was swapped with the kernel page due to the kernel page being a page that will shortly be copied to. This patch ensures that kimage_alloc_page returns a page that was created with the correct gfp flags. I have verified the change and fixed the whitespace damage of the original patch. Jonathan did a great job of tracking this down after he hit the problem. -- Eric Signed-off-by: Jonathan Steel Signed-off-by: Eric W. Biederman Acked-by: Simon Horman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 39f00c087d31f668eb6eaf97508af22a32c5b1d9 Author: Randy Dunlap Date: Mon Sep 22 13:57:44 2008 -0700 kernel-doc: allow structs whose members are all private Struct members may be marked as private by using /* private: */ before them, as noted in Documentation/kernel-doc-nano-HOWTO.txt Fix kernel-doc to handle structs whose members are all private; otherwise invalid XML is generated: xmlto: input does not validate (status 3) linux-2.6.27-rc6-git4/Documentation/DocBook/debugobjects.xml:146: element variablelist: validity error : Element variablelist content does not follow the DTD, expecting ((title , titleabbrev?)? , varlistentry+), got () Document linux-2.6.27-rc6-git4/Documentation/DocBook/debugobjects.xml does not validate make[1]: *** [Documentation/DocBook/debugobjects.html] Error 3 Signed-off-by: Randy Dunlap Reported-by: Roland McGrath Cc: Roland McGrath Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c32a162fd420fe8dfb049db941b2438061047fcc Author: Kirill A. Shutemov Date: Mon Sep 22 13:57:43 2008 -0700 smb.h: do not include linux/time.h in userspace linux/time.h conflicts with time.h from glibc It breaks building smbmount from samba. It's regression introduced by commit 76308da (" smb.h: uses struct timespec but didn't include linux/time.h"). Signed-off-by: Kirill A. Shutemov Cc: [2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 683f40d7e7eee06811db43cb4c45349eab0d539e Author: Akinobu Mita Date: Mon Sep 22 13:57:41 2008 -0700 ibmasr: remove unnecessary spin_unlock() __asr_toggle() is always called with asr_lock held. But there is unnecessary spin_unlock() call in __asr_toggle(). Signed-off-by: Akinobu Mita Cc: Wim Van Sebroeck Acked-by: Andrey Panin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b0b8daf7849cc98217ca018fbe82c61cd2b735bc Author: Liam Girdwood Date: Thu Sep 18 14:36:37 2008 +0100 ALSA: ASoC: maintainers - update email address for Liam Girdwood This patch updates the maintainers email address for Liam Girdwood and adds a URL for the ASoC website. Signed-off-by: Liam Girdwood Signed-off-by: Takashi Iwai commit f8e256c687eb53850685747757c8d75e58756e15 Author: Ingo Molnar Date: Tue Sep 23 13:00:57 2008 +0200 timers: fix build error in !oneshot case kernel/time/tick-common.c: In function ‘tick_setup_periodic’: kernel/time/tick-common.c:113: error: implicit declaration of function ‘tick_broadcast_oneshot_active’ Signed-off-by: Ingo Molnar commit 09bfeea13cea843fb03eaa96b5d891fa0abdcc90 Author: Andreas Herrmann Date: Thu Sep 18 21:12:10 2008 +0200 x86: c1e_idle: don't mark TSC unstable if CPU has invariant TSC Impact: Functional TSC is marked unstable on AMD family 0x10 and 0x11 CPUs. This would be wrong because for those CPUs "invariant TSC" means: "The TSC counts at the same rate in all P-states, all C states, S0, or S1" (See "Processor BIOS and Kernel Developer's Guides" for those CPUs.) [ tglx: Changed C1E to AMD C1E in the printks to avoid confusion with Intel C1E ] Signed-off-by: Andreas Herrmann Signed-off-by: Thomas Gleixner commit a8d6829044901a67732904be5f1eacdf8539604f Author: Thomas Gleixner Date: Mon Sep 22 19:02:25 2008 +0200 x86: prevent C-states hang on AMD C1E enabled machines Impact: System hang when AMD C1E machines switch into C2/C3 AMD C1E enabled systems do not work with normal ACPI C-states even if the BIOS is advertising them. Limit the C-states to C1 for the ACPI processor idle code. Signed-off-by: Thomas Gleixner commit 27ce4cb4a0c7cf59b9a9952266883862f2e4c99f Author: Thomas Gleixner Date: Mon Sep 22 19:04:02 2008 +0200 clockevents: prevent mode mismatch on cpu online Impact: timer hang on CPU online observed on AMD C1E systems When a CPU is brought online then the broadcast machinery can be in the one shot state already. Check this and setup the timer device of the new CPU in one shot mode so the broadcast code can pick up the next_event value correctly. Another AMD C1E oddity, as we switch to broadcast immediately and not after the full bring up via the ACPI cpu idle code. Signed-off-by: Thomas Gleixner commit 302745699c1b675b5d2a1af87271de10e4d96b6a Author: Thomas Gleixner Date: Mon Sep 22 19:02:25 2008 +0200 clockevents: check broadcast device not tick device Impact: Possible hang on CPU online observed on AMD C1E machines. The broadcast setup code looks at the mode of the tick device to determine whether it needs to be shut down or setup. This is wrong when the broadcast mode is set to one shot already. This can happen when a CPU is brought online as it goes through the periodic setup first. The problem went unnoticed as sane systems do not call into that code before the switch to one shot for the clock event device happens. The AMD C1E idle routine switches over immediately and thereby shuts down the just setup device before the first interrupt happens. Signed-off-by: Thomas Gleixner commit 49d670fb8dd62d3ed4e3ed2513538ea65b051aed Author: Thomas Gleixner Date: Mon Sep 22 18:56:01 2008 +0200 clockevents: prevent stale tick_next_period for onlining CPUs Impact: possible hang on CPU onlining in timer one shot mode. The tick_next_period variable is only used during boot on nohz/highres enabled systems, but for CPU onlining it needs to be maintained when the per cpu clock events device operates in one shot mode. Signed-off-by: Thomas Gleixner commit 4faac97d44ac27bdbb010a9c3597401a8f89341f Author: Thomas Gleixner Date: Mon Sep 22 18:54:29 2008 +0200 x86: prevent stale state of c1e_mask across CPU offline/online Impact: hang which happens across CPU offline/online on AMD C1E systems. When a CPU goes offline then the corresponding bit in the broadcast mask is cleared. For AMD C1E enabled CPUs we do not reenable the broadcast when the CPU comes online again as we do not clear the corresponding bit in the c1e_mask, which keeps track which CPUs have been switched to broadcast already. So on those !$@#& machines we never switch back to broadcasting after a CPU offline/online cycle. Clear the bit when the CPU plays dead. Signed-off-by: Thomas Gleixner commit 6441402b1f173fa38e561d3cee7c01c32e5281ad Author: Thomas Gleixner Date: Mon Sep 22 18:46:37 2008 +0200 clockevents: prevent cpu online to interfere with nohz Impact: rare hang which can be triggered on CPU online. tick_do_timer_cpu keeps track of the CPU which updates jiffies via do_timer. The value -1 is used to signal, that currently no CPU is doing this. There are two cases, where the variable can have this state: boot: necessary for systems where the boot cpu id can be != 0 nohz long idle sleep: When the CPU which did the jiffies update last goes into a long idle sleep it drops the update jiffies duty so another CPU which is not idle can pick it up and keep jiffies going. Using the same value for both situations is wrong, as the CPU online code can see the -1 state when the timer of the newly onlined CPU is setup. The setup for a newly onlined CPU goes through periodic mode and can pick up the do_timer duty without being aware of the nohz / highres mode of the already running system. Use two separate states and make them constants to avoid magic numbers confusion. Signed-off-by: Thomas Gleixner commit fa748203175de7c08f2df80e5a0eeca40329b5e2 Author: Rakib Mullick Date: Mon Sep 22 14:55:45 2008 -0700 sched: fix init_hrtick() section mismatch warning LD kernel/built-in.o WARNING: kernel/built-in.o(.text+0x326): Section mismatch in reference from the function init_hrtick() to the variable .cpuinit.data:hotplug_hrtick_nb.8 The function init_hrtick() references the variable __cpuinitdata hotplug_hrtick_nb.8. This is often because init_hrtick lacks a __cpuinitdata annotation or the annotation of hotplug_hrtick_nb.8 is wrong. Signed-off-by: Md.Rakib H. Mullick Signed-off-by: Andrew Morton Signed-off-by: Ingo Molnar commit 05e12e1c4c09cd35ac9f4e6af1e42b0036375d72 Author: Ravikiran G Thirumalai Date: Mon Sep 22 22:58:47 2008 -0700 x86: fix 27-rc crash on vsmp due to paravirt during module load 27-rc fails to boot up if configured to use modules. Turns out vsmp_patch was marked __init, and vsmp_patch being the pvops 'patch' routine for vsmp, a call to vsmp_patch just turns out to execute a code page with series of 0xcc (POISON_FREE_INITMEM -- int3). vsmp_patch has been marked with __init ever since pvops, however, apply_paravirt can be called during module load causing calls to freed memory location. Since apply_paravirt can only be called during init/module load, make vsmp_patch with "__init_or_module" Signed-off-by: Ravikiran Thirumalai Signed-off-by: Ingo Molnar commit 7275fc8c36dbad3a871f82b1f9f1f524688176ea Author: Wim Van Sebroeck Date: Thu Sep 18 12:26:15 2008 +0000 [WATCHDOG] unlocked_ioctl changes Fix some drivers so that they use the unlocked_ioctl call. Signed-off-by: Wim Van Sebroeck commit edf86c9b98b5162bed64a70f9424bd2dd58a717e Author: Ben Dooks Date: Tue Sep 16 11:31:01 2008 +0100 [WATCHDOG] wdt285: fix sparse warnings The wdt285.c watchdog driver is producing a number of sparse errors due to missing __user attributes to calls to put_user and copy_to_user, as well as in the prototype of watchdog_write. wdt285.c:144:21: warning: incorrect type in argument 1 (different address spaces) wdt285.c:144:21: expected void [noderef] *to wdt285.c:144:21: got void * wdt285.c:150:9: warning: incorrect type in initializer (different address spaces) wdt285.c:150:9: expected int const [noderef] *register __p wdt285.c:150:9: got int * wdt285.c:159:9: warning: incorrect type in initializer (different address spaces) wdt285.c:159:9: expected int const [noderef] *register __p wdt285.c:159:9: got int * wdt285.c:174:9: warning: incorrect type in initializer (different address spaces) wdt285.c:174:9: expected int const [noderef] *register __p wdt285.c:174:9: got int * wdt285.c:183:12: warning: incorrect type in initializer (incompatible argument 2 (different address spaces)) wdt285.c:183:12: expected int ( *write )( ... ) wdt285.c:183:12: got int ( static [toplevel] * )( ... ) Signed-off-by: Ben Dooks Signed-off-by: Wim Van Sebroeck Signed-off-by: Andrew Morton commit 7f605ac00416d763c2d9681e378a75e7adbb06e8 Author: Akinobu Mita Date: Sat Sep 13 18:47:19 2008 +0900 [WATCHDOG] ibmasr: remove unnecessary spin_unlock() __asr_toggle() is always called with asr_lock held. But there is unnecessary spin_unlock() call in __asr_toggle(). Signed-off-by: Akinobu Mita Signed-off-by: Wim Van Sebroeck Acked-by: Andrey Panin Signed-off-by: Andrew Morton commit 44b50e5a1af13c605d6c3b17a60e42eb0ee48d5f Author: David S. Miller Date: Mon Sep 22 15:42:24 2008 -0700 sparc64: Fix missing devices due to PCI bridge test in of_create_pci_dev(). Just like in the arch/sparc64/kernel/of_device.c code fix commit 071d7f4c3b411beae08d27656e958070c43b78b4 ("sparc64: Fix SMP bootup with CONFIG_STACK_DEBUG or ftrace.") we have to check the OF device node name for "pci" instead of relying upon the 'device_type' property being there on all PCI bridges. Tested by Meelis Roos, and confirmed to make the PCI QFE devices reappear on the E3500 system. Signed-off-by: David S. Miller commit 4c07ab0fe4b4eaa0fc31f640ca65da7c173f5043 Merge: cec5eb7... 6115e85... Author: David S. Miller Date: Mon Sep 22 15:29:05 2008 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 5fbcd260c2c52f78cd699f65e9c7af2e60b5380c Author: Marcel Holtmann Date: Tue Sep 23 00:16:36 2008 +0200 [Bluetooth] Fix USB disconnect handling of btusb driver The USB transport specification for Bluetooth splits the ACL and SCO handling into two separate interfaces. In Linux it possible to probe and disconnect these interfaces independently. So make sure that both interfaces are tightly bound together. This fixes the suspend regression that some people have expierenced. Signed-off-by: Oliver Neukum Signed-off-by: Marcel Holtmann commit e8c3c3d22b340a406a9aab1b7a9f436636c3de9d Author: Marcel Holtmann Date: Tue Sep 23 00:16:36 2008 +0200 [Bluetooth] Fix wrong URB handling of btusb driver The btusb driver contains two typos that result in some buggy behavior, but the impact is not immediately visible. During initialization the submitting of interrupt URBs might fail and then make sure to remove the correct flag and not one of the hci_dev flags. When closing down the interface make sure to kill the anchor for the ISOC URBs and not kill the interrupt URBs twice. Also cancel any scheduled work when closing down the interface. Signed-off-by: Marcel Holtmann commit bdbef3d696ca83489eb653459b5a7a62ecf5596a Author: Marcel Holtmann Date: Tue Sep 23 00:16:35 2008 +0200 [Bluetooth] Fix I/O errors on MacBooks with Broadcom chips The newer MacBooks contain a Broadcom based Bluetooth chip and to make this work properly, HCI_Reset must be send first. If HCI_Reset is not used then a lot of I/O errors show up and its triggers packets from non-existent ACL links. Signed-off-by: Marcel Holtmann commit 6115e8557a75b5f24b56ed46c60dffef7e7fa992 Author: Senthil Balasubramanian Date: Mon Sep 22 14:22:39 2008 +0530 ath9k: Fix IRQ nobody cared issue with ath9k IRQs should be disabled before calling free_irq. Also flush pending IRQs. Pasted the kernel log message for reference. kernel: irq 17: nobody cared (try booting with the "irqpoll" option) kernel: [] __report_bad_irq+0x2e/0x6f kernel: [] note_interrupt+0x1b5/0x207 kernel: [] ? handle_IRQ_event+0x21/0x48 kernel: [] handle_fasteoi_irq+0x8e/0xad kernel: [] do_IRQ+0x6c/0x84 kernel: [] common_interrupt+0x23/0x28 kernel: [] ? acpi_idle_enter_simple+0x198/0x205 kernel: [] ? menu_select+0x5c/0x78 kernel: [] cpuidle_idle_call+0x59/0x89 kernel: [] cpu_idle+0xae/0xcf kernel: [] rest_init+0x4e/0x50 kernel: ======================= kernel: handlers: kernel: [] (ath_isr+0x0/0x13a [ath9k]) kernel: Disabling IRQ #17 Signed-off-by: Senthil Balasubramanian Tested-by: Steven Noonan Signed-off-by: John W. Linville commit d3758f87f39c5b072dde74c55bfb988262a3a45c Author: Jay Lan Date: Mon Sep 22 14:21:19 2008 -0700 [IA64] kexec fails on systems with blocks of uncached memory Currently a memory segment in memory map with attribute of EFI_MEMORY_UC is denoted as "System RAM" in /proc/iomem, while memory of attribute (EFI_MEMORY_WB|EFI_MEMORY_UC) is also labeled the same. The kexec utility then includes uncached memory as part of vmcore. The kdump kernel MCA'ed when it tries to save the vmcore to a disk. A normal "cached" access may cause MCAs. This patch would label memory with attribute of EFI_MEMORY_UC only as "Uncached RAM" so that kexec would know not to include it in the vmcore. I will submit a separate kexec-tools patch to the kexec list. Signed-off-by: Jay Lan Acked-by: Simon Horman Signed-off-by: Tony Luck commit 06f95ea8988513b172080c419e4be8826c55a318 Author: Alex Chiang Date: Tue Sep 16 18:25:33 2008 -0600 [IA64] Ski simulator doesn't need check_sal_cache_flush Peter Chubb reported that commit 3463a93def55c309f3c0d0a8aaf216be3be42d64 (Update check_sal_cache_flush to use platform_send_ipi()) broke Ski because it does not implement IPIs. Tony Luck suggested we just #ifndef out the call (since the simulator does not have the SAL bug that this code is attempting to detect and workaround) Signed-off-by: Alex Chiang Signed-off-by: Tony Luck commit 5d89945e6ec44494285cb8de85d4f43d4647b740 Author: born.into.silence@gmail.com Date: Fri Sep 19 16:47:06 2008 -0700 wireless: zd1211rw: add device ID fix wifi dongle "trust nw-3100" akpm: taken from http://bugzilla.kernel.org/show_bug.cgi?id=11587 I bought the wifi dongle trust nw-3100 wich is in fact a zd1211rw. Its hardware id was missing in the sources, adding it made it work flawlessly. Cc: Daniel Drake Cc: Ulrich Kunitz Cc: Johannes Berg Signed-off-by: Andrew Morton Signed-off-by: John W. Linville commit d0be7cc7688d0cc2e4daf952c43b5ce86e5c8a1d Author: Senthil Balasubramanian Date: Wed Sep 17 12:39:49 2008 +0530 ath9k: connectivity is lost after Group rekeying is done Connectivtiy is lost after Group rekeying is done. The keytype maintained by ath9k is reset when group key is updated. Though sc_keytype can be reset only for broadcast key the proper fix would be to use mac80211 provided key type from txinfo during xmit and get rid of sc_keytype from ath9k ath_softc. Signed-off-by: Vasanthakumar Thiagarajan Signed-off-by: Senthil Balasubramanian Tested-by: Steven Noonan Signed-off-by: John W. Linville commit a304edb4893042fb75ce7bab079924f626634f45 Merge: cec5eb7... b1132b3... Author: Linus Torvalds Date: Mon Sep 22 09:09:18 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: ASoC: Fix at32-pcm build breakage with PM enabled commit cec5eb7be3a104fffd27ca967ee8e15a123050e2 Author: Alan Cox Date: Mon Sep 22 15:58:14 2008 +0100 pcmcia: Fix broken abuse of dev->driver_data PCMCIA abuses dev->private_data in the probe methods. Unfortunately it continues to abuse it after calling drv->probe() which leads to crashes and other nasties (such as bogus probes of multifunction devices) giving errors like pcmcia: registering new device pcmcia0.1 kernel: 0.1: GetNextTuple: No more items Extract the passed data before calling the driver probe function that way we don't blow up when the driver reuses dev->private_data as its right. As its close to the final release just move the hack so it works out, hopefully someone will be sufficiently embarrassed to produce a nice rework for 2.6.28. Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds commit ae9111912500db9fcc244ec16c3d7e471c551f52 Merge: 18f22fb... 1577e4b... Author: Linus Torvalds Date: Mon Sep 22 07:46:06 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: jornada720_ts - fix build error ( LONG() usage ) Input: bcm5974 - switch back to normal mode when closing commit 18f22fbb8ba5570a5ea3d531bc4ec65cf211f11b Merge: 72d3105... ad55dca... Author: Linus Torvalds Date: Mon Sep 22 07:45:06 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: netdev: simple_tx_hash shouldn't hash inside fragments commit b1132b3d874dcef296a63b46680a41b02de66bb4 Author: Haavard Skinnemoen Date: Fri Sep 19 18:50:45 2008 +0200 ALSA: ASoC: Fix at32-pcm build breakage with PM enabled s/PDC_PTCR/ATMEL_PDC_PTCR/ Signed-off-by: Haavard Skinnemoen Acked-by: Mark Brown Signed-off-by: Takashi Iwai commit b61e06f258e50b25c38a73bea782bdb6876f0f70 Author: Andrea Righi Date: Sat Sep 20 18:02:27 2008 +0200 x86, oprofile: BUG scheduling while atomic nmi_shutdown() calls unregister_die_notifier() from an atomic context after setting preempt_disable() via get_cpu_var(): [ 1049.404154] BUG: scheduling while atomic: oprofiled/7796/0x00000002 [ 1049.404171] INFO: lockdep is turned off. [ 1049.404176] Modules linked in: oprofile af_packet rfcomm l2cap kvm_intel kvm i915 drm acpi_cpufreq cpufreq_userspace cpufreq_conservative cpufreq_ondemand cpufreq_powersave freq_table container sbs sbshc dm_mod arc4 ecb cryptomgr aead snd_hda_intel crypto_blkcipher snd_pcm_oss crypto_algapi snd_pcm iwlagn iwlcore snd_timer iTCO_wdt led_class btusb iTCO_vendor_support snd psmouse bluetooth mac80211 soundcore cfg80211 snd_page_alloc intel_agp video output button battery ac dcdbas evdev ext3 jbd mbcache sg sd_mod piix ata_piix libata scsi_mod dock tg3 libphy ehci_hcd uhci_hcd usbcore thermal processor fan fuse [ 1049.404362] Pid: 7796, comm: oprofiled Not tainted 2.6.27-rc5-mm1 #30 [ 1049.404368] Call Trace: [ 1049.404384] [] thread_return+0x4a0/0x7d3 [ 1049.404396] [] generic_exec_single+0x52/0xe0 [ 1049.404405] [] generic_exec_single+0xda/0xe0 [ 1049.404414] [] smp_call_function_single+0x73/0x150 [ 1049.404423] [] schedule_timeout+0x95/0xd0 [ 1049.404430] [] wait_for_common+0x43/0x180 [ 1049.404438] [] wait_for_common+0x114/0x180 [ 1049.404448] [] default_wake_function+0x0/0x10 [ 1049.404457] [] synchronize_rcu+0x30/0x40 [ 1049.404463] [] wakeme_after_rcu+0x0/0x10 [ 1049.404472] [] _spin_unlock_irqrestore+0x40/0x80 [ 1049.404482] [] atomic_notifier_chain_unregister+0x3f/0x60 [ 1049.404501] [] nmi_shutdown+0x51/0x90 [oprofile] [ 1049.404517] [] oprofile_shutdown+0x34/0x70 [oprofile] [ 1049.404532] [] event_buffer_release+0xe/0x40 [oprofile] [ 1049.404543] [] __fput+0xcd/0x240 [ 1049.404551] [] filp_close+0x54/0x90 [ 1049.404560] [] put_files_struct+0xb1/0xd0 [ 1049.404568] [] do_exit+0x18f/0x930 [ 1049.404576] [] restore_args+0x0/0x30 [ 1049.404584] [] do_group_exit+0x36/0xa0 [ 1049.404592] [] system_call_fastpath+0x16/0x1b This can be easily triggered with 'opcontrol --shutdown'. Simply move get_cpu_var() above unregister_die_notifier(). Signed-off-by: Andrea Righi Acked-by: Robert Richter Signed-off-by: Ingo Molnar commit 72d31053f62c4bc464c2783974926969614a8649 Author: Linus Torvalds Date: Sun Sep 21 15:29:55 2008 -0700 Linux 2.6.27-rc7 commit d541b22abde3e71af4b65d79a510b6bc551d5f76 Merge: 6f21d80... d130d97... Author: Linus Torvalds Date: Sun Sep 21 12:41:19 2008 -0700 Merge branch 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6 * 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6: hwmon: (ad7414) Make ad7414_update_device() static hwmon: (it87) Fix fan tachometer reading in IT8712F rev 0x7 (I) hwmon: (atxp1) Fix device detection logic commit 6f21d806f698a5c437dcae1f03e8dd73e3f5aab1 Merge: e59e14b... 9f72632... Author: Linus Torvalds Date: Sun Sep 21 12:40:56 2008 -0700 Merge branch 'kvm-updates/2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm * 'kvm-updates/2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm: KVM: ia64: 'struct fdesc' build fix commit e59e14b6602a106c5f88b70264f814a987b2d7a4 Merge: 5c0a95c... 6b3766a... Author: Linus Torvalds Date: Sun Sep 21 12:40:30 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] vmlinux.lds.S: handle .text.* [MIPS] Fix potential latency problem due to non-atomic cpu_wait. [MIPS] SMTC: Clear TIF_FPUBOUND on clone / fork. [MIPS] Fix 64-bit IP checksum code commit 5c0a95c73f80c034914e219eee8075acdf56b527 Merge: baaea1d... a650031... Author: Linus Torvalds Date: Sun Sep 21 12:38:45 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc: mmc_test: initialize mmc_test_lock statically mmc_block: handle error from mmc_register_driver() atmel-mci: Set MMC_CAP_NEEDS_POLL if no detect_pin atmel-mci: Fix bogus debugfs file size atmel-mci: Fix memory leak in atmci_regs_show atmel-mci: debugfs: enable clock before dumping regs tmio_mmc: fix compilation with debug enabled commit baaea1dc0befb7b64e6dbf2d1469d0a296a79e54 Author: Jean Delvare Date: Sat Sep 20 12:34:33 2008 +0200 MAINTAINERS: Various fixes * Normalize some S: entries to match the enumeration at the beginning of the file. * Change one mailing list entry from S: to L:. Signed-off-by: Jean Delvare Signed-off-by: Linus Torvalds commit 795fb7e74dff04f661b61eccd3c48554b7d1f747 Author: Jean Delvare Date: Sat Sep 20 12:33:08 2008 +0200 MAINTAINERS: Trivial whitespace cleanups * Drop trailing whitespace. * Replace spaces and combinations of spaces and tabs by single tabs. Signed-off-by: Jean Delvare Signed-off-by: Linus Torvalds commit 6b3766a263a62fc82ca0457faa73dc34b98ceb87 Author: Atsushi Nemoto Date: Tue Aug 5 23:45:14 2008 +0900 [MIPS] vmlinux.lds.S: handle .text.* The -ffunction-sections puts each text in .text.function_name section. Without this patch, most functions are placed outside _text..._etext area and it breaks show_stacktrace(), etc. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit c65a5480ff29198c241f11d39d9e34ab22c72c69 Author: Atsushi Nemoto Date: Mon Nov 12 02:05:18 2007 +0900 [MIPS] Fix potential latency problem due to non-atomic cpu_wait. If an interrupt happened between checking of NEED_RESCHED and WAIT instruction, adjust EPC to restart from checking of NEED_RESCHED. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit 6657fe0a0281e06ff46eb42bc18ecb68d8b14b27 Author: Ralf Baechle Date: Tue Sep 9 15:19:10 2008 +0200 [MIPS] SMTC: Clear TIF_FPUBOUND on clone / fork. Signed-off-by: Ralf Baechle commit b80a1b80818cd83c6c2109081b43551e7af72c84 Author: Atsushi Nemoto Date: Sat Sep 20 17:20:04 2008 +0200 [MIPS] Fix 64-bit IP checksum code Use unsigned loads to avoid possible misscalculation of IP checksums. This bug was instruced in f761106cd728bcf65b7fe161b10221ee00cf7132 (lmo) / ed99e2bc1dc5dc54eb5a019f4975562dbef20103 (kernel.org). [Original fix by Atsushi. Improved instruction scheduling and fix for unaligned unsigned load by me -- Ralf] Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit ad55dcaff0e34269f86975ce2ea0da22e9eb74a1 Author: Alexander Duyck Date: Sat Sep 20 22:05:50 2008 -0700 netdev: simple_tx_hash shouldn't hash inside fragments Currently simple_tx_hash is hashing inside of udp fragments. As a result packets are getting getting sent to all queues when they shouldn't be. This causes a serious performance regression which can be seen by sending UDP frames larger than mtu on multiqueue devices. This change will make it so that fragments are hashed only as IP datagrams w/o any protocol information. Signed-off-by: Alexander Duyck Signed-off-by: David S. Miller commit 7ee766d8fba9dfd93bf3eca7a8d84a25404a68dc Author: David S. Miller Date: Sat Sep 20 22:00:40 2008 -0700 sparc64: Fix disappearing PCI devices on e3500. Based upon a bug report by Meelis Roos. The OF device layer builds properties by matching bus types and applying 'range' properties as appropriate, up to the root. The match for "PCI" busses is looking at the 'device_type' property, and this does work %99 of the time. But on an E3500 system with a PCI QFE card, the DEC 21153 bridge sitting above the QFE network interface devices has a 'name' of "pci", but it completely lacks a 'device_type' property. So we don't match it as a PCI bus, and subsequently we end up with no resource values at all for the devices sitting under that DEC bridge. Signed-off-by: David S. Miller commit a650031a6bd16cb6789da9b3c27fc97341239f12 Author: Akinobu Mita Date: Sat Sep 13 19:03:32 2008 +0900 mmc_test: initialize mmc_test_lock statically The mutex mmc_test_lock is initialized at every time mmc_test device is probed. Probing another mmc_test device may break the mutex, if the probe function is called while the mutex is locked. This patch fixes it by statically initializing mmc_test_lock. Signed-off-by: Akinobu Mita Signed-off-by: Pierre Ossman commit 9d4e98e9609bc19d4a8ac4a5c3218358d1820114 Author: Akinobu Mita Date: Sat Sep 13 19:02:07 2008 +0900 mmc_block: handle error from mmc_register_driver() Check error from mmc_register_driver() and properly unwind block device registration. Signed-off-by: Akinobu Mita Signed-off-by: Pierre Ossman commit da45b66ec89bbf3a1c172688c35d4d3a6e8e757f Author: Haavard Skinnemoen Date: Fri Sep 19 21:09:30 2008 +0200 atmel-mci: Set MMC_CAP_NEEDS_POLL if no detect_pin This allows the mmc core to detect card insertion/removal for slots that don't have any CD pin wired up. Signed-off-by: Haavard Skinnemoen Signed-off-by: Pierre Ossman commit 75d33cc751214f8388d58fca3ef6d1df786b5861 Author: Haavard Skinnemoen Date: Fri Sep 19 21:09:29 2008 +0200 atmel-mci: Fix bogus debugfs file size We used to store a binary register snapshot in the "regs" file, so we set the file size to be the size of this snapshot. This is no longer valid since we switched to using seq_file. Signed-off-by: Haavard Skinnemoen Signed-off-by: Pierre Ossman commit b17339a12c279d73869c74a37642035cd2f896f8 Author: Haavard Skinnemoen Date: Fri Sep 19 21:09:28 2008 +0200 atmel-mci: Fix memory leak in atmci_regs_show The debugfs hook atmci_regs_show allocates a temporary buffer for storing a register snapshot, but it doesn't free it before returning. Plug this leak. Signed-off-by: Haavard Skinnemoen Signed-off-by: Pierre Ossman commit 87e60f2b80202575a23fa1bf56c6eb3b419c480a Author: Haavard Skinnemoen Date: Fri Sep 19 21:09:27 2008 +0200 atmel-mci: debugfs: enable clock before dumping regs Make sure that the peripheral clock is enabled before reading the MMIO registers for the debugfs "regs" dump. Signed-off-by: Haavard Skinnemoen Signed-off-by: Pierre Ossman commit fe246eb0b7f2e995c4f172f360bc4e86baccaafe Author: Dmitry Baryshkov Date: Wed Sep 3 19:33:30 2008 +0400 tmio_mmc: fix compilation with debug enabled Signed-off-by: Dmitry Baryshkov Acked-by: Ian Molton Signed-off-by: Pierre Ossman commit d130d97154f5342973a0fffc0b5a144359273c79 Author: Adrian Bunk Date: Sat Sep 20 10:25:20 2008 +0200 hwmon: (ad7414) Make ad7414_update_device() static This patch makes the needlessly global ad7414_update_device() static. Signed-off-by: Adrian Bunk Acked-by: Sean MacLennan Signed-off-by: Jean Delvare commit 859b9ef30cc1bdba4b55327b95b22489bd5591c2 Author: Andrew Paprocki Date: Sat Sep 20 10:25:19 2008 +0200 hwmon: (it87) Fix fan tachometer reading in IT8712F rev 0x7 (I) The IT8712F v0.9.1 datasheet applies to revisions >= 0x8 (J). The driver was incorrectly attempting to enable 16-bit fan readings on rev 0x7 (I) which led to incorrect RPM values. Signed-off-by: Andrew Paprocki Tested-by: John Gumb Signed-off-by: Jean Delvare commit 13b3c3fa27f8f4ed306ce624f446fab000dd8ee4 Author: Jean Delvare Date: Sat Sep 20 10:25:19 2008 +0200 hwmon: (atxp1) Fix device detection logic The atxp1 device detection code has a major logic flaw, fix it. Not sure how we managed to miss this when the driver was merged... Signed-off-by: Jean Delvare Acked-by: Sebastian Witt commit 9f7263236aa4401f8e52cae084f652175b7a7b5f Author: Jes Sorensen Date: Fri Sep 12 14:12:08 2008 +0200 KVM: ia64: 'struct fdesc' build fix Commit 4611a77 ("[IA64] fix compile failure with non modular builds") introduced struct fdesc into asm/elf.h, which duplicates KVM's definition. Remove the latter to avoid the build error. Signed-off-by: Jes Sorensen Acked-by: Tony Luck Signed-off-by: Avi Kivity commit 9824b8f11373b0df806c135a342da9319ef1d893 Merge: ab048fb... 9adb8c1... Author: Linus Torvalds Date: Fri Sep 19 16:24:03 2008 -0700 Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6: [S390] cio: fix orb initialization in cio_start_key [S390] cio: Fix driver_data handling for ccwgroup devices. commit ab048fb1aafff7883a6bbe62b5354fbc2fa5597c Merge: 5a0cd4e... 2fd6f6e... Author: Linus Torvalds Date: Fri Sep 19 16:21:59 2008 -0700 Merge git://oss.sgi.com:8090/xfs/linux-2.6 * git://oss.sgi.com:8090/xfs/linux-2.6: [XFS] Don't do I/O beyond eof when unreserving space [XFS] Fix use-after-free with buffers [XFS] Prevent lockdep false positives when locking two inodes. [XFS] Fix barrier status change detection. [XFS] Prevent direct I/O from mapping extents beyond eof [XFS] Fix regression introduced by remount fixup [XFS] Move memory allocations for log tracing out of the critical path commit 5a0cd4eb661fea095ff9962060c21c161a9ed43f Merge: b4df9d8... 