commit 89c8f056a30781d9713f4e7f7a2d6cc849758790 Author: Greg Kroah-Hartman Date: Fri Apr 13 13:48:14 2007 -0700 Linux 2.6.20.7 commit 6aadc57bb407ed0036c63faf9733fc93f0198ac2 Author: Chuck Ebbert Date: Wed Apr 11 15:33:54 2007 -0400 Update libata drive blacklist to the latest from 2.6.21 Update libata drive blacklist to the latest from 2.6.21 Removes one duplicate entry from blacklist table, adds several entries for drives with broken NCQ. [diff between 2.6.20 and 2.6.21-rc6, with one entry removed that required new libata features] Signed-off-by: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 8d6b75109e6c95fbb3d5e747f709e2e7633e6233 Author: Brian Pomerantz Date: Sun Apr 1 23:49:41 2007 -0700 fix page leak during core dump When the dump cannot occur most likely because of a full file system and the page to be written is the zero page, the call to page_cache_release() is missed. Signed-off-by: Brian Pomerantz Cc: Hugh Dickins Cc: Nick Piggin Cc: David Howells Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit c83d476c9dfc8306bd8578555d6ec462492cc707 Author: Andrew Morton Date: Sun Apr 1 23:49:44 2007 -0700 revert "retries in ext4_prepare_write() violate ordering requirements" Revert b46be05004abb419e303e66e143eed9f8a6e9f3f. Same reasoning as for ext3. Cc: Kirill Korotaev Cc: Ingo Molnar Cc: Ken Chen Cc: Andrey Savochkin Cc: Cc: Dmitriy Monakhov Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 5dc1802f745ba8a665d667f676f1eb21df432a41 Author: Andrew Morton Date: Sun Apr 1 23:49:43 2007 -0700 revert "retries in ext3_prepare_write() violate ordering requirements" Revert e92a4d595b464c4aae64be39ca61a9ffe9c8b278. Dmitry points out "When we block_prepare_write() failed while ext3_prepare_write() we jump to "failure" label and call ext3_prepare_failure() witch search last mapped bh and invoke commit_write untill it. This is wrong!! because some bh from begining to the last mapped bh may be not uptodate. As a result we commit to disk not uptodate page content witch contains garbage from previous usage." and "Unexpected file size increasing." Call trace the same as it was in first issue but result is different. For example we have file with i_size is zero. we want write two blocks , but fs has only one free block. ->ext3_prepare_write(...from == 0, to == 2048) retry: ->block_prepare_write() == -ENOSPC# we failed but allocated one block here. ->ext3_prepare_failure() ->commit_write( from == 0, to == 1024) # after this i_size becomes 1024 :) if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries)) goto retry; Finally when all retries will be spended ext3_prepare_failure return -ENOSPC, but i_size was increased and later block trimm procedures can't help here. We don't appear to have the horsepower to fix these issues, so let's put things back the way they were for now. Cc: Kirill Korotaev Cc: Ingo Molnar Cc: Ken Chen Cc: Andrey Savochkin Cc: Cc: Dmitriy Monakhov Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 0ece095ba7eaa8396e0a510ea2fdea16340149e6 Author: Albert Lee Date: Tue Apr 10 14:07:52 2007 -0400 libata: Clear tf before doing request sense (take 3) libata: Clear tf before doing request sense (take 3) patch 2/4: Clear tf before doing request sense. This fixes the AOpen 56X/AKH timeout problem. (http://bugzilla.kernel.org/show_bug.cgi?id=8244) Signed-off-by: Albert Lee Signed-off-by: Jeff Garzik Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 4e169f6ceff7af6a26e777fa87c28e41ffcd342e Author: Mark Lord Date: Tue Apr 10 13:09:02 2007 -0400 fix lba48 bug in libata fill_result_tf() 2.6.21 fix lba48 bug in libata fill_result_tf() Current 2.6.21 libata does the following: void ata_tf_read(struct ata_port *ap, struct ata_taskfile *tf) { struct ata_ioports *ioaddr = &ap->ioaddr; tf->command = ata_check_status(ap); ... if (tf->flags & ATA_TFLAG_LBA48) { iowrite8(tf->ctl | ATA_HOB, ioaddr->ctl_addr); tf->hob_feature = ioread8(ioaddr->error_addr); ... } } ... static void fill_result_tf(struct ata_queued_cmd *qc) { struct ata_port *ap = qc->ap; ap->ops->tf_read(ap, &qc->result_tf); qc->result_tf.flags = qc->tf.flags; } Based on this, those last two statements fill_result_tf() appear