commit 7e35c8503968979d55c71de29445c66eeb024284 Author: Greg Kroah-Hartman Date: Thu Nov 20 15:02:37 2008 -0800 Linux 2.6.27.7 commit 913d910d70e641d2c753d45d98587640219a78bc Author: Alexey Starikovskiy Date: Tue Nov 11 12:54:11 2008 +0300 ACPI: EC: Don't do transaction from GPE handler in poll mode. commit 8517934ef6aaa28d6e055b98df65b31cedbd1372 upstream. Referencies: http://bugzilla.kernel.org/show_bug.cgi?id=12004 Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit d09277432f84ae0c8588032518e1ff7842ef5606 Author: Alexey Starikovskiy Date: Sun Nov 9 19:01:06 2008 +0300 ACPI: EC: lower interrupt storm treshold commit 06cf7d3c7af902939cd1754abcafb2464060cba8 upstream. http://bugzilla.kernel.org/show_bug.cgi?id=11892 Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit d8f87ea71ed9fb0a1d576758e7c732b0fce6b27f Author: Alexey Starikovskiy Date: Wed Nov 12 01:40:19 2008 +0300 ACPI: EC: restart failed command commit a2f93aeadf97e870ff385030633a73e21146815d upstream. Restart current transaction if we recieved unexpected GPEs instead of needed ones. http://bugzilla.kernel.org/show_bug.cgi?id=11896 Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 177fab4bee97e0fac5b96c5f7cc9de40d1a8759f Author: Alexey Starikovskiy Date: Sat Nov 8 21:42:30 2008 +0300 ACPI: EC: wait for last write gpe commit dd15f8c42af09031e27da5b4d697ce925511f2e1 upstream. There is a possibility that EC might break if next command is issued within 1 us after write or burst-disable command. Suggestd-by: Zhao Yakui Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 4efdad4891fcfeeac62bca2aa86f0ade79c0bb1b Author: Alexey Starikovskiy Date: Tue Oct 28 00:35:30 2008 +0300 ACPI: EC: revert msleep patch commit 1cfe62c8010ac56e1bd3827e30386a87cc2f3594 upstream. With the better solution for EC interrupt storm issue, there is no need to use msleep over udelay. References: http://bugzilla.kernel.org/show_bug.cgi?id=11810 http://bugzilla.kernel.org/show_bug.cgi?id=10724 Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 5a4c6fe7a2fe3a81921832af856621b8f8231814 Author: Alan Stern Date: Wed Oct 29 15:16:58 2008 -0400 USB: don't register endpoints for interfaces that are going away commit 352d026338378b1f13f044e33c1047da6e470056 upstream. This patch (as1155) fixes a bug in usbcore. When interfaces are deleted, either because the device was disconnected or because of a configuration change, the extra attribute files and child endpoint devices may get left behind. This is because the core removes them before calling device_del(). But during device_del(), after the driver is unbound the core will reinstall altsetting 0 and recreate those extra attributes and children. The patch prevents this by adding a flag to record when the interface is in the midst of being unregistered. When the flag is set, the attribute files and child devices will not be created. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit efa086b9aa83975c48730c5ffe79aa8e1fe3bf3d Author: Alan Stern Date: Wed Nov 12 17:04:53 2008 -0500 USB: EHCI: fix handling of dead controllers commit 67b2e029743a52670d77864723b4d0d40f7733b5 upstream. This patch (as1165) makes a few small changes in the logic used by ehci-hcd when it encounters a controller error: Instead of printing out the masked status, it prints the original status as read directly from the hardware. It doesn't check for the STS_HALT status bit before taking action. The mere fact that the STS_FATAL bit is set means that something bad has happened and the controller needs to be reset. With the old code this test could never succeed because the STS_HALT bit was masked out from the status. I anticipate that this will prevent the occasional "irq X: nobody cared" problem people encounter when their EHCI controllers die. Signed-off-by: Alan Stern Cc: David Brownell Signed-off-by: Greg Kroah-Hartman commit b060be07052aa48ff66879c0c47d40d2bbd2c698 Author: Alan Stern Date: Wed Nov 12 17:02:57 2008 -0500 USB: EHCI: fix divide-by-zero bug commit 372dd6e8ed924e876f3beb598721e813ad7fa323 upstream. This patch (as1164) fixes a bug in