7e2c232... Author: Linus Torvalds Date: Fri Sep 19 16:18:21 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IPoIB: Fix deadlock on RTNL between bcast join comp and ipoib_stop() RDMA/nes: Fix client side QP destroy IB/mlx4: Fix up fast register page list format mlx4_core: Set RAE and init mtt_sz field in FRMR MPT entries commit b4df9d88a62c6db4cee0d96507a27527bf205dde Merge: 902f2ac... ec5d498... Author: Linus Torvalds Date: Fri Sep 19 16:17:12 2008 -0700 Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: fix deadlock in setting scheduler parameter to zero sched: fix 2.6.27-rc5 couldn't boot on tulsa machine randomly commit 902f2ac9da7975a5a04fc835860f2a7096c481d3 Merge: 06d4a22... 2344abb... Author: Linus Torvalds Date: Fri Sep 19 16:16:50 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: clockevents: make device shutdown robust clocksource, acpi_pm.c: fix check for monotonicity clockevents: remove WARN_ON which was used to gather information commit 06d4a22be3af824cfcbf53ac84d95bd700a949c2 Merge: b971963... ba0593b... Author: Linus Torvalds Date: Fri Sep 19 16:11:09 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: completely disable NOPL on 32 bits x86/paravirt: Remove duplicate paravirt_pagetable_setup_{start, done}() xen: fix for xen guest with mem > 3.7G x86: fix possible x86_64 and EFI regression arch/x86/kernel/kdebugfs.c: introduce missing kfree commit b9719635f85b1d3c54775b53ea45fdd8e7496682 Merge: e72a68f... 2d291e9... Author: Linus Torvalds Date: Fri Sep 19 16:05:05 2008 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: Fix compile failure with non modular builds powerpc: Holly board needs dtbImage target powerpc: Fix interrupt values for DMA2 in MPC8610 HPCD device tree commit e72a68fc26887d2097fd7f14794aeb7c17851a5d Merge: 1cce92a... 58005b3... Author: Linus Torvalds Date: Fri Sep 19 16:04:42 2008 -0700 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] 5255/1: Update jornada ssp to remove build errors/warnings [ARM] omap: back out 'internal_clock' support [ARM] 5249/1: davinci: remove redundant check in davinci_psc_config() commit 1cce92aef225171705c3f53a871938abca2177de Merge: 79d57ab... 3d431a7... Author: Linus Torvalds Date: Fri Sep 19 16:03:38 2008 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6 * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6: avr32: nmi_enter() without nmi_exit() avr32: fix sys_sync_file_range() call convention avr32: add generic_find_next_le_bit bit function avr32: add .gitignore files atstk1000: fix build breakage with BOARD_ATSTK100X_SW2_CUSTOM=y commit 79d57ab98b7bc32e5bb20683814cfb76dbb54a9e Merge: a19eee5... 9744197... Author: Linus Torvalds Date: Fri Sep 19 16:02:52 2008 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: Don't wait UNINTERRUPTIBLE for other resync to finish commit a19eee5e5e8b11b4a37490f1272d9509dcfcb263 Merge: 764527a... 9843099... Author: Linus Torvalds Date: Fri Sep 19 16:02:05 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Fix SMP bootup with CONFIG_STACK_DEBUG or ftrace. sparc64: Fix OOPS in psycho_pcierr_intr_other(). commit 764527a1b3294b4560203979f39a3671b9a26676 Merge: 45e9c0d... e727240... Author: Linus Torvalds Date: Fri Sep 19 16:01:37 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: e100: Use pci_pme_active to clear PME_Status and disable PME# e1000: prevent corruption of EEPROM/NVM forcedeth: call restore mac addr in nv_shutdown path bnx2: Promote vector field in bnx2_irq structure from u16 to unsigned int sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH sctp: do not enable peer features if we can't do them. sctp: set the skb->ip_summed correctly when sending over loopback. udp: Fix rcv socket locking commit 3d431a742728e6b619ce57a030a92d228c13d1d2 Author: Manfred Spraul Date: Wed Aug 20 15:39:59 2008 +0200 avr32: nmi_enter() without nmi_exit() While updating the rcu code, I noticed that do_nmi() for AVR32 is odd: There is an nmi_enter() call without an nmi_exit(). This can't be correct, it breaks rcu (at least the preempt version) and lockdep. [haavard.skinnemoen@atmel.com: fixed another case that returned directly] Signed-off-by: Haavard Skinnemoen commit 73d4393d1df4ff3892b040396f101ede94e9e846 Author: Hans-Christian Egtvedt Date: Wed Sep 17 13:39:45 2008 +0200 avr32: fix sys_sync_file_range() call convention On AVR32, all parameters beyond the 5th are passed on the stack. System calls don't use the stack -- they borrow a callee-saved register instead. This means that syscalls that take 6 parameters must be called through a stub that pushes the last parameter on the stack. This patch adds a stub for sync_file_range syscall on AVR32 architecture. Tested with uClibc snapshot. Signed-off-by: Hans-Christian Egtvedt Signed-off-by: Haavard Skinnemoen commit e37925ebdb9738fc7968119198c6997e79093c02 Author: Hans-Christian Egtvedt Date: Wed Sep 10 15:52:04 2008 +0200 avr32: add generic_find_next_le_bit bit function This patch implements the generic_find_next_le_bit bit function for AVR32 architecture. This is used by EXT4 file system. Signed-off-by: Hans-Christian Egtvedt Signed-off-by: Haavard Skinnemoen commit 1b771c12b56fdea6c0596a69c63b097b62ce9f41 Author: Markus Heidelberg Date: Mon Sep 8 00:22:45 2008 +0200 avr32: add .gitignore files Ignore Kernel binaries, kernel/vmlinux.lds and a log file. Signed-off-by: Markus Heidelberg Signed-off-by: Haavard Skinnemoen commit 7fb61a7b6f9111245867fa2bce47949f4298d430 Author: Haavard Skinnemoen Date: Fri Sep 19 17:56:54 2008 +0200 atstk1000: fix build breakage with BOARD_ATSTK100X_SW2_CUSTOM=y The #ifdef surrounding the code adding the mmc controller had a typo, causing it to be compiled even when mmc was supposed to be disabled. Signed-off-by: Haavard Skinnemoen commit 9744197c3d7b329590c2be33ad7b17409bd798fe Author: NeilBrown Date: Fri Sep 19 11:49:54 2008 +1000 md: Don't wait UNINTERRUPTIBLE for other resync to finish When two md arrays share some block device (e.g each uses different partitions on the one device), a resync of one array will wait for the resync on the other to finish. This can be a long time and as it currently waits TASK_UNINTERRUPTIBLE, the softlockup code notices and complains. So use TASK_INTERRUPTIBLE instead and make sure to flush signals before calling schedule. Signed-off-by: NeilBrown commit e7272403d2f9be3dbb7cc185fcc390e781b1af6b Author: Rafael J. Wysocki Date: Fri Aug 8 00:18:04 2008 +0200 e100: Use pci_pme_active to clear PME_Status and disable PME# Currently e100 uses pci_enable_wake() to clear pending wake-up events and disable PME# during intitialization, but that function is not suitable for this purpose, because it immediately returns error code if device_may_wakeup() returns false for given device. Make e100 use pci_pme_active(), which carries out exactly the required operations, instead. Signed-off-by: Rafael J. Wysocki Signed-off-by: Jeff Garzik commit 78566fecbb12a7616ae9a88b2ffbc8062c4a89e3 Author: Christopher Li Date: Fri Sep 5 14:04:05 2008 -0700 e1000: prevent corruption of EEPROM/NVM Andrey reports e1000 corruption, and that a patch in vmware's ESX fixed it. The EEPROM corruption is triggered by concurrent access of the EEPROM read/write. Putting a lock around it solve the problem. [akpm@linux-foundation.org: use DEFINE_SPINLOCK to avoid confusing lockdep] Signed-off-by: Christopher Li Reported-by: Andrey Borzenkov Cc: Zach Amsden Cc: Pratap Subrahmanyam Cc: Jeff Kirsher Cc: Jesse Brandeburg Cc: Bruce Allan Cc: PJ Waskiewicz Cc: John Ronciak Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit f55c21fd9a92a444e55ad1ca4e4732d56661bf2e Author: Yinghai Lu Date: Sat Sep 13 13:10:31 2008 -0700 forcedeth: call restore mac addr in nv_shutdown path after | commit f735a2a1a4f2a0f5cd823ce323e82675990469e2 | Author: Tobias Diedrich | Date: Sun May 18 15:02:37 2008 +0200 | | [netdrvr] forcedeth: setup wake-on-lan before shutting down | | When hibernating in 'shutdown' mode, after saving the image the suspend hook | is not called again. | However, if the device is in promiscous mode, wake-on-lan will not work. | This adds a shutdown hook to setup wake-on-lan before the final shutdown. | | Signed-off-by: Tobias Diedrich | Signed-off-by: Jeff Garzik my servers with nvidia ck804 and mcp55 will reverse mac address with kexec. it turns out that we need to restore the mac addr in nv_shutdown(). [akpm@linux-foundation.org: fix typo in printk] Signed-off-by: Yinghai Lu Cc: Tobias Diedrich Cc: Ayaz Abdulla Cc: Jeff Garzik Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit 27ed9ddfde8d2967076c51815e4ce297c4a18139 Author: Benjamin Li Date: Thu Sep 18 16:46:11 2008 -0700 bnx2: Promote vector field in bnx2_irq structure from u16 to unsigned int The bnx2 driver stores/uses the irq value from the pci_dev internally. But when it stores the irq value, it has been performing an integer demotion. Because of the recent changes made to arch/x86/kernel/io_apic.c, the new method in creating the irq value (using build_irq_for_pci_dev()) has exposed this bug on x86 systems. Because of this demotion when calling request_irq() from bnx2_request_irq(), the driver would get a return code of -EINVAL. This is because the kernel could not find the requested irq descriptor. By storing the irq value properly, the kernel can find the correct irq descriptor and the bnx2 driver can operate normally. Signed-off-by: Benjamin Li Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit add52379dde2e5300e2d574b172e62c6cf43b3d3 Author: Vlad Yasevich Date: Thu Sep 18 16:28:27 2008 -0700 sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH If INIT-ACK is received with SupportedExtensions parameter which indicates that the peer does not support AUTH, the packet will be silently ignore, and sctp_process_init() do cleanup all of the transports in the association. When T1-Init timer is expires, OOPS happen while we try to choose a different init transport. The solution is to only clean up the non-active transports, i.e the ones that the peer added. However, that introduces a problem with sctp_connectx(), because we don't mark the proper state for the transports provided by the user. So, we'll simply mark user-provided transports as ACTIVE. That will allow INIT retransmissions to work properly in the sctp_connectx() context and prevent the crash. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit 0ef46e285c062cbe35d60c0adbff96f530d31c86 Author: Vlad Yasevich Date: Thu Sep 18 16:27:38 2008 -0700 sctp: do not enable peer features if we can't do them. Do not enable peer features like addip and auth, if they are administratively disabled localy. If the peer resports that he supports something that we don't, neither end can use it so enabling it is pointless. This solves a problem when talking to a peer that has auth and addip enabled while we do not. Found by Andrei Pelinescu-Onciul . Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit 58005b325394b18b8b6a737e06b4128deb2c4e63 Author: Kristoffer Ericson Date: Thu Sep 18 12:19:39 2008 +0100 [ARM] 5255/1: Update jornada ssp to remove build errors/warnings * Adds ssp functions into header so we don't get "implicit declaration" error at builtime. * Converts jornada_ssp_start/end functions into voids with proper declarations (to avoid "prototype..." warning). * Sorts include files in alphabetical order * Minor comment changes Signed-off-by: Kristoffer Ericson Signed-off-by: Russell King commit a3028b8ed1e1e9930bfa70ce4555fb7f9fad3dcc Author: Vlad Yasevich Date: Thu Sep 18 02:48:25 2008 -0700 sctp: set the skb->ip_summed correctly when sending over loopback. Loopback used to clobber the ip_summed filed which sctp then used to figure out if it needed to do checksumming or not. Now that loopback doesn't do that any more, sctp needs to set the ip_summed field correctly. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit 7e4f88da7bf1887563f70bd5edbbd0479e31dc12 Author: Joerg Roedel Date: Wed Sep 17 14:19:15 2008 +0200 AMD IOMMU: protect completion wait loop with iommu lock The unlocked polling of the ComWaitInt bit in the IOMMU completion wait path is racy. Protect it with the iommu lock. Signed-off-by: Joerg Roedel Signed-off-by: Ingo Molnar commit ee2fa7435b6dddf1ca119f298ad0100cf50c0397 Author: Joerg Roedel Date: Wed Sep 17 13:47:25 2008 +0200 AMD IOMMU: set iommu sunc flag after command queuing The iommu->need_sync flag must be set after the command is queued to avoid race conditions. Signed-off-by: Joerg Roedel Signed-off-by: Ingo Molnar commit 7424bac82ff3bd956ea04101550e01bdae17284d Author: Alexander Beregalov Date: Wed Sep 17 22:09:41 2008 +0400 UBIFS: fix printk format warnings fs/ubifs/dir.c:428: warning: format '%llu' expects type 'long long unsigned int', but argument 5 has type 'long unsigned int' fs/ubifs/debug.c:541: warning: format '%llu' expects type 'long long unsigned int', but argument 2 has type 'long unsigned int' Signed-off-by: Alexander Beregalov Signed-off-by: Artem Bityutskiy commit 7e8bc3c6db9b4b74842b1c70bbf5c2a99a112b0d Author: Russell King Date: Wed Sep 17 20:58:11 2008 +0100 [ARM] omap: back out 'internal_clock' support The structures weren't ready for this change: arch/arm/plat-omap/devices.c:320: error: 'struct omap_mmc_conf' has no member named 'internal_clock' arch/arm/plat-omap/devices.c:326: error: implicit declaration of function 'omap_ctrl_readl' arch/arm/plat-omap/devices.c:326: error: 'OMAP2_CONTROL_DEVCONF0' undeclared (first use in this function) arch/arm/plat-omap/devices.c:328: error: implicit declaration of function 'omap_ctrl_writel' Signed-off-by: Russell King commit 380b0fdfd0227d7604cd91ad97fb846ba643e0e7 Author: roelkluin Date: Mon Sep 15 20:56:44 2008 +0100 [ARM] 5249/1: davinci: remove redundant check in davinci_psc_config() id is unsigned, check is redundant. Signed-off-by: Roel Kluin Signed-off-by: Russell King commit 2d291e902791e1c8d72bc223b6f063bbb27a1280 Author: James Bottomley Date: Tue Sep 9 14:04:18 2008 +0000 Fix compile failure with non modular builds Commit deac93df26b20cf8438339b5935b5f5643bc30c9 ("lib: Correct printk %pF to work on all architectures") broke the non modular builds by moving an essential function into modules.c. Fix this by moving it out again and into asm/sections.h as an inline. To do this, the definition of struct ppc64_opd_entry has been lifted out of modules.c and put in asm/elf.h where it belongs. Signed-off-by: James Bottomley Signed-off-by: Paul Mackerras commit 32dde0f975e430f00f03f80f7dbab585d8b45eab Author: Josh Boyer Date: Tue Sep 9 04:00:28 2008 +0000 powerpc: Holly board needs dtbImage target One of the changes in the bootwrapper makefile introduced the dtbImage targets for boards that need a simple zImage with a DTB embedded in them (595be948cce574ff2d5dde5d0426a636a4363c70, "[POWERPC] bootwrapper: Build multiple cuImages"). When this was done, it broke booting on the Holly board as the zImage.holly wrapper did not get the DTB embedded properly. This changes the target for the Holly board to a dtbImage so that the wrapper includes the vmlinux, wrapper bits, and DTB. Signed-off-by: Josh Boyer Signed-off-by: Paul Mackerras commit 6e14968c869cd30e236bb626dd0c16421d2a658d Author: Adrian Hunter Date: Wed Sep 17 10:52:07 2008 +0300 UBIFS: remove incorrect assert The assert was not valid because one of the variables 'taken_empty_lebs' has transient values out of sync with the other variables. Signed-off-by: Adrian Hunter Signed-off-by: Artem Bityutskiy commit 6dcfac4f13d6b32fbaa60b64a23249999e66af8e Author: Adrian Hunter Date: Fri Sep 12 12:27:47 2008 +0300 UBIFS: TNC / GC race fixes - update GC sequence number if any nodes may have been moved even if GC did not finish the LEB - don't ignore error return when reading Signed-off-by: Adrian Hunter Signed-off-by: Artem Bityutskiy commit 0855f310dff76ae42c5aac32f600f8f692bbd23f Author: Sebastian Siewior Date: Tue Sep 9 11:17:29 2008 +0200 UBIFS: create the name of the background thread in every case If the ubifs partition is mounted RO and then remounted RW we end up with no thread name in ubifs_remount_rw() and the thread appears nameless. Signed-off-by: Sebastian Siewior Signed-off-by: Artem Bityutskiy commit 2fd6f6ec64ff347447d26646ac6188f3658b383c Author: Lachlan McIlroy Date: Wed Sep 17 16:52:50 2008 +1000 [XFS] Don't do I/O beyond eof when unreserving space When unreserving space with boundaries that are not block aligned we round up the start and round down the end boundaries and then use this function, xfs_zero_remaining_bytes(), to zero the parts of the blocks that got dropped during the rounding. The problem is we don't consider if these blocks are beyond eof. Worse still is if we encounter delayed allocations beyond eof we will try to use the magic delayed allocation block number as a real block number. If the file size is ever extended to expose these blocks then we'll go through xfs_zero_eof() to zero them anyway. SGI-PV: 983683 SGI-Modid: xfs-linux-melb:xfs-kern:32055a Signed-off-by: Lachlan McIlroy Signed-off-by: Christoph Hellwig commit e1f5dbd7077eebec794452a516cb02f1669b036d Author: Lachlan McIlroy Date: Wed Sep 17 16:52:13 2008 +1000 [XFS] Fix use-after-free with buffers We have a use-after-free issue where log completions access buffers via the buffer log item and the buffer has already been freed. Fix this by taking a reference on the buffer when attaching the buffer log item and release the hold when the buffer log item is detached and we no longer need the buffer. Also create a new function xfs_buf_item_free() to combine some common code. SGI-PV: 985757 SGI-Modid: xfs-linux-melb:xfs-kern:32025a Signed-off-by: Lachlan McIlroy Signed-off-by: Christoph Hellwig commit f9114eba1eb08ee75fd0f1eee780f0290fb3c043 Author: David Chinner Date: Wed Sep 17 16:51:21 2008 +1000 [XFS] Prevent lockdep false positives when locking two inodes. If we call xfs_lock_two_inodes() to grab both the iolock and the ilock, then drop the ilocks on both inodes, then grab them again (as xfs_swap_extents() does) then lockdep will report a locking order problem. This is a false positive. To avoid this, disallow xfs_lock_two_inodes() fom locking both inode locks at once - force calers to make two separate calls. This means that nested dropping and regaining of the ilocks will retain the same lockdep subclass and so lockdep will not see anything wrong with this code. SGI-PV: 986238 SGI-Modid: xfs-linux-melb:xfs-kern:31999a Signed-off-by: David Chinner Signed-off-by: Christoph Hellwig Signed-off-by: Peter Leckie Signed-off-by: Lachlan McIlroy commit b5b8c9acd547244eb2b7d0280ba38b9dd01971cc Author: David Chinner Date: Wed Sep 17 16:50:50 2008 +1000 [XFS] Fix barrier status change detection. The current code in xlog_iodone() uses the wrong macro to check if the barrier has been cleared due to an EOPNOTSUPP error form the lower layer. SGI-PV: 986143 SGI-Modid: xfs-linux-melb:xfs-kern:31984a Signed-off-by: David Chinner Signed-off-by: Nathaniel W. Turner Signed-off-by: Peter Leckie Signed-off-by: Lachlan McIlroy commit 364f358a734ddcd827c662ccbfa58ee3ac510762 Author: Lachlan McIlroy Date: Wed Sep 17 16:50:14 2008 +1000 [XFS] Prevent direct I/O from mapping extents beyond eof With the help from some tracing I found that we try to map extents beyond eof when doing a direct I/O read. It appears that the way to inform the generic direct I/O path (ie do_direct_IO()) that we have breached eof is to return an unmapped buffer from xfs_get_blocks_direct(). This will cause do_direct_IO() to jump to the hole handling code where is will check for eof and then abort. This problem was found because a direct I/O read was trying to map beyond eof and was encountering delayed allocations. The delayed allocations beyond eof are speculative allocations and they didn't get converted when the direct I/O flushed the file because there was only enough space in the current AG to convert and write out the dirty pages within eof. Note that xfs_iomap_write_allocate() wont necessarily convert all the delayed allocation passed to it - it will return after allocating the first extent - so if the delayed allocation extends beyond eof then it will stay that way. SGI-PV: 983683 SGI-Modid: xfs-linux-melb:xfs-kern:31929a Signed-off-by: Lachlan McIlroy Signed-off-by: Christoph Hellwig commit 6efdf281777eb07fac28ac2b2d7df1e619ee6da1 Author: Christoph Hellwig Date: Wed Sep 17 16:49:33 2008 +1000 [XFS] Fix regression introduced by remount fixup Logically we would return an error in xfs_fs_remount code to prevent users from believing they might have changed mount options using remount which can't be changed. But unfortunately mount(8) adds all options from mtab and fstab to the mount arguments in some cases so we can't blindly reject options, but have to check for each specified option if it actually differs from the currently set option and only reject it if that's the case. Until that is implemented we return success for every remount request, and silently ignore all options that we can't actually change. SGI-PV: 985710 SGI-Modid: xfs-linux-melb:xfs-kern:31908a Signed-off-by: Christoph Hellwig Signed-off-by: Tim Shimmin Signed-off-by: Lachlan McIlroy commit 31bd61f2bb79e098117d823e054342b03aa87668 Author: Lachlan McIlroy Date: Wed Sep 17 16:45:37 2008 +1000 [XFS] Move memory allocations for log tracing out of the critical path Memory allocations for log->l_grant_trace and iclog->ic_trace are done on demand when the first event is logged. In xlog_state_get_iclog_space() we call xlog_trace_iclog() under a spinlock and allocating memory here can cause us to sleep with a spinlock held and deadlock the system. For the log grant tracing we use KM_NOSLEEP but that means we can lose trace entries. Since there is no locking to serialize the log grant tracing we could race and have multiple allocations and leak memory. So move the allocations to where we initialize the log/iclog structures. Use KM_NOFS to avoid recursing into the filesystem and drop log->l_trace since it's not even used. SGI-PV: 983738 SGI-Modid: xfs-linux-melb:xfs-kern:31896a Signed-off-by: Lachlan McIlroy Signed-off-by: Christoph Hellwig commit 45e9c0de2e86485f8b6633fd64ab19cfbff167f6 Author: Arjan van de Ven Date: Mon Sep 15 16:43:18 2008 -0700 warn: Turn the netdev timeout WARN_ON() into a WARN() this patch turns the netdev timeout WARN_ON_ONCE() into a WARN_ONCE(), so that the device and driver names are inside the warning message. This helps automated tools like kerneloops.org to collect the data and do statistics, as well as making it more likely that humans cut-n-paste the important message as part of a bugreport. Signed-off-by: Arjan van de Ven Signed-off-by: Linus Torvalds commit c8b0f4382cd7b5e58b17bd30d16898b7f249813c Merge: 1b901aa... 02b71b7... Author: Linus Torvalds Date: Tue Sep 16 19:36:06 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6: slub: fixed uninitialized counter in struct kmem_cache_node commit 1b901aa2b5debe0df02e9d6bb8d86e342b6d47b5 Merge: ef3d771... a834795... Author: Linus Torvalds Date: Tue Sep 16 19:35:49 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] VR41xx: unsigned irq cannot be negative commit ef3d7714f6b75b51825ad0384b5ce48358427e50 Author: David Miller Date: Tue Sep 16 15:00:11 2008 -0700 Fix PNP build failure, bugzilla #11276 This fill fix the following regression list entry: Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=11276 Subject : build error: CONFIG_OPTIMIZE_INLINING=y causes gcc 4.2 to do stupid things Submitter : Randy Dunlap Date : 2008-08-06 17:18 (38 days old) References : http://marc.info/?l=linux-kernel&m=121804329014332&w=4 http://lkml.org/lkml/2008/7/22/353 Handled-By : Bjorn Helgaas Patch : http://lkml.org/lkml/2008/7/22/364 with what I believe is a better fix than the one referenced in the regression entry above. These PNP header interfaces try to work in such a way that you can reference some of them even if PNP is not enabled, and the compiler was expected to optimize everything away. Which is mostly fine, except that there was one interface for which there was not provided an inline "NOP" implementation. Once we add that, all of these compile failures cannot handle any more. pnp: Provide NOP inline implementation of pnp_get_resource() when !PNP Fixes kernel bugzilla #11276. Signed-off-by: David S. Miller Signed-off-by: Linus Torvalds commit 49f276be7ce12d90b6941a000b09e61b68e6c4f2 Author: Stephen Hemminger Date: Tue Sep 16 16:04:12 2008 -0700 hpplus: fix build regression This fixes kernel regression for 2.6.27-rc in http://bugzilla.kernel.org/show_bug.cgi?id=11547 The change to split 8390 into old isa and non-isa versions overlooked this driver. Signed-off-by: Stephen Hemminger Signed-off-by: Linus Torvalds commit e95926d05d028a6bf0ab60b21b484c3d622fdcd1 Author: Linus Torvalds Date: Tue Sep 16 19:32:30 2008 -0700 Revert "b43/b43legacy: add RFKILL_STATE_HARD_BLOCKED support" This reverts commit bc19d6e0b74ef03a3baf035412c95192b54dfc6f, which as Larry Finger reports causes the radio LED on his system to no longer respond to rfkill switch events. Reported-by: Larry Finger Requested-by: John W. Linville Signed-off-by: Linus Torvalds commit b08508c40adf3fd1330aabc4f37d3254179776c4 Author: Greg KH Date: Tue Aug 26 08:20:34 2008 -0700 PCI: fix compiler warnings in pci_get_subsys() pci_get_subsys() changed in 2.6.26 so that the from pointer is modified when the call is being invoked, so fix up the 'const' marking of it that the compiler is complaining about. Reported-by: Rufus & Azrael Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jesse Barnes commit 612f9d338a6060f814ef35b7108b43407a5df423 Author: Timur Tabi Date: Tue Sep 9 14:43:39 2008 -0500 powerpc: Fix interrupt values for DMA2 in MPC8610 HPCD device tree For Freescale 8xxx devices that use an MPIC, the interrupt numbers in the device tree must be 16 greater than the values documented in the reference manual. In these chips, the MPIC is wired to use the first 16 numbers for external interrupts, but the documentation numbers internal interrupts from 0. In the MPC8610 HPCD device tree, the interrupt properties for the DMA channels for DMA2 were not the adjusted values. This fixes that. Signed-off-by: Timur Tabi Signed-off-by: Kumar Gala Signed-off-by: Paul Mackerras commit 2344abbcbdb82140050e8be29d3d55e4f6fe860b Author: Thomas Gleixner Date: Tue Sep 16 11:32:50 2008 -0700 clockevents: make device shutdown robust The device shut down does not cleanup the next_event variable of the clock event device. So when the device is reactivated the possible stale next_event value can prevent the device to be reprogrammed as it claims to wait on a event already. This is the root cause of the resurfacing suspend/resume problem, where systems need key press to come back to life. Fix this by setting next_event to KTIME_MAX when the device is shut down. Use a separate function for shutdown which takes care of that and only keep the direct set mode call in the broadcast code, where we can not touch the next_event value. Signed-off-by: Thomas Gleixner commit 7e2c23285454ecc8c8159b86d6343efe222ca3ae Merge: e8224e4... 