commit 96dc683b1e342144af1fbd2187f0ab04dad497c2 Author: Greg Kroah-Hartman Date: Wed Aug 20 11:16:13 2008 -0700 Linux 2.6.25.16 commit 1e5cb08fae0a8ef8729e2f413969d9f7d38cf422 Author: Andrew Vasquez Date: Thu Aug 14 09:39:35 2008 -0700 qla2xxx: Set an rport's dev_loss_tmo value in a consistent manner. [ Upstream commit 85821c906cf3563a00a3d98fa380a2581a7a5ff1 ] As there's no point in adding a fixed-fudge value (originally 5 seconds), honor the user settings only. We also remove the driver's dead-callback get_rport_dev_loss_tmo function (qla2x00_get_rport_loss_tmo()). Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 47668fc2803db3524b852c91dfb7e2cce410fa5d Author: Seokmann Ju Date: Thu Aug 14 09:37:34 2008 -0700 qla2xxx: Add dev_loss_tmo_callbk/terminate_rport_io callback support. [ Upstream commit 5f3a9a207f1fccde476dd31b4c63ead2967d934f ] Signed-off-by: Seokmann Ju Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 7f455504768b59700186ca291aa6a7b68a787330 Author: Joerg Roedel Date: Sun Aug 17 00:25:07 2008 +0000 x86: fix setup code crashes on my old 486 box commit 7b27718bdb1b70166383dec91391df5534d449ee upstream yesterday I tried to reactivate my old 486 box and wanted to install a current Linux with latest kernel on it. But it turned out that the latest kernel does not boot because the machine crashes early in the setup code. After some debugging it turned out that the problem is the query_ist() function. If this interrupt with that function is called the machine simply locks up. It looks like a BIOS bug. Looking for a workaround for this problem I wrote the attached patch. It checks for the CPUID instruction and if it is not implemented it does not call the speedstep BIOS function. As far as I know speedstep should be available since some Pentium earliest. Alan Cox observed that it's available since the Pentium II, so cpuid levels 4 and 5 can be excluded altogether. H. Peter Anvin cleaned up the code some more: > Right in concept, but I dislike the implementation (duplication of the > CPU detect code we already have). Could you try this patch and see if > it works for you? which, with a small modification to fix a build error with it the resulting kernel boots on my machine. Signed-off-by: Joerg Roedel Signed-off-by: "H. Peter Anvin" Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 139d09bb6ec8af8de216b0e8b04304d3f5f396bf Author: Jan Beulich Date: Sun Aug 17 00:25:05 2008 +0000 x86: fix spin_is_contended() commit 7bc069c6bc4ede519a7116be1b9e149a1dbf787a upstream The masked difference is what needs to be compared against 1, rather than the difference of masked values (which can be negative). Signed-off-by: Jan Beulich Acked-by: Nick Piggin Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 8351091278bee4ee706b1c08c54193914acc7d31 Author: Jan Beulich Date: Tue Jul 22 13:04:18 2008 +0000 CIFS: Fix compiler warning on 64-bit commit 04e1e0cccade330ab3715ce59234f7e3b087e246 upstream. Signed-off-by: Steve French Cc: Eugene Teo Signed-off-by: Greg Kroah-Hartman commit 8d1fddf801ddebbc287a5567270ba866ce51a3c2 Author: Hans Verkuil Date: Tue Aug 12 10:50:29 2008 +0200 i2c: Fix NULL pointer dereference in i2c_new_probed_device Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b25b791b13aaa336b56c4f9bd417ff126363f80b Fix a NULL pointer dereference that happened when calling i2c_new_probed_device on one of the addresses for which we use byte reads instead of quick write for detection purpose (that is: 0x30-0x37 and 0x50-0x5f). Signed-off-by: Hans Verkuil Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit c119d39883ca9a7016a37fc701f7cbe7c3d03956 Author: David Howells Date: Wed Jul 9 15:06:45 2008 -0700 netfilter: nf_nat_snmp_basic: fix a range check in NAT for SNMP commit 252815b0cfe711001eff0327872209986b36d490 upstream Fix a range check in netfilter IP NAT for SNMP to always use a big enough size variable that the compiler won't moan about comparing it to ULONG_MAX/8 on a 64-bit platform. Signed-off-by: David Howells Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Cc: Eugene Teo Signed-off-by: Greg Kroah-Hartman commit 2d72ac97f97ea85db7d1d78b75f4943aedd7af61 Author: Marcus Sundberg Date: Thu Jul 10 21:28:08 2008 +0200 r8169: avoid thrashing PCI conf space above RTL_GIGA_MAC_VER_06 commit 77332894c21165404496c56763d7df6c15c4bb09 upstream The magic write to register 0x82 will often cause PCI config space on my 8168 (PCI ID 10ec:8168, revision 2. mounted in an LG P300 laptop) to be filled with ones during driver load, and thus breaking NIC operation until reboot. If it does not happen on first driver load it can easily be reproduced