to me to be in the wrong order, in that the tf->flags are uninitialized at the point where tf_read() is invoked. So for lba48 commands, tf_read() won't be reading back the full lba48 register contents.. Correct? This patch corrects fill_result_tf() so that the flags get copied to result_tf before they are used by tf_read(). Signed-off-by: Mark Lord Signed-off-by: Jeff Garzik Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit c23bbe5978f98e7ae3a41f13dbf48d70c6651573 Author: Conke Hu Date: Tue Apr 10 13:06:56 2007 -0400 ahci.c: walkaround for SB600 SATA internal error issue ahci.c: walkaround for SB600 SATA internal error issue There is a HW issue in ATI SB600 SATA that PxSERR.E should not be set on some conditions, for example, when there is no media in SATA CD/DVD drive or media is not ready, AHCI controller fails to execute ATAPI commands and reports PORT_IRQ_TF_ERR, but ATI SB600 SATA controller sets PxSERR.E at the same time, which is not necessary. This patch is just to ignore the INTERNAL ERROR in such case. Without this patch, ahci error handler will report many errors as below: ----------- cut from dmesg ----------- ata9: soft resetting port ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300) ata9.00: configured for UDMA/33 ata9: EH complete ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2 ata9.00: (irq_stat 0x40000001) ata9.00: cmd a0/00:00:00:00:20/00:00:00:00:00/a0 tag 0 cdb 0x0 data 0 res 51/24:03:00:00:20/00:00:00:00:00/a0 Emask 0x40 (internal error) ata9: soft resetting port ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300) ata9.00: configured for UDMA/33 ata9: EH complete ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2 ata9.00: (irq_stat 0x40000001) ata9.00: cmd a0/01:00:00:00:00/00:00:00:00:00/a0 tag 0 cdb 0x43 data 12 in res 51/24:03:00:00:00/00:00:00:00:00/a0 Emask 0x40 (internal error) -------- end cut --------- Signed-off-by: Conke Hu Signed-off-by: Jeff Garzik Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 0cecc9afc526ef12a2911b68e2941b10badcbb82 Author: Mark Lord Date: Mon Apr 9 15:21:15 2007 -0400 libata bugfix: preserve LBA bit for HDIO_DRIVE_TASK libata bugfix: preserve LBA bit for HDIO_DRIVE_TASK Preserve the LBA bit in the DevSel/Head register for HDIO_DRIVE_TASK. Signed-off-by: Mark Lord Signed-off-by: Jeff Garzik Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 3c163bc0b44d31618fa8f08a5e149335f6c8cbc4 Author: John W. Linville Date: Wed Apr 4 15:30:35 2007 -0400 softmac: avoid assert in ieee80211softmac_wx_get_rate [PATCH] softmac: avoid assert in ieee80211softmac_wx_get_rate Unconfigured bcm43xx device can hit an assert() during wx_get_rate queries. This is because bcm43xx calls ieee80211softmac_start late (i.e. during open instead of probe). bcm43xx_net_open -> bcm43xx_init_board -> bcm43xx_select_wireless_core -> ieee80211softmac_start Fix is to check that device is running before completing ieee80211softmac_wx_get_rate. Signed-off-by: John W. Linville Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit b95c2d9a59eab707fe82629fd7d0b4f3656d93be Author: Neil Brown Date: Wed Apr 4 15:29:43 2007 -0400 knfsd: allow nfsd READDIR to return 64bit cookies From Neil Brown [PATCH] knfsd: allow nfsd READDIR to return 64bit cookies ->readdir passes lofft_t offsets (used as nfs cookies) to nfs3svc_encode_entry{,_plus}, but when they pass it on to encode_entry it becomes an 'off_t', which isn't good. So filesystems that returned 64bit offsets would lose. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 92ada370b0342f39f2a20a311a7115c2ed5faf50 Author: Suleiman Souhlal Date: Wed Apr 4 15:28:52 2007 -0400 ide: use correct IDE error recovery ide: use correct IDE error recovery IDE error recovery is using IDLE IMMEDIATE if the drive is busy or has DRQ set. This violates the ATA spec (can only send IDLE IMMEDIATE when drive is not busy) and really hoses up some drives (modern drives will not be able to recover using this error handling). The correct thing to do is issue a SRST followed by a SET FEATURES command. This is what Western Digital recommends for error recovery and what Western Digital says Windows does.  