29bdc88... d7ffd50... Author: Roland Dreier Date: Tue Sep 16 11:57:52 2008 -0700 Merge branches 'ipoib', 'mlx4' and 'nes' into for-linus commit e8224e4b804b4fd26723191c1891101a5959bb8a Author: Yossi Etigin Date: Tue Sep 16 11:57:45 2008 -0700 IPoIB: Fix deadlock on RTNL between bcast join comp and ipoib_stop() Taking rtnl_lock in ipoib_mcast_join_complete() causes a deadlock with ipoib_stop(). We avoid it by scheduling the piece of code that takes the lock on ipoib_workqueue instead of executing it directly. This works because we only flush the ipoib_workqueue with the RTNL not held. The deadlock happens because ipoib_stop() calls ipoib_ib_dev_down() which calls ipoib_mcast_dev_flush(), which calls ipoib_mcast_free(), which calls ipoib_mcast_leave(). The latter calls ib_sa_free_multicast(), and this waits until the multicast completion handler finishes. This handler is ipoib_mcast_join_complete(), which waits for the rtnl_lock(), which was already taken by ipoib_stop(). This bug was introduced in commit a77a57a1 ("IPoIB: Fix deadlock on RTNL in ipoib_stop()"). Signed-off-by: Yossi Etigin Signed-off-by: Roland Dreier commit d7ffd5076d4407d54b25bc4b25f3002f74fbafde Author: Faisal Latif Date: Tue Sep 16 11:56:26 2008 -0700 RDMA/nes: Fix client side QP destroy Fix QP not being destroyed properly on the client, which leads to userspace programs hanging on exit. This is a missing chunk from the connection management rewrite in commit 6492cdf3 ("RDMA/nes: CM connection setup/teardown rework"). Signed-off-by: Faisal Latif Signed-off-by: Roland Dreier commit 9843099ff46467461d6476a827f6f9701682dbac Author: David S. Miller Date: Tue Sep 16 11:44:00 2008 -0700 sparc64: Fix SMP bootup with CONFIG_STACK_DEBUG or ftrace. Based upon a report by Meelis Roos. Any function call can try to access the current thread register via the _mcount hooks when the kernel is built with -pg (via ftrace or STACK_DEBUG). That can't be setup properly very early on during the bootup of other cpus for sun4u and some early sun4v systems. So add notrace markers to these specific functions, so that _mcount doesn't get invoked too early. Signed-off-by: David S. Miller commit 1577e4b70a04cce39f296cc714da5ad5d272105a Author: Kristoffer Ericson Date: Tue Sep 16 14:19:25 2008 -0400 Input: jornada720_ts - fix build error ( LONG() usage ) This patch removes the usage of LONG() which is deprecated; we also replace BIT() with BIT_MASK(). signed-off-by: Kristoffer Ericson Signed-off-by: Dmitry Torokhov commit f948cc6ab9e61a8e88d70ee9aafc690e6d26f92c Author: David S. Miller Date: Tue Sep 16 09:53:42 2008 -0700 sparc64: Fix OOPS in psycho_pcierr_intr_other(). We no longer put the top-level PCI controller device into the PCI layer device list. So pbm->pci_bus->self is always NULL. Therefore, use direct PCI config space accesses to get at the PCI controller's PCI_STATUS register. Tested by Meelis Roos. Signed-off-by: David S. Miller commit 9adb8c1d4f0ac78b3469e377ce5f8a846cbaedaf Author: Stefan Weinhuber Date: Tue Sep 16 09:32:19 2008 -0700 [S390] cio: fix orb initialization in cio_start_key The functions cio_tm_start_key and cio_start_key use the same private orb structure of a subchannel, so the orb needs to be cleared of old data before it is used again. A respective memset is missing from cio_start_key and hereby added. Signed-off-by: Stefan Weinhuber Acked-by: Cornelia Huck Signed-off-by: Martin Schwidefsky commit f26fd5d6e5006eae75a389c7ce74ed16761d094b Author: Cornelia Huck Date: Tue Sep 16 09:32:18 2008 -0700 [S390] cio: Fix driver_data handling for ccwgroup devices. Since 16f7f9564c3ae190954f2ec55f385a268b93ac4d, we've seen oopses when grouping/ungrouping devices: Unable to handle kernel pointer dereference at virtual kernel address 0000000000 114000 Oops: 0004 [#1] PREEMPT SMP Modules linked in: bonding qeth_l2 dm_multipath sunrpc qeth_l3 dm_mod qeth chsc_ sch ccwgroup CPU: 1 Not tainted 2.6.26-29.x.20080815-s390xdefault #1 Process iperf (pid: 24412, task: 000000003f446038, ksp: 000000003c929e08) Krnl PSW : 0404d00180000000 000003e00006f6e6 (qeth_irq+0xda/0xb28 [qeth]) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 EA:3 Krnl GPRS: 0000000000000000 000003e000000003 0000000000000000 0000000000114ccc 000000003fb82e48 000003e00006f60c 000000000000000c 000000003ce72100 0000000000114944 000000003fb82e48 0000000000114ccc 000000003fe8fd28 000003e000066000 000003e000076128 000000003fe8fdb8 000000003fe8fd28 Krnl Code: 000003e00006f6da: bf3f2024 icm %r3,15,36(%r2) 000003e00006f6de: a774023c brc 7,3e00006fb56 000003e00006f6e2: a7280000 lhi %r2,0 >000003e00006f6e6: 5020a1a0 st %r2,416(%r10) 000003e00006f6ea: 58109000 l %r1,0(%r9) 000003e00006f6ee: a7111000 tmll %r1,4096 000003e00006f6f2: a77400f9 brc 7,3e00006f8e4 000003e00006f6f6: 8810000c srl %r1,12 Call Trace: ([<000000003fe8fd20>] 0x3fe8fd20) [<000000000033bf2a>] ccw_device_call_handler+0xb2/0xd8 [<0000000000339e1c>] ccw_device_irq+0x124/0x164 [<0000000000339758>] io_subchannel_irq+0x8c/0x118 [<00000000003309ba>] do_IRQ+0x192/0x1bc [<0000000000114f66>] io_return+0x0/0x8 [<00000000001149cc>] sysc_do_svc+0x0/0x22 ([<0000000000114a18>] sysc_noemu+0x10/0x16) [<00000200002e047c>] 0x200002e047c Last Breaking-Event-Address: [<000003e00006f6d6>] qeth_irq+0xca/0xb28 [qeth] The problem is that dev->driver_data for a ccw device is NULL, while it should point to the ccwgroup device it is a member of. This happened due to incorrect cleanup if creating a ccwgroup device failed because the ccw devices were already grouped. Fix this by setting cdev[i] to NULL in the error handling of ccwgroup_create_from_string() after we give up our reference and by checking if the driver_data points to the ccwgroup device in ccwgroup_release() just to be really sure. Signed-off-by: Cornelia Huck Signed-off-by: Martin Schwidefsky commit ba0593bf553c450a03dbc5f8c1f0ff58b778a0c8 Author: H. Peter Anvin Date: Tue Sep 16 09:29:40 2008 -0700 x86: completely disable NOPL on 32 bits Completely disable NOPL on 32 bits. It turns out that Microsoft Virtual PC is so broken it can't even reliably *fail* in the presence of NOPL. This leaves the infrastructure in place but disables it unconditionally. Signed-off-by: H. Peter Anvin commit cd72ad3f57c400baa2ddb78b4fc2781cf68ffb6f Author: Henrik Rydberg Date: Sun Sep 14 11:52:44 2008 -0400 Input: bcm5974 - switch back to normal mode when closing Staying in multi-touch mode after closing the device sometimes makes the keyboard drop keys or repeat keys irratically. The conjecture is that some internal buffer starts to overflow, resulting in undefined behavior. Switching back to normal mode when closing the device makes the problem go away. Signed-off-by: Henrik Rydberg Signed-off-by: Dmitry Torokhov commit e1f4f59d1ab9ebac44830d6ae450fb358ac559d3 Author: Sitsofe Wheeler Date: Tue Sep 16 14:27:13 2008 +0100 PCI: Fix pcie_aspm=force pcie_aspm=force did not work because aspm_force was being double negated leading to the sanity check failing. Moving a bracket should fix this. Acked-by: Alan Cox Signed-off-by: Sitsofe Wheeler Signed-off-by: Jesse Barnes commit a83479545d0e693da0886fd28d041d3a5c1bc966 Author: roel kluin Date: Mon Sep 15 20:50:54 2008 -0400 [MIPS] VR41xx: unsigned irq cannot be negative Signed-off-by: Roel Kluin Acked-by: Yoichi Yuasa Signed-off-by: Ralf Baechle commit 29bdc88384c2b24e37e5760df0dc898546083d6b Author: Vladimir Sokolovsky Date: Mon Sep 15 14:25:23 2008 -0700 IB/mlx4: Fix up fast register page list format Byte swap the addresses in the page list for fast register work requests to big endian to match what the HCA expectx. Also, the addresses must have the "present" bit set so that the HCA knows it can access them. Otherwise the HCA will fault the first time it accesses the memory region. Signed-off-by: Vladimir Sokolovsky Signed-off-by: Roland Dreier commit 93821778def10ec1e69aa3ac10adee975dad4ff3 Author: Herbert Xu Date: Mon Sep 15 11:48:46 2008 -0700 udp: Fix rcv socket locking The previous patch in response to the recursive locking on IPsec reception is broken as it tries to drop the BH socket lock while in user context. This patch fixes it by shrinking the section protected by the socket lock to sock_queue_rcv_skb only. The only reason we added the lock is for the accounting which happens in that function. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 02b71b70129aaaa38f280af2aa5a767a4dec9107 Author: Salman Qazi Date: Thu Sep 11 12:25:41 2008 -0700 slub: fixed uninitialized counter in struct kmem_cache_node Initialized total objects atomic for the node in init_kmem_cache_node. The uninitialized value was ruining the stats in /proc/slabinfo. Acked-by: Christoph Lameter Signed-off-by: Salman Qazi Signed-off-by: Pekka Enberg commit bc45eb8950b8c14487385cfd2bda1613ca8d9703 Merge: 2123870... ba95487... Author: Linus Torvalds Date: Sun Sep 14 22:50:43 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: talitos - Avoid consecutive packets going out with same IV commit ba95487df97f9c45cfdae2a47de56235e7a13dc5 Author: Kim Phillips Date: Sun Sep 14 13:41:19 2008 -0700 crypto: talitos - Avoid consecutive packets going out with same IV The SEC's h/w IV out implementation DMAs the trailing encrypted payload block of the last encryption to ctx->iv. Since the last encryption may still be pending completion, we can sufficiently prevent successive packets from being transmitted with the same IV by xoring with sequence number. Also initialize alg_list earlier to prevent oopsing on a failed probe. Signed-off-by: Kim Phillips Signed-off-by: Lee Nipper Signed-off-by: Herbert Xu commit 5132895f14a57607152f7865dc862fb076ce2585 Author: Alex Nixon Date: Wed Sep 3 14:36:40 2008 +0100 x86/paravirt: Remove duplicate paravirt_pagetable_setup_{start, done}() They were already called once in arch/x86/kernel/setup.c - we don't need to call them again. fixes: http://bugzilla.kernel.org/show_bug.cgi?id=11485 Signed-off-by: Alex Nixon Signed-off-by: Ingo Molnar commit 5670a43d710a12fcbbfaefd3991002768b488d82 Author: Jeremy Fitzhardinge Date: Sun Sep 14 07:42:23 2008 -0700 xen: fix for xen guest with mem > 3.7G PFN_PHYS() can truncate large addresses unless its passed a suitable large type. This is fixed more generally in the patch series introducing phys_addr_t, but we need a short-term fix to solve a Xen regression reported by Roberto De Ioris. Reported-by: Roberto De Ioris Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Ingo Molnar commit 212387055902b65f79463d1934033255aa6b99e1 Author: Uwe Kleine-König Date: Sat Sep 13 22:29:31 2008 +0200 Add Uwe Kleine-König to .mailmap There are a few commits that misencoded my name (or used "oe" instead of "ö"). So add a correct version to .mailmap. Signed-off-by: Uwe Kleine-König Signed-off-by: Linus Torvalds commit 6bfb09a1005193be5c81ebac9f3ef85210142650 Merge: 7c22a3d... 88c381b... Author: Linus Torvalds Date: Sat Sep 13 14:51:22 2008 -0700 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] Fix PCI_DMA_BUS_IS_PHYS for ARM [ARM] 5247/1: tosa: SW_EAR_IN support [ARM] 5246/1: tosa: add proper clock alias for tc6393xb clock [ARM] 5245/1: Fix warning about unused return value in drivers/pcmcia [ARM] OMAP: Fix MMC device data imx serial: fix rts handling for non imx1 based hardware imx serial: set RXD mux bit on i.MX27 and i.MX31 i.MX serial: fix init failure pcm037: add rts/cts support for serial port commit 7c22a3d853804d2716ef4f90cdd693a83819ba11 Merge: 0cb60ef... 97b697a... Author: Linus Torvalds Date: Sat Sep 13 14:48:14 2008 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: [libata] LBA28/LBA48 off-by-one bug in ata.h sata_inic162x: enable LED blinking ata: duplicate variable sparse warning commit 0cb60efd03ed82d02f44a14594714367e59e8abc Merge: c19e808... 395a125... Author: Linus Torvalds Date: Sat Sep 13 14:47:33 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI: re-add debug prints for unmodified BARs PCI: fix pciehp_free_irq() PCI Hotplug: fakephp: fix deadlock... again PCI: Fix printk warnings in setup-bus.c PCI: Fix printk warnings in probe.c PCI/iommu: blacklist DMAR on Intel G31/G33 chipsets commit c19e80808b34b3de5c20884f11f58c3b6988daff Merge: 344a782... cff502a... Author: Linus Torvalds Date: Sat Sep 13 14:46:57 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: niu: panic on reset netlink: fix overrun in attribute iteration [Bluetooth] Fix regression from using default link policy ath9k: Assign seq# when mac80211 requests this commit 344a7829c421ce6c626cb94c6576f66a7c28a871 Merge: 8e82f8c... 7d4ee28... Author: Linus Torvalds Date: Sat Sep 13 14:45:42 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc: Fix user_regset 'n' field values. sparc64: Fix PCI error interrupt registry on PSYCHO. sparc32: Fix function signature of of_bus_sbus_get_flags(). sparc64: Fix interrupt register calculations on Psycho and Sabre. commit 8e82f8c34b1759ae0d80fe96101746ec51fb1ba4 Author: Alex Dubov Date: Sat Sep 13 02:33:26 2008 -0700 memstick: fix MSProHG 8-bit interface mode support - 8-bit interface mode never worked properly. The only adapter I have which supports the 8b mode (the Jmicron) had some problems with its clock wiring and they discovered it only now. We also discovered that ProHG media is more sensitive to the ordering of initialization commands. - Make the driver fall back to highest supported mode instead of always falling back to serial. The driver will attempt the switch to 8b mode for any new MSPro card, but not all of them support it. Previously, these new cards ended up in serial mode, which is not the best idea (they work fine with 4b, after all). - Edit some macros for better conformance to Sony documentation Signed-off-by: Alex Dubov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8d99f83b9478768d3a8d7d1bcd9bd182c75a0447 Author: Andrew Morton Date: Sat Sep 13 02:33:25 2008 -0700 rescan_partitions(): make device capacity errors non-fatal Herton Krzesinski reports that the error-checking changes in 04ebd4aee52b06a2c38127d9208546e5b96f3a19 ("block/ioctl.c and fs/partition/check.c: check value returned by add_partition") cause his buggy USB camera to no longer mount. "The camera is an Olympus X-840. The original issue comes from the camera itself: its format program creates a partition with an off by one error". Buggy devices happen. It is better for the kernel to warn and to proceed with the mount. Reported-by: Herton Ronaldo Krzesinski Cc: Abdel Benamrouche Cc: Jens Axboe Cc: Alan Stern Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 42cde4309b8f2671610be049352df2f8716e8809 Author: Ben Dooks Date: Sat Sep 13 02:33:24 2008 -0700 spi_s3c24xx: fix section warning Fix the section mismatch warning generated by the incorrect naming of s3c24xx_spidrv which should be s3c24xx_spi_driver: WARNING: drivers/spi/spi_s3c24xx.o(.data+0x4): Section mismatch in reference from the variable s3c24xx_spidrv to the (unknown reference) .exit.text:(unknown) Signed-off-by: Ben Dooks Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3aa04f1b07352be89960bddca4db0d5d8c09510c Author: Haavard Skinnemoen Date: Sat Sep 13 02:33:23 2008 -0700 atmel_lcdfb: disable LCD and DMA engines when suspending When suspending the system with atmel_lcdfb enabled, I sometimes see this: atmel_lcdfb atmel_lcdfb.0: FIFO underflow 0x10 Which can be explained by the fact that we're not stopping the LCD controller and its DMA engine when suspending, we're just gating the clocks to them. There's another potential issue which may be harder to trigger but much more nasty: If we gate the clocks at _just_ the right moment, e.g. when the DMA engine is doing a bus transaction, we may cause the DMA engine to violate the system bus protocol and cause a lockup. Avoid these issues by shutting down the LCD controller before entering suspend (and restarting it when resuming). This prevents the underrun from happening in the first place, and prevents whatever nastiness is happening when the bus clock stops in the middle of a DMA transfer. Signed-off-by: Haavard Skinnemoen Acked-by: Nicolas Ferre Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8275d102f8dbaa4f437f6b03b00d85bfb4e16025 Author: Robin Holt Date: Sat Sep 13 02:33:22 2008 -0700 ia64: fix panic during `modprobe -r xpc' If you are on ia64 and you modprobe xpc then modprobe -r xpc, you immediately get a panic. xpc depends on xp which depends on gru for a symbol. That symbol is only used when we are running on UV hardware. Currently, the GRU driver detects we are not on UV hardware and does no initializing. It does not do the same check when unloading. As a result, the gru driver attempts to tear down stuff that was not setup. This is a simple two-line workaround to get us through this release. Once 2.6.28 is opened, we need to rework the symbols that xp is depending on from gru so the gru driver can properly fail to load when hardware is not available. Signed-off-by: Robin Holt Cc: "Luck, Tony" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ecc9a04de66e7b2d40d539cc39d5798bc46553e9 Author: Ming Lei Date: Sat Sep 13 02:33:21 2008 -0700 MAINTAINERS: fix USB VIDEO CLASS mail list address It should be linux-uvc-devel@lists.berlios.de. Signed-off-by: Ming Lei Cc: Mauro Carvalho Chehab Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9f986a8cdf94a5855201cf67db6ffdf926bc4cd9 Author: David Brownell Date: Sat Sep 13 02:33:20 2008 -0700 Documentation/ABI: /sys/class/gpio Provide summary ABI docs about the /sys/class/gpio files. Signed-off-by: David Brownell Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5bead2a0680687b9576d57c177988e8aa082b922 Author: Mel Gorman Date: Sat Sep 13 02:33:19 2008 -0700 mm: mark the correct zone as full when scanning zonelists The iterator for_each_zone_zonelist() uses a struct zoneref *z cursor when scanning zonelists to keep track of where in the zonelist it is. The zoneref that is returned corresponds to the the next zone that is to be scanned, not the current one. It was intended to be treated as an opaque list. When the page allocator is scanning a zonelist, it marks elements in the zonelist corresponding to zones that are temporarily full. As the zonelist is being updated, it uses the cursor here; if (NUMA_BUILD) zlc_mark_zone_full(zonelist, z); This is intended to prevent rescanning in the near future but the zoneref cursor does not correspond to the zone that has been found to be full. This is an easy misunderstanding to make so this patch corrects the problem by changing zoneref cursor to be the current zone being scanned instead of the next one. Signed-off-by: Mel Gorman Cc: Andy Whitcroft Cc: KAMEZAWA Hiroyuki Cc: [2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e96445533ac3f4f7964646a202ff3620602fab4 Author: Ned Forrester Date: Sat Sep 13 02:33:18 2008 -0700 pxa2xx_spi: dma bugfixes Fixes two DMA bugs in the pxa2xx_spi driver. The first bug is in all versions of this driver; the second was introduced in the 2.6.20 kernel, and prevents using the driver with chips like m25p16 flash (which can issue large DMA reads). 1. Zero length transfers are permitted for use to insert timing, but pxa2xx_spi.c will fail if this is requested in DMA mode. Fixed by using programmed I/O (PIO) mode for such transfers. 2. Transfers larger than 8191 are not permitted in DMA mode. A test for length rejects all large transfers regardless of DMA or PIO mode. Worked around by rejecting only large transfers with DMA mapped buffers, and forcing all other transfers larger than 8191 to use PIO mode. A rate limited warning is issued for DMA transfers forced to PIO mode. This patch should apply to all kernels back to and including 2.6.20; it was test patched against 2.6.20. An additional patch would be required for older kernels, but those versions are very buggy anyway. Signed-off-by: Ned Forrester Cc: Vernon Sauder Cc: Eric Miao Signed-off-by: David Brownell Cc: [2.6.25.x, 2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8423597d676615f3dd2d9ab36f59f147086b90b8 Author: Ned Forrester Date: Sat Sep 13 02:33:17 2008 -0700 pxa2xx_spi: chipselect bugfixes Fixes several chipselect bugs in the pxa2xx_spi driver. These bugs are in all versions of this driver and prevent using it with chips like m25p16 flash. 1. The spi_transfer.cs_change flag is handled too early: before spi_transfer.delay_usecs applies, thus making the delay ineffective at holding chip select. 2. spi_transfer.delay_usecs is ignored on the last transfer of a message (likewise not holding chipselect long enough). 3. If spi_transfer.cs_change is set on the last transfer, the chip select is always disabled, instead of the intended meaning: optionally holding chip select enabled for the next message. Those first three bugs were fixed with a relocation of delays and chip select de-assertions. 4. If a message has the cs_change flag set on the last transfer, and had the chip select stayed enabled as requested (see 3, above), it would not have been disabled if the next message is for a different chip. Fixed by dropping chip select regardless of cs_change at end of a message, if there is no next message or if the next message is for a different chip. This patch should apply to all kernels back to and including 2.6.20; it was test patched against 2.6.20. An additional patch would be required for older kernels, but those versions are very buggy anyway. Signed-off-by: Ned Forrester Cc: Vernon Sauder Cc: Eric Miao Signed-off-by: David Brownell Cc: [2.6.25.x, 2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa77d96ba94326db4f50d2aa36602824dd03286a Author: Peter Korsgaard Date: Sat Sep 13 02:33:15 2008 -0700 spi_mpc83xx: reject invalid transfer sizes Error out on transfer length != multiple of bytes per word with -EINVAL. Fixes a buffer overrun crash if length < bytes per word. Signed-off-by: Peter Korsgaard Acked-by: Joakim Tjernlund Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 53604dbe1371c3c4458c2d741adbd8cfd8fe8e79 Author: Peter Korsgaard Date: Sat Sep 13 02:33:14 2008 -0700 spi_mpc83xx: fix clockrate calculation for low speed Commit a61f5345 (spi_mpc83xx clockrate fixes) broke clockrate calculation for low speeds. SPMODE_DIV16 should be set if the divider is higher than 64, not only if the divider gets clipped to 1024. Furthermore, the clipping check was off by a factor 16 as well. Signed-off-by: Peter Korsgaard Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d7a3e4959c28bccc25dd33315809ffcf40f7493e Author: Hugh Dickins Date: Sat Sep 13 02:33:13 2008 -0700 mm: ifdef Quicklists in /proc/meminfo A "Quicklists: 0 kB" line has just started appearing in /proc/meminfo, but most architectures (including x86) don't have them configured, so #ifdef it, like the highmem lines. And those architectures which do have quicklists configured are using them for page tables: so let's place it next to PageTables. Signed-off-by: Hugh Dickins Acked-by: Christoph Lameter Acked-by: KOSAKI Motohiro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1558182f651798164418abf53f76786da0ea4a6f Author: Eric Sesterhenn Date: Sat Sep 13 02:33:12 2008 -0700 bfs: fix Lockdep warning This fixes: ============================================= [ INFO: possible recursive locking detected ] 2.6.27-rc5-00283-g70bb089 #68 --------------------------------------------- touch/6855 is trying to acquire lock: (&info->bfs_lock){--..}, at: [] bfs_delete_inode+0x9e/0x18c but task is already holding lock: (&info->bfs_lock){--..}, at: [] bfs_create+0x45/0x187 other info that might help us debug this: 2 locks held by touch/6855: #0: (&type->i_mutex_dir_key#5){--..}, at: [] do_filp_open+0x10b/0x62f #1: (&info->bfs_lock){--..}, at: [] bfs_create+0x45/0x187 stack backtrace: Pid: 6855, comm: touch Not tainted 2.6.27-rc5-00283-g70bb089 #68 [] validate_chain+0x458/0x9f4 [] ? trace_hardirqs_off+0xb/0xd [] __lock_acquire+0x666/0x6e0 [] lock_acquire+0x5b/0x77 [] ? bfs_delete_inode+0x9e/0x18c [] mutex_lock_nested+0xbc/0x234 [] ? bfs_delete_inode+0x9e/0x18c [] ? bfs_delete_inode+0x9e/0x18c [] bfs_delete_inode+0x9e/0x18c [] ? bfs_delete_inode+0x0/0x18c [] generic_delete_inode+0x94/0xfe [] generic_drop_inode+0x12/0x12f [] iput+0x4b/0x4e [] bfs_create+0x163/0x187 [] vfs_create+0xa6/0x114 [] do_filp_open+0x1ad/0x62f [] ? native_sched_clock+0x82/0x96 [] ? _spin_unlock+0x27/0x3c [] ? alloc_fd+0xbf/0xc9 [] ? sub_preempt_count+0x9d/0xab [] ? alloc_fd+0xbf/0xc9 [] do_sys_open+0x42/0xb8 [] ? trace_hardirqs_on_thunk+0xc/0x10 [] sys_open+0x1e/0x26 [] sysenter_do_call+0x12/0x31 ======================= The problem is that we don't unlock the bfs->lock mutex before calling iput (we do in the other cases). Signed-off-by: Eric Sesterhenn Cc: Tigran Aivazian Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b261dfea48e81636516f4fa653667097638a8a62 Author: Hidehiro Kawai Date: Sat Sep 13 02:33:10 2008 -0700 coredump_filter: add description of bit 4 There is no description of bit 4 of coredump_filter in the documentation. This patch adds it. Signed-off-by: Hidehiro Kawai Cc: Roland McGrath Cc: Mel Gorman Acked-by: KOSAKI Motohiro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 024994310e10cd7632f43b6873558820308c1af1 Author: Li Zefan Date: Sat Sep 13 02:33:09 2008 -0700 cpuset: hotplug documentation fix If all the cpus in a cpuset are offlined, the tasks in it will be moved to the nearest ancestor with non-empty cpus. Signed-off-by: Li Zefan Acked-by: Paul Jackson Cc: Paul Menage Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4e74339af6a59c061cf02f1ac497766bca1de19a Author: Li Zefan Date: Sat Sep 13 02:33:08 2008 -0700 cpuset: avoid changing cpuset's cpus when -errno returned After the patch: commit 0b2f630a28d53b5a2082a5275bc3334b10373508 Author: Miao Xie Date: Fri Jul 25 01:47:21 2008 -0700 cpusets: restructure the function update_cpumask() and update_nodemask() It might happen that 'echo 0 > /cpuset/sub/cpus' returned failure but 'cpus' has been changed, because cpus was changed before calling heap_init() which may return -ENOMEM. This patch restores the orginal behavior. Signed-off-by: Li Zefan Acked-by: Paul Menage Cc: Paul Jackson Cc: Miao Xie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dea420ce0e2973e8ef1fd11fde6804c8d03a82ad Author: Hiroshi DOYU Date: Sat Sep 13 02:33:07 2008 -0700 include/linux/ioport.h: add missing macro argument for devm_release_* family akpm: these have no callers at this time, but they shall soon, so let's get them right. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Hiroshi DOYU Cc: Tony Lindgren Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 665020c35e89a9e0643e21561e4f8f967f4f2c4b Author: Alexey Dobriyan Date: Sat Sep 13 02:33:06 2008 -0700 proc: more debugging for "already registered" case Print parent directory name as well. The aim is to catch non-creation of parent directory when proc_mkdir will return NULL and all subsequent registrations go directly in /proc instead of intended directory. Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton [ Fixed insane printk string while at it. - Linus ] Signed-off-by: Linus Torvalds commit 97b697a11b07e2ebfa69c488132596cc5eb24119 Author: Taisuke Yamada Date: Sat Sep 13 16:46:15 2008 -0400 [libata] LBA28/LBA48 off-by-one bug in ata.h I recently bought 3 HGST P7K500-series 500GB SATA drives and had trouble accessing the block right on the LBA28-LBA48 border. Here's how it fails (same for all 3 drives): # dd if=/dev/sdc bs=512 count=1 skip=268435455 > /dev/null dd: reading `/dev/sdc': Input/output error 0+0 records in 0+0 records out 0 bytes (0 B) copied, 0.288033 seconds, 0.0 kB/s # dmesg ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0 ata1.00: BMDMA stat 0x25 ata1.00: cmd c8/00:08:f8:ff:ff/00:00:00:00:00/ef tag 0 dma 4096 in res 51/04:08:f8:ff:ff/00:00:00:00:00/ef Emask 0x1 (device error) ata1.00: status: { DRDY ERR } ata1.00: error: { ABRT } ata1.00: configured for UDMA/33 ata1: EH complete ... After some investigations, it turned out this seems to be caused by misinterpretation of the ATA specification on LBA28 access. Following part is the code in question: === include/linux/ata.h === static inline int lba_28_ok(u64 block, u32 n_block) { /* check the ending block number */ return ((block + n_block - 1) < ((u64)1 << 28)) && (n_block <= 256); } HGST drive (sometimes) fails with LBA28 access of {block = 0xfffffff, n_block = 1}, and this behavior seems to be comformant. Other drives, including other HGST drives are not that strict, through. >From the ATA specification: (http://www.t13.org/Documents/UploadedDocuments/project/d1410r3b-ATA-ATAPI-6.pdf) 8.15.29 Word (61:60): Total number of user addressable sectors This field contains a value that is one greater than the total number of user addressable sectors (see 6.2). The maximum value that shall be placed in this field is 0FFFFFFFh. So the driver shouldn't use the value of 0xfffffff for LBA28 request as this exceeds maximum user addressable sector. The logical maximum value for LBA28 is 0xffffffe. The obvious fix is to cut "- 1" part, and the patch attached just do that. I've been using the patched kernel for about a month now, and the same fix is also floating on the net for some time. So I believe this fix works reliably. Just FYI, many Windows/Intel platform users also seems to be struck by this, and HGST has issued a note pointing to Intel ICH8/9 driver. "28-bit LBA command is being used to access LBAs 29-bits in length" http://www.hitachigst.com/hddt/knowtree.nsf/cffe836ed7c12018862565b000530c74/b531b8bce8745fb78825740f00580e23 Also, *BSDs seems to have similar fix included sometime around ~2004, through I have not checked out exact portion of the code. Signed-off-by: Taisuke Yamada Signed-off-by: Jeff Garzik commit 99580664aa83ca04bb52988d504a4195b41833b0 Author: Bob Stewart Date: Thu Sep 11 11:50:03 2008 +0200 sata_inic162x: enable LED blinking Enable LED blinking. Signed-off-by: Bob Stewart Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit da3ceb2288d0b50373b69d57a81c34fdd7cd11aa Author: Stephen Hemminger Date: Mon Sep 8 09:31:39 2008 -0700 ata: duplicate variable sparse warning drivers/ata/ata_piix.c:1502:7: warning: symbol 'rc' shadows an earlier one Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 88c381bf09d7b3f2c2e8749150087aff2c434be4 Author: Russell King Date: Sat Sep 13 21:23:06 2008 +0100 [ARM] Fix PCI_DMA_BUS_IS_PHYS for ARM PCI_DMA_BUS_IS_PHYS was defined to be zero, which meant we ignored the DMA mask for IDE and SCSI transfers. This is wrong - we have no DMA translation hardware. We want to obey DMA masks so that the block layer performs bouncing itself. Reported-by: Mikael Pettersson Signed-off-by: Russell King commit 68ddb1d963c44da913b0331b633828c48206351b Merge: c33de47... 9fbe604... Author: Russell King Date: Sat Sep 13 20:10:59 2008 +0100 Merge branch 'for-rmk' of git://pasiphae.extern.pengutronix.de/git/imx/linux-2.6.git commit c33de47bce74e0c890f9f830a7641371524edbc1 Author: Dmitry Baryshkov Date: Thu Sep 11 01:28:51 2008 +0100 [ARM] 5247/1: tosa: SW_EAR_IN support Signed-off-by: Dmitry Baryshkov Acked-by: Eric Miao Signed-off-by: Russell King commit 7bdb22c9d4b4f526b81770cd719d2f5dddf0373d Author: Dmitry Baryshkov Date: Wed Sep 10 10:30:37 2008 +0100 [ARM] 5246/1: tosa: add proper clock alias for tc6393xb clock Add clock alias for clock that is used by tc6393xb device on tosa. As that chip plays pretty major part in tosa life and is currently disabled, this is 2.4.27 material. Signed-off-by: Dmitry Baryshkov Signed-off-by: Russell King commit 632480ea6548ae66e89a49ef037fd593c7a52418 Author: Jürgen Schindele Date: Mon Sep 8 22:06:29 2008 +0100 [ARM] 5245/1: Fix warning about unused return value in drivers/pcmcia Fix warning when compiling "drivers/pcmcia/soc-common.c" The return value of the function "device_create_file" was not used / assigned. Signed-off-by: Jrgen Schindele Signed-off-by: Russell King commit 048feec5548c0582ee96148c61b87cccbcb5f9be Author: Andrew Vasquez Date: Thu Sep 11 22:19:45 2008 -0700 [SCSI] qla2xxx: Defer enablement of RISC interrupts until ISP initialization completes. Josip Rodin noted (http://article.gmane.org/gmane.linux.ports.sparc/10152) the driver oopsing during registration of an rport to the FC-transport layer with a backtrace indicating a dereferencing of an shost->shost_data equal to NULL. David Miller identified a small window in driver logic where this could happen: > Look at how the driver registers the IRQ handler before the host has > been registered with the SCSI layer. > > That leads to a window of time where the shost hasn't been setup > fully, yet ISRs can come in and trigger DPC thread events, such as > loop resyncs, which expect the transport area to be setup. > > But it won't be setup, because scsi_add_host() hasn't finished yet. > > Note that in Josip's crash log, we don't even see the > > qla_printk(KERN_INFO, ha, "\n" > " QLogic Fibre Channel HBA Driver: %s\n" > " QLogic %s - %s\n" > " ISP%04X: %s @ %s hdma%c, host#=%ld, fw=%s\n", > ... > > message yet. > > Which means that the crash occurs between qla2x00_request_irqs() > and printing that message. Close this window by enabling RISC interrupts after the host has been registered with the SCSI midlayer. Reported-by: Josip Rodin Cc: Stable Tree Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley commit 395a125c6237802b19bf22b41017c99ff57f1024 Author: Yinghai Lu Date: Tue Sep 9 12:27:52 2008 -0700 PCI: re-add debug prints for unmodified BARs Print out for device BAR values before the kernel tries to update them. Also make related output use KERN_DEBUG. Signed-off-by: Yinghai Lu Signed-off-by: Jesse Barnes commit cff502a38394fd33693f6233e03fca363dfa956d Author: Santwona Behera Date: Fri Sep 12 16:04:26 2008 -0700 niu: panic on reset The reset_task function in the niu driver does not reset the tx and rx buffers properly. This leads to panic on reset. This patch is a modified implementation of the previously posted fix. Signed-off-by: Santwona Behera Signed-off-by: David S. Miller commit 7d4ee289d139d27b619c08c9809e7b1088c100aa Author: David S. Miller Date: Fri Sep 12 15:01:31 2008 -0700 sparc: Fix user_regset 'n' field values. As noticed by Russell King, we were not setting this properly to the number of entries, but rather the total size. This results in the core dumping code allocating waayyyy too much memory. Signed-off-by: David S. Miller commit 80a56ab626c70468be92e74cf3d288ffaed23fdb Author: David S. Miller Date: Fri Sep 12 15:13:15 2008 -0700 sparc64: Fix PCI error interrupt registry on PSYCHO. We need to pass IRQF_SHARED, otherwise we get things like: IRQ handler type mismatch for IRQ 33 current handler: PSYCHO_UE Call Trace: [000000000048394c] request_irq+0xac/0x120 [00000000007c5f6c] psycho_scan_bus+0x98/0x158 [00000000007c2bc0] pcibios_init+0xdc/0x12c [0000000000426a5c] do_one_initcall+0x1c/0x160 [00000000007c0180] kernel_init+0x9c/0xfc [0000000000427050] kernel_thread+0x30/0x60 [00000000006ae1d0] rest_init+0x10/0x60 on e3500 and similar systems. On a single board, the UE interrupts of two Psycho nodes are funneled through the same interrupt, from of_debug=3 dump: /pci@b,4000: direct translate 2ee --> 21 ... /pci@b,2000: direct translate 2ee --> 21 Decimal "33" mentioned above is the hex "21" mentioned here. Thanks to Meelis Roos for dumps and testing. Signed-off-by: David S. Miller commit 0ad5bce7409d681a5655c66e64bb0eb740b89c1f Author: Jeremy Fitzhardinge Date: Thu Sep 11 16:42:00 2008 -0700 x86: fix possible x86_64 and EFI regression Russ Anderson reported a boot crash with EFI and latest mainline: BIOS-e820: 00000000fffa0000 - 00000000fffac000 (reserved) Pid: 0, comm: swapper Not tainted 2.6.27-rc5-00100-gec0c15a-dirty #5 Call Trace: [] early_idt_handler+0x55/0x69 [] __memcpy+0x12/0xa4 [] efi_init+0xce/0x932 [] setup_early_serial8250_console+0x2d/0x36a [] __insert_resource+0x18/0xc8 [] setup_arch+0x3a7/0x632 [] start_kernel+0x91/0x367 [] x86_64_start_kernel+0xe3/0xe7 [] x86_64_start_kernel+0x0/0xe7 RIP 0x10 Such a crash is possible if the CPU in this system is a 64-bit processor which doesn't support NX (ie, old Intel P4 -based64-bit processors). Certainly, if we support such processors, then we should start with _PAGE_NX initially clear in __supported_pte_flags, and then set it once we've established that the processor does indeed support NX. That will prevent early_ioremap - or anything else - from trying to set it. The simple fix is to simply call check_efer() earlier. Reported-by: Russ Anderson Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Ingo Molnar commit d58b622b5de9747c82fcc3548f3ec87a02c24dce Merge: 1045b03... 