commit 5defaf81d28daf50c6b148fa6d482cb7e0e61d73 Author: Greg Kroah-Hartman Date: Sat Dec 13 15:56:16 2008 -0800 Linux 2.6.27.9 commit c6e9f8086227d824a45de8b0d9f626d66a30c6b0 Author: Wim Van Sebroeck Date: Wed Oct 15 08:53:06 2008 +0000 ib700wdt.c - fix buffer_underflow bug commit 7c2500f17d65092d93345f3996cf82ebca17e9ff upstream. This fixes Bug 11399: if ibwdt_set_heartbeat(int t) is called with value 30 then the check "if ((t < 0) || (t > 30))" in ibwdt_set_heartbeat is not going to fail because t == 30, but in the loop, the check wd_times[i] > t is never going to be true because none of the wd_times are greater than the value of t (i.e. 30). So we are exiting the loop with i == -1 and therefore setting wd_margin to -1 which is wrong. Reported-by: Zvonimir Rakamaric Signed-off-by: Wim Van Sebroeck Signed-off-by: Greg Kroah-Hartman commit c832f62d3d057abfc1125621c80ede5840cf7aef Author: Alan Cox Date: Mon Oct 13 10:45:17 2008 +0100 applicom: Fix an unchecked user ioctl range and an error return commit a7be18d436f0c7007794965e5af29fa1ffff1e05 upstream. Closes bug #11408 by checking the card index range for command 0 Fixes the ioctl to return ENOTTY which is correct for unknown ioctls Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b1e58876b39029fb4f1b49504ba01f5454428878 Author: Dave Chinner Date: Thu Dec 4 09:09:34 2008 +1100 XFS: Fix hang after disallowed rename across directory quota domains commit 576a488a27f267af203f3ea69c700a1612335e9f upstream. When project quota is active and is being used for directory tree quota control, we disallow rename outside the current directory tree. This requires a check to be made after all the inodes involved in the rename are locked. We fail to unlock the inodes correctly if we disallow the rename when the target is outside the current directory tree. This results in a hang on the next access to the inodes involved in failed rename. Reported-by: Arkadiusz Miskiewicz Signed-off-by: Dave Chinner Tested-by: Arkadiusz Miskiewicz Signed-off-by: Lachlan McIlroy Signed-off-by: Greg Kroah-Hartman commit ec9ea180923639380683ebb52d135bc01959f2b1 Author: Milton Miller Date: Mon Oct 20 15:37:03 2008 +0000 powerpc: Use cpu_thread_in_core in smp_init for of_spin_map commit 6a75a6b8e85e92cc774d42a4e113c76c30b5a539 upstream. We used to assume that even numbered threads were the primary threads, ie those that would be listed and started as a cpu from open firmware. Replace a left over is even (% 2) check with a check for it being a primary thread and update the comments. Tested with a debug print on pseries, identical code found for cell. Signed-off-by: Milton Miller Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit c53129f96b5f2d7fa3979d39a9b641bafec430b9 Author: Rene Herman Date: Wed Oct 15 22:03:58 2008 -0700 pnp: make the resource type an unsigned long commit b563cf59c4d67da7d671788a9848416bfa4180ab upstream. PnP encodes the resource type directly as its struct resource->flags value which is an unsigned long. Make it so... Signed-off-by: Rene Herman Cc: "H. Peter Anvin" Acked-by: Bjorn Helgaas Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 39493f2809c5d4ee52ab118e0197644ad9490d13 Author: Jeff Layton Date: Wed Dec 10 06:44:29 2008 -0500 cifs: fix a regression in cifs umount codepath backport of 469ee614aaa367d9cde01cbdd2027212f56c6cc6 upstream. Several cifs patches were added to 2.6.27.8 to fix some races in the mount/umount codepath. When this was done, a couple of prerequisite patches were missed causing a minor regression. When the last cifs mount to a server goes away, the kthread that manages the socket is supposed to come down. The patches that went into 2.6.27.8 removed the kthread_stop calls that used to take down these threads, but left the thread function expecting them. This made the thread stay up even after the last mount