It also does not violate the ATA spec as far as I can tell. Bart: * port the patch over the current tree * undo the recalibration code removal * send SET FEATURES command after checking for good drive status * don't check whether the current request is of REQ_TYPE_ATA_{CMD,TASK} type because we need to send SET FEATURES before handling any requests * some pre-ATA4 drives require INITIALIZE DEVICE PARAMETERS command before other commands (except IDENTIFY) so send SET FEATURES only if there are no pending drive->special requests * update comments and patch description * any bugs introduced by this patch are mine and not Suleiman's :-) Signed-off-by: Suleiman Souhlal Acked-by: Alan Cox Cc: Chuck Ebbert Signed-off-by: Bartlomiej Zolnierkiewicz commit 8b256a36a57638e6693b04bd17d01596a3e19afe Author: David Miller Date: Tue Apr 10 13:39:35 2007 -0700 Fix TCP slow_start_after_idle sysctl [TCP]: slow_start_after_idle should influence cwnd validation too For the cases that slow_start_after_idle are meant to deal with, it is almost a certainty that the congestion window tests will think the connection is application limited and we'll thus decrease the cwnd there too. This defeats the whole point of setting slow_start_after_idle to zero. So test it there too. We do not cancel out the entire tcp_cwnd_validate() function so that if the sysctl is changed we still have the validation state maintained. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit fa520f761777759cf1aebfda81ce250fc840719f Author: Patrick McHardy Date: Tue Apr 10 13:38:39 2007 -0700 Fix tcindex classifier ABI borkage... [NET_SCHED]: cls_tcindex: fix compatibility breakage Userspace uses an integer for TCA_TCINDEX_SHIFT, the kernel was changed to expect and use a u16 value in 2.6.11, which broke compatibility on big endian machines. Change back to use int. Reported by Ole Reinartz Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c823d26e9a668566fa92f7486b2380191497ba7a Author: Herbert Xu Date: Tue Apr 10 13:37:24 2007 -0700 Fix IPSEC replay window handling [IPSEC]: Reject packets within replay window but outside the bit mask Up until this point we've accepted replay window settings greater than 32 but our bit mask can only accomodate 32 packets. Thus any packet with a sequence number within the window but outside the bit mask would be accepted. This patch causes those packets to be rejected instead. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 12da1b6a092a13c2cf4903fd0d39c139d511ef96 Author: John Heffner Date: Tue Apr 10 13:36:40 2007 -0700 Fix TCP receiver side SWS handling. [TCP]: Do receiver-side SWS avoidance for rcvbuf < MSS. Signed-off-by: John Heffner Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 0b3a1a3864038660bb03c39d4b0c8708390f238d Author: David Miller Date: Tue Apr 10 13:35:41 2007 -0700 Fix scsi sense handling [SCSI]: Fix scsi_send_eh_cmnd scatterlist handling This fixes a regression caused by commit: 2dc611de5a3fd955cd0298c50691d4c05046db97 The sense buffer code in scsi_send_eh_cmnd was changed to use alloc_page() and a scatter list, but the sense data copy was not updated to match so what we actually get in the sense buffer is total grabage starting with the kernel address of the struct page we got. Basically the stack frame of scsi_send_eh_cmd() is what ends up in the sense buffer. Depending upon how pointers look on a given platform, you can end up getting sr_ioctl.c errors when you mount a cdrom. If the CDROM gives a check condition for GPCMD_GET_CONFIGURATION issued by drivers/cdrom/cdrom.c:cdrom_mmc_profile(), sr_ioctl will spit out this error message in sr_do_ioctl() with the way pointers are on sparc64: default: printk(KERN_ERR "%s: CDROM (ioctl) error, command: ", cd->cdi.name); __scsi_print_command(cgc->cmd); scsi_print_sense_hdr("sr", &sshdr); err = -EIO; This is the error Tom Callaway reported in: http://marc.info/?l=linux-sparc&m=117407453208101&w=2 Anyways, fix this by using page_address(sgl.page) which is OK because we know this is low-mem due to GFP_ATOMIC. Signed-off-by: David S. Miller Acked-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit cda778fcf66a3d1ea47fa86e979c12996bcfbc8f Author: YOSHIFUJI Hideaki