7c6a329... Author: David S. Miller Date: Thu Sep 11 19:11:50 2008 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/holtmann/bluetooth-2.6 commit 1045b03e07d85f3545118510a587035536030c1c Author: Vegard Nossum Date: Thu Sep 11 19:05:29 2008 -0700 netlink: fix overrun in attribute iteration kmemcheck reported this: kmemcheck: Caught 16-bit read from uninitialized memory (f6c1ba30) 0500110001508abf050010000500000002017300140000006f72672e66726565 i i i i i i i i i i i i i u u u u u u u u u u u u u u u u u u u ^ Pid: 3462, comm: wpa_supplicant Not tainted (2.6.27-rc3-00054-g6397ab9-dirty #13) EIP: 0060:[] EFLAGS: 00010296 CPU: 0 EIP is at nla_parse+0x5a/0xf0 EAX: 00000008 EBX: fffffffd ECX: c06f16c0 EDX: 00000005 ESI: 00000010 EDI: f6c1ba30 EBP: f6367c6c ESP: c0a11e88 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 CR0: 8005003b CR2: f781cc84 CR3: 3632f000 CR4: 000006d0 DR0: c0ead9bc DR1: 00000000 DR2: 00000000 DR3: 00000000 DR6: ffff4ff0 DR7: 00000400 [] rtnl_setlink+0x63/0x130 [] rtnetlink_rcv_msg+0x165/0x200 [] netlink_rcv_skb+0x76/0xa0 [] rtnetlink_rcv+0x1e/0x30 [] netlink_unicast+0x281/0x290 [] netlink_sendmsg+0x1b9/0x2b0 [] sock_sendmsg+0xd2/0x100 [] sys_sendto+0xa5/0xd0 [] sys_send+0x36/0x40 [] sys_socketcall+0x1e6/0x2c0 [] sysenter_do_call+0x12/0x3f [] 0xffffffff This is the line in nla_ok(): /** * nla_ok - check if the netlink attribute fits into the remaining bytes * @nla: netlink attribute * @remaining: number of bytes remaining in attribute stream */ static inline int nla_ok(const struct nlattr *nla, int remaining) { return remaining >= sizeof(*nla) && nla->nla_len >= sizeof(*nla) && nla->nla_len <= remaining; } It turns out that remaining can become negative due to alignment in nla_next(). But GCC promotes "remaining" to unsigned in the test against sizeof(*nla) above. Therefore the test succeeds, and the nla_for_each_attr() may access memory outside the received buffer. A short example illustrating this point is here: #include main(void) { printf("%d\n", -1 >= sizeof(int)); } ...which prints "1". This patch adds a cast in front of the sizeof so that GCC will make a signed comparison and fix the illegal memory dereference. With the patch applied, there is no kmemcheck report. Signed-off-by: Vegard Nossum Acked-by: Thomas Graf Signed-off-by: David S. Miller commit 7c6a329e444725f24c02192ac493d8a7cd9fa638 Author: Marcel Holtmann Date: Fri Sep 12 03:11:54 2008 +0200 [Bluetooth] Fix regression from using default link policy To speed up the Simple Pairing connection setup, the support for the default link policy has been enabled. This is in contrast to settings the link policy on every connection setup. Using the default link policy is the preferred way since there is no need to dynamically change it for every connection. For backward compatibility reason and to support old userspace the HCISETLINKPOL ioctl has been switched over to using hci_request() to issue the HCI command for setting the default link policy instead of just storing it in the HCI device structure. However the hci_request() can only be issued when the device is brought up. If used on a device that is registered, but still down it will timeout and fail. This is problematic since the command is put on the TX queue and the Bluetooth core tries to submit it to hardware that is not ready yet. The timeout for these requests is 10 seconds and this causes a significant regression when setting up a new device. The userspace can perfectly handle a failure of the HCISETLINKPOL ioctl and will re-submit it later, but the 10 seconds delay causes a problem. So in case hci_request() is called on a device that is still down, just fail it with ENETDOWN to indicate what happens. Signed-off-by: Marcel Holtmann commit a551b98d5f6fce5897d497abd8bfb262efb33d2a Merge: d1c6d2e... 50bed2e... Author: Linus Torvalds Date: Thu Sep 11 11:50:15 2008 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: sg: disable interrupts inside sg_copy_buffer commit d1c6d2e547148c5aa0c0a4ff6aac82f7c6da1d8b Author: David Howells Date: Thu Sep 11 17:18:56 2008 +0100 MN10300: Change the fault handler to check in_atomic() not in_interrupt() Change the MN10300 fault handler to make it check in_atomic() rather than in_interrupt() as commit 6edaf68a87d17570790fd55f0c451a29ec1d6703 did for other architectures: Author: Peter Zijlstra Date: Wed Dec 6 20:32:18 2006 -0800 [PATCH] mm: arch do_page_fault() vs in_atomic() In light of the recent pagefault and filemap_copy_from_user work I've gone through all the arch pagefault handlers to make sure the inc_preempt_count() 'feature' works as expected. Several sections of code (including the new filemap_copy_from_user) rely on the fact that faults do not take locks under increased preempt count. Signed-off-by: David Howells Acked-by: Peter Zijlstra Signed-off-by: Linus Torvalds commit 50bed2e2862a8f3a4f7d683d0d27292e71ef18b9 Author: FUJITA Tomonori Date: Thu Sep 11 18:35:39 2008 +0200 sg: disable interrupts inside sg_copy_buffer The callers of sg_copy_buffer must disable interrupts before calling it (since it uses kmap_atomic). Some callers use it on interrupt-disabled code but some need to take the trouble to disable interrupts just for this. No wonder they forget about it and we hit a bug like: http://bugzilla.kernel.org/show_bug.cgi?id=11529 James said that it might be better to disable interrupts inside the function rather than risk the callers getting it wrong. Signed-off-by: FUJITA Tomonori Signed-off-by: Jens Axboe commit 6d242a263618ba7f0f9a41dd91b347d19e704bbe Merge: a0a4a2c... 2dc75d3... Author: Linus Torvalds Date: Thu Sep 11 08:42:55 2008 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: disable sysfs parts of the disk command filter commit a0a4a2cb0d69446c084792a40884d911dfc3cf27 Merge: 29cd195... 534e38b... Author: Linus Torvalds Date: Thu Sep 11 08:42:14 2008 -0700 Merge branch 'kvm-updates/2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm * 'kvm-updates/2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm: KVM: VMX: Always return old for clear_flush_young() when using EPT KVM: SVM: fix guest global tlb flushes with NPT KVM: SVM: fix random segfaults with NPT enabled commit 29cd195e078db0d90dd447a156039513ecdd8f16 Merge: c529b7e... 01b291b... Author: Linus Torvalds Date: Thu Sep 11 08:41:17 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] fix check of PQ and PDT bits for WLUNs [SCSI] make scsi_check_sense HARDWARE_ERROR return ADD_TO_MLQUEUE on retry [SCSI] scsi_dh: make check_sense return ADD_TO_MLQUEUE [SCSI] zfcp: Remove duplicated unlikely() macros. [SCSI] zfcp: channel cannot be detached due to refcount imbalance [SCSI] zfcp: Fix reference counter for remote ports [SCSI] zfcp: Simplify ccw notify handler [SCSI] zfcp: Correctly query end flag in gpn_ft response [SCSI] zfcp: Fix request queue locking [SCSI] sd: select CRC_T10DIF only when necessary commit c529b7e2db948e240c48c54a83d0b6279275e57d Merge: e2858ce... e7b1403... Author: Linus Torvalds Date: Thu Sep 11 08:40:32 2008 -0700 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6: [IA64] prevent ia64 from invoking irq handlers on offline CPUs [IA64] arch/ia64/sn/pci/tioca_provider.c: introduce missing kfree [IA64] fix up bte.h [IA64] fix compile failure with non modular builds commit e2858ce3ed519500e3b9af1c16c25250ff16cd5c Merge: 9a0e4c8... 5c89468... Author: Linus Torvalds Date: Thu Sep 11 08:40:11 2008 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6: udf: add llseek method udf: Fix error paths in udf_new_inode() udf: Fix lock inversion between iprune_mutex and alloc_mutex (v2) commit 69da6b87fcb270f758fe75141c32e041f8db510c Author: Jouni Malinen Date: Mon Aug 11 14:01:50 2008 +0300 ath9k: Assign seq# when mac80211 requests this Use TX control flag IEEE80211_TX_CTL_ASSIGN_SEQ as a request to update the seq# for the frames. This will likely require some further cleanup to get seq# correctly for Beacons vs. other frames and also potentially for multiple BSSes. Anyway, this is better than ending up sending out most frames with seq# 0. (This is a backport of patch w/ same title already in net-next-2.6. It is verified to fix http://bugzilla.kernel.org/show_bug.cgi?id=11394 and it should be acceptable for -rc due to the driver being new in 2.6.27.) Signed-off-by: Jouni Malinen Signed-off-by: John W. Linville commit 2dc75d3c3b49c64fd26b4832a7efb75546cb3fc5 Author: Jens Axboe Date: Thu Sep 11 14:20:23 2008 +0200 block: disable sysfs parts of the disk command filter We still have life time issues with the sysfs command filter kobject, so disable it for 2.6.27 release. We can revisit this and make it work properly for 2.6.28, for 2.6.27 release it's too risky. Signed-off-by: Jens Axboe commit 7736c09c6cf9521f2413d78856a66f4a37046e84 Author: Russell King Date: Tue Sep 9 10:16:22 2008 +0100 [ARM] OMAP: Fix MMC device data OMAPs MMC device data was passing the wrong structure via the platform device. Moreover, a missing function means that both sx1_defconfig and omap_h2_1610_defconfig builds failed with undefined reference to `omap_set_mmc_info' errors. Fix this by updating the MMC support from the omapzoom tree. Signed-off-by: Russell King commit f1926ce63b996b42772b39e4b47bb4ef4ba748b4 Author: Dominik Brodowski Date: Thu Sep 11 11:09:49 2008 +0200 clocksource, acpi_pm.c: fix check for monotonicity Actually check the monotonicity of the ACPI PMTMR ten times, only delay for 0.9 miliseconds at most, and bail out early if some problem is determined. Reported-by: Jochen Voß Signed-off-by: Dominik Brodowski Signed-off-by: Ingo Molnar commit 6ef62164e794c480259ac158aa6c8c7b85746545 Merge: e75b986... adee14b... Author: Ingo Molnar Date: Thu Sep 11 11:13:58 2008 +0200 Merge commit 'v2.6.27-rc6' into timers/urgent commit 534e38b447df47f129a6d3ec3af6705c1e3f651e Author: Sheng Yang Date: Mon Sep 8 15:12:30 2008 +0800 KVM: VMX: Always return old for clear_flush_young() when using EPT As well as discard fake accessed bit and dirty bit of EPT. Signed-off-by: Sheng Yang Signed-off-by: Avi Kivity commit e5eab0cede4b1ffaca4ad857d840127622038e55 Author: Joerg Roedel Date: Tue Sep 9 19:11:51 2008 +0200 KVM: SVM: fix guest global tlb flushes with NPT Accesses to CR4 are intercepted even with Nested Paging enabled. But the code does not check if the guest wants to do a global TLB flush. So this flush gets lost. This patch adds the check and the flush to svm_set_cr4. Signed-off-by: Joerg Roedel Signed-off-by: Avi Kivity commit 44874f84918e37b64bec6df1587e5fe2fdf6ab62 Author: Joerg Roedel Date: Wed Aug 27 14:18:43 2008 +0200 KVM: SVM: fix random segfaults with NPT enabled This patch introduces a guest TLB flush on every NPF exit in KVM. This fixes random segfaults and #UD exceptions in the guest seen under some workloads (e.g. long running compile workloads or tbench). A kernbench run with and without that fix showed that it has a slowdown lower than 0.5% Cc: stable@kernel.org Signed-off-by: Joerg Roedel Signed-off-by: Alexander Graf Signed-off-by: Avi Kivity commit ec5d498991e87c74730509508b25c3959192b7e7 Author: Hiroshi Shimamoto Date: Wed Sep 10 17:00:19 2008 -0700 sched: fix deadlock in setting scheduler parameter to zero Andrei Gusev wrote: > I played witch scheduler settings. After doing something like: > echo -n 1000000 >sched_rt_period_us > > command is locked. I found in kernel.log: > > Sep 11 00:39:34 zaratustra > Sep 11 00:39:34 zaratustra Pid: 4495, comm: bash Tainted: G W > (2.6.26.3 #12) > Sep 11 00:39:34 zaratustra EIP: 0060:[] EFLAGS: 00210246 CPU: 0 > Sep 11 00:39:34 zaratustra EIP is at div64_u64+0x57/0x80 > Sep 11 00:39:34 zaratustra EAX: 0000389f EBX: 00000000 ECX: 00000000 > EDX: 00000000 > Sep 11 00:39:34 zaratustra ESI: d9800000 EDI: d9800000 EBP: 0000389f > ESP: ea7a6edc > Sep 11 00:39:34 zaratustra DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 > Sep 11 00:39:34 zaratustra Process bash (pid: 4495, ti=ea7a6000 > task=ea744000 task.ti=ea7a6000) > Sep 11 00:39:34 zaratustra Stack: 00000000 000003e8 d9800000 0000389f > c0119042 00000000 00000000 00000001 > Sep 11 00:39:34 zaratustra 00000000 00000000 ea7a6f54 00010000 00000000 > c04d2e80 00000001 000e7ef0 > Sep 11 00:39:34 zaratustra c01191a3 00000000 00000000 ea7a6fa0 00000001 > ffffffff c04d2e80 ea5b2480 > Sep 11 00:39:34 zaratustra Call Trace: > Sep 11 00:39:34 zaratustra [] __rt_schedulable+0x52/0x130 > Sep 11 00:39:34 zaratustra [] sched_rt_handler+0x83/0x120 > Sep 11 00:39:34 zaratustra [] proc_sys_call_handler+0xb6/0xd0 > Sep 11 00:39:34 zaratustra [] proc_sys_write+0x0/0x20 > Sep 11 00:39:34 zaratustra [] proc_sys_write+0x19/0x20 > Sep 11 00:39:34 zaratustra [] vfs_write+0xa8/0x140 > Sep 11 00:39:34 zaratustra [] sys_write+0x41/0x80 > Sep 11 00:39:34 zaratustra [] sysenter_past_esp+0x6a/0x91 > Sep 11 00:39:34 zaratustra ======================= > Sep 11 00:39:34 zaratustra Code: c8 41 0f ad f3 d3 ee f6 c1 20 0f 45 de > 31 f6 0f ad ef d3 ed f6 c1 20 0f 45 fd 0f 45 ee 31 c9 39 eb 89 fe 89 ea > 77 08 89 e8 31 d2 f3 89 c1 89 f0 8b 7c 24 08 f7 f3 8b 74 24 04 89 > ca 8b 1c 24 > Sep 11 00:39:34 zaratustra EIP: [] div64_u64+0x57/0x80 SS:ESP > 0068:ea7a6edc > Sep 11 00:39:34 zaratustra ---[ end trace 4eaa2a86a8e2da22 ]--- fix the boundary condition. sysctl_sched_rt_period=0 makes exception at to_ratio(). Signed-off-by: Hiroshi Shimamoto Signed-off-by: Ingo Molnar commit baf25731e54d06eb13dc4eda78c6dc7da4ce84e8 Author: Zhang, Yanmin Date: Tue Sep 9 11:26:33 2008 +0800 sched: fix 2.6.27-rc5 couldn't boot on tulsa machine randomly On my tulsa x86-64 machine, kernel 2.6.25-rc5 couldn't boot randomly. Basically, function __enable_runtime forgets to reset rt_rq->rt_throttled to 0. When every cpu is up, per-cpu migration_thread is created and it runs very fast, sometimes to mark the corresponding rt_rq->rt_throttled to 1 very quickly. After all cpus are up, with below calling chain: sched_init_smp => arch_init_sched_domains => build_sched_domains => ... => cpu_attach_domain => rq_attach_root => set_rq_online => ... => _enable_runtime _enable_runtime is called against every rt_rq again, so rt_rq->rt_time is reset to 0, but rt_rq->rt_throttled might be still 1. Later on function do_sched_rt_period_timer couldn't reset it, and all RT tasks couldn't be scheduled to run on that cpu. here is RT task migration_thread which is woken up when a task is migrated to another cpu. Below patch fixes it against 2.6.27-rc5. Signed-off-by: Zhang Yanmin Signed-off-by: Ingo Molnar commit bdba4d6b77fcc76f206986d7cc55f1feb20301f8 Author: David S. Miller Date: Wed Sep 10 23:38:51 2008 -0700 sparc32: Fix function signature of of_bus_sbus_get_flags(). This doesn't match the function pointer type it gets assigned to. Luckily, this was harmless. Signed-off-by: David S. Miller commit 6c832e36447821779344f3d33970a4a7a10245cc Author: Hans Verkuil Date: Sun Aug 24 06:29:30 2008 -0300 V4L/DVB (8789): wm8739: remove wrong kfree i2c_client is allocated for us, we should never free it ourselves. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 2389b36072892fed57a701e01a7dbe655420e5e5 Author: Mauro Carvalho Chehab Date: Wed Aug 6 20:13:46 2008 -0300 V4L/DVB (8559a): Fix a merge conflict at gspca/sonixb Signed-off-by: Mauro Carvalho Chehab commit 9a0e4c8038390342f48e574b157a1971e2f07348 Merge: 9e7222c... 46dfa04... Author: Linus Torvalds Date: Wed Sep 10 14:16:53 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: add deprecated ide-scsi to feature-removal-schedule.txt ide: Fix pointer arithmetic in hpt3xx driver code (3rd try) commit 9e7222c83560186686319f2892f43fc557baed2d Author: Geert Uytterhoeven Date: Wed Sep 10 22:15:19 2008 +0200 m68k: Update defconfigs for 2.6.27-rc6 Signed-off-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds commit 5368f69c8b155d6e82dfc622d817c882689e9cd9 Author: Geert Uytterhoeven Date: Wed Sep 10 22:15:18 2008 +0200 VIDEO_SH_MOBILE_CEU should depend on HAS_DMA commit 0d3244d6439c8c31d2a29efd587c7aca9042c8aa ("V4L/DVB (8342): sh_mobile_ceu_camera: Add SuperH Mobile CEU driver V3") introduced VIDEO_SH_MOBILE_CEU, which selects VIDEOBUF_DMA_CONTIG. This circumvents the dependency on HAS_DMA of VIDEOBUF_DMA_CONTIG. Add a dependency on HAS_DMA to VIDEO_SH_MOBILE_CEU to fix this. Signed-off-by: Geert Uytterhoeven Acked-by: Paul Mundt Acked-by: Magnus Damm Signed-off-by: Linus Torvalds commit ebfb2c63405f2410897674f14e41c031c9302909 Author: David S. Miller Date: Wed Sep 10 14:08:27 2008 -0700 sparc64: Fix interrupt register calculations on Psycho and Sabre. Use the IMAP offset calculation for OBIO devices as documented in the programmer's manual. Which is "0x10000 + ((ino & 0x1f) << 3)" Signed-off-by: David S. Miller commit 36223a399f639b13b7a454349565934e6d3e2db0 Author: Daniel J Blueman Date: Wed Sep 10 21:07:55 2008 +0100 swiotlb: fix back-off path when memory allocation fails This fixes a SWIOTLB oops With SWIOTLB being enabled and straight-forward page allocation failure [1], the swiotlb_alloc_coherent fall-back path hits an issue [2], resulting in my webcam failing to work. At the time of oops, RDI is clearly a pointer to a structure which has arrived as NULL, leading to the typo in swiotlb_map_single's callsite arguments. Correctly passing the device structure [3] addresses the issue and gets my webcam working again (the allocation failure still occuring). --- [1] skype: page allocation failure. order:3, mode:0x1 Pid: 5895, comm: skype Not tainted 2.6.27-rc6-235c-debug #1 Call Trace: [] __alloc_pages_internal+0x4a0/0x5d0 [] alloc_pages_current+0xad/0x110 [] __get_free_pages+0x1d/0x60 [] swiotlb_alloc_coherent+0x49/0x180 [] dma_alloc_coherent+0x281/0x310 [] hcd_buffer_alloc+0x50/0x90 [] usb_buffer_alloc+0x2d/0x40 [] uvc_alloc_urb_buffers+0x53/0xf0 [uvcvideo] [] uvc_init_video+0x158/0x3e0 [uvcvideo] [] uvc_video_enable+0x37/0x80 [uvcvideo] [] uvc_v4l2_do_ioctl+0x723/0x1260 [uvcvideo] [] ? trace_hardirqs_off_caller+0x21/0xc0 [] ? trace_hardirqs_off_caller+0x21/0xc0 [] video_usercopy+0x19f/0x390 [videodev] [] ? uvc_v4l2_do_ioctl+0x0/0x1260 [uvcvideo] [] ? put_lock_stats+0xe/0x30 [] uvc_v4l2_ioctl+0x4d/0x80 [uvcvideo] [] native_ioctl+0x83/0x90 [compat_ioctl32] [] v4l_compat_ioctl32+0x2be/0x1da4 [compat_ioctl32] [] ? do_page_fault+0x3d1/0xae0 [] ? trace_hardirqs_on+0xd/0x10 [] ? trace_hardirqs_on_caller+0x149/0x1b0 [] ? trace_hardirqs_on+0xd/0x10 [] compat_sys_ioctl+0x8a/0x3c0 [] ? trace_hardirqs_off_thunk+0x3a/0x3c [] sysenter_dispatch+0x7/0x2c [] ? trace_hardirqs_on_thunk+0x3a/0x3f Mem-Info: Node 0 DMA per-cpu: CPU 0: hi: 0, btch: 1 usd: 0 CPU 1: hi: 0, btch: 1 usd: 0 Node 0 DMA32 per-cpu: CPU 0: hi: 186, btch: 31 usd: 3 CPU 1: hi: 186, btch: 31 usd: 0 Node 0 Normal per-cpu: CPU 0: hi: 186, btch: 31 usd: 23 CPU 1: hi: 186, btch: 31 usd: 179 Active:78545 inactive:48683 dirty:31 writeback:0 unstable:2 free:830202 slab:17516 mapped:17473 pagetables:3496 bounce:0 Node 0 DMA free:36kB min:28kB low:32kB high:40kB active:0kB inactive:0kB present:15156kB pages_scanned:0 all_unreclaimable? no lowmem_reserve[]: 0 3207 3956 3956 Node 0 DMA32 free:3197192kB min:6512kB low:8140kB high:9768kB active:0kB inactive:0kB present:3284896kB pages_scanned:0 all_unreclaimable? no lowmem_reserve[]: 0 0 748 748 Node 0 Normal free:123580kB min:1516kB low:1892kB high:2272kB active:314180kB inactive:194732kB present:766464kB pages_scanned:0 all_unreclaimable? no lowmem_reserve[]: 0 0 0 0 Node 0 DMA: 1*4kB 0*8kB 0*16kB 1*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 36kB Node 0 DMA32: 4*4kB 3*8kB 2*16kB 3*32kB 4*64kB 5*128kB 3*256kB 5*512kB 4*1024kB 5*2048kB 776*4096kB = 3197224kB Node 0 Normal: 14*4kB 14*8kB 8*16kB 6*32kB 1*64kB 3*128kB 3*256kB 2*512kB 4*1024kB 1*2048kB 28*4096kB = 123560kB 64847 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 502752kB Total swap = 502752kB 1048576 pages RAM 52120 pages reserved 71967 pages shared 143004 pages non-shared --- [2] BUG: unable to handle kernel NULL pointer dereference at 00000000000002c8 IP: [] map_single+0x1c/0x280 PGD 10e54e067 PUD 10e595067 PMD 0 Oops: 0000 [1] PREEMPT SMP DEBUG_PAGEALLOC CPU 0 Modules linked in: kvm_intel kvm microcode uvcvideo compat_ioctl32 videodev v4l1_compat shpchp pci_hotplug Pid: 5895, comm: skype Not tainted 2.6.27-rc6-235c-debug #1 RIP: 0010:[] [] map_single+0x1c/0x280 RSP: 0018:ffff88010e78d988 EFLAGS: 00210296 RAX: 0000780000000000 RBX: 0000000000000000 RCX: 0000000000000002 RDX: 0000000000005000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88010e78d9e8 R08: 0000000000000000 R09: 0000000000000001 R10: ffff88010e78d698 R11: 0000000000000001 R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000005000 R15: ffff88012f1c9968 FS: 0000000000000000(0000) GS:ffffffff80a6cdc0(0063) knlGS:00000000f6355b90 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000000002c8 CR3: 000000010e57d000 CR4: 00000000000026e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process skype (pid: 5895, threadinfo ffff88010e78c000, task ffff88012b9cc460) Stack: 0000000200000000 0000000000005000 0000000000000000 0000000000000000 00000000000017b8 0000000000000000 ffff88010e78d9c8 0000000000000000 0000000000000002 0000000000000000 0000000000005000 ffff88012f1c9968 Call Trace: [] swiotlb_map_single_attrs+0x60/0xf0 [] swiotlb_map_single+0xc/0x10 [] swiotlb_alloc_coherent+0xfe/0x180 [] dma_alloc_coherent+0x281/0x310 [] hcd_buffer_alloc+0x50/0x90 [] usb_buffer_alloc+0x2d/0x40 [] uvc_alloc_urb_buffers+0x53/0xf0 [uvcvideo] [] uvc_init_video+0x158/0x3e0 [uvcvideo] [] uvc_video_enable+0x37/0x80 [uvcvideo] [] uvc_v4l2_do_ioctl+0x723/0x1260 [uvcvideo] [] ? trace_hardirqs_off_caller+0x21/0xc0 [] ? trace_hardirqs_off_caller+0x21/0xc0 [] video_usercopy+0x19f/0x390 [videodev] [] ? uvc_v4l2_do_ioctl+0x0/0x1260 [uvcvideo] [] ? put_lock_stats+0xe/0x30 [] uvc_v4l2_ioctl+0x4d/0x80 [uvcvideo] [] native_ioctl+0x83/0x90 [compat_ioctl32] [] v4l_compat_ioctl32+0x2be/0x1da4 [compat_ioctl32] [] ? do_page_fault+0x3d1/0xae0 [] ? trace_hardirqs_on+0xd/0x10 [] ? trace_hardirqs_on_caller+0x149/0x1b0 [] ? trace_hardirqs_on+0xd/0x10 [] compat_sys_ioctl+0x8a/0x3c0 [] ? trace_hardirqs_off_thunk+0x3a/0x3c [] sysenter_dispatch+0x7/0x2c [] ? trace_hardirqs_on_thunk+0x3a/0x3f Code: 45 31 c0 48 89 e5 e8 a4 ff ff ff c9 c3 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 38 48 89 75 b0 48 89 55 a8 89 4d a4 <48> 8b 87 c8 02 00 00 48 85 c0 0f 84 1c 02 00 00 48 8b 58 08 48 RIP [] map_single+0x1c/0x280 RSP CR2: 00000000000002c8 ---[ end trace 5d15baeeb7025a0e ]--- --- [3] ffffffff8046c830 : map_single(): /store/kernel/linux/lib/swiotlb.c:291 ffffffff8046c830: 55 push %rbp ffffffff8046c831: 48 89 e5 mov %rsp,%rbp ffffffff8046c834: 41 57 push %r15 ffffffff8046c836: 41 56 push %r14 ffffffff8046c838: 41 55 push %r13 ffffffff8046c83a: 41 54 push %r12 ffffffff8046c83c: 53 push %rbx ffffffff8046c83d: 48 83 ec 38 sub $0x38,%rsp ffffffff8046c841: 48 89 75 b0 mov %rsi,-0x50(%rbp) ffffffff8046c845: 48 89 55 a8 mov %rdx,-0x58(%rbp) ffffffff8046c849: 89 4d a4 mov %ecx,-0x5c(%rbp) dma_get_seg_boundary(): /store/kernel/linux/include/linux/dma-mapping.h:80 ffffffff8046c84c: 48 8b 87 c8 02 00 00 mov 0x2c8(%rdi),%rax <---- --- [4] Signed-off-by: Daniel J Blueman Signed-off-by: Linus Torvalds commit 46dfa040f6c26f416a0979a7cd5a2d81f08121d5 Author: FUJITA Tomonori Date: Wed Sep 10 22:22:34 2008 +0200 add deprecated ide-scsi to feature-removal-schedule.txt Signed-off-by: FUJITA Tomonori Signed-off-by: Bartlomiej Zolnierkiewicz commit 62ff2ecf7a4e69f7271b7f7a57aaee76ffe610f2 Author: Masoud Sharbiani Date: Wed Sep 10 22:22:34 2008 +0200 ide: Fix pointer arithmetic in hpt3xx driver code (3rd try) git commit 74811f355f4f69a187fa74892dcf2a684b84ce99 causes crash at module load (or boot) time on my machine with a hpt374 controller. The reason for this is that for initializing second controller which sets (hwif->dev == host->dev[1]) to true (1), adds 1 to a void ptr, which advances it by one byte instead of advancing it by sizeof(hpt_info) bytes. Because of this, all initialization functions get corrupted data in info variable which causes a crash at boot time. This patch fixes that and makes my machine boot again. The card itself is a HPT374 raid conroller: Here is the lspci -v output: 03:06.0 RAID bus controller: HighPoint Technologies, Inc. HPT374 (rev 07) Subsystem: HighPoint Technologies, Inc. Unknown device 0001 Flags: bus master, 66MHz, medium devsel, latency 120, IRQ 28 I/O ports at 8000 [size=8] I/O ports at 7800 [size=4] I/O ports at 7400 [size=8] I/O ports at 7000 [size=4] I/O ports at 6800 [size=256] Expansion ROM at fe8e0000 [disabled] [size=128K] Capabilities: [60] Power Management version 2 03:06.1 RAID bus controller: HighPoint Technologies, Inc. HPT374 (rev 07) Subsystem: HighPoint Technologies, Inc. Unknown device 0001 Flags: bus master, 66MHz, medium devsel, latency 120, IRQ 28 I/O ports at 9800 [size=8] I/O ports at 9400 [size=4] I/O ports at 9000 [size=8] I/O ports at 8800 [size=4] I/O ports at 8400 [size=256] Capabilities: [60] Power Management version 2 Signed-off-by: Masoud Sharbiani Cc: Sergei Shtylyov Cc: Andrew Morton [bart: use dev_get_drvdata() per Sergei's suggestion] Signed-off-by: Bartlomiej Zolnierkiewicz commit e7b140365b86aaf94374214c6f4e6decbee2eb0a Author: Paul E. McKenney Date: Sun Aug 31 11:06:30 2008 -0700 [IA64] prevent ia64 from invoking irq handlers on offline CPUs Make ia64 refrain from clearing a given to-be-offlined CPU's bit in the cpu_online_mask until it has processed pending irqs. This change prevents other CPUs from being blindsided by an apparently offline CPU nevertheless changing globally visible state. Also remove the existing redundant cpu_clear(cpu, cpu_online_map). Signed-off-by: Paul E. McKenney Signed-off-by: Tony Luck commit a5827f40afafc864f57a1c44915f0bfaf3d94f53 Author: Adrian Bunk Date: Thu Aug 28 01:05:26 2008 +0300 PCI: fix pciehp_free_irq() This patch fixes an obvious bug (loop was never entered) caused by commit 820943b6fc4781621dee52ba026106758a727dd3 (pciehp: cleanup pcie_poll_cmd). Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Acked-by: Kenji Kaneshige Signed-off-by: Jesse Barnes commit 6bf6a1a49377c32a02939ec835553703994f3e41 Author: Julia Lawall Date: Wed Sep 10 13:57:19 2008 +0200 [IA64] arch/ia64/sn/pci/tioca_provider.c: introduce missing kfree Error handling code following a kmalloc should free the allocated data. Signed-off-by: Julia Lawall Signed-off-by: Tony Luck commit 47633cf0d60bde5581d039ac1283ef4377a6e782 Author: Robin Holt Date: Tue Sep 9 10:34:44 2008 -0500 [IA64] fix up bte.h bte.h expects a #define of L1_CACHE_MASK which is currently only in bte.c. This small patch gets bte.h to include cleanly and makes BTE_UNALIGNED_COPY not report errors. Signed-off-by: Robin Holt Signed-off-by: Tony Luck commit 4611a771fc8e5ad77d27f25268846abb425101a0 Author: James Bottomley Date: Tue Sep 9 17:56:47 2008 -0500 [IA64] fix compile failure with non modular builds Broke the non modular builds by moving an essential function into modules.c. Fix this by moving it out again and into asm/sections.h as an inline. To do this, the definitions of struct fdesc and struct got_val have been lifted out of modules.c and put in asm/elf.h where they belong. Signed-off-by: James Bottomley Signed-off-by: Tony Luck commit f461a1d80c865e5ec4d24107adbab8b010b60e32 Author: Julia Lawall Date: Wed Sep 10 13:57:43 2008 +0200 arch/x86/kernel/kdebugfs.c: introduce missing kfree Error handling code following a kmalloc should free the allocated data. Note that at the point of the change, node has not yet been stored in d, so it is not affected by the existing cleanup code. The semantic match that finds the problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @r exists@ local idexpression x; statement S; expression E; identifier f,l; position p1,p2; expression *ptr != NULL; @@ ( if ((x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...)) == NULL) S | x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...); ... if (x == NULL) S ) <... when != x when != if (...) { <+...x...+> } x->f = E ...> ( return \(0\|<+...x...+>\|ptr\); | return@p2 ...; ) @script:python@ p1 << r.p1; p2 << r.p2; @@ print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line) // Signed-off-by: Julia Lawall Signed-off-by: Ingo Molnar commit 0e116227a01580acf47437adba3afadf21b6bd5f Author: Tao Ma Date: Wed Sep 3 01:57:14 2008 +0800 ocfs2: Fix a bug in direct IO read. ocfs2 will become read-only if we try to read the bytes which pass the end of i_size. This can be easily reproduced by following steps: 1. mkfs a ocfs2 volume with bs=4k cs=4k and nosparse. 2. create a small file(say less than 100 bytes) and we will create the file which is allocated 1 cluster. 3. read 8196 bytes from the kernel using O_DIRECT which exceeds the limit. 