by unloading and loading the driver a few times. The magic write was added long ago by this commit: Author: François Romieu Date: Sat Jan 10 06:00:46 2004 -0500 [netdrvr r8169] Merge of changes done by Realtek to rtl8169_init_one(): - phy capability settings allows lower or equal capability as suggested in Realtek's changes; - I/O voodoo; - no need to s/mdio_write/RTL8169_WRITE_GMII_REG/; - s/rtl8169_hw_PHY_config/rtl8169_hw_phy_config/; - rtl8169_hw_phy_config(): ad-hoc struct "phy_magic" to limit duplication of code (yep, the u16 -> int conversions should work as expected); - variable renames and whitepace changes ignored. As the 8168 wasn't supported by that version this patch simply removes the bogus write from mac versions <= RTL_GIGA_MAC_VER_06. [The change above makes sense for the 8101/8102 too -- Ueimor] Signed-off-by: Marcus Sundberg Signed-off-by: Francois Romieu Cc: Karsten Keil Signed-off-by: Greg Kroah-Hartman commit 194819c48a49a6a748ce892fade81ef21934b892 Author: David Miller Date: Wed Aug 6 15:28:12 2008 -0700 radeon: misc corrections Commit efc491814308f89d5ef6c4fe19ae4552a67d4132 upstream radeon: misc corrections I have a new PCI-E radeon RV380 series card (PCI device ID 5b64) that hangs in my sparc64 boxes when the init scripts set the font. The problem goes away if I disable acceleration. I haven't figured out that bug yet, but along the way I found some corrections to make based upon some auditing. 1) The RB2D_DC_FLUSH_ALL value used by the kernel fb driver and the XORG video driver differ. I've made the kernel match what XORG is using. 2) In radeonfb_engine_reset() we have top-level code structure that roughly looks like: if (family is 300, 350, or V350) do this; else do that; ... if (family is NOT 300, OR family is NOT 350, OR family is NOT V350) do another thing; this last conditional makes no sense, is always true, and obviously was likely meant to be "family is NOT 300, 350, or V350". So I've made the code match the intent. Signed-off-by: David S. Miller Acked-by: Benjamin Herrenschmidt Tested-by: Benjamin Herrenschmidt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9a7b6ab850f962305ae7c5cb77c77628e734ed08 Author: Ingo Molnar Date: Tue Aug 5 16:14:11 2008 -0400 uml: PATH_MAX needs limits.h commit b6d8adf477439e7086224bc9674c6b6638780783 upstream. Include limits.h to get a definition of PATH_MAX. Signed-off-by: Ingo Molnar Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit eebf550701a6419e627596654f3a3a345a3b9bcd Author: Jeff Dike Date: Tue Aug 5 16:14:10 2008 -0400 uml: Fix boot crash commit 7c1fed03b9fa32d4323d5caa6a9c7dcdd7eba767 upstream My copying of linux/init.h didn't go far enough. The definition of __used singled out gcc minor version 3, but didn't care what the major version was. This broke when unit-at-a-time was added and gcc started throwing out initcalls. This results in an early boot crash when ptrace tries to initialize a process with an empty, uninitialized register set. Signed-off-by: Jeff Dike Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 54b3dcdfaa010e60a5657d6eea5672d930e575cc Author: Jeff Dike Date: Tue Aug 5 16:14:10 2008 -0400 uml: fix gcc ICEs and unresolved externs commit 4f81c5350b44bcc501ab6f8a089b16d064b4d2f6 upstream There are various constraints on the use of unit-at-a-time: - i386 uses no-unit-at-a-time for pre-4.0 (not 4.3) - x86_64 uses unit-at-a-time always Uli reported a crash on x86_64 with gcc 4.1.2 with unit-at-a-time, resulting in commit c0a18111e571138747a98af18b3a2124df56a0d1 Ingo reported a gcc internal error with gcc 4.3 with no-unit-at-a-timem, resulting in 22eecde2f9034764a3fd095eecfa3adfb8ec9a98 Benny Halevy is seeing extern inlines not resolved with gcc 4.3 with no-unit-at-a-time This patch reintroduces unit-at-a-time for gcc >= 4.0, bringing back the possibility of Uli's crash. If that happens, we'll debug it. I started seeing both the internal compiler errors and unresolved inlines on Fedora 9. This patch fixes both problems, without so far reintroducing the crash reported by Uli. Signed-off-by: Jeff Dike Cc: Benny Halevy Cc: Adrian Bunk Cc: Ingo Molnar Cc: Ulrich Drepper Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ec70bce783891791930988bbd137c74dc8b416fc Author: Jeff Dike Date: Tue Aug 5 16:14:09 2008 -0400 uml: work around broken host PTRACE_SYSEMU commit f1ef9167ca4494a8c6d71d0031c73e9c8841eadd upstream Fedora broke PTRACE_SYSEMU again, and UML crashes as a result when it doesn't need to. This patch makes the PTRACE_SYSEMU check fail gracefully and makes UML fall back to PTRACE_SYSCALL. Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 38f6a47d3889def2a4d87e4f8b636fa7cf14cac4 Author: Jeff Dike Date: Tue Aug 5 16:14:09 2008 -0400 uml: stub needs to tolerate SIGWINCH commit 3d5ede6f776bdb1483bcd086f79c3bf41fed3865 upstream We lost the marking of SIGWINCH as being OK to receive during stub execution, causing a panic should that happen. Cc: Benedict Verheyen Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 4b09fd1b359a42f910881feca140ae0bf3efb28e Author: Jeff Dike Date: Tue Aug 5 16:14:09 2008 -0400 uml: memcpy export needs to follow host declaration commit 8bfd04b974689f700bbd053ad6e66b0a95fb80c9 upstream x86_64 defines either memcpy or __memcpy depending on the gcc version, and it looks like UML needs to follow that in its exporting. Cc: Gabriel C Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2babd2d9bbac17d4407d0592a2eee7db18278f00 Author: Al Viro Date: Tue Aug 5 16:14:07 2008 -0400 uml: missing export of csum_partial() on uml/amd64 commit 3e3b48e5198544dd90e27265a70c1a834139e025 upstream Signed-off-by: Al Viro Cc: Jeff Dike Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d448dc1547ff53d06386582bb9db155aec2b10a7 Author: Tom Spink Date: Tue Aug 5 16:14:06 2008 -0400 uml: deal with inaccessible address space start commit 40fb16a360d9c6459afee91dc793c1e3374feb94 upstream This patch makes os_get_task_size locate the bottom of the address space, as well as the top. This is for systems which put a lower limit on mmap addresses. It works by manually scanning pages from zero onwards until a valid page is found. Because the bottom of the address space may not be zero, it's not sufficient to assume the top of the address space is the size of the address space. The size is the difference between the top address and bottom address. [jdike@addtoit.com: changed the name to reflect that this function is supposed to return the top of the process address space, not its size and changed the return value to reflect that. Also some minor formatting changes] Signed-off-by: Tom Spink Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bbdf9b9a28729ed1dd211368f76baef051aaecae Author: Jeff Dike Date: Tue Aug 5 16:14:06 2008 -0400 uml: deal with host time going backwards commit 06e1e4ffbd1932e288839b3140cda6b8141eb684 upstream Protection against the host's time going backwards (eg, ntp activity on the host) by keeping track of the time at the last tick and if it's greater than the current time, keep time stopped until the host catches up. Cc: Nix Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2fd42a3cc07e8facd413e9bcf12de69a525736ab Author: Al Viro Date: Tue Aug 5 16:14:05 2008 -0400 uml: missed kmalloc() in pcap_user.c commit 296cd66f7f6e130fe08e6880ecb13c3fc615a8db upstream Signed-off-by: Al Viro Acked-by: Jeff Dike Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e3ac3cda49d4ee77dee42270d02d3996bace3744 Author: Jeff Dike Date: Tue Aug 5 16:14:05 2008 -0400 uml: track and make up lost ticks commit fe2cc53ee013a4d4d0317d418e7019fe6533a5a8 upstream Alarm delivery could be noticably late in the !CONFIG_NOHZ case because lost ticks weren't being taken into account. This is now treated more carefully, with the time between ticks being calculated and the appropriate number of ticks delivered to the timekeeping system. Cc: Nix Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 0273b8ecffb49750e676a49b32c11fc01f11b413 Author: Jeff Dike Date: Tue Aug 5 16:14:04 2008 -0400 uml: physical memory shouldn't include initial stack commit 60a2988aea701a6424809a5432bf068667aac177 upstream The top of physical memory should be below the initial process stack, not the top of the address space, at least for as long as the stack isn't known to the kernel VM system and appropriately reserved. Cc: "Christopher S. Aker" Signed-off-by: Jeff Dike Cc: WANG Cong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a2f5f89c579c5c7df9860c9ae328d6c8405f57c1 Author: Jeff Dike Date: Tue Aug 5 16:14:03 2008 -0400 uml: fix bad NTP interaction with clock commit cfd28f6695d0fc047478480791a21bdd4967f98e upstream UML's supposed nanosecond clock interacts badly with NTP when NTP decides that the clock has drifted ahead and needs to be slowed down. Slowing down the clock is done by decrementing the cycle-to-nanosecond multiplier, which is 1. Decrementing that gives you 0 and time is stopped. This is fixed by switching to a microsecond clock, with a multiplier of 1000. Signed-off-by: Jeff Dike Cc: WANG Cong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c538f403b2d48ce41cfab3d087f6bebeaf9284ab Author: Jeff Dike Date: Tue Aug 5 16:14:03 2008 -0400 uml: fix build when SLOB is enabled commit 43f5b3085fdd27c4edf535d938b2cb0ccead4f75 