Date: Tue Apr 10 13:31:20 2007 -0700 Fix length validation in rawv6_sendmsg() [IPv6]: Fix incorrect length check in rawv6_sendmsg() In article <20070329.142644.70222545.davem@davemloft.net> (at Thu, 29 Mar 2007 14:26:44 -0700 (PDT)), David Miller says: > From: Sridhar Samudrala > Date: Thu, 29 Mar 2007 14:17:28 -0700 > > > The check for length in rawv6_sendmsg() is incorrect. > > As len is an unsigned int, (len < 0) will never be TRUE. > > I think checking for IPV6_MAXPLEN(65535) is better. > > > > Is it possible to send ipv6 jumbo packets using raw > > sockets? If so, we can remove this check. > > I don't see why such a limitation against jumbo would exist, > does anyone else? > > Thanks for catching this Sridhar. A good compiler should simply > fail to compile "if (x < 0)" when 'x' is an unsigned type, don't > you think :-) Dave, we use "int" for returning value, so we should fix this anyway, IMHO; we should not allow len > INT_MAX. Signed-off-by: YOSHIFUJI Hideaki Acked-by: Sridhar Samudrala Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 1e3769dc9ac7559010cfad5400896f24f1d33ad3 Author: Patrick McHardy Date: Tue Apr 10 13:29:44 2007 -0700 Fix IFB net driver input device crashes [IFB]: Fix crash on input device removal The input_device pointer is not refcounted, which means the device may disappear while packets are queued, causing a crash when ifb passes packets with a stale skb->dev pointer to netif_rx(). Fix by storing the interface index instead and do a lookup where neccessary. Signed-off-by: Patrick McHardy Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9e45b2f0fd14f032b1fcbaae0b2548274a9cc9be Author: Patrick McHardy Date: Tue Apr 10 14:47:21 2007 +0200 NETFILTER: ipt_CLUSTERIP: fix oops in checkentry function [NETFILTER]: ipt_CLUSTERIP: fix oops in checkentry function The clusterip_config_find_get() already increases entries reference counter, so there is no reason to do it twice in checkentry() callback. This causes the config to be freed before it is removed from the list, resulting in a crash when adding the next rule. Signed-off-by: Jaroslav Kysela Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8e6697b59bda75baa4c0db4d7b9ff4514f032744 Author: Francois Romieu Date: Thu Apr 5 22:52:12 2007 -0700 8139too: RTNL and flush_scheduled_work deadlock Your usual dont-flush_scheduled_work-with-RTNL-held stuff. It is a bit different here since the thread runs permanently or is only occasionally kicked for recovery depending on the hardware revision. Signed-off-by: Francois Romieu Cc: Ben Greear Signed-off-by: Greg Kroah-Hartman commit 2d6a42397823d5de05303941ad3df8a11e06a11a Author: Neil Brown Date: Wed Apr 11 13:31:07 2007 +1000 Fix calculation for size of filemap_attr array in md/bitmap. If 'num_pages' were ever 1 more than a multiple of 8 (32bit platforms) for of 16 (64 bit platforms). filemap_attr would be allocated one 'unsigned long' shorter than required. We need a round-up in there. Signed-off-by: Neil Brown Signed-off-by: Greg Kroah-Hartman commit 2031c51916f2fd44222715c8b1ba23d5f8ef56f9 Author: Adam Kropelin Date: Wed Apr 11 11:13:13 2007 +0200 HID: Do not discard truncated input reports HID: Do not discard truncated input reports Truncated reports should not be discarded since it prevents buggy devices from communicating with userspace. Prior to the regession introduced in 2.6.20, a shorter-than-expected report in hid_input_report() was passed thru after having the missing bytes cleared. This behavior was established over a few patches in the 2.6.early-teens days, including commit cd6104572bca9e4afe0dcdb8ecd65ef90b01297b. This patch restores the previous behavior and fixes the regression. Signed-off-by: Adam Kropelin Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 6beeeb80630839e09763ee7102fb82e48cdb4e3e Author: Andreas Oberritter Date: Sun Apr 8 10:56:40 2007 -0400 DVB: pluto2: fix incorrect TSCR register setting DVB: pluto2: fix incorrect TSCR register setting The ADEF bits in the TSCR register have different meanings in read and write mode. For this reason ADEF has to be reset on every read-modify-write operation. This patch introduces a special write function for this register, which takes care of it. Thanks to Holger Magnussen for pointing my nose at this problem. (cherry picked from commit 1489f90a49f0603a393e1800d729050f6e332bec) Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit e298396771fd1d4f459fd8ae35c3795160b79652 Author: Andreas Oberritter Date: Sun Apr 8 10:54:27 2007 -0400 DVB: tda10086: fix DiSEqC message length DVB: tda10086: fix DiSEqC message length Setting the message length to zero means to send one byte, so you need a subtraction instead of an addition. (cherry picked from commit d420cb44693b8370cbf06c3e31b4b5dec66c9f86) Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit a4f00f5044f5c722eb6d73e1785b2c31d349c204 Author: Stephen Hemminger Date: Sat Apr 7 16:42:09 2007 -0700 sky2: phy workarounds for Yukon EC-U A1 The workaround Yukon EC-U wasn't comparing with correct version and wasn't doing correct setup. Without it, 88e8056 throws all sorts of errors. Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman commit 22fb81eeb181ca53989b94fc480ac1ab1f61fe5d Author: Stephen Hemminger Date: Sat Apr 7 16:42:08 2007 -0700 sky2: turn on clocks when doing resume Some of these chips are disabled until clock is enabled. This fixes: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404107 Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman commit 6f13df7937b163572c588fb4486df27d6de02f5f Author: Stephen Hemminger Date: Sat Apr 7 16:42:07 2007 -0700 sky2: turn carrier off when down Driver needs to turn off carrier when down. Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman commit 734479b0c0eb6e472e2041664ed0ae129c58f676 Author: Stephen Hemminger Date: Sat Apr 7 16:42:06 2007 -0700 skge: turn carrier off when down Driver needs to turn off carrier when down, otherwise it can confuse bonding and bridging and looks like carrier is on immediately when it is brought back up. Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman commit 0fb7a0aa32466404d7b31488df9ad0fcbe738b3c Author: Stephen Hemminger Date: Wed Apr 4 11:10:43 2007 -0700 sky2: reliable recovery This adds working recovery from transmit timeouts. Previous code didn't do enough to truly reset chip. It is a backport of the 2.6.21 code. Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman commit a63b596ec4b04fdf46bdc2d9c7410924ed4d9724 Author: Thomas Gleixner Date: Mon Apr 2 14:25:31 2007 +0200 i386: fix file_read_actor() and pipe_read() for original i386 systems The __copy_to_user_inatomic() calls in file_read_actor() and pipe_read() are broken on original i386 machines, where WP-works-ok == false, as __copy_to_user_inatomic() on such systems calls functions which might sleep and/or contain cond_resched() calls inside of a kmap_atomic() region. The original check for WP-works-ok was in access_ok(), but got moved during the 2.5 series to fix a race vs. swap. Return the number of bytes to copy in the case where we are in an atomic region, so the non atomic code pathes in file_read_actor() and pipe_read() are taken. This could be optimized to avoid the kmap_atomic by moving the check for WP-works-ok into fault_in_pages_writeable(), but this is more intrusive and can be done later. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 3dedd29b0ef5c7a36ac835ac5524a6a8e22c22ab Author: Jan Beulich Date: Sun Apr 1 20:41:26 2007 +0200 kbuild: fix dependency generation Commit 2e3646e51b2d6415549b310655df63e7e0d7a080 changed the way the split config tree is built, but failed to also adjust fixdep accordingly - if changing a config option from or to m, files referencing the respective CONFIG_..._MODULE (but not the corresponding CONFIG_...) didn't get rebuilt. The problem is that trisate symbol are represent with three different symbols: SYMBOL=n => no symbol defined SYMBOL=y => CONFIG_SYMBOL defined to '1' SYMBOL=m => CONFIG_SYMBOL_MODULE defined to '1' But conf_split_config do not distingush between the =y and =m case, so only the =y case is honoured. This is fixed in fixdep so when a CONFIG symbol with _MODULE is found we skip that part and only look for the CONFIG_SYMBOL version. Signed-off-by: Jan Beulich Signed-off-by: Sam Ravnborg Signed-off-by: Greg Kroah-Hartman