4. The ocfs2 volume becomes read-only and dmesg shows: OCFS2: ERROR (device sda13): ocfs2_direct_IO_get_blocks: Inode 66010 has a hole at block 1 File system is now read-only due to the potential of on-disk corruption. Please run fsck.ocfs2 once the file system is unmounted. So suppress the ERROR message. Signed-off-by: Tao Ma Signed-off-by: Mark Fasheh commit adee14b2e1557d0a8559f29681732d05a89dfc35 Author: Linus Torvalds Date: Tue Sep 9 16:27:49 2008 -0700 Linux 2.6.27-rc6 commit 91cd99f677ada2af90b06cb1f59e99f27ade5740 Merge: 5b0dac7... e550dfb... Author: Linus Torvalds Date: Tue Sep 9 16:25:58 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: ipv6: Fix OOPS in ip6_dst_lookup_tail(). ipsec: Restore larval states and socket policies in dump [Bluetooth] Reject L2CAP connections on an insecure ACL link [Bluetooth] Enforce correct authentication requirements [Bluetooth] Fix reference counting during ACL config stage commit 5b0dac745f2e43836e8fb2920391834d8a8f7fed Merge: bdce291... 2eb2f77... Author: Linus Torvalds Date: Tue Sep 9 16:25:02 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Disable timer interrupts in fixup_irqs(). commit e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b Author: Neil Horman Date: Tue Sep 9 13:51:35 2008 -0700 ipv6: Fix OOPS in ip6_dst_lookup_tail(). This fixes kernel bugzilla 11469: "TUN with 1024 neighbours: ip6_dst_lookup_tail NULL crash" dst->neighbour is not necessarily hooked up at this point in the processing path, so blindly dereferencing it is the wrong thing to do. This NULL check exists in other similar paths and this case was just an oversight. Also fix the completely wrong and confusing indentation here while we're at it. Based upon a patch by Evgeniy Polyakov. Signed-off-by: Neil Horman Signed-off-by: David S. Miller commit bdce291a69a4de340eb5a0f7b87dd0d49744d6b6 Merge: 93811d9... 61c22c3... Author: Linus Torvalds Date: Tue Sep 9 13:47:01 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: clockevents: remove WARN_ON which was used to gather information commit e75b986af7881ed8d8ccb1ed154045ed17cfebd0 Author: Thomas Gleixner Date: Tue Sep 9 21:38:57 2008 +0200 clockevents: remove WARN_ON which was used to gather information The issue of the endless reprogramming loop due to a too small min_delta_ns was fixed with the previous updates of the clock events code, but we had no information about the spread of this problem. I added a WARN_ON to get automated information via kerneloops.org and to get some direct reports, which allowed me to analyse the affected machines. The WARN_ON has served its purpose and would be annoying for a release kernel. Remove it and just keep the information about the increase of the min_delta_ns value. Signed-off-by: Thomas Gleixner commit 61c22c34c6f80a8e89cff5ff717627c54cc14fd4 Author: Thomas Gleixner Date: Tue Sep 9 21:38:57 2008 +0200 clockevents: remove WARN_ON which was used to gather information The issue of the endless reprogramming loop due to a too small min_delta_ns was fixed with the previous updates of the clock events code, but we had no information about the spread of this problem. I added a WARN_ON to get automated information via kerneloops.org and to get some direct reports, which allowed me to analyse the affected machines. The WARN_ON has served its purpose and would be annoying for a release kernel. Remove it and just keep the information about the increase of the min_delta_ns value. Signed-off-by: Thomas Gleixner commit 93811d94f7e9bcfeed7d6ba75ea5d9c80a70ab95 Merge: ea81e27... d6be118... Author: Linus Torvalds Date: Tue Sep 9 12:23:41 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: fix memmap=exactmap boot argument x86: disable static NOPLs on 32 bits xen: fix 2.6.27-rc5 xen balloon driver warnings commit d6be118a97ce51ca84035270f91c2bccecbfac5f Author: Prarit Bhargava Date: Tue Sep 9 09:56:08 2008 -0400 x86: fix memmap=exactmap boot argument When using kdump modifying the e820 map is yielding strange results. For example starting with BIOS-provided physical RAM map: BIOS-e820: 0000000000000100 - 0000000000093400 (usable) BIOS-e820: 0000000000093400 - 00000000000a0000 (reserved) BIOS-e820: 0000000000100000 - 000000003fee0000 (usable) BIOS-e820: 000000003fee0000 - 000000003fef3000 (ACPI data) BIOS-e820: 000000003fef3000 - 000000003ff80000 (ACPI NVS) BIOS-e820: 000000003ff80000 - 0000000040000000 (reserved) BIOS-e820: 00000000e0000000 - 00000000f0000000 (reserved) BIOS-e820: 00000000fec00000 - 00000000fec10000 (reserved) BIOS-e820: 00000000fee00000 - 00000000fee01000 (reserved) BIOS-e820: 00000000ff000000 - 0000000100000000 (reserved) and booting with args memmap=exactmap memmap=640K@0K memmap=5228K@16384K memmap=125188K@22252K memmap=76K#1047424K memmap=564K#1047500K resulted in: user-defined physical RAM map: user: 0000000000000000 - 0000000000093400 (usable) user: 0000000000093400 - 00000000000a0000 (reserved) user: 0000000000100000 - 000000003fee0000 (usable) user: 000000003fee0000 - 000000003fef3000 (ACPI data) user: 000000003fef3000 - 000000003ff80000 (ACPI NVS) user: 000000003ff80000 - 0000000040000000 (reserved) user: 00000000e0000000 - 00000000f0000000 (reserved) user: 00000000fec00000 - 00000000fec10000 (reserved) user: 00000000fee00000 - 00000000fee01000 (reserved) user: 00000000ff000000 - 0000000100000000 (reserved) But should have resulted in: user-defined physical RAM map: user: 0000000000000000 - 00000000000a0000 (usable) user: 0000000001000000 - 000000000151b000 (usable) user: 00000000015bb000 - 0000000008ffc000 (usable) user: 000000003fee0000 - 000000003ff80000 (ACPI data) This is happening because of an improper usage of strcmp() in the e820 parsing code. The strcmp() always returns !0 and never resets the value for e820.nr_map and returns an incorrect user-defined map. This patch fixes the problem. Signed-off-by: Prarit Bhargava Signed-off-by: Ingo Molnar commit ea81e2722e55ba0269c92f266763e445dcffb973 Merge: 0b1fc33... b301ea8... Author: Linus Torvalds Date: Tue Sep 9 11:53:05 2008 -0700 Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6: [S390] cio: allow offline processing for disconnected devices [S390] cio: handle ssch() return codes correctly. [S390] cio: Correct cleanup on error. [S390] CVE-2008-1514: prevent ptrace padding area read/write in 31-bit mode commit 0b1fc335d2f2c1206ac4048e5f6d8971f2aae6be Merge: b975dee... 4a911b1... Author: Linus Torvalds Date: Tue Sep 9 11:52:34 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] IP22: Fix detection of second HPC3 on Challenge S commit b975dee3811ae0c58bd0e19cbd041cac8dd37ec5 Merge: deac93d... a5cb562... Author: Linus Torvalds Date: Tue Sep 9 11:52:12 2008 -0700 Merge branch 'linux-next' of git://git.infradead.org/~dedekind/ubifs-2.6 * 'linux-next' of git://git.infradead.org/~dedekind/ubifs-2.6: UBIFS: make minimum fanout 3 UBIFS: fix division by zero UBIFS: amend f_fsid UBIFS: fill f_fsid UBIFS: improve statfs reporting even more UBIFS: introduce LEB overhead UBIFS: add forgotten gc_idx_lebs component UBIFS: fix assertion UBIFS: improve statfs reporting UBIFS: remove incorrect index space check UBIFS: push empty flash hack down UBIFS: do not update min_idx_lebs in stafs UBIFS: allow for racing between GC and TNC UBIFS: always read hashed-key nodes under TNC mutex UBIFS: fix zero-length truncations commit deac93df26b20cf8438339b5935b5f5643bc30c9 Author: James Bottomley Date: Wed Sep 3 20:43:36 2008 -0500 lib: Correct printk %pF to work on all architectures It was introduced by "vsprintf: add support for '%pS' and '%pF' pointer formats" in commit 0fe1ef24f7bd0020f29ffe287dfdb9ead33ca0b2. However, the current way its coded doesn't work on parisc64. For two reasons: 1) parisc isn't in the #ifdef and 2) parisc has a different format for function descriptors Make dereference_function_descriptor() more accommodating by allowing architecture overrides. I put the three overrides (for parisc64, ppc64 and ia64) in arch/kernel/module.c because that's where the kernel internal linker which knows how to deal with function descriptors sits. Signed-off-by: James Bottomley Acked-by: Benjamin Herrenschmidt Acked-by: Tony Luck Acked-by: Kyle McMartin Signed-off-by: Linus Torvalds commit 7ae115b4f50d3c5824f1a15e572b5de9d1b06d35 Author: Chris Snook Date: Tue Sep 9 03:26:57 2008 -0400 MAINTAINERS: add Atheros maintainer for atlx Jie Yang at Atheros is getting more directly involved with upstream work on the atl* drivers. This patch changes the ATL1 entry to ATLX (atl2 support posted to netdev today) and adds him as a maintainer. Signed-off-by: Linus Torvalds commit adaae7215e5130e5ce1ac3ee390e5a23101b09b2 Author: Christoph Hellwig Date: Tue Sep 9 20:02:01 2008 +0200 update Documentation/filesystems/Locking for 2.6.27 changes In the 2.6.27 circle ->fasync lost the BKL, and the last remaining ->open variant that takes the BKL is also gone. ->get_sb and ->kill_sb didn't have BKL forever, so updated the entries while we're at that. Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds commit 48902025af4da44dbbc0231061e542d6d40e712e Author: Alex Chiang Date: Fri Sep 5 14:05:03 2008 -0700 PCI Hotplug: fakephp: fix deadlock... again Commit fe99740cac117f208707488c03f3789cf4904957 (construct one fakephp slot per PCI slot) introduced a regression, causing a deadlock when removing a PCI device. We also never actually removed the device from the PCI core. So we: - remove the device from the PCI core - do not directly call remove_slot() to prevent deadlock Yu Zhao reported and diagnosed this defect. Signed-off-by: Alex Chiang Acked-by: Yu Zhao Cc: Matthew Wilcox Cc: Kristen Carlson Accardi Signed-off-by: Andrew Morton Signed-off-by: Jesse Barnes commit 53bc88701be91e7f631ad31418b32392aa952e9b Author: Johann Felix Soden Date: Fri Aug 22 20:25:10 2008 +0200 PCI: Fix printk warnings in setup-bus.c Again, the cleaned up code introduced some resource warnings: drivers/pci/setup-bus.c: In function 'pci_bus_dump_res': drivers/pci/setup-bus.c:542: warning: format '%llx' expects type 'long long unsigned int', but argument 5 has type 'resource_size_t' drivers/pci/setup-bus.c:542: warning: format '%llx' expects type 'long long unsigned int', but argument 6 has type 'resource_size_t' Fix those up too. Signed-off-by: Johann Felix Soden Signed-off-by: Jesse Barnes commit 4ca8a7726fb0e8094fdb56f2ae2d69fcf9254eae Author: Johann Felix Soden Date: Fri Aug 22 20:46:59 2008 +0200 PCI: Fix printk warnings in probe.c The cleaned up resource code in probe.c introduced some warnings: drivers/pci/probe.c: In function 'pci_read_bridge_bases': drivers/pci/probe.c:386: warning: format '%llx' expects type 'long long unsigned int', but argument 3 has type 'resource_size_t' drivers/pci/probe.c:386: warning: format '%llx' expects type 'long long unsigned int', but argument 4 has type 'resource_size_t' drivers/pci/probe.c:398: warning: format '%llx' expects type 'long long unsigned int', but argument 3 has type 'resource_size_t' drivers/pci/probe.c:398: warning: format '%llx' expects type 'long long unsigned int', but argument 4 has type 'resource_size_t' drivers/pci/probe.c:434: warning: format '%llx' expects type 'long long unsigned int', but argument 4 has type 'resource_size_t' drivers/pci/probe.c:434: warning: format '%llx' expects type 'long long unsigned int', but argument 5 has type 'resource_size_t' So fix them up. Signed-off-by: Johann Felix Soden Signed-off-by: Jesse Barnes commit cbda1ba898647aeb4ee770b803c922f595e97731 Author: David Woodhouse Date: Sun Sep 7 16:35:26 2008 +0100 PCI/iommu: blacklist DMAR on Intel G31/G33 chipsets Some BIOSes (the Intel DG33BU, for example) wrongly claim to have DMAR when they don't. Avoid the resulting crashes when it doesn't work as expected. Signed-off-by: David Woodhouse Acked-by: Ingo Molnar Signed-off-by: Jesse Barnes commit 225f40055f779032974a9fce7b2f9c9eda04ff58 Author: Herbert Xu Date: Tue Sep 9 05:23:37 2008 -0700 ipsec: Restore larval states and socket policies in dump The commit commit 4c563f7669c10a12354b72b518c2287ffc6ebfb3 ("[XFRM]: Speed up xfrm_policy and xfrm_state walking") inadvertently removed larval states and socket policies from netlink dumps. This patch restores them. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit b301ea8c81b13123761772f344faf606c76ba174 Author: Peter Oberparleiter Date: Tue Sep 9 12:38:59 2008 +0200 [S390] cio: allow offline processing for disconnected devices When disconnected ccw devices are removed, the device has to be set offline, otherwise there will be side effects including a reference count imbalance. This patch modifies ccw_device_offline to work for devices in disconnecte/not operational state. ccw_device_offline is called by cio for devices which are online during device removal. Signed-off-by: Peter Oberparleiter Signed-off-by: Martin Schwidefsky commit c91ebe496120e05301465fff31094bfecf798e9f Author: Cornelia Huck Date: Tue Sep 9 12:38:58 2008 +0200 [S390] cio: handle ssch() return codes correctly. ssch() has two classes of return codes: - condition codes (0-3) which need to be translated to Linux error codes - Linux error codes (-EIO on exceptions) which should be passed to the caller (instead of erronously being handled like condition code 3) Signed-off-by: Cornelia Huck Signed-off-by: Martin Schwidefsky commit a2164b8174f13b7315c3f45c0b48dec619285096 Author: Cornelia Huck Date: Tue Sep 9 12:38:57 2008 +0200 [S390] cio: Correct cleanup on error. Fix cleanup on error in chp_new() and init_channel_subsystem() (must not call kfree() on structures that had been registered). Signed-off-by: Cornelia Huck Signed-off-by: Martin Schwidefsky commit 3d6e48f43340343d97839eadb1ab7b6a3ea98797 Author: Jarod Wilson Date: Tue Sep 9 12:38:56 2008 +0200 [S390] CVE-2008-1514: prevent ptrace padding area read/write in 31-bit mode When running a 31-bit ptrace, on either an s390 or s390x kernel, reads and writes into a padding area in struct user_regs_struct32 will result in a kernel panic. This is also known as CVE-2008-1514. Test case available here: http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/tests/user-area-padding.c?cvsroot=systemtap Steps to reproduce: 1) wget the above 2) gcc -o user-area-padding-31bit user-area-padding.c -Wall -ggdb2 -D_GNU_SOURCE -m31 3) ./user-area-padding-31bit Test status ----------- Without patch, both s390 and s390x kernels panic. With patch, the test case, as well as the gdb testsuite, pass without incident, padding area reads returning zero, writes ignored. Nb: original version returned -EINVAL on write attempts, which broke the gdb test and made the test case slightly unhappy, Jan Kratochvil suggested the change to return 0 on write attempts. Signed-off-by: Jarod Wilson Tested-by: Jan Kratochvil Signed-off-by: Martin Schwidefsky commit fd9ec7d31ffc36917dc7cac0fd0435f587a572d4 Merge: 82a28c7... e7c29cb... Author: David S. Miller Date: Tue Sep 9 02:11:11 2008 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/holtmann/bluetooth-2.6 commit e7c29cb16c833441fd2160642bb13025f4e7ac70 Author: Marcel Holtmann Date: Tue Sep 9 07:19:20 2008 +0200 [Bluetooth] Reject L2CAP connections on an insecure ACL link The Security Mode 4 of the Bluetooth 2.1 specification has strict authentication and encryption requirements. It is the initiators job to create a secure ACL link. However in case of malicious devices, the acceptor has to make sure that the ACL is encrypted before allowing any kind of L2CAP connection. The only exception here is the PSM 1 for the service discovery protocol, because that is allowed to run on an insecure ACL link. Previously it was enough to reject a L2CAP connection during the connection setup phase, but with Bluetooth 2.1 it is forbidden to do any L2CAP protocol exchange on an insecure link (except SDP). The new hci_conn_check_link_mode() function can be used to check the integrity of an ACL link. This functions also takes care of the cases where Security Mode 4 is disabled or one of the devices is based on an older specification. Signed-off-by: Marcel Holtmann commit 09ab6f4c2376a0fc31abde1e2991513f900ea825 Author: Marcel Holtmann Date: Tue Sep 9 07:19:20 2008 +0200 [Bluetooth] Enforce correct authentication requirements With the introduction of Security Mode 4 and Simple Pairing from the Bluetooth 2.1 specification it became mandatory that the initiator requires authentication and encryption before any L2CAP channel can be established. The only exception here is PSM 1 for the service discovery protocol (SDP). It is meant to be used without any encryption since it contains only public information. This is how Bluetooth 2.0 and before handle connections on PSM 1. For Bluetooth 2.1 devices the pairing procedure differentiates between no bonding, general bonding and dedicated bonding. The L2CAP layer wrongly uses always general bonding when creating new connections, but it should not do this for SDP connections. In this case the authentication requirement should be no bonding and the just-works model should be used, but in case of non-SDP connection it is required to use general bonding. If the new connection requires man-in-the-middle (MITM) protection, it also first wrongly creates an unauthenticated link key and then later on requests an upgrade to an authenticated link key to provide full MITM protection. With Simple Pairing the link key generation is an expensive operation (compared to Bluetooth 2.0 and before) and doing this twice during a connection setup causes a noticeable delay when establishing a new connection. This should be avoided to not regress from the expected Bluetooth 2.0 connection times. The authentication requirements are known up-front and so enforce them. To fulfill these requirements the hci_connect() function has been extended with an authentication requirement parameter that will be stored inside the connection information and can be retrieved by userspace at any time. This allows the correct IO capabilities exchange and results in the expected behavior. Signed-off-by: Marcel Holtmann commit f1c08ca559387ab30992055596d54061dfa022b1 Author: Marcel Holtmann Date: Tue Sep 9 07:19:19 2008 +0200 [Bluetooth] Fix reference counting during ACL config stage The ACL config stage keeps holding a reference count on incoming connections when requesting the extended features. This results in keeping an ACL link up without any users. The problem here is that the Bluetooth specification doesn't define an ownership of the ACL link and thus it can happen that the implementation on the initiator side doesn't care about disconnecting unused links. In this case the acceptor needs to take care of this. Signed-off-by: Marcel Holtmann commit 2eb2f77900d62796934bcd43c4089e444cf1179e Author: David S. Miller Date: Mon Sep 8 17:21:07 2008 -0700 sparc64: Disable timer interrupts in fixup_irqs(). When a CPU is offlined, we leave the timer interrupts disabled because fixup_irqs() does not explicitly take care of that case. Fix this by invoking tick_ops->disable_irq(). Based upon analysis done by Paul E. McKenney. Signed-off-by: David S. Miller commit 82a28c794f27aac17d7a3ebd7f14d731a11a5532 Merge: c1bad36... 84c4f2f... Author: Linus Torvalds Date: Mon Sep 8 15:55:18 2008 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6 * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6: avr32: pm_standby low-power ram bug fix avr32: Fix lockup after Java stack underflow in user mode commit c1bad36054828b6a625afea39deb83d0e66e4336 Merge: 6a23312... 4ff23fa... Author: Linus Torvalds Date: Mon Sep 8 15:54:32 2008 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: powerpc: Fix rare boot build breakage powerpc/spufs: Fix possible scheduling of a context to multiple SPEs powerpc/spufs: Fix race for a free SPU powerpc/spufs: Fix multiple get_spu_context() commit 6a23312bd31878db555afad98b44705fc1590896 Merge: 4ced08b... f4c4cd6... Author: Linus Torvalds Date: Mon Sep 8 15:51:12 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: Revert "crypto: camellia - Use kernel-provided bitops, unaligned access helpers" commit 4ced08b89f591521c3d2e3e87ab914016e6b7d94 Merge: e1d7bf1... 1ad77a8... Author: Linus Torvalds Date: Mon Sep 8 15:50:19 2008 -0700 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] 5241/1: provide ioremap_wc() [ARM] omap: fix virtual vs physical address space confusions [ARM] remove unused #include [ARM] omap: fix build error in ohci-omap.c [ARM] omap: fix gpio.c build error commit e1d7bf14999469b16e86889ac71c94a9d0d2f5f4 Merge: e228c1b... 291c54f... Author: Linus Torvalds Date: Mon Sep 8 15:47:21 2008 -0700 Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: arch_reinit_sched_domains() must destroy domains to force rebuild sched, cpuset: rework sched domains and CPU hotplug handling (v4) commit e228c1b51ef572843827630e643a682ef492b933 Merge: a46add7... 8e48b6b... Author: Linus Torvalds Date: Mon Sep 8 15:46:56 2008 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: ahci: RAID mode SATA patch for Intel Ibex Peak DeviceIDs pata_sil680: remove duplicate pcim_enable_device libata-sff: kill spurious WARN_ON() in ata_hsm_move() sata_nv: disable hardreset for generic ahci: disable PMP for marvell ahcis sata_mv: add RocketRaid 1720 PCI ID to driver ahci, pata_marvell: play nicely together commit a46add72f79bb8196f07a860adddd312ca398eec Author: Uwe Kleine-König Date: Tue Sep 9 00:11:39 2008 +0200 Fix format of MAINTAINERS ... one entry lacked a colon which broke one of my scripts. Signed-off-by: Uwe Kleine-König Signed-off-by: Linus Torvalds commit bcbc713470283bc82d043fd23b02e41a9eb8dee5 Merge: b364e2f... 8d4698f... Author: Linus Torvalds Date: Mon Sep 8 15:43:44 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: bridge: don't allow setting hello time to zero netns : fix kernel panic in timewait socket destruction pkt_sched: Fix qdisc state in net_tx_action() netfilter: nf_conntrack_irc: make sure string is terminated before calling simple_strtoul netfilter: nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet netfilter: nf_conntrack_gre: more locking around keymap list netfilter: nf_conntrack_sip: de-static helper pointers commit b364e2f5262e972e731a576dfc6ede0689a6c19e Merge: 06dd881... 4d08461... Author: Linus Torvalds Date: Mon Sep 8 15:43:02 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Prevent sparc64 from invoking irq handlers on offline CPUs sparc64: Fix IPI call locking. commit 06dd881f59b3c07a430cdcbef2197f9b6dc79ae8 Author: Jason Wessel Date: Mon Sep 8 14:53:37 2008 +0100 usb: fix null deferences in low level usb serial The hw interface drivers for the usb serial devices deference the tty structure to set up the parameters for the initial console. The tty structure should be passed as a parameter to the set_termios() call. Signed-off-by: Jason Wessel Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds commit af904deaf6da3f3285eb0a06a3dc6a1af0251030 Author: Chuck Lever Date: Mon Sep 8 11:58:13 2008 -0400 NFS: Restore missing hunk in NFS mount option parser Automounter maps can contain mount options valid for other NFS implementations but not for Linux. The Linux automounter uses the mount command's "-s" command line option ("s" for "sloppy") so that mount requests containing such options are not rejected. Commit f45663ce5fb30f76a3414ab3ac69f4dd320e760a attempted to address a known regression with text-based NFS mount option parsing. Unrecognized mount options would cause mount requests to fail, even if the "-s" option was used on the mount command line. Unfortunately, this commit was not complete as submitted. It adds a new mount option, "sloppy". But it is missing a hunk, so it now allows NFS mounts with unrecognized mount options, even if the "sloppy" option is not present. This could be a problem if a required critical mount option such as "sync" is misspelled, for example, and is considered a regression from 2.6.26. This patch restores the missing hunk. Now, the default behavior of text-based NFS mount options is as before: any unrecognized mount option will cause the mount to fail. Please include this in 2.6.27-rc. Thanks to Neil Brown for reporting this. Signed-off-by: Chuck Lever Acked-by: J. Bruce Fields Signed-off-by: Linus Torvalds commit 8d4698f7a54a492a1b96c505b30fe750ae3e61d5 Author: Stephen Hemminger Date: Mon Sep 8 13:44:40 2008 -0700 bridge: don't allow setting hello time to zero Dushan Tcholich reports that on his system ksoftirqd can consume between %6 to %10 of cpu time, and cause ~200 context switches per second. He then correlated this with a report by bdupree@techfinesse.com: http://marc.info/?l=linux-kernel&m=119613299024398&w=2 and the culprit cause seems to be starting the bridge interface. In particular, when starting the bridge interface, his scripts are specifying a hello timer interval of "0". The bridge hello time can't be safely set to values less than 1 second, otherwise it is possible to end up with a runaway timer. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit d315492b1a6ba29da0fa2860759505ae1b2db857 Author: Daniel Lezcano Date: Mon Sep 8 13:17:27 2008 -0700 netns : fix kernel panic in timewait socket destruction How to reproduce ? - create a network namespace - use tcp protocol and get timewait socket - exit the network namespace - after a moment (when the timewait socket is destroyed), the kernel panics. # BUG: unable to handle kernel NULL pointer dereference at 0000000000000007 IP: [] inet_twdr_do_twkill_work+0x6e/0xb8 PGD 119985067 PUD 11c5c0067 PMD 0 Oops: 0000 [1] SMP CPU 1 Modules linked in: ipv6 button battery ac loop dm_mod tg3 libphy ext3 jbd edd fan thermal processor thermal_sys sg sata_svw libata dock serverworks sd_mod scsi_mod ide_disk ide_core [last unloaded: freq_table] Pid: 0, comm: swapper Not tainted 2.6.27-rc2 #3 RIP: 0010:[] [] inet_twdr_do_twkill_work+0x6e/0xb8 RSP: 0018:ffff88011ff7fed0 EFLAGS: 00010246 RAX: ffffffffffffffff RBX: ffffffff82339420 RCX: ffff88011ff7ff30 RDX: 0000000000000001 RSI: ffff88011a4d03c0 RDI: ffff88011ac2fc00 RBP: ffffffff823392e0 R08: 0000000000000000 R09: ffff88002802a200 R10: ffff8800a5c4b000 R11: ffffffff823e4080 R12: ffff88011ac2fc00 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000041cbd940(0000) GS:ffff8800bff839c0(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000007 CR3: 00000000bd87c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 0, threadinfo ffff8800bff9e000, task ffff88011ff76690) Stack: ffffffff823392e0 0000000000000100 ffffffff821e3a3a 0000000000000008 0000000000000000 ffffffff821e3a61 ffff8800bff7c000 ffffffff8203c7e7 ffff88011ff7ff10 ffff88011ff7ff10 0000000000000021 ffffffff82351108 Call Trace: [] ? inet_twdr_hangman+0x0/0x9e [] ? inet_twdr_hangman+0x27/0x9e [] ? run_timer_softirq+0x12c/0x193 [] ? __do_softirq+0x5e/0xcd [] ? call_softirq+0x1c/0x28 [] ? do_softirq+0x2c/0x68 [] ? smp_apic_timer_interrupt+0x8e/0xa9 [] ? apic_timer_interrupt+0x66/0x70 [] ? default_idle+0x27/0x3b [] ? cpu_idle+0x5f/0x7d Code: e8 01 00 00 4c 89 e7 41 ff c5 e8 8d fd ff ff 49 8b 44 24 38 4c 89 e7 65 8b 14 25 24 00 00 00 89 d2 48 8b 80 e8 00 00 00 48 f7 d0 <48> 8b 04 d0 48 ff 40 58 e8 fc fc ff ff 48 89 df e8 c0 5f 04 00 RIP [] inet_twdr_do_twkill_work+0x6e/0xb8 RSP CR2: 0000000000000007 This patch provides a function to purge all timewait sockets related to a network namespace. The timewait sockets life cycle is not tied with the network namespace, that means the timewait sockets stay alive while the network namespace dies. The timewait sockets are for avoiding to receive a duplicate packet from the network, if the network namespace is freed, the network stack is removed, so no chance to receive any packets from the outside world. Furthermore, having a pending destruction timer on these sockets with a network namespace freed is not safe and will lead to an oops if the timer callback which try to access data belonging to the namespace like for example in: inet_twdr_do_twkill_work -> NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITED); Purging the timewait sockets at the network namespace destruction will: 1) speed up memory freeing for the namespace 2) fix kernel panic on asynchronous timewait destruction Signed-off-by: Daniel Lezcano Acked-by: Denis V. Lunev Acked-by: Eric W. Biederman Signed-off-by: David S. Miller commit 14469a8dd23677921db5e7354a602c98d9c6300f Author: Linus Torvalds Date: Fri Sep 5 09:30:14 2008 -0700 x86: disable static NOPLs on 32 bits On 32-bit, at least the generic nops are fairly reasonable, but the default nops for 64-bit really look pretty sad, and the P6 nops really do look better. So I would suggest perhaps moving the static P6 nop selection into the CONFIG_X86_64 thing. The alternative is to just get rid of that static nop selection, and just have two cases: 32-bit and 64-bit, and just pick obviously safe cases for them. Signed-off-by: H. Peter Anvin commit 5c89468c12899b84886cb47eec93f0c88e0f896a Author: Christoph Hellwig Date: Mon Sep 8 19:44:17 2008 +0200 udf: add llseek method UDF currently doesn't set a llseek method for regular files, which means it will fall back to default_llseek. This means no one can seek beyond 2 Gigabytes on udf, and that there's not protection vs the i_size updates from writers. Signed-off-by: Christoph Hellwig Signed-off-by: Jan Kara commit 0253398ca1df7e1d2bfbb452175c964a0862482c Author: Jeremy Fitzhardinge Date: Mon Sep 8 09:54:49 2008 -0700 xen: fix 2.6.27-rc5 xen balloon driver warnings Set the class so it doesn't clash with the normal memory class. Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Ingo Molnar =================================================================== commit 4a911b1efe219fa3c8af697be0054c72e13bdae4 Author: Thomas Bogendoerfer Date: Thu Sep 4 23:05:45 2008 +0200 [MIPS] IP22: Fix detection of second HPC3 on Challenge S The second HPC3 could be found only on Guiness systems (Challenge-S), but not on fullhouse (Indigo2) systems. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Ralf Baechle commit 8e48b6b307085ce8a747cf94294742f7b7a11b18 Author: Seth Heasley Date: Wed Aug 27 16:47:22 2008 -0700 ahci: RAID mode SATA patch for Intel Ibex Peak DeviceIDs Add the Intel Ibex Peak (PCH) SATA RAID Controller DeviceIDs. Signed-off-by: Seth Heasley Signed-off-by: Jeff Garzik commit de058cdea65842ed4bf17da6b50d6fe6b120a6ef Author: David Milburn Date: Fri Aug 29 10:36:28 2008 -0500 pata_sil680: remove duplicate pcim_enable_device Remove duplicate call to pcim_enable_device in sil680_init_one. Signed-off-by: David Milburn Signed-off-by: Jeff Garzik commit 9c2676b61a5a4b6d99e65fb2f438fb3914302eda Author: Tejun Heo Date: Fri Aug 29 16:27:43 2008 +0200 libata-sff: kill spurious WARN_ON() in ata_hsm_move() On HSM_ST_ERR, ata_hsm_move() triggers WARN_ON() if AC_ERR_DEV or AC_ERR_HSM is not set. PHY events may trigger HSM_ST_ERR with other error codes and, with or without it, there just isn't much reason to do WARN_ON() on it. Even if error code is not set there, core EH logic won't have any problem dealing with the error condition. OSDL bz#11065 reports this problem. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit 2fd673ecf0378ddeeeb87b3605e50212e0c0ddc6 Author: Tejun Heo Date: Fri Aug 29 16:13:12 2008 +0200 sata_nv: disable hardreset for generic of them being unifying probing, hotplug and EH reset paths uniform. Previously, broken hardreset could go unnoticed as it wasn't used during probing but when something goes wrong or after hotplug the problem will surface and bite hard. OSDL bug 11195 reports that sata_nv generic flavor falls into this category. Hardreset itself succeeds but PHY stays offline after hardreset. I tried longer debounce timing but the result was the same. http://bugzilla.kernel.org/show_bug.cgi?id=11195 So, it seems we'll have to drop hardreset from the generic flavor. Signed-off-by: Tejun Heo Cc: Peer Chen Signed-off-by: Jeff Garzik commit 17248461cb66103b87ff03bdee34aa61035cc93e Author: Tejun Heo Date: Fri Aug 29 16:03:59 2008 +0200 ahci: disable PMP for marvell ahcis Marvell ahcis don't play nicely with PMPs. Disable it. Reported by KueiHuan Chen in the following thread. http://thread.gmane.org/gmane.linux.ide/33296 Signed-off-by: Tejun Heo Cc: KueiHuan Chen Cc: Mark Lord Signed-off-by: Jeff Garzik commit 46c5784c8fa736c2bb42fe681189b86e99abdc2e Author: Mark Lord Date: Thu Sep 4 18:21:07 2008 -0400 sata_mv: add RocketRaid 1720 PCI ID to driver Signed-off-by: Petr Jelen Signed-off-by: Mark Lord Signed-off-by: Jeff Garzik commit 5b66c829bf5c65663b2f68ee6b42f6e834cd39cd Author: Alan Cox Date: Wed Sep 3 14:48:34 2008 +0100 ahci, pata_marvell: play nicely together I've been chasing Jeff about this for months. Jeff added the Marvell device identifiers to the ahci driver without making the AHCI driver handle the PATA port. This means a lot of users can't use current kernels and in most distro cases can't even install. This has been going on since March 2008 for the 6121 Marvell, and late 2007 for the 6145!!! This was all pointed out at the time and repeatedly ignored. Bugs assigned to Jeff about this are ignored also. To quote Jeff in email > "Just switch the order of 'ahci' and 'pata_marvell' in > /etc/modprobe.conf, then use Fedora's tools regenerate the initrd. > See? It's not rocket science, and the current configuration can be > easily made to work for Fedora users." (Which isn't trivial, isn't end user, shouldn't be needed, and as it usually breaks at install time is in fact impossible) To quote Jeff in August 2007 > " mv-ahci-pata > Marvell 6121/6141 PATA support. Needs fixing in the 'PATA controller > command' area before it is usable, and can go upstream." Only he add the ids anyway later and caused regressions, adding a further id in March causing more regresions. The actual fix for the moment is very simple. If the user has included the pata_marvell driver let it drive the ports. If they've only selected for SATA support give them the AHCI driver which will run the port a fraction faster. Allow the user to control this decision via ahci.marvell_enable as a module parameter so that distributions can ship 'it works' defaults and smarter users (or config tools) can then flip it over it desired. Signed-off-by: Alan Cox Signed-off-by: Jeff Garzik commit 4ff23fa93011e2367fea056e72c92709178972d9 Author: Hugh Dickins Date: Sun Sep 7 00:35:48 2008 +0100 powerpc: Fix rare boot build breakage A make -j20 powerpc kernel build broke a couple of months ago saying: In file included from arch/powerpc/boot/gunzip_util.h:13, from arch/powerpc/boot/prpmc2800.c:21: arch/powerpc/boot/zlib.h:85: error: expected ‘:’, ‘,’, ‘;’, ‘}’ or ‘__attribute__’ before ‘*’ token arch/powerpc/boot/zlib.h:630: warning: type defaults to ‘int’ in declaration of ‘Byte’ arch/powerpc/boot/zlib.h:630: error: expected ‘;’, ‘,’ or ‘)’ before ‘*’ token It happened again yesterday: too rare for me to confirm the fix, but it looks like the list of dependants on gunzip_util.h was incomplete. Signed-off-by: Hugh Dickins Signed-off-by: Paul Mackerras commit f4c4cd6d14e3a3f638475f2f83e26765a7d3327b Author: Herbert Xu Date: Mon Sep 8 14:29:54 2008 +1000 Revert "crypto: camellia - Use kernel-provided bitops, unaligned access helpers" This reverts commit bd699f2df6dbc2f4cba528fe598bd63a4d3702c5, which causes camellia to fail the included self-test vectors. It has also been confirmed that it breaks existing encrypted disks using camellia. Signed-off-by: Herbert Xu commit e8a83e10d7dfe5d0841062780769b30f65417e15 Author: Jarek Poplawski Date: Sun Sep 7 18:41:21 2008 -0700 pkt_sched: Fix qdisc state in net_tx_action() net_tx_action() can skip __QDISC_STATE_SCHED bit clearing while qdisc is neither ran nor rescheduled, which may cause endless loop in dev_deactivate(). Reported-by: Denys Fedoryshchenko Tested-by: Denys Fedoryshchenko Signed-off-by: Jarek Poplawski Acked-by: Herbert Xu Signed-off-by: David S. Miller commit e3b802ba885b54f4050164c3cfd9e0ba9c73173a Author: Patrick McHardy Date: Sun Sep 7 18:21:24 2008 -0700 netfilter: nf_conntrack_irc: make sure string is terminated before calling simple_strtoul Alexey Dobriyan points out: 1. simple_strtoul() silently accepts all characters for given base even if result won't fit into unsigned long. This is amazing stupidity in itself, but 2. nf_conntrack_irc helper use simple_strtoul() for DCC request parsing. Data first copied into 64KB buffer, so theoretically nothing prevents reading past the end of it, since data comes from network given 1). This is not actually a problem currently since we're guaranteed to have a 0 byte in skb_shared_info or in the buffer the data is copied to, but to make this more robust, make sure the string is actually terminated. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 51807e91a76a531d059ec7ce3395c435e4df52a8 Author: Alexey Dobriyan Date: Sun Sep 7 18:20:36 2008 -0700 netfilter: nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet It does "kfree(list_head)" which looks wrong because entity that was allocated is definitely not list_head. However, this all works because list_head is first item in struct nf_ct_gre_keymap. Signed-off-by: Alexey Dobriyan Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 887464a41fde7e9e1e11ca86748338033c502446 Author: Alexey Dobriyan Date: Sun Sep 7 18:20:08 2008 -0700 netfilter: nf_conntrack_gre: more locking around keymap list gre_keymap_list should be protected in all places. (unless I'm misreading something) Signed-off-by: Alexey Dobriyan Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 66bf79182d6531c14c1f9a507b6bbf374a2ae4cd Author: Alexey Dobriyan Date: Sun Sep 7 18:19:25 2008 -0700 netfilter: nf_conntrack_sip: de-static helper pointers Helper's ->help hook can run concurrently with itself, so iterating over SIP helpers with static pointer won't work reliably. Signed-off-by: Alexey Dobriyan Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit b2e601d14deb2083e2a537b47869ab3895d23a28 Author: Andre Detsch Date: Thu Sep 4 21:16:27 2008 +0000 powerpc/spufs: Fix possible scheduling of a context to multiple SPEs We currently have a race when scheduling a context to a SPE - after we have found a runnable context in spusched_tick, the same context may have been scheduled by spu_activate(). This may result in a panic if we try to unschedule a context that has been freed in the meantime. This change exits spu_schedule() if the context has already been scheduled, so we don't end up scheduling it twice. Signed-off-by: Andre Detsch Signed-off-by: Jeremy Kerr commit 7686ad5606f08d9dfb33a2087a36c8366366015b Merge: 64f996f... 9ce1ca2... Author: Linus Torvalds Date: Sat Sep 6 21:47:30 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: i8042 - make Lenovo 3000 N100 blacklist entry more specific Input: bcm5974 - add BTN_TOUCH event for mousedev benefit Input: bcm5974 - improve finger tracking and counting Input: bcm5974 - small formatting cleanup Input: bcm5974 - add maintainer entry commit 64f996f670e9477072a43b226294ea1cc153f6ac Merge: f532522... 23952a9... Author: Linus Torvalds Date: Sat Sep 6 19:36:23 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: cpu_init(): fix memory leak when using CPU hotplug x86: pda_init(): fix memory leak when using CPU hotplug x86, xen: Use native_pte_flags instead of native_pte_val for .pte_flags x86: move mtrr cpu cap setting early in early_init_xxxx x86: delay early cpu initialization until cpuid is done x86: use X86_FEATURE_NOPL in alternatives x86: add NOPL as a synthetic CPU feature bit x86: boot: stub out unimplemented CPU feature words commit f5325225658737e6c9cb8e24373e2c281a90be2a Merge: 4747832... 4ab6a21... Author: Linus Torvalds Date: Sat Sep 6 19:33:26 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: clocksource, acpi_pm.c: check for monotonicity clocksource, acpi_pm.c: use proper read function also in errata mode ntp: fix calculation of the next jiffie to trigger RTC sync x86: HPET: read back compare register before reading counter x86: HPET fix moronic 32/64bit thinko clockevents: broadcast fixup possible waiters HPET: make minimum reprogramming delta useful clockevents: prevent endless loop lockup clockevents: prevent multiple init/shutdown clockevents: enforce reprogram in oneshot setup clockevents: prevent endless loop in periodic broadcast handler clockevents: prevent clockevent event_handler ending up handler_noop commit 4747832b56a95dbeb0cef4714e6fcc766eed0a95 Merge: a22a9a9... 8a65649... Author: Linus Torvalds Date: Sat Sep 6 19:33:10 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: Fix CONFIG_AC97_BUS dependency commit a22a9a90cfbcc91c3e0f8dc8549535e2786d3e7e Merge: 70bb089... 0011036... Author: Linus Torvalds Date: Sat Sep 6 19:32:21 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] Probe initrd header only if explicitly specified [MIPS] TX39xx: Add missing local_flush_icache_range initialization [MIPS] TXx9: Fix txx9_pcode initialization [MIPS] Fix WARNING: at kernel/smp.c:290 [MIPS] Fix data bus error recovery commit 291c54ff764d12ecc9a916cb478a0bbb45c5990e Merge: 4904862... dfb512e... Author: Ingo Molnar Date: Sat Sep 6 21:03:16 2008 +0200 Merge branch 'sched/cpuset' into sched/urgent commit 23952a96ae738277f3139b63d622e22984589031 Author: Andreas Herrmann Date: Wed Aug 6 10:29:37 2008 +0200 x86: cpu_init(): fix memory leak when using CPU hotplug Exception stacks are allocated each time a CPU is set online. But the allocated space is never freed. Thus with one CPU hotplug offline/online cycle there is a memory leak of 24K (6 pages) for a CPU. Fix is to allocate exception stacks only once -- when the CPU is set online for the first time. Signed-off-by: Andreas Herrmann Cc: akpm@linux-foundation.org Signed-off-by: Ingo Molnar commit d04ec773d7ca1bbc05a2768be95c1cebe2b07757 Author: Andreas Herrmann Date: Wed Aug 6 10:27:30 2008 +0200 x86: pda_init(): fix memory leak when using CPU hotplug pda->irqstackptr is allocated whenever a CPU is set online. But it is never freed. This results in a memory leak of 16K for each CPU offline/online cycle. Fix is to allocate pda->irqstackptr only once. Signed-off-by: Andreas Herrmann Cc: akpm@linux-foundation.org Signed-off-by: Ingo Molnar commit e4a6be4d2850da032a782b5296c07dfdf583af86 Author: Eduardo Habkost Date: Thu Jul 24 12:15:45 2008 -0300 x86, xen: Use native_pte_flags instead of native_pte_val for .pte_flags Using native_pte_val triggers the BUG_ON() in the paravirt_ops version of pte_flags(). Signed-off-by: Eduardo Habkost Acked-by: Jeremy Fitzhardinge Signed-off-by: Ingo Molnar commit dfb512ec4834116124da61d6c1ee10fd0aa32bd6 Author: Max Krasnyansky Date: Fri Aug 29 13:11:41 2008 -0700 sched: arch_reinit_sched_domains() must destroy domains to force rebuild What I realized recently is that calling rebuild_sched_domains() in arch_reinit_sched_domains() by itself is not enough when cpusets are enabled. partition_sched_domains() code is trying to avoid unnecessary domain rebuilds and will not actually rebuild anything if new domain masks match the old ones. What this means is that doing echo 1 > /sys/devices/system/cpu/sched_mc_power_savings on a system with cpusets enabled will not take affect untill something changes in the cpuset setup (ie new sets created or deleted). This patch fixes restore correct behaviour where domains must be rebuilt in order to enable MC powersaving flags. Test on quad-core Core2 box with both CONFIG_CPUSETS and !CONFIG_CPUSETS. Also tested on dual-core Core2 laptop. Lockdep is happy and things are working as expected. Signed-off-by: Max Krasnyansky Tested-by: Vaidyanathan Srinivasan Signed-off-by: Ingo Molnar commit dd786dd12c99634055a9066f25ea957f29991c22 Author: Yinghai Lu Date: Thu Sep 4 21:09:43 2008 +0200 x86: move mtrr cpu cap setting early in early_init_xxxx Krzysztof Helt found MTRR is not detected on k6-2 root cause: we moved mtrr_bp_init() early for mtrr trimming, and in early_detect we only read the CPU capability from cpuid, so some cpu doesn't have that bit in cpuid. So we need to add early_init_xxxx to preset those bit before mtrr_bp_init for those earlier cpus. this patch is for v2.6.27 Reported-by: Krzysztof Helt Signed-off-by: Yinghai Lu Signed-off-by: Ingo Molnar commit 12cf105cd66d95cf32c73cfa847a50bd1b700f23 Author: Krzysztof Helt Date: Thu Sep 4 21:09:43 2008 +0200 x86: delay early cpu initialization until cpuid is done Move early cpu initialization after cpu early get cap so the early cpu initialization can fix up cpu caps. Signed-off-by: Krzysztof Helt Signed-off-by: Yinghai Lu Signed-off-by: Ingo Molnar commit 4ab6a219113197425ac112e35e1ec8062c69888e Author: Dominik Brodowski Date: Fri Sep 5 14:05:35 2008 -0700 clocksource, acpi_pm.c: check for monotonicity The current check for monotonicity is way too weak: Andreas Mohr reports ( http://lkml.org/lkml/2008/8/10/77 ) that on one of his test systems the current check only triggers in 50% of all cases, leading to catastrophic timer behaviour. To fix this issue, expand the check for monotonicity by doing ten consecutive tests instead of one. Signed-off-by: Dominik Brodowski Signed-off-by: Andrew Morton Signed-off-by: Ingo Molnar commit dfdf748a61a21b7397b9f57c83de722de71dc56a Author: Dominik Brodowski Date: Fri Sep 5 14:05:33 2008 -0700 clocksource, acpi_pm.c: use proper read function also in errata mode On all hardware (some Intel ICH4, PIIX4 and PIIX4E chipsets) affected by a hardware errata there's about a 4.2% chance that initialization of the ACPI PMTMR fails. On those chipsets, we need to read out the timer value at least three times to get a correct result, for every once in a while (i.e. within a 3 ns window every 69.8 ns) the read returns a bogus result. During normal operation we work around this issue, but during initialization reading a bogus value may lead to -EINVAL even though the hardware is usable. Thanks to Andreas Mohr for spotting this issue. Signed-off-by: Dominik Brodowski Signed-off-by: Andrew Morton Signed-off-by: Ingo Molnar commit 4ff4b9e19a80b73959ebeb28d1df40176686f0a8 Author: Maciej W. Rozycki Date: Fri Sep 5 14:05:31 2008 -0700 ntp: fix calculation of the next jiffie to trigger RTC sync We have a bug in the calculation of the next jiffie to trigger the RTC synchronisation. The aim here is to run sync_cmos_clock() as close as possible to the middle of a second. Which means we want this function to be called less than or equal to half a jiffie away from when now.tv_nsec equals 5e8 (500000000). If this is not the case for a given call to the function, for this purpose instead of updating the RTC we calculate the offset in nanoseconds to the next point in time where now.tv_nsec will be equal 5e8. The calculated offset is then converted to jiffies as these are the unit used by the timer. Hovewer timespec_to_jiffies() used here uses a ceil()-type rounding mode, where the resulting value is rounded up. As a result the range of now.tv_nsec when the timer will trigger is from 5e8 to 5e8 + TICK_NSEC rather than the desired 5e8 - TICK_NSEC / 2 to 5e8 + TICK_NSEC / 2. As a result if for example sync_cmos_clock() happens to be called at the time when now.tv_nsec is between 5e8 + TICK_NSEC / 2 and 5e8 to 5e8 + TICK_NSEC, it will simply be rescheduled HZ jiffies later, falling in the same range of now.tv_nsec again. Similarly for cases offsetted by an integer multiple of TICK_NSEC. This change addresses the problem by subtracting TICK_NSEC / 2 from the nanosecond offset to the next point in time where now.tv_nsec will be equal 5e8, effectively shifting the following rounding in timespec_to_jiffies() so that it produces a rounded-to-nearest result. Signed-off-by: Maciej W. Rozycki Signed-off-by: Andrew Morton Signed-off-by: Ingo Molnar commit 1ad77a876da48331451698cc4172c90ab9b6372f Author: Lennert Buytenhek Date: Fri Sep 5 13:17:11 2008 +0100 [ARM] 5241/1: provide ioremap_wc() This patch provides an ARM implementation of ioremap_wc(). We use different page table attributes depending on which CPU we are running on: - Non-XScale ARMv5 and earlier systems: The ARMv5 ARM documents four possible mapping types (CB=00/01/10/11). We can't use any of the cached memory types (CB=10/11), since that breaks coherency with peripheral devices. Both CB=00 and CB=01 are suitable for _wc, and CB=01 (Uncached/Buffered) allows the hardware more freedom than CB=00, so we'll use that. (The ARMv5 ARM seems to suggest that CB=01 is allowed to delay stores but isn't allowed to merge them, but there is no other mapping type we can use that allows the hardware to delay and merge stores, so we'll go with CB=01.) - XScale v1/v2 (ARMv5): same as the ARMv5 case above, with the slight difference that on these platforms, CB=01 actually _does_ allow merging stores. (If you want noncoalescing bufferable behavior on Xscale v1/v2, you need to use XCB=101.) - Xscale v3 (ARMv5) and ARMv6+: on these systems, we use TEXCB=00100 mappings (Inner/Outer Uncacheable in xsc3 parlance, Uncached Normal in ARMv6 parlance). The ARMv6 ARM explicitly says that any accesses to Normal memory can be merged, which makes Normal memory more suitable for _wc mappings than Device or Strongly Ordered memory, as the latter two mapping types are guaranteed to maintain transaction number, size and order. We use the Uncached variety of Normal mappings for the same reason that we can't use C=1 mappings on ARMv5. The xsc3 Architecture Specification documents TEXCB=00100 as being Uncacheable and allowing coalescing of writes, which is also just what we need. Signed-off-by: Lennert Buytenhek Signed-off-by: Russell King commit 8a656496b21efd95fd55b66e0601c5ad41f9b156 Author: Takashi Iwai Date: Sat Sep 6 11:43:41 2008 +0200 Fix CONFIG_AC97_BUS dependency CONFIG_AC97_BUS is used from both sound and ucb1400 drivers. The recent change in Kconfig introduced the exclusive dependency on CONFIG_SOUND, and disabled the ucb1400 build without sound. This patch makes CONFIG_AC97_BUS independent. Signed-off-by: Takashi Iwai Tested-by: Randy Dunlap commit 72d43d9bc9210d24d09202eaf219eac09e17b339 Author: Thomas Gleixner Date: Sat Sep 6 03:06:08 2008 +0200 x86: HPET: read back compare register before reading counter After fixing the u32 thinko I sill had occasional hickups on ATI chipsets with small deltas. There seems to be a delay between writing the compare register and the transffer to the internal register which triggers the interrupt. Reading back the value makes sure, that it hit the internal match register befor we compare against the counter value. Signed-off-by: Thomas Gleixner commit f7676254f179eac6b5244a80195ec8ae0e9d4606 Author: Thomas Gleixner Date: Sat Sep 6 03:03:32 2008 +0200 x86: HPET fix moronic 32/64bit thinko We use the HPET only in 32bit mode because: 1) some HPETs are 32bit only 2) on i386 there is no way to read/write the HPET atomic 64bit wide The HPET code unification done by the "moron of the year" did not take into account that unsigned long is different on 32 and 64 bit. This thinko results in a possible endless loop in the clockevents code, when the return comparison fails due to the 64bit/332bit unawareness. unsigned long cnt = (u32) hpet_read() + delta can wrap over 32bit. but the final compare will fail and return -ETIME causing endless loops. Signed-off-by: Thomas Gleixner commit 7300711e8c6824fcfbd42a126980ff50439d8dd0 Author: Thomas Gleixner Date: Sat Sep 6 03:01:45 2008 +0200 clockevents: broadcast fixup possible waiters Until the C1E patches arrived there where no users of periodic broadcast before switching to oneshot mode. Now we need to trigger a possible waiter for a periodic broadcast when switching to oneshot mode. Otherwise we can starve them for ever. Signed-off-by: Thomas Gleixner commit f31d731e4467e61de51d7f6d7115f3b712d9354c Author: H. Peter Anvin Date: Mon Aug 18 17:50:33 2008 -0700 x86: use X86_FEATURE_NOPL in alternatives Use X86_FEATURE_NOPL to determine if it is safe to use P6 NOPs in alternatives. Also, replace table and loop with simple if statement. Signed-off-by: H. Peter Anvin commit b6734c35af028f06772c0b2c836c7d579e6d4dad Author: H. Peter Anvin Date: Mon Aug 18 17:39:32 2008 -0700 x86: add NOPL as a synthetic CPU feature bit The long noops ("NOPL") are supposed to be detected by family >= 6. Unfortunately, several non-Intel x86 implementations, both hardware and software, don't obey this dictum. Instead, probe for NOPL directly by executing a NOPL instruction and see if we get #UD. Signed-off-by: H. Peter Anvin commit b74b06c5f6612a72298f37baa65460a59c26ca67 Author: H. Peter Anvin Date: Fri Aug 15 15:36:31 2008 -0700 x86: boot: stub out unimplemented CPU feature words The CPU feature detection code in the boot code is somewhat minimal, and doesn't include all possible CPUID words. In particular, it doesn't contain the code for CPU feature words 2 (Transmeta), 3 (Linux-specific), 5 (VIA), or 7 (scattered). Zero them out, so we can still set those bits as known at compile time; in particular, this allows creating a Linux-specific NOPL flag and have it required (and therefore resolvable at compile time) in 64-bit mode. Signed-off-by: H. Peter Anvin commit 70bb08962ea9bd50797ae9f16b2493f5f7c65053 Author: Andrew Morton Date: Fri Sep 5 14:00:24 2008 -0700 drivers/mmc/card/block.c: fix refcount leak in mmc_block_open() mmc_block_open() increments md->usage although it returns with -EROFS when default mounting a MMC/SD card with write protect switch on. This reference counting bug prevents /dev/mmcblkX from being released on card removal, and situation worsen with reinsertion until the minor number range runs out. Reported-by: Acked-by: Pierre Ossman Cc: [2.6.25.x, 2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 22f30168d296dbb54a21ebad44c9d735bca6f67b Author: Roland McGrath Date: Fri Sep 5 14:00:23 2008 -0700 tracehook: comment pasto fixes Fix some pasto's in comments in the new linux/tracehook.h and asm-generic/syscall.h files. Reported-by: Wenji Huang Signed-off-by: Roland McGrath Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 34a35bddb9382fc2663e3137875ee58928f7d704 Author: Stanislaw Gruszka Date: Fri Sep 5 14:00:22 2008 -0700 atmel_lcdfb: fix oops in rmmod when framebuffer fails to register If framebuffer registration failed in platform driver ->probe() callback, dev_get_drvdata() points to freed memory region, but ->remove() function try to use it and the following oops occurs: Unable to handle kernel NULL pointer dereference at virtual address 00000228 pgd = c3a20000 [00000228] *pgd=23a2b031, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] Modules linked in: atmel_lcdfb(-) cfbcopyarea cfbimgblt cfbfillrect [last unloaded: atmel_lcdfb] CPU: 0 Not tainted (2.6.27-rc2 #116) PC is at atmel_lcdfb_remove+0x14/0xf8 [atmel_lcdfb] LR is at platform_drv_remove+0x20/0x24 pc : [] lr : [] psr: a0000013 sp : c3a45e84 ip : c3a45ea0 fp : c3a45e9c r10: 00000002 r9 : c3a44000 r8 : c0026c04 r7 : 00000880 r6 : c02bb228 r5 : 00000000 r4 : c02bb230 r3 : bf007e3c r2 : c02bb230 r1 : 00000004 r0 : c02bb228 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 0005317f Table: 23a20000 DAC: 00000015 Process rmmod (pid: 6799, stack limit = 0xc3a44260) Stack: (0xc3a45e84 to 0xc3a46000) 5e80: c02bb230 bf007e3c bf007e3c c3a45eac c3a45ea0 c0157d28 bf006bc0 5ea0: c3a45ec4 c3a45eb0 c0156d20 c0157d18 c02bb230 c02bb2d8 c3a45ee0 c3a45ec8 5ec0: c0156da8 c0156cb8 bf007e3c bf007ee0 c02c8e14 c3a45efc c3a45ee4 c0156018 5ee0: c0156d50 bf007e3c bf007ee0 00000000 c3a45f18 c3a45f00 c0157220 c0155f9c 5f00: 00000000 bf007ee0 bf008000 c3a45f28 c3a45f1c c0157e34 c01571ec c3a45f38 5f20: c3a45f2c bf006ba8 c0157e30 c3a45fa4 c3a45f3c c005772c bf006ba4 656d7461 5f40: 636c5f6c 00626664 c004c988 c3a45f80 c3a45f5c 00000000 c3a45fb0 00000000 5f60: ffffffff becaccd8 00000880 00000000 000a5e80 00000001 bf007ee0 00000880 5f80: c3a45f84 00000000 becaccd4 00000002 000003df 00000081 00000000 c3a45fa8 5fa0: c0026a60 c0057584 00000002 000003df 00900081 000a5e80 00000880 00000000 5fc0: becaccd4 00000002 000003df 00000000 000a5e80 00000001 00000002 0000005f 5fe0: 4004f5ec becacbe8 0001a158 4004f5fc 20000010 00900081 f9ffbadf 7bbfb2bb Backtrace: [] (atmel_lcdfb_remove+0x0/0xf8 [atmel_lcdfb]) from [] (platform_drv_remove+0x20/0x24) r6:bf007e3c r5:bf007e3c r4:c02bb230 [] (platform_drv_remove+0x0/0x24) from [] (__device_release_driver+0x78/0x98) [] (__device_release_driver+0x0/0x98) from [] (driver_detach+0x68/0x90) r5:c02bb2d8 r4:c02bb230 [] (driver_detach+0x0/0x90) from [] (bus_remove_driver+0x8c/0xb4) r6:c02c8e14 r5:bf007ee0 r4:bf007e3c [] (bus_remove_driver+0x0/0xb4) from [] (driver_unregister+0x44/0x48) r6:00000000 r5:bf007ee0 r4:bf007e3c [] (driver_unregister+0x0/0x48) from [] (platform_driver_unregister+0x14/0x18) r6:bf008000 r5:bf007ee0 r4:00000000 [] (platform_driver_unregister+0x0/0x18) from [] (atmel_lcdfb_exit+0x14/0x1c [atmel_lcdfb]) [] (atmel_lcdfb_exit+0x0/0x1c [atmel_lcdfb]) from [] (sys_delete_module+0x1b8/0x22c) [] (sys_delete_module+0x0/0x22c) from [] (ret_fast_syscall+0x0/0x2c) r7:00000081 r6:000003df r5:00000002 r4:becaccd4 Code: e92dd870 e24cb004 e59050c4 e1a06000 (e5954228) ---[ end trace 85476b184d9e68d8 ]--- This patch fixes the oops. Signed-off-by: Stanislaw Gruszka Acked-by: Nicolas Ferre Acked-by: Krzysztof Helt Cc: Haavard Skinnemoen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3cb5599a84c557c0dd9a19feb63a3788268cf249 Author: Rafael J. Wysocki Date: Fri Sep 5 14:00:19 2008 -0700 forcedeth: fix kexec regression Fix regression tracked as http://bugzilla.kernel.org/show_bug.cgi?id=11361 and caused by commit f735a2a1a4f2a0f5cd823ce323e82675990469e2 ("[netdrvr] forcedeth: setup wake-on-lan before shutting down") that makes network adapters integrated into the NVidia MCP55 chipsets fail to work in kexeced kernels. The problem appears to be that if the adapter is put into D3_hot during ->shutdown(), it cannot be brought back into D0 after kexec (ref. http://marc.info/?l=linux-kernel&m=121900062814967&w=4). Therefore, only put forcedeth into D3 during ->shutdown() if the system is to be powered off. Signed-off-by: Rafael J. Wysocki Tested-by: Yinghai Lu Cc: Ayaz Abdulla Acked-by: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 11d55d2cba6e867be8955e5ae011c54c556b849f Author: Li Zefan Date: Fri Sep 5 14:00:18 2008 -0700 res_counter: fix off-by-one bug in setting limit I found we can no longer set limit to 0 with 2.6.27-rcX: # mount -t cgroup -omemory xxx /mnt # mkdir /mnt/0 # echo 0 > /mnt/0/memory.limit_in_bytes bash: echo: write error: Device or resource busy It turned out 'limit' can't be set to 'usage', which is wrong IMO. Signed-off-by: Li Zefan Acked-by: KAMEZAWA Hiroyuki Acked-by: Balbir Singh Acked-by: Pavel Emelyanov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7f621861fbdb1ea90c36b1a59a45cb84b4a2239f Merge: 1c402c8... 4904862... Author: Linus Torvalds Date: Fri Sep 5 14:37:15 2008 -0700 Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: fix process time monotonicity sched_clock: fix NOHZ interaction commit 1c402c8cd1fb4d0524bab184f8609f7e098ccb2e Merge: 45d866e... e6a5652... Author: Linus Torvalds Date: Fri Sep 5 14:36:21 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: add io delay quirk for Presario F700 commit 45d866e1a06dba309f79dbb61ad1db964bb8ee8a Merge: 6f74b18... de24125... Author: Linus Torvalds Date: Fri Sep 5 14:35:56 2008 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx: async_tx: fix the bug in async_tx_run_dependencies commit 6f74b1849bf04432c4a2fe21f594136e5b9d1fad Merge: b693ffe... b35de67... Author: Linus Torvalds Date: Fri Sep 5 14:31:54 2008 -0700 Merge git://git.infradead.org/~dwmw2/dwmw2-2.6.27 * git://git.infradead.org/~dwmw2/dwmw2-2.6.27: Revert "[ARM] use the new byteorder headers" Fix conditional export of kvh.h and a.out.h to userspace. [MTD] [NAND] tmio_nand: fix base address programming commit b693ffe67363119199ffe9f2fac9119475968e8a Merge: 14408c4... 4eb00c9... Author: Linus Torvalds Date: Fri Sep 5 14:30:58 2008 -0700 Merge branch 'sh/for-2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: i2c: fix i2c-sh_mobile timing issues sh64: resume_kernel fix for kernel oops built with CONFIG_BKL_PREEMPT=y. sh: resume_kernel fix for kernel oops built with CONFIG_BKL_PREEMPT=y. sh: fix semtimedop syscall sh: update AP325RXA defconfig sh: update Migo-R defconfig sh: fix platform_resource_setup_memory() section mismatch sh: fix kexec entry point for crash kernels sh: crash kernel resource fix sh: fix ptrace_64.c:user_disable_single_step() sh64: re-add the __strnlen_user() prototype commit 14408c4f4172eafc26ff52bebb7a8ab85b1c5492 Merge: 54e2a32... 8561098... Author: Linus Torvalds Date: Fri Sep 5 14:29:50 2008 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb: (98 commits) V4L/DVB (8881): gspca: After 'while (retry--) {...}', retry will be -1 but not 0. V4L/DVB (8880): PATCH: Fix parents on some webcam drivers V4L/DVB (8877): b2c2 and bt8xx: udelay to mdelay V4L/DVB (8876): budget: udelay changed to mdelay V4L/DVB (8874): gspca: Adjust hstart for sn9c103/ov7630 and update usb-id's. V4L/DVB (8873): gspca: Bad image offset with rev012a of spca561 and adjust exposure. V4L/DVB (8872): gspca: Bad image format and offset with rev072a of spca561. V4L/DVB (8870): gspca: Fix dark room problem with sonixb. V4L/DVB (8869): gspca: Move the Sonix webcams with TAS5110C1B from sn9c102 to gspca. V4L/DVB (8868): gspca: Support for vga modes with sif sensors in sonixb. V4L/DVB (8844): dabusb_fpga_download(): fix a memory leak V4L/DVB (8843): tda10048_firmware_upload(): fix a memory leak V4L/DVB (8842): vivi_release(): fix use-after-free V4L/DVB (8840): dib0700: add basic support for Hauppauge Nova-TD-500 (84xxx) V4L/DVB (8839): dib0700: add comment to identify 35th USB id pair V4L/DVB (8837): dvb: fix I2C adapters name size V4L/DVB (8835): gspca: Same pixfmt as the sn9c102 driver and raw Bayer added in sonixb. V4L/DVB (8834): gspca: Have a bigger buffer for sn9c10x compressed images. V4L/DVB (8833): gspca: Cleanup the sonixb code. V4L/DVB (8832): gspca: Bad pixelformat of vc0321 webcams. ... commit 54e2a3270f4d5f50aefb08630a3c3c758b9c2723 Merge: 41c9229... 