upstream Reintroduce uml_kmalloc for the benefit of UML libc code. The previous tactic of declaring __kmalloc so it could be called directly from the libc side of the house turned out to be getting too intimate with slab, and it doesn't work with slob. So, the uml_kmalloc wrapper is back. It calls kmalloc or whatever that translates into, and libc code calls it. kfree is left alone since that still works, leaving a somewhat inconsistent API. Signed-off-by: Jeff Dike Cc: WANG Cong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit fb9a5db0a2b7f04fe24dfa257526e6191a21372a Author: David S. Miller Date: Thu Jul 31 20:40:46 2008 -0700 sparc64: Do not clobber %g7 in setcontext() trap. [ Upstream commit 0a4949c4414af2eb91414bcd8e2a8ac3706f7dde ] That's the userland thread register, so we should never try to change it like this. Based upon glibc bug nptl/6577 and suggestions by Jakub Jelinek. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7fc2e4bf52ac57fc1fcdbeb6464fd137020f2292 Author: Mikael Pettersson Date: Wed Jul 30 15:40:50 2008 -0700 sparc64: FUTEX_OP_ANDN fix [ Upstream commit d72609e17fd93bb2f7e0f7e1bdc70b6d20e43843 ] Correct sparc64's implementation of FUTEX_OP_ANDN to do a bitwise negate of the oparg parameter before applying the AND operation. All other archs that support FUTEX_OP_ANDN either negate oparg explicitly (frv, ia64, mips, sh, x86), or do so indirectly by using an and-not instruction (powerpc). Since sparc64 has and-not, I chose to use that solution. I've not found any use of FUTEX_OP_ANDN in glibc so the impact of this bug is probably minor. But other user-space components may try to use it so it should still get fixed. Signed-off-by: Mikael Pettersson Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a250ca45baa1f3f36233727132d4d7728d5a0a63 Author: Wei Yongjun Date: Thu Jul 31 20:46:47 2008 -0700 ipv6: Fix ip6_xmit to send fragments if ipfragok is true [ Upstream commit 77e2f14f71d68d05945f1d30ca55b5194d6ab1ce ] SCTP used ip6_xmit() to send fragments after received ICMP packet too big message. But while send packet used ip6_xmit, the skb->local_df is not initialized. So when skb if enter ip6_fragment(), the following code will discard the skb. ip6_fragment(...) { if (!skb->local_df) { ... return -EMSGSIZE; } ... } SCTP do the following step: 1. send packet ip6_xmit(skb, ipfragok=0) 2. received ICMP packet too big message 3. if PMTUD_ENABLE: ip6_xmit(skb, ipfragok=1) This patch fixed the problem by set local_df if ipfragok is true. Signed-off-by: Wei Yongjun Acked-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 1452004a74824f0e863c249a6a2dd00240956c96 Author: Stephen Hemminger Date: Wed Jul 30 16:29:19 2008 -0700 random32: seeding improvement [ Upstream commit 697f8d0348a652593d195a13dd1067d9df911a82 ] The rationale is: * use u32 consistently * no need to do LCG on values from (better) get_random_bytes * use more data from get_random_bytes for secondary seeding * don't reduce state space on srandom32() * enforce state variable initialization restrictions Note: the second paper has a version of random32() with even longer period and a version of random64() if needed. Signed-off-by: Stephen Hemminger Signed-off-by: Andrew Morton Cc: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ab332c1c4bcdd94cb1d2eb6778e38b4b640f918a Author: Arnaldo Carvalho de Melo Date: Wed Aug 13 13:48:39 2008 -0700 dccp: change L/R must have at least one byte in the dccpsf_val field commit 3e8a0a559c66ee9e7468195691a56fefc3589740 upstream Thanks to Eugene Teo for reporting this problem. Signed-off-by: Eugene Teo Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Gerrit Renker Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit fec02fcbfad86016a1e458cce9d40a0383fb3966 Author: Carlos Corbacho Date: Fri Aug 15 16:30:03 2008 +0000 acer-wmi: Fix wireless and bluetooth on early AMW0 v2 laptops commit 5c742b45dd5fbbb6cf74d3378341704f4b23c5e8 upstream In the old acer_acpi, I discovered that on some of the newer AMW0 laptops that supported the WMID methods, they don't work properly for setting the wireless and bluetooth values. So for the AMW0 V2 laptops, we want to use both the 'old' AMW0 and the 'new' WMID methods for setting wireless & bluetooth to guarantee we always enable it. This was fixed in acer_acpi some time ago, but I forgot to port the patch over to acer-wmi when it was merged. (Without this patch, early AMW0 V2 laptops such as the Aspire 5040 won't work with acer-wmi, where-as they did with the old acer_acpi). AK: fix compilation Signed-off-by: Carlos Corbacho Signed-off-by: Andi Kleen Signed-off-by: Greg