the EHCI scheduler. The interval value it uses is already in linear format, not logarithmically coded. The existing code can sometimes crash the system by trying to divide by zero. Signed-off-by: Alan Stern Cc: David Brownell Signed-off-by: Greg Kroah-Hartman commit 3ab4c4da271c5628b1320d8ee2232db297c901b6 Author: Brandon Philips Date: Thu Nov 6 11:19:11 2008 -0800 USB: cdc-acm.c: fix recursive lock in acm_start_wb error path commit ad0b65efd12d020b046cde8d6f474e37bb98dd73 upstream. Fixes an obvious bug in cdc-acm by avoiding a recursive lock on acm_start_wb()'s error path. Should apply towards 2.6.27 stable and 2.6.28. ============================================= [ INFO: possible recursive locking detected ] 2.6.27-2-pae #109 --------------------------------------------- python/31449 is trying to acquire lock: (&acm->write_lock){++..}, at: [] acm_start_wb+0x5c/0x7b [cdc_acm] but task is already holding lock: (&acm->write_lock){++..}, at: [] acm_tty_write+0xe1/0x167 [cdc_acm] other info that might help us debug this: 2 locks held by python/31449: #0: (&tty->atomic_write_lock){--..}, at: [] tty_write_lock+0x14/0x3b #1: (&acm->write_lock){++..}, at: [] acm_tty_write+0xe1/0x167 [cdc_acm] stack backtrace: Pid: 31449, comm: python Not tainted 2.6.27-2-pae #109 [] ? printk+0xf/0x18 [] __lock_acquire+0xc7b/0x1316 [] lock_acquire+0x70/0x97 [] ? acm_start_wb+0x5c/0x7b [cdc_acm] [] _spin_lock_irqsave+0x37/0x47 [] ? acm_start_wb+0x5c/0x7b [cdc_acm] [] acm_start_wb+0x5c/0x7b [cdc_acm] [] acm_tty_write+0x143/0x167 [cdc_acm] [] write_chan+0x1cd/0x297 [] ? default_wake_function+0x0/0xd [] tty_write+0x149/0x1b9 [] ? write_chan+0x0/0x297 [] ? rw_verify_area+0x76/0x98 [] ? tty_write+0x0/0x1b9 [] vfs_write+0x8c/0x136 [] sys_write+0x3b/0x60 [] sysenter_do_call+0x12/0x3f ======================= Signed-off-by: Brandon Philips Cc: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 9cea94e00e67ee2e472f473e6a18659a690f32ad Author: Geoff Levand Date: Fri Oct 31 13:52:54 2008 -0700 USB: Fix PS3 USB shutdown problems commit ddcb01ff9bf49c4dbbb058423559f7bc90b89374 upstream. Add ehci_shutdown() or ohci_shutdown() calls to the USB PS3 bus glue. ehci_shutdown() and ohci_shutdown() do some controller specific cleanups not done by usb_remove_hcd(). Fixes errors on shutdown or reboot similar to these: ps3-ehci-driver sb_07: HC died; cleaning up irq 51: nobody cared (try booting with the "irqpoll" option) Related bugzilla reports: http://bugzilla.kernel.org/show_bug.cgi?id=11819 http://bugzilla.terrasoftsolutions.com/show_bug.cgi?id=317 Signed-off-by: Geoff Levand Signed-off-by: Greg Kroah-Hartman commit a42d8f3151895bdd5b7c517d2a9d4ed054c14b28 Author: Alan Stern Date: Tue Nov 4 11:33:35 2008 -0500 USB: unusual_devs entry for Argosy USB mass-storage interface commit 8010e06cc90367b4d3fba3b0ec3ced32360ac890 upstream. This patch (as1162) adds an unusual_devs entry for Argosy's USB-IDE interface. This fixes Bugzilla #11843. Signed-off-by: Alan Stern Tested-by: Luciano Rocha Signed-off-by: Greg Kroah-Hartman commit ccc737870153d1b73c99f3bcfafc6e09ea6b718b Author: David Brownell Date: Wed Nov 12 11:35:13 2008 -0800 USB: gadget: cdc-acm deadlock fix commit e50ae572b33646656fa7037541613834dcadedfb upstream. This fixes a deadlock appearing with some USB peripheral drivers when running CDC ACM gadget code. The newish (2.6.27) CDC ACM event notification mechanism sends messages (IN to the host) which are short enough to fit in most FIFOs. That means that with some peripheral controller drivers (evidently not the ones used to verify the notification code!!) the completion callback can be issued before queue() returns. The deadlock would come because the completion callback and the event-issuing code shared a spinlock. Fix is trivial: drop that lock while queueing the message. Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 2630765e027d3cd600839b8dd59e7d5691428aff Author: Sebastian Andrzej Siewior Date: Sun Nov 2 15:25:42 2008 +0100 USB: remove optional bus bindings in isp1760, fixing runtime warning commit ff30bf1ca4b548c0928dae6bfce89458b95e5bf4 upstream. Roland Reported the following: | kmem_cache_create: duplicate cache isp1760_qtd | Pid: 461, comm: modprobe Tainted: G W 2.6.28-rc2-git3-default #4 | Call Trace: | [] kmem_cache_create+0xc9/0x3a3 | [] free_pages_bulk+0x16c/0x1c9 | [] isp1760_init+0x0/0xb [isp1760] | [] init_kmem_once+0x18/0x5f [isp1760] | [] isp1760_init+0x5/0xb [isp1760] | [] _stext+0x4d/0x148 | [] load_module+0x12cd/0x142e | [] kmem_cache_destroy+0x0/0xd7 | [] sys_init_module+0x87/0x176 | [] sysenter_do_call+0x12/0x2f The reason, is that ret is initialized with ENODEV instead of 0 _or_ the kmem cache is not freed in error case with no bus binding. The difference between OF+PCI and OF only is | 15148 804 32 15984 3e70 isp1760-of-pci.o | 13748 676 8 14432 3860 isp1760-of.o about 1.5 KiB. Until there is a checkbox where the user *must* select atleast one item, and may select multiple entries I don't make it selectable anymore. Having a driver which can't be used under any circumstances is broken anyway and I've seen distros shipping it that way. Reported-by: Roland Kletzing Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Greg Kroah-Hartman commit 257379190a7c3ca37afd780548d0471ab45000bf Author: Mikulas Patocka Date: Thu Nov 13 23:38:52 2008 +0000 dm raid1: flush workqueue before destruction commit 18776c7316545482a02bfaa2629a2aa1afc48357 upstream. We queue work on keventd queue --- so this queue must be flushed in the destructor. Otherwise, keventd could access mirror_set after it was freed. Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit c9e53b238e2d99094b2158a7d85170ba7dd8eeb8 Author: Miquel van Smoorenburg Date: Wed Nov 5 00:09:12 2008 +0100 SCSI: dpt_i2o: fix transferred data length for scsi_set_resid() commit df81d2371aeca0f7474f197a3090830899016e39 upstream. dpt_i2o.c::adpt_i2o_to_scsi() reads the value at (reply+5) which should contain the length in bytes of the transferred data. This would be correct if reply was a u32 *. However it is a void * here, so we need to read the value at (reply+20) instead. The value at (reply+5) is usually 0xff0000, which is apparently 'large enough' and didn't cause any trouble until 2.6.27 where commit 427e59f09fdba387547106de7bab980b7fff77be Author: James Bottomley Date: Sat Mar 8 18:24:17 2008 -0600 [SCSI] make use of the residue value caused this to become visible through e.g. iostat -x . Signed-off-by: Miquel van Smoorenburg Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 7d02fe0c0552a85c05be8f4a834b79d22deeb3c7 Author: Lalit Chandivade Date: Fri Oct 24 15:13:44 2008 -0700 SCSI: qla2xxx: Correct Atmel flash-part handling. commit 821b3996001508e872582dcafc7575021f122728 upstream. Use correct block size (4K) for erase command 0x20 for Atmel Flash. Use dword addresses for determining sector boundary. Signed-off-by: Lalit Chandivade Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 56965a2c46d82de250c961947268a737a3ce9e61 Author: Shyam Sundar Date: Fri Oct 24 15:13:46 2008 -0700 SCSI: qla2xxx: Do not honour max_vports from firmware for 2G ISPs and below. commit 680d7db88ace53c673e1c437c9b6abcc053e8d6f upstream. For 23XX ISPs, max_vports may return an invalid value. Do not honour it. Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit ed07e187be0e13b8043a685cbe43df4adf82b856 Author: Michael Reed Date: Fri Oct 24 15:13:47 2008 -0700 SCSI: qla2xxx: Return a FAILED status when abort mailbox-command fails. commit 5bff55db3dc4d659f46b4d2fce2f61c1964c2762 upstream. Mike Reed noted (https://bugzilla.novell.com/show_bug.cgi?id=421330) that the driver was incorrectly returning a SUCCESS status if the driver's request to the firmware to abort a command failed. By doing so, the mid-layer believed, incorrectly, that the command has completed and has been returned (ultimately clearing scsi_cmnd.request_buffer) yet the driver still has the command. What should correctly happen is a mid-layer escalation (device-reset, etc.) of recovery during which the driver will eventually return the outstanding commands to the mid-layer. Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit c71aa7304abab14c23d72c468ecf039c405d418e Author: Geert Uytterhoeven Date: Fri Nov 14 08:10:19 2008 +0100 m68k: Fix off-by-one in m68k_setup_user_interrupt() commit 27123cbc264de89ce6951b1b4c84c223eb0f1702 upstream. commit 69961c375288bdab7604e0bb1c8d22999bb8a347 ("[PATCH] m68k/Atari: Interrupt updates") added a BUG_ON() with an incorrect upper bound comparison, which causes an early crash on VME boards, where IRQ_USER is 8, cnt is 192 and NR_IRQS is 200. Reported-by: Stephen N Chivers Tested-by: Kars de Jong Signed-off-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c56d539ed9fdc100e03888bf1b6b52faa3e9b521 Author: Zhao Yakui Date: Mon Aug 11 13:40:22 2008 +0800 ACPI : Load device driver according to the status of acpi device commit 39a0ad871000d2a016a4fa113a6e53d22aabf25d upstream. According to ACPI spec when the status of some device is not present but functional, the device is valid and the children of this device should be enumerated. It means that the device should be added to linux acpi device tree. But the device driver for this device should not be loaded. The detailed info can be found in the section 6.3.7 of ACPI 3.0b spec. _STA may return bit 0 clear (not present) with bit 3 set (device is functional). This case is used to indicate a valid device for which no device driver should be loaded (for example, a bridge device.). Children of this device may be present and valid. OS should continue enumeration below a device whose _STA returns this bit combination http://bugzilla.kernel.org/show_bug.cgi?id=3358 Signed-off-by: Zhao Yakui Signed-off-by: Li Shaohua Signed-off-by: Zhang Rui Signed-off-by: Andi Kleen Signed-off-by: Len Brown Cc: Holger Macht Signed-off-by: Greg Kroah-Hartman commit 65347ce15fb47f3aa58107be55ec00fa6f1eda22 Author: Heiko Carstens Date: Fri Nov 14 18:18:07 2008 +0100 S390: cpu topology: fix locking commit 74af283102b358b0da545460d0d176f473e110f6 upstream. cpu_coregroup_map used to grab a mutex on s390 since it was only called from process context. Since c7c22e4d5c1fdebfac4dba76de7d0338c2b0d832 "block: add support for IO CPU affinity" this is not true anymore. It now also gets called from softirq context. To prevent possible deadlocks change this in architecture code and use a spinlock instead of a mutex. Cc: Jens Axboe Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit d12a87b8e4b2b1a830f248d2b76a2943effbea92 Author: Mauro Carvalho Chehab Date: Fri Nov 14 10:46:59 2008 -0300 V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble commit 01a1a3cc1e3fbe718bd06a2a5d4d1a2d0fb4d7d9 upstream. This bug were supposed to be fixed by 5ba2f67afb02c5302b2898949ed6fc3b3d37dcf1, where a call to NULL happens. Not all tvaudio chips allow controlling bass/treble. So, the driver has a table with a flag to indicate if the chip does support it. Unfortunately, the handling of this logic were broken for a very long time (probably since the first module version). Due to that, an OOPS were generated for devices that don't support bass/treble. This were the resulting OOPS message before the patch, with debug messages enabled: tvaudio' 1-005b: VIDIOC_S_CTRL BUG: unable to handle kernel NULL pointer dereference at 00000000 IP: [<00000000>] *pde = 22fda067 *pte = 00000000 Oops: 0000 [#1] SMP Modules linked in: snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_hwdep snd soundcore tuner_simple tuner_types tea5767 tuner tvaudio bttv bridgebnep rfcomm l2cap bluetooth it87 hwmon_vid hwmon fuse sunrpc ipt_REJECT nf_conntrack_ipv4 iptable_filter ip_tables ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables x_tables ipv6 dm_mirrordm_multipath dm_mod configfs videodev v4l1_compat ir_common 8139cp compat_ioctl32 v4l2_common 8139too videobuf_dma_sg videobuf_core mii btcx_risc tveeprom i915 button snd_page_alloc serio_raw drm pcspkr i2c_algo_bit i2c_i801 i2c_core iTCO_wdt iTCO_vendor_support sr_mod cdrom sg ata_generic pata_acpi ata_piix libata sd_mod scsi_mod ext3 jbdmbcache uhci_hcd ohci_hcd ehci_hcd [last unloaded: soundcore] Pid: 15413, comm: qv4l2 Not tainted (2.6.25.14-108.fc9.i686 #1) EIP: 0060:[<00000000>] EFLAGS: 00210246 CPU: 0 EIP is at 0x0 EAX: 00008000 EBX: ebd21600 ECX: e2fd9ec4 EDX: 00200046 ESI: f8c0f0c4 EDI: f8c0f0c4 EBP: e2fd9d50 ESP: e2fd9d2c DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process qv4l2 (pid: 15413, ti=e2fd9000 task=ebe44000 task.ti=e2fd9000) Stack: f8c0c6ae e2ff2a00 00000d00 e2fd9ec4 ebc4e000 e2fd9d5c f8c0c448 00000000 f899c12a e2fd9d5c f899c154 e2fd9d68 e2fd9d80 c0560185 e2fd9d88 f8f3e1d8 f8f3e1dc ebc4e034 f8f3e18c e2fd9ec4 00000000 e2fd9d90 f899c286 c008561c Call Trace: [] ? chip_command+0x266/0x4b6 [tvaudio] [] ? chip_command+0x0/0x4b6 [tvaudio] [] ? i2c_cmd+0x0/0x2f [i2c_core] [] ? i2c_cmd+0x2a/0x2f [i2c_core] [] ? device_for_each_child+0x21/0x49 [] ? i2c_clients_command+0x1c/0x1e [i2c_core] [] ? bttv_call_i2c_clients+0x14/0x16 [bttv] [] ? bttv_s_ctrl+0x1bc/0x313 [bttv] [] ? bttv_s_ctrl+0x0/0x313 [bttv] [] ? __video_do_ioctl+0x1f84/0x3726 [videodev] [] ? sock_aio_write+0x100/0x10d [] ? kmap_atomic_prot+0x1dd/0x1df [] ? enqueue_hrtimer+0xc2/0xcd [] ? copy_from_user+0x39/0x121 [] ? __video_ioctl2+0x1aa/0x24a [videodev] [] ? do_notify_resume+0x768/0x795 [] ? getnstimeofday+0x34/0xd1 [] ? autoremove_wake_function+0x0/0x33 [] ? video_ioctl2+0xf/0x13 [videodev] [] ? vfs_ioctl+0x50/0x69 [] ? do_vfs_ioctl+0x239/0x24c [] ? sys_ioctl+0x40/0x5b [] ? syscall_call+0x7/0xb [] ? cpuid4_cache_sysfs_exit+0x3d/0x69 ======================= Code: Bad EIP value. EIP: [<00000000>] 0x0 SS:ESP 0068:e2fd9d2c Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 6d9773f9a11f85d63d2a7bea10a87cbc8dcc09b7 Author: Al Viro Date: Sun Nov 16 22:19:10 2008 +0000 Fix broken ownership of /proc/sys/ files commit 5c06fe772da43db63b053addcd2c267f76d0be91 upstream. D'oh... Signed-off-by: Al Viro Reported-and-tested-by: Peter Palfrader Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 861ea9ffa58a2c2cd55bc87b59e8eb77fb635b28 Author: Eric Dumazet Date: Mon Nov 10 21:43:08 2008 -0800 net: fix /proc/net/snmp as memory corruptor commit b971e7ac834e9f4bda96d5a96ae9abccd01c1dd8 upstream. icmpmsg_put() can happily corrupt kernel memory, using a static table and forgetting to reset an array index in a loop. Remove the static array since its not safe without proper locking. Signed-off-by: Alexey Dobriyan Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 08ed5844d41cdd0b8576de8b4b7036b0adbf1688 Author: Matthew Garrett Date: Wed Oct 29 14:01:03 2008 -0700 sony-laptop: ignore missing _DIS method on pic device commit 6158d3a2323835546c7cf83a170316fa77b726e0 upstream. At least the Vaio VGN-Z540N doesn't have this method, so let's not fail to suspend just because it doesn't exist. Signed-off-by: Adam Jackson Acked-by: Mattia Dongili Cc: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Steve Conklin Signed-off-by: Greg Kroah-Hartman commit 8cbad29c963e46d5806040ae5abead32e604e5a5 Author: Francois Romieu Date: Sat Sep 13 15:04:38 2008 +0200 r8169: select MII in Kconfig commit b73724921d906d1642f9f6d054079c6b095903fe upstream. drivers/built-in.o: In function `rtl8169_gset_xmii': r8169.c:(.text+0x82259): undefined reference to `mii_ethtool_gset' Signed-off-by: Hugh Dickins Acked-by: Francois Romieu Cc: Edward Hsu Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 3fd7e3ce7ec2dcf13a2fa592ee48dd528ba9c561 Author: Gerald Schaefer Date: Thu Nov 6 12:53:36 2008 -0800 memory hotplug: fix page_zone() calculation in test_pages_isolated() commit a70dcb969f64e2fa98c24f47854f20bf02ff0092 upstream. My last bugfix here (adding zone->lock) introduced a new problem: Using page_zone(pfn_to_page(pfn)) to get the zone after the for() loop is wrong. pfn will then be >= end_pfn, which may be in a different zone or not present at all. This may lead to an addressing exception in page_zone() or spin_lock_irqsave(). Now I use __first_valid_page() again after the loop to find a valid page for page_zone(). Signed-off-by: Gerald Schaefer Acked-by: Nathan Fontenot Reviewed-by: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bb590336a129a63f2b69aaab7caae0cd3c0b6c07 Author: Elvis Pranskevichus Date: Wed Sep 10 