673d62c... Author: Linus Torvalds Date: Fri Sep 5 14:28:19 2008 -0700 Merge branch 'core/debugobjects' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core/debugobjects' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: debugobjects: fix lockdep warning commit 41c9229498a2eb89db1c0a77321c61b448738de4 Merge: bf7394c... 5ed4591... Author: Linus Torvalds Date: Fri Sep 5 14:27:12 2008 -0700 Merge branch 'release-2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-acpi-2.6 * 'release-2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-acpi-2.6: acer-wmi: remove debugfs entries upon unloading ACPI: Avoid bogus timeout about SMbus check fujitsu-laptop: fix regression for P8010 in 2.6.27-rc ACPI: Make Len Brown the ACPI maintainer again ACPI: thinkpad-acpi: wan radio control is not experimental PNPACPI: ignore the producer/consumer bit for extended IRQ descriptors acpi: add checking for NULL early param ACPI: Fix typo in "Disable MWAIT via DMI on broken Compal board" ACPI: Fix now signed module parameter. ACPI: Change package length error to warning ACPI: Fix now signed module parameter. commit 0011036beeffeada15acd1936d67988de21ca65e Author: Atsushi Nemoto Date: Tue Aug 26 22:34:57 2008 +0900 [MIPS] Probe initrd header only if explicitly specified Currently init_initrd() probes initrd header at the last page of kernel image, but it is valid only if addinitrd was used. If addinitrd was not used, the area contains garbage so probing there might misdetect initrd header (magic number is not strictly robust). This patch introduces CONFIG_PROBE_INITRD_HEADER to explicitly enable this probing. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit 3885ec8ca29e5e33e9a5f0ae9dc849d798634ec9 Author: Atsushi Nemoto Date: Tue Aug 26 22:30:41 2008 +0900 [MIPS] TX39xx: Add missing local_flush_icache_range initialization Commmit 59e39ecd933ba49eb6efe84cbfa5597a6c9ef18a ("Fix WARNING: at kernel/smp.c:290") introduced local_flush_icache_range but lacks initialization for some TX39 case. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit 073828d078d3e55b23b2b5937a49dc1019c5907d Author: Atsushi Nemoto Date: Tue Aug 26 21:29:58 2008 +0900 [MIPS] TXx9: Fix txx9_pcode initialization The txx9_pcode variable was introduced in commit fe1c2bc64f65003b39f331a8e4b0d15b235a4afd ("TXx9: Add 64-bit support") but was not initialized properly. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit e0cee3eea7875800451739ae38f99edcf11c133d Author: Thomas Bogendoerfer Date: Mon Aug 4 20:53:57 2008 +0200 [MIPS] Fix WARNING: at kernel/smp.c:290 trap_init issues flush_icache_range(), which uses ipi functions to get icache flushing done on all cpus. But this is done before interrupts are enabled and caused WARN_ON messages. This changeset introduces a new local_flush_icache_range() and uses it before interrupts (and additional CPUs) are enabled to avoid this problem. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Ralf Baechle commit 0510617b85758b6e66f3c602ceccea1826440470 Author: Thomas Bogendoerfer Date: Mon Aug 4 19:44:34 2008 +0200 [MIPS] Fix data bus error recovery With -ffunction-section the entries in __dbe_table aren't no longer sorted, so the lookup of exception addresses in do_be() failed for some addresses. To avoid this we now sort __dbe_table. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Ralf Baechle commit bf7394ccc13fe291d9258f01113b4c61214ddeae Author: Linus Torvalds Date: Fri Sep 5 12:38:09 2008 -0700 Revert "mac80211: Use IWEVASSOCREQIE instead of IWEVCUSTOM" This reverts commit 087d833e5a9f67ba933cb32eaf5a2279c1a5b47c, which was reported to break wireless at least in some combinations with 32bit user space and a 64bit kernel. Alex Williamnson bisected it to this commit. Reported-and-bisected-by: Alex Williamson Acked-by: John W. Linville Cc: David Miller Cc: Jouni Malinen Signed-off-by: Linus Torvalds commit a5cb562d6977d9d7989c346b7b153cef31ec0228 Author: Artem Bityutskiy Date: Wed Sep 3 18:26:47 2008 +0300 UBIFS: make minimum fanout 3 UBIFS does not really work correctly when fanout is 2, because of the way we manage the indexing tree. It may just become a list and UBIFS screws up. Signed-off-by: Artem Bityutskiy commit f171d4d769c8ccac6675892960e37f6485837fae Author: Artem Bityutskiy Date: Wed Sep 3 16:17:14 2008 +0300 UBIFS: fix division by zero If fanout is 3, we have division by zero in 'ubifs_read_superblock()': divide error: 0000 [#1] PREEMPT SMP Pid: 28744, comm: mount Not tainted (2.6.27-rc4-ubifs-2.6 #23) EIP: 0060:[] EFLAGS: 00010202 CPU: 0 EIP is at ubifs_reported_space+0x2d/0x69 [ubifs] EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 ESI: 00000000 EDI: f0ae64b0 EBP: f1f9fcf4 ESP: f1f9fce0 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Signed-off-by: Artem Bityutskiy commit 49048622eae698e5c4ae61f7e71200f265ccc529 Author: Balbir Singh Date: Fri Sep 5 18:12:23 2008 +0200 sched: fix process time monotonicity Spencer reported a problem where utime and stime were going negative despite the fixes in commit b27f03d4bdc145a09fb7b0c0e004b29f1ee555fa. The suspected reason for the problem is that signal_struct maintains it's own utime and stime (of exited tasks), these are not updated using the new task_utime() routine, hence sig->utime can go backwards and cause the same problem to occur (sig->utime, adds tsk->utime and not task_utime()). This patch fixes the problem TODO: using max(task->prev_utime, derived utime) works for now, but a more generic solution is to implement cputime_max() and use the cputime_gt() function for comparison. Reported-by: spencer@bluehost.com Signed-off-by: Balbir Singh Signed-off-by: Peter Zijlstra Signed-off-by: Ingo Molnar commit 56c7426b3951e4f35a71d695f1c982989399d6fd Author: Peter Zijlstra Date: Mon Sep 1 16:44:23 2008 +0200 sched_clock: fix NOHZ interaction If HLT stops the TSC, we'll fail to account idle time, thereby inflating the actual process times. Fix this by re-calibrating the clock against GTOD when leaving nohz mode. Signed-off-by: Peter Zijlstra Tested-by: Avi Kivity Signed-off-by: Ingo Molnar commit b35de672e74ceea6482b4f690ad053aec8465c5d Author: David Woodhouse Date: Fri Sep 5 16:01:15 2008 +0100 Revert "[ARM] use the new byteorder headers" This reverts commit ae82cbfc8beaa69007aa09966d3983ac938c3577. It needs the new byteorder headers to be exported to userspace, and they aren't yet -- and probably shouldn't be, at this point in the 2.6.27 release cycle (or ever, for that matter). Signed-off-by: David Woodhouse Acked-by: Russell King commit de24125dd0a452bfd4502fc448e3534c5d2e87aa Author: Yuri Tikhonov Date: Fri Sep 5 08:15:47 2008 -0700 async_tx: fix the bug in async_tx_run_dependencies Should clear the next pointer of the TX if we are sure that the next TX (say NXT) will be submitted to the channel too. Overwise, we break the chain of descriptors, because we lose the information about the next descriptor to run. So next time, when invoke async_tx_run_dependencies() with TX, it's TX->next will be NULL, and NXT will be never submitted. Cc: [2.6.26] Signed-off-by: Yuri Tikhonov Signed-off-by: Ilya Yanok Signed-off-by: Dan Williams commit afbc8d8e72daa5a5faf6a0242186bdfcc42b2427 Author: Khem Raj Date: Thu Sep 4 23:11:01 2008 -0700 Fix conditional export of kvh.h and a.out.h to userspace. Some architectures have moved the asm/ into arch/ and some have not. This patch checks for a.out.h and kvh.h in both places before exporting the corresponding file from linux/ [dwmw2: simplified a little] Signed-off-by: Khem Raj Signed-off-by: David Woodhouse commit 076c7f4c6c55c37975c8e04ae6827267794d5d2e Author: Dmitry Baryshkov Date: Thu Sep 4 13:28:33 2008 +0400 [MTD] [NAND] tmio_nand: fix base address programming Fix offset of second word used for programming base address of memory window. Also program tmio with offset of the FCR, not with physical memory location. Signed-off-by: Dmitry Baryshkov Cc: Ian Molton Signed-off-by: David Woodhouse commit 7cfb0435330364f90f274a26ecdc5f47f738498c Author: Thomas Gleixner Date: Wed Sep 3 21:37:24 2008 +0000 HPET: make minimum reprogramming delta useful The minimum reprogramming delta was hardcoded in HPET ticks, which is stupid as it does not work with faster running HPETs. The C1E idle patches made this prominent on AMD/RS690 chipsets, where the HPET runs with 25MHz. Set it to 5us which seems to be a reasonable value and fixes the problems on the bug reporters machines. We have a further sanity check now in the clock events, which increases the delta when it is not sufficient. Signed-off-by: Thomas Gleixner Tested-by: Luiz Fernando N. Capitulino Tested-by: Dmitry Nezhevenko Signed-off-by: Ingo Molnar commit 1fb9b7d29d8e85ba3196eaa7ab871bf76fc98d36 Author: Thomas Gleixner Date: Wed Sep 3 21:37:14 2008 +0000 clockevents: prevent endless loop lockup The C1E/HPET bug reports on AMDX2/RS690 systems where tracked down to a too small value of the HPET minumum delta for programming an event. The clockevents code needs to enforce an interrupt event on the clock event device in some cases. The enforcement code was stupid and naive, as it just added the minimum delta to the current time and tried to reprogram the device. When the minimum delta is too small, then this loops forever. Add a sanity check. Allow reprogramming to fail 3 times, then print a warning and double the minimum delta value to make sure, that this does not happen again. Use the same function for both tick-oneshot and tick-broadcast code. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar commit 9c17bcda991000351cb2373f78be7e4b1c44caa3 Author: Thomas Gleixner Date: Wed Sep 3 21:37:08 2008 +0000 clockevents: prevent multiple init/shutdown While chasing the C1E/HPET bugreports I went through the clock events code inch by inch and found that the broadcast device can be initialized and shutdown multiple times. Multiple shutdowns are not critical, but useless waste of time. Multiple initializations are simply broken. Another CPU might have the device in use already after the first initialization and the second init could just render it unusable again. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar commit 7205656ab48da29a95d7f55e43a81db755d3cb3a Author: Thomas Gleixner Date: Wed Sep 3 21:37:03 2008 +0000 clockevents: enforce reprogram in oneshot setup In tick_oneshot_setup we program the device to the given next_event, but we do not check the return value. We need to make sure that the device is programmed enforced so the interrupt handler engine starts working. Split out the reprogramming function from tick_program_event() and call it with the device, which was handed in to tick_setup_oneshot(). Set the force argument, so the devices is firing an interrupt. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar commit d4496b39559c6d43f83e4c08b899984f8b8089b5 Author: Thomas Gleixner Date: Wed Sep 3 21:36:57 2008 +0000 clockevents: prevent endless loop in periodic broadcast handler The reprogramming of the periodic broadcast handler was broken, when the first programming returned -ETIME. The clockevents code stores the new expiry value in the clock events device next_event field only when the programming time has not been elapsed yet. The loop in question calculates the new expiry value from the next_event value and therefor never increases. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar commit 7c1e76897492d92b6a1c2d6892494d39ded9680c Author: Venkatesh Pallipadi Date: Wed Sep 3 21:36:50 2008 +0000 clockevents: prevent clockevent event_handler ending up handler_noop There is a ordering related problem with clockevents code, due to which clockevents_register_device() called after tickless/highres switch will not work. The new clockevent ends up with clockevents_handle_noop as event handler, resulting in no timer activity. The problematic path seems to be * old device already has hrtimer_interrupt as the event_handler * new clockevent device registers with a higher rating * tick_check_new_device() is called * clockevents_exchange_device() gets called * old->event_handler is set to clockevents_handle_noop * tick_setup_device() is called for the new device * which sets new->event_handler using the old->event_handler which is noop. Change the ordering so that new device inherits the proper handler. This does not have any issue in normal case as most likely all the clockevent devices are setup before the highres switch. But, can potentially be affecting some corner case where HPET force detect happens after the highres switch. This was a problem with HPET in MSI mode code that we have been experimenting with. Signed-off-by: Venkatesh Pallipadi Signed-off-by: Shaohua Li Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar commit 4eb00c9f92202a759aadbce73ea4a947b639b5e6 Author: Magnus Damm Date: Wed Aug 27 18:33:56 2008 +0900 i2c: fix i2c-sh_mobile timing issues This patch teaches the i2c-sh_mobile driver to make use of wait irqs. Without this patch only dte irqs are used which may lead to overruns and cases of missing stop and extra bytes being read on the i2c bus. Use of wait irqs forces the hardware to pause and wait until the cpu is ready. Polling is also reworked in this patch to fix ms delay issues. Verified with bus analyzer and tested on MigoR and AP325RXA boards. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit dbce1f649e3d22aa7ddc0fdbfa6a7470047b61bd Author: Paul Mundt Date: Fri Sep 5 14:51:28 2008 +0900 sh64: resume_kernel fix for kernel oops built with CONFIG_BKL_PREEMPT=y. Follows the SH change. Signed-off-by: Paul Mundt commit 323b8c410a2453f15578c22b0eef50456359bbfc Author: Carmelo Amoroso Date: Fri Sep 5 14:42:16 2008 +0900 sh: resume_kernel fix for kernel oops built with CONFIG_BKL_PREEMPT=y. This patch fixes a problem within the SH implementation of resume_kernel code, that implements in assembly the bulk of preempt_schedule_irq function without taking care of the extra code needed to handle the BKL preemptible. The patch basically consists of removing this asm code and calling the common C implementation (see kernel/sched.c) as other archs do. Another change is the missing 'cli' macro invocation at the beginning of the resume_kernel. Signed-off-by: Giuseppe Cavallaro Signed-off-by: Carmelo Amoroso Signed-off-by: Paul Mundt commit 9ce1ca284a322ba6f9d691136a29c9cfe381e1fc Author: Jiri Kosina Date: Thu Sep 4 22:28:48 2008 -0400 Input: i8042 - make Lenovo 3000 N100 blacklist entry more specific Apparently, there are more different versions of Lenovo 3000 N100, some of them working properly with active mux, and some of them requiring it being switched off. This patch applies 'nomux' only to the specific product name that is reported to behave badly unless 'nomux' is specified. Signed-off-by: Jiri Kosina Signed-off-by: Dmitry Torokhov commit a6821f345fd508b17f5ce310b677b37aefb028dc Author: Henrik Rydberg Date: Thu Sep 4 22:28:31 2008 -0400 Input: bcm5974 - add BTN_TOUCH event for mousedev benefit The mousedev driver requires the use of BTN_TOUCH events to process ABS_X and ABS_Y events properly, which is what is needed for the bcm5974-based apple computers to have a functional pointer out-of-the-box. Signed-off-by: Henrik Rydberg Signed-off-by: Dmitry Torokhov commit 75e21e3f3bb2b4a41bb0646a4d54eef27eb36ca5 Author: Henrik Rydberg Date: Thu Sep 4 22:28:23 2008 -0400 Input: bcm5974 - improve finger tracking and counting The problem of finger tracking, i.e., when to switch focus from one finger to another on the trackpad, has been improved by utilizing more information from the bcm5974 chip output. This results in less pointer hopping when many fingers are on the trackpad. In addition, a finger counting method based on pressure information from all fingers is introduced. Together with a pressure hysteresis window, this yields a more stable counting of the number of fingers on the trackpad. Signed-off-by: Henrik Rydberg Signed-off-by: Dmitry Torokhov commit 158e0fb6028a2329425d8287b1b2402a12ed4f28 Author: Henrik Rydberg Date: Thu Sep 4 22:20:10 2008 -0400 Input: bcm5974 - small formatting cleanup Signed-off-by: Henrik Rydberg Signed-off-by: Dmitry Torokhov commit b65fe0356b5b732d7e1e0224c6a1cf2eb5255984 Author: Jeremy Kerr Date: Thu Sep 4 15:02:47 2008 +1000 powerpc/spufs: Fix race for a free SPU We currently have a race for a free SPE. With one thread doing a spu_yield(), and another doing a spu_activate(): thread 1 thread 2 spu_yield(oldctx) spu_activate(ctx) __spu_deactivate(oldctx) spu_unschedule(oldctx, spu) spu->alloc_state = SPU_FREE spu = spu_get_idle(ctx) - searches for a SPE in state SPU_FREE, gets the context just freed by thread 1 spu_schedule(ctx, spu) spu->alloc_state = SPU_USED spu_schedule(newctx, spu) - assumes spu is still free - tries to schedule context on already-used spu This change introduces a 'free_spu' flag to spu_unschedule, to indicate whether or not the function should free the spu after descheduling the context. We only set this flag if we're not going to re-schedule another context on this SPU. Add a comment to document this behaviour. Signed-off-by: Jeremy Kerr commit 9f43e3914dceb0f8191875b3cdf4325b48d0d70a Author: Jeremy Kerr Date: Tue Sep 2 11:57:09 2008 +1000 powerpc/spufs: Fix multiple get_spu_context() Commit 8d5636fbca202f61fdb808fc9e20c0142291d802 introduced a reference count on SPU contexts during find_victim, but this may cause a leak in the reference count if we later find a better contender for a context to unschedule. Change the reference to after we've found our victim context, so we don't do the extra get_spu_context(). Signed-off-by: Jeremy Kerr commit 8561098ff11d21f1a6a9a01fae2e68653928dbb5 Author: Li Zefan Date: Tue Sep 2 07:02:50 2008 -0300 V4L/DVB (8881): gspca: After 'while (retry--) {...}', retry will be -1 but not 0. Signed-off-by: Li Zefan Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 748c7f80acc266a54ade4d6863229402fd3cd363 Author: Hans de Goede Date: Mon Sep 1 15:28:23 2008 -0300 V4L/DVB (8880): PATCH: Fix parents on some webcam drivers While doing some testing using Luca Risolia's sonix driver I noticed that the video device did not get ACL's set to allow access by locally logged in users, nor does it show up as a video device in lshal, causing cheese to not see it. This turns out to be caused by all of Luca Risolia's drivers not setting the parent member of the video_device struct. This patch fixes this. Cc: Luca Risolia Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit c4e3fd940c7081a0332e9b4ea6485744075067b0 Author: Thierry MERLE Date: Mon Sep 1 17:32:10 2008 -0300 V4L/DVB (8877): b2c2 and bt8xx: udelay to mdelay b2c2-flexcop, dvb/bt8xx and video/bt8xx fails to build on ARM with: __bad_udelay is specifically designed on ARM to fail when udelay is called in a bad way. arch/arm/include/asm/delay.h has this to say about __bad_udelay: /* * This function intentionally does not exist; if you see references to * it, it means that you're calling udelay() with an out of range value. * * With currently imposed limits, this means that we support a max delay * of 2000us. Further limits: HZ<=1000 and bogomips<=3355 */ extern void __bad_udelay(void); Solution is to replace udelay by a mdelay and udelay with value less than 2000 Signed-off-by: Thierry MERLE Signed-off-by: Mauro Carvalho Chehab commit db210426d48998ed412f267b28cf6e62ea0496a8 Author: Thierry MERLE Date: Mon Sep 1 17:28:57 2008 -0300 V4L/DVB (8876): budget: udelay changed to mdelay budget.ko fails to build on ARM with: ERROR: "__bad_udelay" [drivers/media/dvb/ttpci/budget.ko] undefined! make[1]: *** [__modpost] Error 1 __bad_udelay is specifically designed on ARM to fail when udelay is called in a bad way. arch/arm/include/asm/delay.h has this to say about __bad_udelay: /* * This function intentionally does not exist; if you see references to * it, it means that you're calling udelay() with an out of range value. * * With currently imposed limits, this means that we support a max delay * of 2000us. Further limits: HZ<=1000 and bogomips<=3355 */ extern void __bad_udelay(void); Solution is to replace udelay by a mdelay and udelay with value less than 2000 Acked-by: Oliver Endriss Signed-off-by: Thierry MERLE Signed-off-by: Mauro Carvalho Chehab commit 65846909d684d75906269df4f5f3474e1fef568b Author: Russell King Date: Wed Sep 3 23:46:18 2008 +0100 [ARM] omap: fix virtual vs physical address space confusions mcbsp is confused as to what takes a physical or virtual address. Fix the two instances where it gets it wrong. Acked-by: Tony Lindgren Signed-off-by: Russell King commit db0a2901a32c44510d7d429358d017143a649a70 Merge: d210baf... 4cce165... Author: Mauro Carvalho Chehab Date: Thu Sep 4 16:24:02 2008 -0300 Merge branch 'fixes_stg' of ../git_old into fixes commit 4cce1655b26a4df1e619b2aa3d2eea1b7a6e906c Author: Hans de Goede Date: Thu Sep 4 16:22:57 2008 -0300 V4L/DVB (8874): gspca: Adjust hstart for sn9c103/ov7630 and update usb-id's. - Adjust hstart in ov7630 on sn9c103 initdata to shift bayer pattern, this is the same change as done for the other initdata tables in a previous patch. - Assign usb-id's for the ov7630 + sn9c103 to gspca if gspca and sn9c102 drivers are both enabled. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 0fc23d20699a6a3b7e34b3be2cc5e60317ba7849 Author: Hans de Goede Date: Thu Sep 4 16:22:57 2008 -0300 V4L/DVB (8873): gspca: Bad image offset with rev012a of spca561 and adjust exposure. -Make raw bayer header size change from 20 to 16 affect rev072a only, my 2 rev012a cams both have a header size of 20 -While testing this I also tested the new exposure setting (good work on finding the register JF), and after quite a bit of testing have found out the exact meaning of the register, this patch modifies setexposure to control the exposure over a much wider range. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit b77c0046a63e7aa87152f9978cf7c46e7bead7fc Author: Jean-Francois Moine Date: Thu Sep 4 16:22:56 2008 -0300 V4L/DVB (8872): gspca: Bad image format and offset with rev072a of spca561. - have 2 pixfmt tables - offset of Bayer frames at 16 instead of 20. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit bf2a2202f75cda679303f09d150f9549f9835953 Author: Hans de Goede Date: Thu Sep 4 16:22:56 2008 -0300 V4L/DVB (8870): gspca: Fix dark room problem with sonixb. When using the sonixb driver in a dark room and given that the autoexposure algorithm starts with a setting most suitable for daylight, the picture produced by the cam may actually be 100% black leading to a avg_lum value of 0, so an avg_lum value of 0 does not always signal an exposure settings change (which it normally does). This patch adds a check for the really black image case and stops dropping all frames as invalid in this case. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit a94a508691d16420ad10572a33db4d45115b5f75 Author: Hans de Goede Date: Thu Sep 4 16:22:55 2008 -0300 V4L/DVB (8869): gspca: Move the Sonix webcams with TAS5110C1B from sn9c102 to gspca. This patch makes gspca claim the USB-ID for sn9c101/2 cams with a TAS5110C1B sensor even if both gspca and sn9c102 are enabled, as these cams are much better supported under gspca (and extensively tested with gspca). It also removes an usb-id from sn9c102 for one more unsupported bridge sensor combo. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 9362773624bcde3ccc198fefcf3c584e5058f645 Author: Hans de Goede Date: Thu Sep 4 16:20:12 2008 -0300 V4L/DVB (8868): gspca: Support for vga modes with sif sensors in sonixb. - Add documentation for some known registers - Add support for vga modes (320x240, 160x120) for sif sensors - Remove F_RAW sensor flag raw mode should work on any sensor as its a bridge only thing and keeping the flag was becoming awkward. - Fixup ov6650 and pas106 auto exposure window settings Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit b380b0d4f7dffcc235c0facefa537d4655619101 Author: Al Viro Date: Thu Sep 4 17:05:57 2008 +0100 forgotten refcount on sysctl root table We should've set refcount on the root sysctl table; otherwise we'll blow up the first time we get down to zero dynamically registered sysctl tables. Signed-off-by: Al Viro Tested-by: James Bottomley Signed-off-by: Linus Torvalds commit 5ed459102d1e914972d65dd4ea9f26073143a4e9 Merge: 4fd2343... 7d964c3... Author: Andi Kleen Date: Thu Sep 4 14:41:02 2008 +0200 Merge branch 'wmi-fix' into release-2.6.27 commit 7d964c352b06aabb895e39d3b479e105bd9d1ca0 Author: Russ Dill Date: Tue Sep 2 14:35:40 2008 -0700 acer-wmi: remove debugfs entries upon unloading The exit function neglects to remove debugfs entries, leading to a BUG on reload. [akpm@linux-foundation.org: cleanups] Signed-off-by: Russ Dill Acked-by: Carlos Corbacho Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Andi Kleen commit 4fd23436f1f414fea9a1a6050d4ed6de02cb91e5 Merge: 54cd314... 266feef... d8196a9... Author: Andi Kleen Date: Thu Sep 4 14:33:03 2008 +0200 Merge branches 'smbus' and 'fujitsu-fix' into release-2.6.27 commit 266feefeb9ea2d846ac82eb6db1a54b230364ba4 Author: Zhao Yakui Date: Tue Aug 26 13:57:34 2008 +0800 ACPI: Avoid bogus timeout about SMbus check In the function of wait_transaction_complete when the timeout happens, OS will try to check the status of SMbus again. If the status is what OS expected, it will be regarded as the bogus timeout. Otherwise it will be treated as ETIME. http://bugzilla.kernel.org/show_bug.cgi?id=10483 Signed-off-by: Zhao Yakui tested-by : Oldřich Jedlička < Signed-off-by: Andi Kleen commit d8196a93b1ce9a5abb410f39f9375912c9e53675 Author: Jonathan Woithe Date: Fri Aug 29 11:06:21 2008 +0930 fujitsu-laptop: fix regression for P8010 in 2.6.27-rc The following patch (based on a patch from Stephen Gildea) fixes a regression with the LCD brightness keys on Fujitsu P8010 laptops which was observed with the 2.6.27-rc series (basically they stopped working due to changes within the fujitsu-laptop and video modules). Please apply to 2.6.27-rc and acpi git. A more complete solution for this laptop will be included in an upcoming patch, hopefully for 2.6.28. In the meantime this restores most functionality for P8010 users. Signed-off-by: Stephen Gildea Signed-off-by: Jonathan Woithe Signed-off-by: Andi Kleen commit 54cd3148a149f7413cc25cb832f42cf0dabcee29 Author: Andi Kleen Date: Thu Sep 4 13:30:07 2008 +0200 ACPI: Make Len Brown the ACPI maintainer again Len is back! Signed-off-by: Andi Kleen commit 8b540fdcb7c445d61955991f071e956ef40a2f17 Author: Huang Weiyi Date: Sat Aug 23 13:56:02 2008 +0800 [ARM] remove unused #include The driver(s) below do not use LINUX_VERSION_CODE nor KERNEL_VERSION. arch/arm/plat-mxc/clock.c This patch removes the said #include . Signed-off-by: Huang Weiyi Signed-off-by: Russell King commit c3df1a2685004bce97827bdbe7a304734009849b Author: Russell King Date: Wed Sep 3 23:59:23 2008 +0100 [ARM] omap: fix build error in ohci-omap.c drivers/usb/host/ohci-omap.c: In function 'ohci_omap_init': drivers/usb/host/ohci-omap.c:228: error: 'start_hnp' undeclared (first use in this function) Signed-off-by: Russell King commit 5f17cfce5776c566d64430f543a289e5cfa4538b Author: Linus Torvalds Date: Thu Sep 4 01:33:59 2008 -0700 PCI: fix pbus_size_mem() resource alignment for CardBus controllers Commit 884525655d07fdee9245716b998ecdc45cdd8007 ("PCI: clean up resource alignment management") changed the resource handling to mark how a resource was aligned on a per-resource basis. Thus, instead of looking at the resource number to determine whether it was a bridge resource or a regular resource (they have different alignment rules), we should just ask the resource for its alignment directly. The reason this broke only cardbus resources was that for the other types of resources, the old way of deciding alignment actually still happened to work. But CardBus bridge resources had been changed by commit 934b7024f0ed29003c95cef447d92737ab86dc4f ("Fix cardbus resource allocation") to look more like regular resources than PCI bridge resources from an alignment handling standpoint. Reported-and-tested-by: Andrew Morton Cc: Ivan Kokshaysky Cc: Jesse Barnes Signed-off-by: Linus Torvalds commit de014d617636d6a6bd5aef3b3d1f7f9a35669057 Author: Alok N Kataria Date: Wed Sep 3 18:18:01 2008 -0700 x86: Change warning message in TSC calibration. When calibration against PIT fails, the warning that we print is misleading. In a virtualized environment the VM may get descheduled while calibration or, the check in PIT calibration may fail due to other virtualization overheads. The warning message explicitly assumes that calibration failed due to SMI's which may not be the case. Change that to something proper. Signed-off-by: Alok N Kataria Signed-off-by: Linus Torvalds commit ce36394269ccd9d1d286d6192ba09fa6894365e9 Author: Tejun Heo Date: Wed Sep 3 16:09:47 2008 +0200 mmap: fix petty bug in anonymous shared mmap offset handling Anonymous mappings should ignore offset but shared anonymous mapping forgot to clear it and makes the following legit test program trigger SIGBUS. #include #include #include #define PAGE_SIZE 4096 int main(void) { char *p; int i; p = mmap(NULL, 2 * PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANONYMOUS, -1, PAGE_SIZE); if (p == MAP_FAILED) { perror("mmap"); return 1; } for (i = 0; i < 2; i++) { printf("page %d\n", i); p[i * 4096] = i; } return 0; } Fix it. Signed-off-by: Tejun Heo Acked-by: Hugh Dickins Acked-by: KOSAKI Motohiro Signed-off-by: Linus Torvalds commit d210baf53b699fc61aa891c177b71d7082d3b957 Merge: 3e25a2d... 8e531af... Author: Linus Torvalds Date: Wed Sep 3 17:57:55 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: SELinux: memory leak in security_context_to_sid_core commit 3e25a2d90e7e303168540c5ecb726297940cb172 Merge: 316343e... 7888bc2... Author: Linus Torvalds Date: Wed Sep 3 17:36:37 2008 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: powerpc: Fix for getting CPU number in power_save_ppc32_restore() powerpc: Fix build error with 64K pages and !hugetlbfs powerpc: Work around gcc's -fno-omit-frame-pointer bug powerpc: Make sure _etext is after all kernel text powerpc: Only make kernel text pages of linear mapping executable powerpc: Fix uninitialised variable in VSX alignment code commit e6a5652fd156a286faadbf7a4062b5354d4e346e Author: Chuck Ebbert Date: Wed Sep 3 19:33:14 2008 -0400 x86: add io delay quirk for Presario F700 Manually adding "io_delay=0xed" fixes system lockups in ioapic mode on this machine. System Information Manufacturer: Hewlett-Packard Product Name: Presario F700 (KA695EA#ABF) Base Board Information Manufacturer: Quanta Product Name: 30D3 Reference: https://bugzilla.redhat.com/show_bug.cgi?id=459546 Signed-off-by: Chuck Ebbert Signed-off-by: H. Peter Anvin commit 316343e2cfd9a4bb4c70d0e1991e7a74840fe29e Merge: ec0c15a... fca1287... Author: Linus Torvalds Date: Wed Sep 3 16:21:02 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: bnx2x: Accessing un-mapped page ath9k: Fix TX control flag use for no ACK and RTS/CTS ath9k: Fix TX status reporting iwlwifi: fix STATUS_EXIT_PENDING is not set on pci_remove iwlwifi: call apm stop on exit iwlwifi: fix Tx cmd memory allocation failure handling iwlwifi: fix rx_chain computation iwlwifi: fix station mimo power save values iwlwifi: remove false rxon if rx chain changes iwlwifi: fix hidden ssid discovery in passive channels iwlwifi: W/A for the TSF correction in IBSS netxen: Remove workaround for chipset quirk pcnet-cs, axnet_cs: add new IDs, remove dup ID with less info ixgbe: initialize interrupt throttle rate net/usb/pegasus: avoid hundreds of diagnostics tipc: Don't use structure names which easily globally conflict. commit 8e531af90f3940615623dc0aa6c94866a6773601 Author: Eric Paris Date: Wed Sep 3 11:49:47 2008 -0400 SELinux: memory leak in security_context_to_sid_core Fix a bug and a philosophical decision about who handles errors. security_context_to_sid_core() was leaking a context in the common case. This was causing problems on fedora systems which recently have started making extensive use of this function. In discussion it was decided that if string_to_context_struct() had an error it was its own responsibility to clean up any mess it created along the way. Signed-off-by: Eric Paris Acked-by: Stephen Smalley Signed-off-by: James Morris commit fca1287a3a9246d4facc27a0a455fada18fd1164 Merge: 437cf2f... 0b62afb... Author: David S. Miller Date: Wed Sep 3 14:43:30 2008 -0700 Merge branch 'davem-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6 commit 437cf2f1c5f05e34510f43e129af29a716b04ce6 Author: Eilon Greenstein Date: Wed Sep 3 14:38:00 2008 -0700 bnx2x: Accessing un-mapped page The allocated RX buffer size was 64 bytes bigger than the PCI mapped size with no good reason. If the packet was actually using the buffer up to its limit and if the last 64 bytes of the buffer crossed 4KB boundary then an unmapped PCI page was accessed. The fix is to use only one parameter for the buffer size - there is no need to differentiate between the buffer size and the PCI mapping size since the extra 64 bytes can actually be used by the FW to align the Ethernet payload to 64 bytes. Also updating the driver version and date Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 5d8538c1c6d85a7979c955b34f0e66d03be43da4 Author: Adrian Bunk Date: Wed Sep 3 17:12:25 2008 -0300 V4L/DVB (8844): dabusb_fpga_download(): fix a memory leak This patch fixes a memory leak in an error path. Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Signed-off-by: Mauro Carvalho Chehab commit 877b5f4eda501ece641adbbea5d1940cbbfd4f38 Author: Adrian Bunk Date: Wed Sep 3 17:12:25 2008 -0300 V4L/DVB (8843): tda10048_firmware_upload(): fix a memory leak This patch fixes a memory leak ("fw" wasn't freed). Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Signed-off-by: Mauro Carvalho Chehab commit 8da9bae3292ea8aee803e7cda295877c361f0694 Author: Adrian Bunk Date: Wed Sep 3 17:12:25 2008 -0300 V4L/DVB (8842): vivi_release(): fix use-after-free video_device_release() does kfree(), which made the following printk() doing a use-after-free. printk() first and release then. Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Signed-off-by: Mauro Carvalho Chehab commit 9a0c04a1ee3b4df6a30ae6975e13c558908df400 Author: Michael Krufky Date: Wed Sep 3 17:12:24 2008 -0300 V4L/DVB (8840): dib0700: add basic support for Hauppauge Nova-TD-500 (84xxx) This adds basic support for the Hauppauge Nova-TD-500 84xxx series. A future patch will allow for one aerial input to supply both tuners. With the current code, an aerial must be plugged into each antannae input in order for both tuners to function. Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit af2a887c9aaca82306e9744d914ac335051ce987 Author: Michael Krufky Date: Wed Sep 3 17:12:24 2008 -0300 V4L/DVB (8839): dib0700: add comment to identify 35th USB id pair This comment helps to make the code more readable. Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 1d434012f23effdc69d58a88229159b57256f6ba Author: Jean Delvare Date: Wed Sep 3 17:12:23 2008 -0300 V4L/DVB (8837): dvb: fix I2C adapters name size Some DVB drivers are incorrectly assuming that the size of i2c_adapter.name is I2C_NAME_SIZE. Here's a fix. Also change strncpy to strlcpy, as the former is error-prone (and was indeed incorrectly used.) Signed-off-by: Jean Delvare Acked-by: Uwe Bugla Reviewed-by: Michael Krufky Signed-off-by: Steven Toth Signed-off-by: Andrew Morton Signed-off-by: Mauro Carvalho Chehab commit c437d657c59921b048997d5bc1f5733670112902 Author: Hans de Goede Date: Wed Sep 3 17:12:22 2008 -0300 V4L/DVB (8835): gspca: Same pixfmt as the sn9c102 driver and raw Bayer added in sonixb. 1) Lower the hstart setting for all sensor by 1 so that we generate (compressed) BGGR data just like sn9c102 does (instead of GBRG data) 2) Add support for raw bayer output in the lowest resolutions (not enough bandwidth for higher resolutions), this should work with all sensors but to be sure only enable it for sensors where it has been tested. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 5c51518da2cabc08af535cf041c6a3697f9e931f Author: Hans de Goede Date: Wed Sep 3 17:12:22 2008 -0300 V4L/DVB (8834): gspca: Have a bigger buffer for sn9c10x compressed images. Under certain conditions sonixb compressed frame size can get bigger then the uncompressed size (seen with 0c45:6028), so make the buffers slightly bigger. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit f45f06b648bad82430c64a2e1ad67dc616eb54c6 Author: Hans de Goede Date: Wed Sep 3 17:12:21 2008 -0300 V4L/DVB (8833): gspca: Cleanup the sonixb code. -the usb-id table caried several flags which were not usb-id specific but sensor specific, add a sensor_data array and move these flag there -fr_h_sz was being abused to store and check which bridge was being used instead add a bridge member to the sd struct -now that we have a sensor_data table use that to store pointers to init_sequences instead of using switch cases on sd->sensor Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 20122542df420a31532c8e2b5d4107e9846bac6b Author: Jean-Francois Moine Date: Wed Sep 3 17:12:20 2008 -0300 V4L/DVB (8832): gspca: Bad pixelformat of vc0321 webcams. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 222a07ffd8e280b1bf4a6f7edab8b6fa27a5455a Author: Hans de Goede Date: Wed Sep 3 17:12:20 2008 -0300 V4L/DVB (8831): gspca: Resolve webcam conflicts between some drivers. -remove USB-id's from zc0301 for cams for which zc0301.c does not support the sensor -remove USB-id's from sn9c102 for cams where sn9c102 does not support the bridge sensor combination -no longer make inclusion of usb id's removed from zc0301 and sn9c102 conditional in gspca -fix conditional inclusion of USB-id's in gspca to also work when the conflicting drivers are build as a module -add a number of USB-id's to gspca from various windows .inf files: 0c45:608f from generic sonix sn9c103 inf file (+ ov7630 which we support) 041e:4022 from creative webcam nx pro, same as already supported 041e:401e 0ac8:0301 from generic zc0301 driver which supports many sensors 10fd:804d from typhoon webshot driver (also FlyCAM-USB 300 plus) Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 271315a9b4363ed884024022f2cf799344548e8f Author: Hans de Goede Date: Wed Sep 3 17:12:19 2008 -0300 V4L/DVB (8830): gspca: Move some probe code to the new init function. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 8295d99ee5340f1e62b53c8adc979e0789299445 Author: Jean-Francois Moine Date: Wed Sep 3 17:12:19 2008 -0300 V4L/DVB (8829): gspca: Have a clean kmalloc-ated buffer for USB exchanges. The USB buffer may be used for DMA and there may be a caching problem if the buffer is part of the device structure. Thanks to Alan Stern. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 91de65ac00f976c972940bedd9dbfe38bb8bfec3 Author: Jean-Francois Moine Date: Wed Sep 3 17:12:18 2008 -0300 V4L/DVB (8828): gspca: Set the clock at the end of initialization in sonixj. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 038ec7c772cb093411b163c22f389787722cfd8e Author: Hans de Goede Date: Wed Sep 3 17:12:18 2008 -0300 V4L/DVB (8827): gspca: Stop pac7302 autogain oscillation. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 086272555d1b7936512de1e6d9efacdf87169cb0 Author: Jean-Francois Moine Date: Wed Sep 3 17:12:17 2008 -0300 V4L/DVB (8826): gspca: Webcam Labtec 2200 (093a:2626) added in pac7311. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 8a5b2e909d56a1d5edec5e8f8848e03aafbc588e Author: Hans de Goede Date: Wed Sep 3 17:12:17 2008 -0300 V4L/DVB (8825): gspca: More controls for pac73xx and new webcam 093a:2624. -Add usb id for 093a:2624 (pac7302) -Report some controls to userspace with 7302 only, as they are 7302 only -Add gain and exposure controls -Add autogain -Fix 7302 imaged being mirrored by default Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit a1e8288b1d80130119692818b46694660f28e03a Author: Jean-Francois Moine Date: Wed Sep 3 17:12:17 2008 -0300 V4L/DVB (8824): gspca: Too much code removed in the suspend/resume changeset. - the stream must stop when the main application closes the device. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit de00448f708a2fd705f9c5ccdfa383dbf3dcef92 Author: Jean-Francois Moine Date: Wed Sep 3 17:12:16 2008 -0300 V4L/DVB (8823): gspca: H and V flips work for ov7670 only in ov519. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 012d6b029ec17f45374303bbdccd0bc206725751 Author: Jean-Francois Moine Date: Wed Sep 3 17:12:16 2008 -0300 V4L/DVB (8822): gspca: Change some subdriver functions for suspend/resume. - new function 'init' called on probe and resume - remove the functions 'open' and 'closed' - 'stopN' and 'stop0' are optional Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 66e4124f41808b50f6e1b6771621d6c7bf1c34a6 Author: Jean-Francois Moine Date: Wed Sep 3 17:12:16 2008 -0300 V4L/DVB (8820): gspca: Change initialization and gamma of zc3xx - pas106. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 4202f71ca1e52d73cab14f3695fdef6b6f010a0b Author: Jean-Francois Moine Date: Wed Sep 3 17:12:15 2008 -0300 V4L/DVB (8819): gspca: Initialize the ov519 at open time and source cleanup. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 1e89e2da48070da8ac221c37fea8fa82da127c34 Author: Jean-Francois Moine Date: Wed Sep 3 17:12:15 2008 -0300 V4L/DVB (8818): gspca: Reinitialize the device on resume. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 65f33396ab57f3346fb07ddee8e3aa616d13386c Author: Hans de Goede Date: Wed Sep 3 17:12:15 2008 -0300 V4L/DVB (8817): gspca: LED and proble changes in sonixb. - turn the led of the cam off after plugging in the cam - move the probe code from open to config, so that if the probe fails we never register Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit e2ad2a54ad1e0f8d7c9e49c38b552a630e015af3 Author: Hans de Goede Date: Wed Sep 3 17:12:15 2008 -0300 V4L/DVB (8816): gspca: Set disabled ctrls and fix a register pb with ovxxxx in sonixb. - set some controls as disabled instead of copying the device descr. - in the ov6650 / 7650 exposure code clamp reg 11 before (instead of after) using it to calculate reg 10. - disable brightness (instead of ignoring it) for the TAS5110. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 0f523c2ff6b5ab3b4412cf56dee77ac57be24103 Author: Hans de Goede Date: Wed Sep 3 17:12:14 2008 -0300 V4L/DVB (8815): gspca: Fix problems with disabled controls. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit f50ba1bed3cfd65d6899afc4cb77299ee5c297ae Author: Jean-Francois Moine Date: Wed Sep 3 17:12:14 2008 -0300 V4L/DVB (8814): gspca: Set DISABLED the disabled controls at query control time. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 221e7dbe55fe515ff786142bac64b507fa9f26de Author: Hans de Goede Date: Wed Sep 3 17:12:14 2008 -0300 V4L/DVB (8813): gspca: Adjust SOF detection for pac73xx. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 327c4abf74a4426676df6c359b2a3dea2a5d126e Author: Hans de Goede Date: Wed Sep 3 17:12:14 2008 -0300 V4L/DVB (8812): gspca: Do pac73xx webcams work. - documentation for some registers - some preparations for adding autogain_n_exposure functionality - various pac7311 fixes - disable brightness and colors controls for 7311 - fix contrast control for 7311 - add hflip and vflip controls for 7311 - minimal jpeg header - proper SOF detection Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 62ee8eeebd1bf6c29977800ac18dfcecf584d42e Author: Jean-Francois Moine Date: Wed Sep 3 17:12:13 2008 -0300 V4L/DVB (8810): gspca: Compile error when CONFIG_PM not defined. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit d6db35e89c420d867e9ffdf145ecf2cb1b91291b Author: Hans de Goede Date: Wed Sep 3 17:12:13 2008 -0300 V4L/DVB (8809): gspca: Revert commit 9a9335776548d01525141c6e8f0c12e86bbde982 the previous patch (sensor upside down). Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 6d8976164dd7d10d25fe940b8546265f60ad52cd Author: Steven Toth Date: Wed Sep 3 17:12:12 2008 -0300 V4L/DVB (8805): Steven Toth email address change I need this so I can better isolate my linux email from my corporate email. Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab commit 5ca947a999c5ea5147cce3e42a9d790d3b87a246 Author: Steven Toth Date: Wed Sep 3 17:12:12 2008 -0300 V4L/DVB (8804): s5h1411: Enable QAM_AUTO mode If apps pass QAM_AUTO then we need to obey it. Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab commit 4fc85c74b431ba6e9a8e295e090cd532667b984d Author: Steven Toth Date: Wed Sep 3 17:12:12 2008 -0300 V4L/DVB (8803): s5h1409: Enable QAM_AUTO mode If apps pass QAM_AUTO then we need to obey it. Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab commit c5bf204f42423f49d7ea34f14eef92780204e168 Author: Hans Verkuil Date: Wed Sep 3 17:12:09 2008 -0300 V4L/DVB (8790): saa7115: call i2c_set_clientdata only when state != NULL Not a bug as such, but it looks really strange doing this before checking whether the state structure could be allocated. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit dc60de338f4b2d445a24d4e36bbc994f3badb406 Author: Hans Verkuil Date: Wed Sep 3 17:11:58 2008 -0300 V4L/DVB (8779): v4l: fix more incorrect video_register_device result checks Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit cba99ae81901fe61ac4b0d65c697474af29dc4ea Author: Hans Verkuil Date: Wed Sep 3 17:11:58 2008 -0300 V4L/DVB (8778): radio: fix incorrect video_register_device result check Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 6c9de52884aeafb05a935467c3a2c05a2d445ab7 Author: Andy Walls Date: Wed Sep 3 17:11:54 2008 -0300 V4L/DVB (8769): cx18: Simplify queue flush logic to prevent oops in cx18_flush_queues() cx18: Simplify queue flush logic to prevent oops in cx18_flush_queues(). If accounting of a queue is in error, logic borrowed from ivtv will cause an oops when flushing the queues for a stream. This change greatly simplifies the queue flush logic, and sets the queue back to sane defaults on a flush. Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit c6eb8eafdba4ad18b4520a0d28a38bc9e61883ea Author: Hans Verkuil Date: Wed Sep 3 17:11:54 2008 -0300 V4L/DVB (8757): v4l-dvb: fix a bunch of sparse warnings Fixed a lot of sparse warnings: mostly warnings about shadowed variables and signed/unsigned mismatches. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 980d4f17345fe420fda2a84cd4a28d5d41d73cef Author: Mauro Carvalho Chehab Date: Wed Sep 3 17:11:53 2008 -0300 V4L/DVB (8751): vivi: Fix some issues at vivi register routine This patch fixes several small issues at vivi register routines: 1) minor and n_devs should be unsigned; 2) n_devs = 0 were not properly handled; 3) if n_devs specify a high number, the driver would just roll back and won't register any device. The proper behaviour is to keep all succeded devices registered; 4) both n_devs and minor were using 0 as permissions. Better to have them with 0444. With the current patch, if n_devs specify a very large value, it will register all possible devices. For example, on a machine without any other V4L drivers loaded, with this patch, we will have something like: vivi: V4L2 device registered as /dev/video0 vivi: V4L2 device registered as /dev/video1 vivi: V4L2 device registered as /dev/video2 ... vivi: V4L2 device registered as /dev/video31 video_register_device_index: get_index failed Video Technology Magazine Virtual Video Capture Board ver 0.5.0 successfully loaded. 5) The number of allocated devices on success is now kept at n_devs: $ cat /sys/module/vivi/parameters/n_devs 32 Thanks to Henne for pointing that there were some issues at vivi. Cc: Henne Signed-off-by: Mauro Carvalho Chehab commit f3b9f50ef771670b5d94c568241d6766691c6c18 Author: Henrik Kretzschmar Date: Wed Sep 3 17:11:53 2008 -0300 V4L/DVB (8750): V4L: check inval in video_register_device_index() Better check the video_device pointer before using it. Signed-off-by: Henrik Kretzschmar Signed-off-by: Mauro Carvalho Chehab commit 5b5aff83a549c8f1e425e06d46ec951eae950b37 Author: Mauro Carvalho Chehab Date: Wed Sep 3 17:11:52 2008 -0300 V4L/DVB (8749): Fix error code, when camera is not turned on by sonypi Signed-off-by: Mauro Carvalho Chehab commit 4ce0b659689a97bc356e96aeac813cad2d137339 Author: Rene Herman Date: Wed Sep 3 16:48:23 2008 -0300 V4L/DVB (8728): 1-make-pms-not-autoprobe-when-builtin update On 10-08-08 23:37, Alan Cox wrote: > > Would probably make the printk "pms: not enabled, use pms.enable=1 to > probe" > > So you know > a) What is wittering about not being probed > b) How to undo it. > > But thats trivia really. Signed-off-by: Rene Herman Signed-off-by: Andrew Morton Signed-off-by: Mauro Carvalho Chehab commit b54ff9398ac7d38a129167b580383943592b6f08 Author: Rene Herman Date: Wed Sep 3 16:48:21 2008 -0300 V4L/DVB (8727): V4L1: make PMS not autoprobe when builtin. The old Mediavision Pro Movie Studio legacy ISA V4L1 driver was found to hang the boot during Ingo Molnar's testing of randconfig kernels. Have it require a "pms.enable=1" kernel parameter to enable the driver when builtin which avoids such problems. This is a deprecated and, very likely, unused driver. Nothing changes modular behaviour moreover. Signed-off-by: Rene Herman Acked-by: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Mauro Carvalho Chehab commit f46466e7d6ff4871e5faae32d277175293a34c1f Author: Simon Arlott Date: Wed Sep 3 16:48:20 2008 -0300 V4L/DVB (8726): link tuner before saa7134 If saa7134_init is run before v4l2_i2c_drv_init (tuner), then saa7134_board_init2 will try to set the tuner type for devices that don't exist yet. This moves tuner to before all of the device-specific drivers so that it's loaded early enough on boot. Signed-off-by: Simon Arlott Signed-off-by: Andrew Morton Signed-off-by: Mauro Carvalho Chehab commit 09a29b771535e0b8cef66946fdaeb43b0e545570 Author: Michael Krufky Date: Wed Sep 3 16:48:17 2008 -0300 V4L/DVB (8722): sms1xxx: fix typo in license header This should have read, "GNU General Public License version 2" rather than, "GNU General Public License version 3" This was actually a typo mass-blunder -- this is not a change in licence, as the code was always GPLv2. Signed-off-by: Uri Shkolnik Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 89a44b8a690ff2d8639b72931d9c197a8db0c803 Author: Hans de Goede Date: Wed Sep 3 16:48:16 2008 -0300 V4L/DVB (8720): gspca: V4L2_CAP_SENSOR_UPSIDE_DOWN added as a cap for some webcams. This patch adds a V4L2_CAP_SENSOR_UPSIDE_DOWN flag to the capabilities flags, and sets this flag for the Philips SPC200NC cam (which has its sensor installed upside down). The same flag is also needed and added for the Philips SPC300NC. Together with a patch to libv4l which adds flipping the image in software this fixes the upside down display with the SPC200NC cam. Signed-of-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit f9b4a377dc6601a3299171c7b24c2c5189c0c10b Author: Jean-Francois Moine Date: Wed Sep 3 16:48:14 2008 -0300 V4L/DVB (8719): gspca: Have VIDIOC_QUERYCTRL more compliant to the spec. - return -EINVAL when control not supported. - start the private controls at V4L2_CID_PRIVATE_BASE. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 6a709749228c5f76f128c69c16f39a52d639bd96 Author: Jean-Francois Moine Date: Wed Sep 3 16:48:10 2008 -0300 V4L/DVB (8718): gspca: suspend/resume added. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 5d05294ac8f6b5d592ee3379fbddd0fb9d1b4c87 Author: Jean-Francois Moine Date: Wed Sep 3 16:48:09 2008 -0300 V4L/DVB (8717): gspca: Frame buffer too small for small resolutions (sonixj and t613). Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 5b064da80831500a6ac6ea501d2d0cb5e8323cc7 Author: Jean-Francois Moine Date: Wed Sep 3 16:48:08 2008 -0300 V4L/DVB (8716): gspca: Bad start of sn9c110 and sensor ov7630. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 142346bf9f2410b32cd219cf3f70a85ac56d5b85 Author: Jean-Francois Moine Date: Wed Sep 3 16:48:07 2008 -0300 V4L/DVB (8715): gspca: Change the name of some webcam in the gspca doc. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 4f30f6cf6b1baf2d19f6b575c4486ae6dc0c2a00 Author: Jean-Francois Moine Date: Wed Sep 3 16:48:05 2008 -0300 V4L/DVB (8714): gspca: Bad start of sn9c110 and sensor om6802. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 9c5f70f248ccce6d943904e6da687c6ec062f072 Author: Jean-Francois Moine Date: Wed Sep 3 16:48:04 2008 -0300 V4L/DVB (8713): gspca: Bad color control again in sonixj. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 759aa3c21ebbab6cc00fc4aebd09b3a7d63715d1 Author: Jean-Francois Moine Date: Wed Sep 3 16:48:03 2008 -0300 V4L/DVB (8712): gspca: Bad start of sonixj webcams since changeset a8779025e7e8. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 4a18625e88efef2b5a21695edcb2b21d98fdf71b Author: Jean-Francois Moine Date: Wed Sep 3 16:48:02 2008 -0300 V4L/DVB (8711): gspca: Bad controls and quantization table of pac7311. Patch adapted from a gspca v1 patch by Thomas Kaiser. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit d55b83d3c4558d0d118bf20ef3f1fa65b1c75c3d Author: Jean-Francois Moine Date: Wed Sep 3 16:48:01 2008 -0300 V4L/DVB (8710): gspca: Bad color control in sonixj. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 05b809c702bf297690c63ea78ee117c4dc909028 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:59 2008 -0300 V4L/DVB (8709): gspca: Fix initialization and controls of sn9x110 - ov7630. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 41b469745f6218efb22bec4e3940b085ffb97216 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:58 2008 -0300 V4L/DVB (8707): gspca: Colors, hflip and vflip controls added for pac7302. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit dff6d321d421c4c059aea72be70df3a8a200b8a3 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:57 2008 -0300 V4L/DVB (8706): Make contrast and brightness work for pac7302. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 3a1ea7050345734acc3a33b2b00a611b9b7bf640 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:55 2008 -0300 V4L/DVB (8705): gspca: Adjust some control limits in spca561. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit d698dc6b0477d3165a7f320b3ce36d1cbd361c94 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:51 2008 -0300 V4L/DVB (8703): gspca: Do controls work for spca561 revision 12a. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 0058717a1ef0c87deeccbe0a3b17def173fee9a9 Author: Andy Walls Date: Wed Sep 3 16:47:50 2008 -0300 V4L/DVB (8701): cx18: Add missing lock for when the irq handler manipulates the queues cx18: Add missing lock for when the irq handler manipulates the queues. This was a potential source of stream queue corruption. Also changed the name of cx18_queue_find_buf() to cx18_queue_get_buf_irq(). Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit 46f2c21cfdb1a829a9a23e23562ffa66b007dc48 Author: Henrik Kretzschmar Date: Wed Sep 3 16:47:39 2008 -0300 V4L/DVB (8682): V4L: fix return value of register video func If a wrong device type is used with video_register_device_index() it should better return an error number, instead of a constant. Signed-off-by: Henrik Kretzschmar Signed-off-by: Mauro Carvalho Chehab commit b045979d61b235cd9cc8347760fcfb44fc8ecbd6 Author: Alexander Beregalov Date: Wed Sep 3 16:47:38 2008 -0300 V4L/DVB (8681): v4l2-ioctl.c: fix warning drivers/media/video/v4l2-ioctl.c:496: warning: format '%08ld' expects type 'long int', but argument 5 has type 'suseconds_t' Signed-off-by: Alexander Beregalov Signed-off-by: Mauro Carvalho Chehab commit c7087f56a42b0aa82b181d9a08a376c4add7a683 Author: Adrian Bunk Date: Wed Sep 3 16:47:36 2008 -0300 V4L/DVB (8678): Remove the dead CONFIG_RADIO_MIROPCM20{,_RDS} code The CONFIG_RADIO_MIROPCM20{,_RDS} code became dead code 1.5 years ago. Signed-off-by: Adrian Bunk Signed-off-by: Mauro Carvalho Chehab commit f75c4950bb6e677e89479192b2ecfbec0beab14e Author: Jean-Francois Moine Date: Wed Sep 3 16:47:35 2008 -0300 V4L/DVB (8675): gspca: Pixmap PJPG (Pixart 73xx JPEG) added, generated by pac7311. The JPEG frames generated by the Pixart 73xx have: - special markers 'ff ff ff xx' every 1024/512 bytes, - unused 8 bits at end of JPEG blocks, and then ask for a new pixel format. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 6ab0b174d22b448d66058c9de0114fdfac5b7ccf Author: Jean-Francois Moine Date: Wed Sep 3 16:47:34 2008 -0300 V4L/DVB (8674): gspca: Webcam 0c45:612e added in sonixj. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 285a4f6c8e518f03758c7b085bda13bb3795df0a Author: Jean-Francois Moine Date: Wed Sep 3 16:47:33 2008 -0300 V4L/DVB (8673): gspca: Bad frame scanning again and bad init in pac7311. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 7879d459f1601be742d0d63930d17cd4aac956fd Author: Jean-Francois Moine Date: Wed Sep 3 16:47:32 2008 -0300 V4L/DVB (8672): gspca: Big rewrite of spca561. Bug register/value inversions in USB exchanges. Exposure and gain controls added for rev 12a. Separate the functions and controls of the revisions 12a and 72a. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit a0b508c2d7d0de0e46555793e334e35381716825 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:31 2008 -0300 V4L/DVB (8671): gspca: Remove the unused field 'dev_name' of the device structure. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 6c9d3c59e6fdb8dfadaf7ba38f1d0b64ff066b36 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:30 2008 -0300 V4L/DVB (8669): gspca: Add white balance control for spca561 rev 012A. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 5bb0f21a46281b021897d2c56d50685c1939b5ee Author: Jean-Francois Moine Date: Wed Sep 3 16:47:29 2008 -0300 V4L/DVB (8668): gspca: Conflict GSPCA / ET61X251 for the webcam 102c:6251. Fix a double handling of 102c:6251 and no handling of 102c:6151 when both drivers GSPCA and ET61X251. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 3466234229e6535a061f5f63a87bfb12c833d96a Author: Hans de Goede Date: Wed Sep 3 16:47:28 2008 -0300 V4L/DVB (8667): gspca: Bad probe of Z-Star/Vimicro webcams with pas106 sensor. This patch moves the detection of the 2wr SIF pas106b sensor to before detecting other sensors. Patch change by jfm: Check SIF for identified webcams only. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 8559e8da31f37e2916195f44bbe79a61008782df Author: Jean-Francois Moine Date: Wed Sep 3 16:47:27 2008 -0300 V4L/DVB (8666): gspca: Bad scanning of frames in pac7311. The previous change in packet scanning did not work, Also, autogain was no more treated at interrupt level. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 9d5c1251bfc10a0e864352f45e272331f65b3420 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:26 2008 -0300 V4L/DVB (8665): gspca: Fix the 640x480 resolution of the webcam 093a:2621. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 49b57dba2f6425e9b42874b4dec2433b335fa69c Author: Jean-Francois Moine Date: Wed Sep 3 16:47:25 2008 -0300 V4L/DVB (8664): gspca: The bridge/sensor of the webcam 093a:2621 is a PAC 7302. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit d2d16e9084ee44088974c3312b803d54dd9b46d7 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:23 2008 -0300 V4L/DVB (8663): gspca: Webcam 0c45:6128 added in sonixj. Patch adapted from a patch to gspcav1 made by the google microdia group. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 23d9e4776b426d1f8a602e0e8d868154847f0dd4 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:22 2008 -0300 V4L/DVB (8661): gspca: Bug in the previous changeset about pac7311. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit e52a5574de9d3bb297a26566871eabcbdfab13b5 Author: Jean-Francois Moine Date: Wed Sep 3 16:47:21 2008 -0300 V4L/DVB (8660): gspca: Simplify the scan of URB packets in pac7311. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit d526afe06b285006c63ed8f2eba9589f04e3283a Author: Hans Verkuil Date: Wed Sep 3 16:47:14 2008 -0300 V4L/DVB (8648): ivtv: improve CC support - change the work-queue to a single threaded high prio workqueue - use DMA instead of PIO for the sliced VBI data. - remove some incorrect tests - increase the internal VBI capture queue size for sliced VBI packets - ignore duplicate VBI lines With these changes it should finally be possible to get reliable closed captions. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit c58dc0beaf70bce4d04ff53b82a7035a255a04e4 Author: Hans Verkuil Date: Wed Sep 3 16:46:58 2008 -0300 V4L/DVB (8633): ivtv: update ivtv version number Since for 2.6.27 ivtvfb uses DMA for write it is important that you can identify which ivtv version supports this and which doesn't. Increase the version number so we can tell the difference. Thanks to Ian Armstrong for pointing this out to me. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 888fe747b5d134e2f3b5c2d3ecc25e1c6dcad4c3 Author: Hans Verkuil Date: Wed Sep 3 16:46:50 2008 -0300 V4L/DVB (8629): v4l2-ioctl: do not try to handle private V4L1 ioctls Some drivers (e.g. zoran) have private V4L1 ioctls. Do not try to pass them to v4l1_compat_translate because then the driver wi