Kroah-Hartman commit e15002a6d8c577560d003d50d8e8c1faeafd2e8e Author: Steve French Date: Fri Aug 15 19:05:06 2008 +0000 CIFS: if get root inode fails during mount, cleanup tree connection commit 2c731afb0d4ba16018b400c75665fbdb8feb2175 upstream Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 0695f8439d0379017605eb86473deb9ba489832a Author: Steve French Date: Fri Aug 15 19:05:03 2008 +0000 CIFS: mount of IPC$ breaks with iget patch commit ad661334b8ae421154b121ee6ad3b56807adbf11 upstream In looking at network named pipe support on cifs, I noticed that Dave Howell's iget patch: iget: stop CIFS from using iget() and read_inode() broke mounts to IPC$ (the interprocess communication share), and don't handle the error case (when getting info on the root inode fails). Thanks to Gunter who noted a typo in a debug line in the original version of this patch. CC: David Howells CC: Gunter Kukkukk Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit bf3e04758501587d7ff4366fd3fab75e7d9e85b8 Author: Petr Tesarik Date: Wed Aug 6 00:05:07 2008 +0000 ide-cd: fix endianity for the error message in cdrom_read_capacity commit 938bb03d188a1e688fb0bcae49788f540193e80a uptream Aesthetic regards aside, commit e8e7b9eb11c34ee18bde8b7011af41938d1ad667 still leaves a bug in the error message, because it uses the unconverted big-endian value for printk. Fix this by using a local variable in machine byte order. The result is correct, more readable, and also produces slightly shorter code on i386. Signed-off-by: Petr Tesarik Cc: Jens Axboe Cc: Jan Kara Cc: Andrew Morton Cc: Acked-by: Borislav Petkov [bart: __u32 -> u32] Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman commit 1cc2f16f28ccfc4c0b477e3b0de7b89817876938 Author: Sven Wegener Date: Thu Aug 14 03:55:22 2008 +0000 ipvs: Fix possible deadlock in estimator code commit 8ab19ea36c5c5340ff598e4d15fc084eb65671dc upstream There is a slight chance for a deadlock in the estimator code. We can't call del_timer_sync() while holding our lock, as the timer might be active and spinning for the lock on another cpu. Work around this issue by using try_to_del_timer_sync() and releasing the lock. We could actually delete the timer outside of our lock, as the add and kill functions are only every called from userspace via [gs]etsockopt() and are serialized by a mutex, but better make this explicit. Signed-off-by: Sven Wegener Acked-by: Simon Horman Signed-off-by: Greg Kroah-Hartman commit b50504f77c63d836cd2ed62d3e675353970b4d58 Author: Jean Delvare Date: Tue Aug 12 23:20:04 2008 +0000 matrox maven: fix a broken error path commit 5ede40f87957c6ededf9284c8339722a97b9dfb6 upstream I broke an error path with d03c21ec0be7787ff6b75dcf56c0e96209ccbfbd, sorry about that. The machine will crash if the i2c_attach_client() or maven_init_client() calls fail, although nobody has yet reported this happening. Signed-off-by: Jean Delvare Acked-by: Krzysztof Helt Cc: Petr Vandrovec Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a81a91f03af0cb89a8a5144d2bb2dc670000aef8 Author: KOSAKI Motohiro Date: Tue Aug 5 00:20:05 2008 +0000 mlock() fix return values commit a477097d9c37c1cf289c7f0257dffcfa42d50197 upstream Halesh says: Please find the below testcase provide to test mlock. Test Case : =========================== #include #include #include #include #include #include #include #include #include int main(void) { int fd,ret, i = 0; char *addr, *addr1 = NULL; unsigned int page_size; struct rlimit rlim; if (0 != geteuid()) { printf("Execute this pgm as root\n"); exit(1); } /* create a file */ if ((fd = open("mmap_test.c",O_RDWR|O_CREAT,0755)) == -1) { printf("cant create test file\n"); exit(1); } page_size = sysconf(_SC_PAGE_SIZE); /* set the MEMLOCK limit */ rlim.rlim_cur = 2000; rlim.rlim_max = 2000; if ((ret = setrlimit(RLIMIT_MEMLOCK,&rlim)) != 0) { printf("Cant change limit values\n"); exit(1); } addr = 0; while (1) { /* map a page into memory each time*/ if ((addr = (char *) mmap(addr,page_size, PROT_READ | PROT_WRITE,MAP_SHARED,fd,0)) == MAP_FAILED) { printf("cant do mmap on file\n"); exit(1); } if (0 == i) addr1 = addr; i++; errno = 0; /* lock the mapped memory pagewise*/ if ((ret = mlock((char *)addr, 1500)) == -1) { printf("errno value is %d\n", errno); printf("cant lock maped region\n"); exit(1); } addr = addr + page_size; } } ====================================================== This testcase results in an mlock() failure with errno 14 that is EFAULT, but it has nowhere been specified that mlock() will return EFAULT. When I tested the same on older kernels like 2.6.18, I got the correct result i.e errno 12 (ENOMEM). I think