10:19:13 2008 -0400 Input: ALPS - add signature for DualPoint found in Dell Latitude E6500 commit 0d46ed1c747edfe6476961d4d9f732ceb7a29074 upstream. Signed-off-by: Elvis Pranskevichus Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 591ffdd8f5f92f9245071131ae137568d1940ba0 Author: Kumar Gala Date: Tue Oct 28 18:01:39 2008 +0000 powerpc/mpic: Fix regression caused by change of default IRQ affinity commit 3c10c9c45e290022ca7d2aa1ad33a0b6ed767520 upstream. The Freescale implementation of MPIC only allows a single CPU destination for non-IPI interrupts. We add a flag to the mpic_init to distinquish these variants of MPIC. We pull in the irq_choose_cpu from sparc64 to select a single CPU as the destination of the interrupt. This is to deal with the fact that the default smp affinity was changed by commit 18404756765c713a0be4eb1082920c04822ce588 ("genirq: Expose default irq affinity mask (take 3)") to be all CPUs. Signed-off-by: Kumar Gala Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit b1bb48b574a9148eb8e8c2723f3444e04ca09437 Author: FUJITA Tomonori Date: Wed Nov 12 11:33:54 2008 +0530 block: fix nr_phys_segments miscalculation bug commit 8677142710516d986d932d6f1fba7be8382c1fec upstream backported by Nikanth Karthikesan to the 2.6.27.y tree. block: fix nr_phys_segments miscalculation bug This fixes the bug reported by Nikanth Karthikesan : http://lkml.org/lkml/2008/10/2/203 The root cause of the bug is that blk_phys_contig_segment miscalculates q->max_segment_size. blk_phys_contig_segment checks: req->biotail->bi_size + next_req->bio->bi_size > q->max_segment_size But blk_recalc_rq_segments might expect that req->biotail and the previous bio in the req are supposed be merged into one segment. blk_recalc_rq_segments might also expect that next_req->bio and the next bio in the next_req are supposed be merged into one segment. In such case, we merge two requests that can't be merged here. Later, blk_rq_map_sg gives more segments than it should. We need to keep track of segment size in blk_recalc_rq_segments and use it to see if two requests can be merged. This patch implements it in the similar way that we used to do for hw merging (virtual merging). Signed-off-by: FUJITA Tomonori Signed-off-by: Jens Axboe Cc: Nikanth Karthikesan Signed-off-by: Greg Kroah-Hartman commit d40ed4a663d70732d352d80d973a0edcb31df076 Author: Jonathan McDowell Date: Sat Sep 13 17:08:31 2008 +0100 kbuild: Fixup deb-pkg target to generate separate firmware deb commit bf1b36445dc868cbbde194aa1dd87e38fe24cf16 upstream. The below is a simplistic fix for "make deb-pkg"; it splits the firmware out to a linux-firmware-image package and adds an (unversioned) Suggests to the linux package for this firmware. Signed-Off-By: Jonathan McDowell Acked-by: Frans Pop Signed-off-by: Sam Ravnborg Signed-off-by: Greg Kroah-Hartman commit 0e20e2321f460f1842683d1a5f7f9de519fb129a Author: Bob Jolliffe Date: Wed Nov 12 20:16:59 2008 +0000 rtl8187 : support for Sitecom WL-168 0001 v4 commit f3c769185a28b7947d97b3552a977102c1fac3f2 upstream. the Sitecom 0001 v4 with product id 0x0df6:0028, uses Realtek's RTL8187B and work fine with new 2.6.27 driver. Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 51ceb068bb72f4e948ccb1a896f4ef8cc647d1e0 Author: Ivan Kuten Date: Mon Nov 10 19:39:25 2008 -0600 rtl8187: Add Abocom USB ID commit 8f7c41d4cec91cdbfa89b4a77d5a628938875366 upstream. Signed-off-by: Ivan Kuten Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 6fc576fc6c06dc972f5bb0a78bb76e81e9860d2b Author: Adam Litke Date: Wed Nov 12 13:24:56 2008 -0800 hugetlb: make unmap_ref_private multi-size-aware commit 7526674de0c921e7f1e9b6f71a1f9d832557b554 upstream. Oops. Part of the hugetlb private reservation code was not fully converted to use hstates. When a huge page must be unmapped from VMAs due to a failed COW, HPAGE_SIZE is used in the call to unmap_hugepage_range() regardless of the page size being used. This works if the VMA is using the default huge page size. Otherwise we might unmap too much, too little, or trigger a BUG_ON. Rare but serious -- fix it. Signed-off-by: Adam Litke Cc: Jon Tollefson Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5f33ce31fb5cffd4daf1bd4aedd0936983524b0a Author: Alan Jenkins Date: Sat Nov 1 11:05:26 2008 +0000 ACPI: EC: make kernel messages more useful when GPE storm is detected commit f8248434e6a11d7cd314281be3b39bbcf82fc243 upstream. Make sure we can tell if the GPE storm workaround gets activated, and avoid flooding the logs afterwards. http://bugzilla.kernel.org/show_bug.cgi?id=11841 "plenty of line "ACPI: EC: non-query interrupt received, switching to interrupt mode" in dmesg" Signed-off-by: Alan Jenkins Acked-by: Alexey Starikovskiy Signed-off-by: Len Brown Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 8bb02ba7401e1974e0030db00385f3a6ef708a62 Author: Peter Gruber Date: Mon Oct 27 23:59:36 2008 -0400 ACPI: avoid empty file name in sysfs commit 4feba70a2c1a1a0c96909f657f48b2e11e682370 upstream. Since commit bc45b1d39a925b56796bebf8a397a0491489d85c acpi tables are allowed to have an empty signature and /sys/firmware/acpi/tables uses the signature as filename. Applications using naive recursion through /sys loop forever. A possible solution would be: (replacing the zero length filename with the string "NULL") http://bugzilla.kernel.org/show_bug.cgi?id=11539 Acked-by: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 2b233b842dfb434bfc946bbd97ec475a01b89000 Author: Johannes Berg Date: Wed Nov 12 16:54:22 2008 -0500 hostap: pad the skb->cb usage in lieu of a proper fix commit f7cd168645dda3e9067f24fabbfa787f9a237488 upstream. Like mac80211 did, this driver makes 'clever' use of skb->cb to pass information along with an skb as it is requeued from the virtual device to the physical wireless device. Unfortunately, that trick no longer works... Unlike mac80211, code complexity and driver apathy makes this hack the best option we have in the short run. Hopefully someone will eventually be motivated to code a proper fix before all the effected hardware dies. (Above text by me. Johannes officially disavows all knowledge of this hack. -- JWL) Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 095d1c96367e0af6b566c9ec7eeae62f0a57d64e Author: Darrick J. Wong Date: Wed Nov 12 13:25:00 2008 -0800 Fix platform drivers that crash on suspend/resume commit fe2d5ffc74a1de6a31e9fd65b65cce72d881edf7 upstream. It turns out that if one registers a struct platform_device, the platform device code expects that platform_device.device->driver points to a struct driver inside a struct platform_driver. This is not the case with the ipmi-si, ipmi-msghandler and ibmaem drivers, which causes the suspend/resume hook functions to jump off into nowhere, causing a crash. Make this assumption hold true for these three drivers. Signed-off-by: Darrick J. Wong Acked-by: Corey Minyard Cc: Jean Delvare Cc: Kay Sievers Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5cf84123715843d404211bc57487ecbadcd3d4c2 Author: Nicolas Pitre Date: Sat Nov 8 21:15:53 2008 +0100 ARM: 5329/1: Feroceon: fix feroceon_l2_inv_range commit 72bc2b1ad62f4d2f0a51b35829093d41f55accce upstream. Same fix as commit c7cf72dcadb: when 'start' and 'end' are less than a cacheline apart and 'start' is unaligned we are done after cleaning and invalidating the first cacheline. Signed-off-by: Nicolas Pitre Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit c4ae2887fba8c33d67feaf00726474eda04d5dd6 Author: Eilon Greenstein Date: Mon Nov 3 16:46:40 2008 -0800 bnx2x: Calling netif_carrier_off at the end of the probe commit 12b56ea89e70d4b04f2f5199750310e82894ebbd upstream. netif_carrier_off was called too early at the probe. In case of failure or simply bad timing, this can cause a fatal error since linkwatch_event might run too soon. Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller Cc: Alex Chiang Signed-off-by: Greg Kroah-Hartman commit b905e4eea3b6ee9d273262a999b8736929f5002d Author: Eilon Greenstein Date: Mon Nov 3 16:46:19 2008 -0800 bnx2x: PCI configuration bug on big-endian commit 7d96567ac0527703cf1b80043fc0ebd7f21a10ad upstream. The current code read nothing but zeros on big-endian (wrong part of the 32bits). This caused poor performance on big-endian machines. Though this issue did not cause the system to crash, the performance is significantly better with the fix so I view it as critical bug fix. Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller Cc: Alex Chiang Signed-off-by: Greg Kroah-Hartman commit 365ef014724ec99fa6aee6bad8b66f352e2ab711 Author: Eilon Greenstein Date: Mon Nov 3 16:45:55 2008 -0800 bnx2x: Removing the PMF indication when unloading commit 9a0354405feb0f8bd460349a93db05e4cca8d166 upstream. When the PMF flag is set, the driver can access the HW freely. When the driver is unloaded, it should not access the HW. The problem caused fatal errors when "ethtool -i" was called after the calling instance was unloaded and another instance was already loaded Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller Cc: Alex Chiang Signed-off-by: Greg Kroah-Hartman commit 96e1cb2535bff4fad43471d95fa2ae5d68fac673 Author: Elias Oltmanns Date: Wed Nov 12 11:30:10 2008 +0100 ath5k: Fix reset sequence for AR5212 in general and RF5111 in particular commit 7d19267b8d1e12c0baebf9be96e04cddffe63f67 upstream Take care to handle register 0xa228 exactly as in the HAL released by Atheros. This change is required to make ath5k work again on my system since commit 2203d6be (ath5k: Misc hw_reset updates), thus fixing a regression in 2.6.27 and therefore hopefully eligible for inclusion into a stable release. v2: Only overwrite initial register values on later revisions of AR5212 chips. v3: Use standard macros to manipulate the register. Signed-off-by: Elias Oltmanns Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit cfce2256fc569c37640eb2ea3204c9b1f02aef4f Author: Elias Oltmanns Date: Wed Nov 12 11:28:39 2008 +0100 ath5k: fix suspend-related oops on rmmod Cumulative patch backporting the following two commits from upstream: commit 8bdd5b9c6bd53add260756b6673a0545fbdbba21 upstream Author: Bob Copeland Based on a patch by Elias Oltmanns, we call ath5k_init in resume even if we didn't previously open the device. Besides starting up the device unnecessarily, this also causes an oops on rmmod because mac80211 will not invoke ath5k_stop and softirqs are left running after the module has been unloaded. Add a new state bit, ATH_STAT_STARTED, to indicate that we have been started up. commit bc1b32d6bdd2d6f3fbee9a7c01c9b099f11c579c upstream Author: Elias Oltmanns After a s2ram / resume cycle, resetting the key cache does not work unless it is deferred until after the hardware has been reinitialised by a call to ath5k_hw_reset(). This fixes a regression introduced by "ath5k: fix suspend-related oops on rmmod". Reported-by: Toralf Förster Signed-off-by: Elias Oltmanns Signed-off-by: Bob Copeland Signed-off-by: Greg Kroah-Hartman commit c72a32e1819c184c16008ab772d414fd2107575b Author: John W. Linville Date: Thu Oct 30 14:12:21 2008 -0400 iwlagn: avoid sleep in softirq context commit 964d2777438bf7687324243d38ade538d9bbfe3c upstream. __ieee80211_tasklet_handler -> __ieee80211_rx -> __ieee80211_rx_handle_packet -> ieee80211_invoke_rx_handlers -> ieee80211_rx_h_decrypt -> ieee80211_crypto_tkip_decrypt -> ieee80211_tkip_decrypt_data -> iwl4965_mac_update_tkip_key -> iwl_scan_cancel_timeout -> msleep Ooops! Avoid the sleep by changing iwl_scan_cancel_timeout with iwl_scan_cancel and simply returning on failure if the scan persists. This will cause hardware decryption to fail and we'll handle a few more frames with software decryption. Signed-off-by: John W. Linville Cc: Holger Macht Signed-off-by: Greg Kroah-Hartman commit e0e208044d83f48efecde9b36150f83cef8cabb4 Author: Dan Williams Date: Fri Sep 26 19:01:20 2008 -0700 touch_mnt_namespace when the mount flags change commit 0e55a7cca4b66f625d67b292f80b6a976e77c51b upstream Daemons that need to be launched while the rootfs is read-only can now poll /proc/mounts to be notified when their O_RDWR requests may no longer end in EROFS. Cc: Kay Sievers Cc: Neil Brown Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman