commit 78ace17e51d4968ed2355e8f708d233d1cc37f6d Author: Greg Kroah-Hartman Date: Fri Oct 13 11:55:04 2006 -0700 Linux 2.6.17.14 commit 38cad36d1cd15e66cc6e4a018c6f0f347fa508a3 Author: Roberto Castagnola Date: Sun Sep 17 00:07:55 2006 -0400 Input: logips2pp - fix button mapping for MX300 MX300 does not have an EXTRA_BTN - it is a simple wheel mouse with an additional task-switcher button, which is reported as side button (and not task button). Signed-off-by: Daniel Drake Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 1358c6514ee69aede18947bb8152b464067e114e Author: Tejun Heo Date: Sun Sep 17 00:05:55 2006 -0400 ahci: do not fail softreset if PHY reports no device All softreset methods are responsible for detecting device presence and succeed softreset in such cases. AHCI didn't use to check for device presence before proceeding with softreset and this caused unnecessary reset retrials during probing. This patch adds presence detection to AHCI softreset. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik Cc: Daniel Drake Signed-off-by: Greg Kroah-Hartman commit 7a84f5cbcf9e0159a2ddde55647a8d69396fd238 Author: Pierre Ossman Date: Sun Sep 17 00:04:41 2006 -0400 MMC: Always use a sector size of 512 bytes Both MMC and SD specifications specify (although a bit unclearly in the MMC case) that a sector size of 512 bytes must always be supported by the card. Cards can report larger "native" size than this, and cards >= 2 GB even must do so. Most other readers use 512 bytes even for these cards. We should do the same to be compatible. Signed-off-by: Pierre Ossman Cc: Daniel Drake Signed-off-by: Greg Kroah-Hartman commit 144bfae25349b7c4be0c6ee82bcb7c3d05990fa8 Author: Linus Torvalds Date: Sun Sep 17 00:02:30 2006 -0400 Add PIIX4 APCI quirk for the 440MX chipset too This is confirmed to fix a hang due to PCI resource conflicts with setting up the Cardbus bridge on old laptops with the 440MX chipsets. Original report by Alessio Sangalli, lspci debugging help by Pekka Enberg, and trial patch suggested by Daniel Ritz: "From the docs available i would _guess_ this thing is really similar to the 82443BX/82371AB combination. at least the SMBus base address register is hidden at the very same place (32bit at 0x90 in function 3 of the "south" brigde)" The dang thing is largely undocumented, but the patch was corroborated by Asit Mallick: "I am trying to find the register information. 440MX is an integration of 440BX north-bridge without AGP and PIIX4E (82371EB). PIIX4 quirk should cover the ACPI and SMBus related I/O registers." and verified to fix the problem by Alessio. Cc: Daniel Ritz Cc: Asit Mallick Cc: Pekka Enberg Cc: Ivan Kokshaysky Cc: Dmitry Torokhov Tested-by: Alessio Sangalli Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8d73f56f5f020bf99be61a6f4ba50be72c97dd0c Author: Joerg Ahrens Date: Sun Sep 17 00:01:05 2006 -0400 xirc2ps_cs: Cannot reset card in atomic context I am using a Xircom CEM33 pcmcia NIC which has occasional hardware problems. If the netdev watchdog detects a transmit timeout, do_reset is called which msleeps - this is illegal in atomic context. This patch schedules the timeout handling as a workqueue item. Signed-off-by: Daniel Drake Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit a7f0f4dc1aa3b640549507ed1ebfb46ab45eebfe Author: David Miller Date: Wed Sep 27 16:25:17 2006 -0700 PKT_SCHED: cls_basic: Use unsigned int when generating handle Prevents filters from being added if the first generated handle already exists. Signed-off-by: Kim Nordlund Signed-off-by: Thomas Graf Signed-off-by: Greg Kroah-Hartman commit c22025315f2b57bed56cfe2a63c9b291f03fe3ba Author: David S. Miller Date: Tue Sep 26 23:15:38 2006 -0700 Fix sparc64 ramdisk handling [SPARC64]: Kill bogus check from bootmem_init(). There is an ancient and totally incorrect sanity check being done on the ramdisk location. The check assumes that the kernel is always loaded to physical address zero, which is wrong. It was trying to validate the ramdisk value by saying that if it fell within the kernel image address range it must be wrong. Anyways, kill this because it actually creates problems. The 'ramdisk_image' should always be adjusted down by KERNBASE. SILO can easily put the ramdisk in a location which causes this test to trigger, breaking things. [ Based almost entirely upon a patch from Ben Collins. ] Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 47ca006812200d8cdc2745bdcadc126e5b360004 Author: David S. Miller Date: Sat Sep 23 18:26:24 2006 -0700 SPARC64: Fix serious bug in sched_clock() on sparc64 [SPARC64]: Fix sched_clock() wrapping every ~17 seconds. Unfortunately, sparc64 doesn't have an easy way to do a "64 X 64 --> 128" bit multiply like PowerPC and IA64 do. We were doing a "64 X 64 --> 64" bit multiple which causes overflow very quickly with a 30-bit quotient shift. So use a quotientshift count of 10 instead of 30, just like x86 and ARM do. This also fixes the wrapping of printk timestamp values every ~17 seconds. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2d287e0384ce2b7c8d2e54697c95a83fc417a2e1 Author: Yeasah Pell Date: Sun Oct 8 14:46:16 2006 -0400 DVB: cx24123: fix PLL divisor setup The cx24109 datasheet says: "NOTE: if A=0, then N=N+1" The current code is the result of a misinterpretation of the datasheet to mean exactly the opposite of the requirement -- The actual value of N is 1 greater than the value written when A is 0, so 1 needs to be *subtracted* from it to compensate. Signed-off-by: Yeasah Pell Signed-off-by: Steven Toth Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit 90d684520e3484b913647bf1c0026f795a087905 Author: Hans Verkuil Date: Sun Oct 8 14:46:05 2006 -0400 V4L: Fix msp343xG handling regression The msp3430G and msp3435G models cannot do Automatic Standard Detection, so these should be forced to BTSC. These chips are early production versions for the msp34xxG series and are quite rare. Due to broken handling of the 'standard' option in 2.6.17, there is no workaround possible. Signed-off-by: Hans Verkuil Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit 91d72bbd4cc7a04e3c2402da85385a2fb377575a Author: Hidetoshi Seto Date: Fri Sep 29 01:05:23 2006 -0700 sysfs: remove duplicated dput in sysfs_update_file Following function can drops d_count twice against one reference by lookup_one_len. /** * sysfs_update_file - update the modified timestamp on an object attribute. * @kobj: object we're acting for. * @attr: attribute descriptor. */ int sysfs_update_file(struct kobject * kobj, const struct attribute * attr) { struct dentry * dir = kobj->dentry; struct dentry * victim; int res = -ENOENT; mutex_lock(&dir->d_inode->i_mutex); victim = lookup_one_len(attr->name, dir, strlen(attr->name)); if (!IS_ERR(victim)) { /* make sure dentry is really there */ if (victim->d_inode && (victim->d_parent->d_inode == dir->d_inode)) { victim->d_inode->i_mtime = CURRENT_TIME; fsnotify_modify(victim); /** * Drop reference from initial sysfs_get_dentry(). */ dput(victim); res = 0; } else d_drop(victim); /** * Drop the reference acquired from sysfs_get_dentry() above. */ dput(victim); } mutex_unlock(&dir->d_inode->i_mutex); return res; } PCI-hotplug (drivers/pci/hotplug/pci_hotplug_core.c) is only user of this function. I confirmed that dentry of /sys/bus/pci/slots/XXX/* have negative d_count value. This patch removes unnecessary dput(). Signed-off-by: Hidetoshi Seto Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit cfb3f12260beaf5dc8f765a1c191822896019d8a Author: Badari Pulavarty Date: Fri Sep 15 09:07:18 2006 -0700 ext3 sequential read regression fix ext3-get-blocks support caused ~20% degrade in Sequential read performance (tiobench). Problem is with marking the buffer boundary so IO can be submitted right away. Here is the patch to fix it. 2.6.18-rc6: commit 63a17cfcfce2888f55f16e2d1e1c587351fffa38 Author: Michael-Luke Jones Date: Sun Sep 10 16:46:35 2006 +0100 Backport: Old IDE, fix SATA detection for cabling This patch is identical to that introduced in 1a1276e7b6cba549553285f74e87f702bfff6fac to the Linus' 2.6 development tree by Alan Cox. 'This is based on the proposed patches flying around but also checks that the device in question is new enough to have word 93 rather thanb blindly assuming word 93 == 0 means SATA (see ATA-5, ATA-7)' -- Alan Cox Required for my SATA drive on an Asus Pundit-R to operate above 33MBps. Signed-off-by: Michael-Luke Jones Signed-off-by: Greg Kroah-Hartman commit d3ea6449776ebc644c587b4e4be9b92840b3c5d4 Author: Trond Myklebust Date: Thu Sep 7 20:09:43 2006 -0400 NFS: More page cache revalidation fixups Whenever the directory changes, we want to make sure that we always invalidate its page cache. Fix up update_changeattr() and nfs_mark_for_revalidate() so that they do so. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 387436208278da65b5715e0b3f96a8a3b5a4ed08 Author: Trond Myklebust Date: Thu Sep 7 20:09:41 2006 -0400 LOCKD: Fix a deadlock in nlm_traverse_files() nlm_traverse_files() is not allowed to hold the nlm_file_mutex while calling nlm_inspect file, since it may end up calling nlm_release_file() when releaseing the blocks. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 4ab4245c7088519526e1c0e60f02a4807ecf2492 Author: Chuck Lever Date: Thu Sep 7 20:09:39 2006 -0400 SUNRPC: avoid choosing an IPMI port for RPC traffic Some hardware uses port 664 for its hardware-based IPMI listener. Teach the RPC client to avoid using that port by raising the default minimum port number to 665. Test plan: Find a mainboard known to use port 664 for IPMI; enable IPMI; mount NFS servers in a tight loop. Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 18807ffe4e541639abae40dcd2ebd7a20e9078d6 Author: Nikita Danilov Date: Thu Sep 7 20:09:36 2006 -0400 NFS: Fix a potential deadlock in nfs_release_page nfs_wb_page() waits on request completion and, as a result, is not safe to be called from nfs_release_page() invoked by VM scanner as part of GFP_NOFS allocation. Fix possible deadlock by analyzing gfp mask and refusing to release page if __GFP_FS is not set. Signed-off-by: Nikita Danilov Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit b7a7e34e7e033822ffef7386b1b884edede7f6c5 Author: Ang Way Chuang Date: Fri Sep 1 14:13:01 2006 +0800 dvb-core: Proper handling ULE SNDU length of 0 (CVE-2006-4623) ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation code has a bug that allows an attacker to send a malformed ULE packet with SNDU length of 0 and bring down the receiving machine. This patch fix the bug and has been tested on version 2.6.17.11. This bug is 100% reproducible and the modified source code (GPL) used to produce this bug will be posted on http://nrg.cs.usm.my/downloads.htm shortly. The kernel will produce a dump during CRC32 checking on faulty ULE packet. Signed-off-by: Ang Way Chuang Signed-off-by: Greg Kroah-Hartman