in source code mlock(2), setting errno ENOMEM has been missed in do_mlock() , on mlock_fixup() failure. SUSv3 requires the following behavior frmo mlock(2). [ENOMEM] Some or all of the address range specified by the addr and len arguments does not correspond to valid mapped pages in the address space of the process. [EAGAIN] Some or all of the memory identified by the operation could not be locked when the call was made. This rule isn't so nice and slighly strange. but many people think POSIX/SUS compliance is important. Reported-by: Halesh Sadashiv Tested-by: Halesh Sadashiv Signed-off-by: KOSAKI Motohiro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 91e647388fa35ec69e3b3f1b84b2b3f4f4bb15c1 Author: Oleg Nesterov Date: Tue Aug 12 15:30:09 2008 +0000 posix-timers: do_schedule_next_timer: fix the setting of ->si_overrun commit 54da1174922cddd4be83d5a364b2e0fdd693f513 upstream do_schedule_next_timer() sets info->si_overrun = timr->it_overrun_last, this discards the already accumulated overruns. Signed-off-by: Oleg Nesterov Cc: Mark McLoughlin Cc: Oliver Pinter Cc: Roland McGrath Cc: Andrew Morton Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 1a78633026ad482dd9d79ad85436a33ddc3050ed Author: Oleg Nesterov Date: Tue Aug 12 15:30:06 2008 +0000 posix-timers: fix posix_timer_event() vs dequeue_signal() race commit ba661292a2bc6ddd305a212b0526e5dc22195fe7 upstream The bug was reported and analysed by Mark McLoughlin , the patch is based on his and Roland's suggestions. posix_timer_event() always rewrites the pre-allocated siginfo before sending the signal. Most of the written info is the same all the time, but memset(0) is very wrong. If ->sigq is queued we can race with collect_signal() which can fail to find this siginfo looking at .si_signo, or copy_siginfo() can copy the wrong .si_code/si_tid/etc. In short, sys_timer_settime() can in fact stop the active timer, or the user can receive the siginfo with the wrong .si_xxx values. Move "memset(->info, 0)" from posix_timer_event() to alloc_posix_timer(), change send_sigqueue() to set .si_overrun = 0 when ->sigq is not queued. It would be nice to move the whole sigq->info initialization from send to create path, but this is not easy to do without uglifying timer_create() further. As Roland rightly pointed out, we need more cleanups/fixes here, see the "FIXME" comment in the patch. Hopefully this patch makes sense anyway, and it can mask the most bad implications. Reported-by: Mark McLoughlin Signed-off-by: Oleg Nesterov Cc: Mark McLoughlin Cc: Oliver Pinter Cc: Roland McGrath Cc: Andrew Morton Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 9658dda9809bbb685e7b3f425559742ce6d25aae Author: David Miller Date: Tue Aug 12 23:20:06 2008 +0000 radeonfb: fix accel engine hangs commit 969830b2fedf8336c41d6195f49d250b1e166ff8 upstream Some chips appear to have the 2D engine hang during screen redraw, typically in a sequence of copyarea operations. This appear to be solved by adding a flush of the engine destination pixel cache and waiting for the engine to be idle before issuing the accel operation. The performance impact seems to be fairly small. Here is a trace on an RV370 (PCI device ID 0x5b64), it records the RBBM_STATUS register, then the source x/y, destination x/y, and width/height used for the copy: ---------------------------------------- radeonfb_prim_copyarea: STATUS[00000140] src[210:70] dst[210:60] wh[a0:10] radeonfb_prim_copyarea: STATUS[00000140] src[2b8:70] dst[2b8:60] wh[88:10] radeonfb_prim_copyarea: STATUS[00000140] src[348:70] dst[348:60] wh[40:10] radeonfb_prim_copyarea: STATUS[80020140] src[390:70] dst[390:60] wh[88:10] radeonfb_prim_copyarea: STATUS[8002613f] src[40:80] dst[40:70] wh[28:10] radeonfb_prim_copyarea: STATUS[80026139] src[a8:80] dst[a8:70] wh[38:10] radeonfb_prim_copyarea: STATUS[80026133] src[e8:80] dst[e8:70] wh[80:10] radeonfb_prim_copyarea: STATUS[8002612d] src[170:80] dst[170:70] wh[30:10] radeonfb_prim_copyarea: STATUS[80026127] src[1a8:80] dst[1a8:70] wh[8:10] radeonfb_prim_copyarea: STATUS[80026121] src[1b8:80] dst[1b8:70] wh[88:10] radeonfb_prim_copyarea: STATUS[8002611b] src[248:80] dst[248:70] wh[68:10] ---------------------------------------- When things are going fine the copies complete before the next ROP is even issued, but all of a sudden the 2D unit becomes active (bit 17 in RBBM_STATUS) and the FIFO retry (bit 13) and FIFO pipeline busy (bit 14) are set as well. The FIFO begins to backup until it becomes full. What happens next is the radeon_fifo_wait() times out, and we access the chip illegally leading to a bus error which usually wedges the box. None of this makes it to the console screen, of course :-) radeon_fifo_wait() should be modified to reset the accelerator when this timeout happens instead of programming the chip anyways. ---------------------------------------- radeonfb: FIFO Timeout ! ERROR(0): Cheetah error trap taken afsr[0010080005000000] afar[000007f900800e40] TL1(0) ERROR(0): TPC[595114] TNPC[595118] O7[459788] TSTATE[11009601] ERROR(0): TPC ERROR(0): M_SYND(0), E_SYND(0), Privileged ERROR(0): Highest priority error (0000080000000000) "Bus error response from system bus" ERROR(0): D-cache idx[0] tag[0000000000000000] utag[0000000000000000] stag[0000000000000000] ERROR(0): D-cache data0[0000000000000000] data1[0000000000000000] data2[0000000000000000] data3[0000000000000000] ERROR(0): I-cache idx[0] tag[0000000000000000] utag[0000000000000000] stag[0000000000000000] u[0000000000000000] l[00\ ERROR(0): I-cache INSN0[0000000000000000] INSN1[0000000000000000] INSN2[0000000000000000] INSN3[0000000000000000] ERROR(0): I-cache INSN4[0000000000000000] INSN5[0000000000000000] INSN6[0000000000000000] INSN7[0000000000000000] ERROR(0): E-cache idx[800e40] tag[000000000e049f4c] ERROR(0): E-cache data0[fffff8127d300180] data1[00000000004b5384] data2[0000000000000000] data3[0000000000000000] Ker:xnel panic - not syncing: Irrecoverable deferred error trap. ---------------------------------------- Another quirk is that these copyarea calls will not happen until the first drivers/char/vt.c:redraw_screen() occurs. This will only happen if you 1) VC switch or 2) run "consolechars" or 3) unblank the screen. This seems to happen because until a redraw_screen() the screen scrolling method used by fbcon is not finalized yet. I've seen this with other fb drivers too. So if all you do is boot straight into X you will never see this bug on the relevant chips. Signed-off-by: David S. Miller Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 435d30c6e982de6c1c4ec5727445657cdb3009ef Author: Tom Zanussi Date: Wed Aug 6 00:05:03 2008 +0000 relay: fix "full buffer with exactly full last subbuffer" accounting problem commit 32194450330be327f3b25bf6b66298bd122599e9 upstream In relay's current read implementation, if the buffer is completely full but hasn't triggered the buffer-full condition (i.e. the last write didn't cross the subbuffer boundary) and the last subbuffer is exactly full, the subbuffer accounting code erroneously finds nothing available. This patch fixes the problem. Signed-off-by: Tom Zanussi Cc: Eduard - Gabriel Munteanu Cc: Pekka Enberg Cc: Jens Axboe Cc: Mathieu Desnoyers Cc: Andrea Righi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit cf6d7d728ac241a86939d1dcb89ad62ce9d8ce5d Author: Tim Wright Date: Tue Aug 5 00:30:07 2008 +0000 SCSI: block: Fix miscalculation of sg_io timeout in CDROM_SEND_PACKET handler. commit ad337591f4fd20de6a0ca03d6715267a5c1d2b16 upstream It seems cdrwtool in the udftools has been unusable on "modern" kernels for some time. A Google search reveals many people with the same issue but no solution (cdrwtool fails to format the disk). After spending some time tracking down the issue, it comes down to the following: The udftools still use the older CDROM_SEND_PACKET interface to send things like FORMAT_UNIT through to the drive. They should really be updated, but that's another story. Since most distros are using libata now, the cd or dvd burner appears as a SCSI device, and we wind up in block/scsi_ioctl.c. Here, the code tries to take the "struct cdrom_generic_command" and translate it and stuff it into a "struct sg_io_hdr" structure so it can pass it to the modern sg_io() routine instead. Unfortunately, there is one error, or rather an omission in the translation. The timeout that is passed in in the "struct cdrom_generic_command" is in HZ=100 units, and this is modified and correctly converted to jiffies by use of clock_t_to_jiffies(). However, a little further down, this cgc.timeout value in jiffies is simply copied into the sg_io_hdr timeout, which should be in milliseconds. Since most modern x86 kernels seems to be getting build with HZ=250, the timeout that is passed to sg_io and eventually converted to the timeout_per_command member of the scsi_cmnd structure is now four times too small. Since cdrwtool tries to set the timeout to one hour for the FORMAT_UNIT command, and it takes about 20 minutes to format a 4x CDRW, the SCSI error-handler kicks in after the FORMAT_UNIT completes because it took longer than the incorrectly-calculated timeout. [jejb: fix up whitespace] Signed-off-by: Tim Wright Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 489943bc2d9abbd6080c55abca297ca628ac49ad Author: HighPoint Linux Team Date: Tue Aug 5 00:30:10 2008 +0000 SCSI: hptiop: add more PCI device IDs commit dd07428b44944b42f699408fe31af47977f1e733 upstream Add PCI device ID for new adapter models. Signed-off-by: HighPoint Linux Team Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 92aac7e259360f1cfaeb7700d9e2de27f824e78a Author: James Bottomley Date: Tue Aug 5 00:30:02 2008 +0000 SCSI: scsi_transport_spi: fix oops in revalidate commit e8bac9e0647dd04c83fd0bfe7cdfe2f6dfb100d0 upstream The class_device->device conversion is causing an oops in revalidate because it's assuming that the device_for_each_child iterator will only return struct scsi_device children. The conversion made all former class_devices children of the device as well, so this assumption is broken. Fix it. Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit a2c7bbce938caa71cd5c15db138974f1c88f1bd7 Author: James Bottomley Date: Tue Aug 5 00:30:05 2008 +0000 SCSI: ses: fix VPD inquiry overrun commit 671a99c8eb2f1dde08ac5538d8cd912047c61ddf upstream There are a few kerneloops.org reports like this one: http://www.kerneloops.org/search.php?search=ses_match_to_enclosure That seem to imply we're running off the end of the VPD inquiry data (although at 512 bytes, it should be long enough for just about anything). we should be using correctly sized buffers anyway, so put those in and hope this oops goes away. Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 7cc646ee8cbc597dd5f531d784965c4d8225155e Author: Frederik Kriewitz Date: Thu Aug 14 03:55:16 2008 +0000 USB: ftdi_sio: add support for Luminance Stellaris Evaluation/Development Kits commit a00c3cadc2bf50b3c925acdb3d0e5789b1650498 upstream The Patch adds support for Luminance Stellaris Evaluation/Development Kits (FTDI 2232C based). The PIDs were missing. Successfully tested with a Stellaris LM3S8962 Evaluation kit. Signed-off-by: Frederik Kriewitz Signed-off-by: Greg Kroah-Hartman commit 18d9aec1a26f7bd8c3eab8ee85551ccc9a9301aa Author: Andre Schenk Date: Thu Aug 14 03:55:19 2008 +0000 USB: ftdi_sio: Add USB Product Id for ELV HS485 commit b5894a500127fce1db1309db5f9ca8b77a2ac266 upstream USB product id registration for the ELV HS485 USB adapter (www.elv.de) to their home automation bus system. Applies to 2.6.26. Signed-off-by: Andre Schenk Signed-off-by: Greg Kroah-Hartman commit c09742e315b1394a7c48a8bac63427179c78af5c Author: Tollef Fog Heen Date: Thu Aug 14 03:55:05 2008 +0000 USB: pl2023: Remove USB id (4348:5523) handled by ch341 commit 8c809681ba0289afd0ed7bbb63679a0568dd441d upstream USB ID 4348:5523 is handled by the ch341 driver. Remove it from the pl2023 driver. Reverts 002e8f2c80c6be76bb312940bc278fc10b2b2487. Signed-off-by: Tollef Fog Heen Signed-off-by: Greg Kroah-Hartman commit 1a3f36d7e251ed2f3df2fa89fc220ad2ce68d9ad Author: Alan Stern Date: Thu Aug 14 03:55:11 2008 +0000 usb-serial: don't release unregistered minors commit 0282b7f2a874e72c18fcd5a112ccf67f71ba7f5c upstream This patch (as1121) fixes a bug in the USB serial core. When a device is unregistered, the core will give back its minors -- even if the device hasn't been assigned any! The patch reserves the highest minor value (255) to mean that no minor was assigned. It also removes some dead code and does a small style fixup. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit ae14e7c32b2bb1b4d37fd7f079769ad7715dfc5f Author: Alan Stern Date: Thu Aug 14 03:55:07 2008 +0000 usb-storage: unusual_devs entries for iRiver T10 and Datafab CF+SM reader commit 368ee6469c327364ea10082a348f91c1f5ba47f7 upstream This patch (as1115) adds unusual_devs entries with the IGNORE_RESIDE flag for the iRiver T10 and the Simple Tech/Datafab CF+SM card reader. Apparently these devices provide reasonable residue values for READ and WRITE operations, but not for others like INQUIRY or READ CAPACITY. This fixes the iRiver T10 problem reported in Bugzilla #11125. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit a6a83ff687d164d1a7b37036d157dc4f3a0707c5 Author: Dave Jones Date: Thu Aug 14 03:55:14 2008 +0000 USB: usb-storage: quirk around v1.11 firmware on Nikon D4 commit b9a097f26e55968cbc52e30a4a2e73d32d7604ce upstream usb-storage: quirk around v1.11 firmware on Nikon D40 https://bugzilla.redhat.com/show_bug.cgi?id=454028 Just as in earlier firmware versions, we need to perform this quirk for the latest version too. Speculatively do the entry for the D80 too, as they seem to have the same firmware problems historically. Signed-off-by: Dave Jones Cc: Johannes Berg Cc: Alan Stern Signed-off-by: Greg Kroah-Hartman