was gone. This patch should fix up this regression and also prevent a possible race where a dead task could be signalled. Signed-off-by: Jeff Layton Cc: Suresh Jayaraman Acked-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 631867888f51ec9dc40bc8f7cb43cc39a6892158 Author: Len Brown Date: Mon Dec 8 16:03:07 2008 -0500 ACPI: delete OSI(Linux) DMI dmesg spam In 2.6.28 a6e0887f21bbab337ee32d9c0a84d7c0b6e9141b removed this code because the linux-acpi community no longer needs the feedback that these console messages solicit. here in .stable, we apply a simpler version of that patch, but for the exact same reasons. Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 1d3bac578875da221abaabc7beba5f1d4f316acb Author: Grant Likely Date: Thu Dec 4 05:39:55 2008 +0000 powerpc/virtex5: Fix Virtex5 machine check handling commit 640d17d60e83401e10e66a0ab6e9e2d6350df656 upstream. The 440x5 core in the Virtex5 uses the 440A type machine check (ie, they have MCSRR0/MCSRR1). They thus need to call the appropriate fixup function to hook the right variant of the exception. Without this, all machine checks become fatal due to loss of context when entering the exception handler. Signed-off-by: Grant Likely Signed-off-by: Josh Boyer Signed-off-by: Greg Kroah-Hartman commit 0501da32b55823305835b43af5a8eb8c48e8406b Author: Roland McGrath Date: Tue Dec 9 19:36:38 2008 -0800 tracehook: exec double-reporting fix commit 85f334666a771680472722eee43ae0fc8730a619 upstream. The patch 6341c39 "tracehook: exec" introduced a small regression in 2.6.27 regarding binfmt_misc exec event reporting. Since the reporting is now done in the common search_binary_handler() function, an exec of a misc binary will result in two (or possibly multiple) exec events being reported, instead of just a single one, because the misc handler contains a recursive call to search_binary_handler. To add to the confusion, if PTRACE_O_TRACEEXEC is not active, the multiple SIGTRAP signals will in fact cause only a single ptrace intercept, as the signals are not queued. However, if PTRACE_O_TRACEEXEC is on, the debugger will actually see multiple ptrace intercepts (PTRACE_EVENT_EXEC). The test program included below demonstrates the problem. This change fixes the bug by calling tracehook_report_exec() only in the outermost search_binary_handler() call (bprm->recursion_depth == 0). The additional change to restore bprm->recursion_depth after each binfmt load_binary call is actually superfluous for this bug, since we test the value saved on entry to search_binary_handler(). But it keeps the use of of the depth count to its most obvious expected meaning. Depending on what binfmt handlers do in certain cases, there could have been false-positive tests for recursion limits before this change. /* Test program using PTRACE_O_TRACEEXEC. This forks and exec's the first argument with the rest of the arguments, while ptrace'ing. It expects to see one PTRACE_EVENT_EXEC stop and then a successful exit, with no other signals or events in between. Test for kernel doing two PTRACE_EVENT_EXEC stops for a binfmt_misc exec: $ gcc -g traceexec.c -o traceexec $ sudo sh -c 'echo :test:M::foobar::/bin/cat: > /proc/sys/fs/binfmt_misc/register' $ echo 'foobar test' > ./foobar $ chmod +x ./foobar $ ./traceexec ./foobar; echo $? ==> good <== foobar test 0 $ ==> bad <== foobar test unexpected status 0x4057f != 0 3 $ */ #include #include #include #include #include #include #include static void wait_for (pid_t child, int expect) { int status; pid_t p = wait (&status); if (p != child) { perror ("wait"); exit (2); } if (status != expect) { fprintf (stderr, "unexpected status %#x != %#x\n", status, expect); exit (3); } } int main (int argc, char **argv) { pid_t child = fork (); if (child < 0) { perror ("fork"); return 127; } else if (child == 0) { ptrace (PTRACE_TRACEME); raise (SIGUSR1); execv (argv[1], &argv[1]); perror ("execve"); _exit (127); } wait_for (child, W_STOPCODE (SIGUSR1)); if (ptrace (PTRACE_SETOPTIONS, child, 0L, (void *) (long) PTRACE_O_TRACEEXEC) != 0) { perror ("PTRACE_SETOPTIONS"); return 4; } if (ptrace (PTRACE_CONT, child, 0L, 0L) != 0) { perror ("PTRACE_CONT"); return 5; } wait_for (child, W_STOPCODE (SIGTRAP | (PTRACE_EVENT_EXEC << 8))); if (ptrace (PTRACE_CONT, child, 0L, 0L) != 0) { perror ("PTRACE_CONT"); return 6; } wait_for (child, W_EXITCODE (0, 0)); return 0; } Reported-by: Arnd Bergmann CC: Ulrich Weigand Signed-off-by: Roland McGrath Acked-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman commit 0993210979a0ce0b25a1949fdbeeb07782747978 Author: Kirill A. Shutemov Date: Wed Oct 15 22:02:39 2008 -0700 Allow recursion in binfmt_script and binfmt_misc commit bf2a9a39639b8b51377905397a5005f444e9a892 upstream. binfmt_script and binfmt_misc disallow recursion to avoid stack overflow using sh_bang and misc_bang. It causes problem in some cases: $ echo '#!/bin/ls' > /tmp/t0 $ echo '#!/tmp/t0' > /tmp/t1 $ echo '#!/tmp/t1' > /tmp/t2 $ chmod +x /tmp/t* $ /tmp/t2 zsh: exec format error: /tmp/t2 Similar problem with binfmt_misc. This patch introduces field 'recursion_depth' into struct linux_binprm to track recursion level in binfmt_misc and binfmt_script. If recursion level more then BINPRM_MAX_RECURSION it generates -ENOEXEC. [akpm@linux-foundation.org: make linux_binprm.recursion_depth a uint] Signed-off-by: Kirill A. Shutemov Cc: Pavel Emelyanov Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f8220954306c6fdc127a5ec645e825991fc97812 Author: Peter Korsgaard Date: Mon Oct 6 10:02:58 2008 +0200 atv: hid quirk for appletv IR receiver (2.6.27 backport of 0f492f2a) Similar to the existing IRCONTROL4 handling Signed-off-by: Peter Korsgaard Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 188127a7b9a4ccdae3d53e362f6824b5a7bce6ce Author: Hugh Dickins Date: Wed Dec 10 20:48:52 2008 +0000 fix mapping_writably_mapped() commit b88ed20594db2c685555b68c52b693b75738b2f5 upstream. Lee Schermerhorn noticed yesterday that I broke the mapping_writably_mapped test in 2.6.7! Bad bad bug, good good find. The i_mmap_writable count must be incremented for VM_SHARED (just as i_writecount is for VM_DENYWRITE, but while holding the i_mmap_lock) when dup_mmap() copies the vma for fork: it has its own more optimal version of __vma_link_file(), and I missed this out. So the count was later going down to 0 (dangerous) when one end unmapped, then wrapping negative (inefficient) when the other end unmapped. The only impact on x86 would have been that setting a mandatory lock on a file which has at some time been opened O_RDWR and mapped MAP_SHARED (but not necessarily PROT_WRITE) across a fork, might fail with -EAGAIN when it should succeed, or succeed when it should fail. But those architectures which rely on flush_dcache_page() to flush userspace modifications back into the page before the kernel reads it, may in some cases have skipped the flush after such a fork - though any repetitive test will soon wrap the count negative, in which case it will flush_dcache_page() unnecessarily. Fix would be a two-liner, but mapping variable added, and comment moved. Reported-by: Lee Schermerhorn Signed-off-by: Hugh Dickins Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 35b9d8e0aa1268072f0a9238d738558c64c77372 Author: Matt Mackall Date: Tue Dec 9 13:14:21 2008 -0800 pagemap: fix 32-bit pagemap regression commit 49c50342c728344b79c8f9e8293637fe80ef5ad5 upstream. The large pages fix from bcf8039ed45 broke 32-bit pagemap by pulling the pagemap entry code out into a function with the wrong return type. Pagemap entries are 64 bits on all systems and unsigned long is only 32 bits on 32-bit systems. Signed-off-by: Matt Mackall Reported-by: Doug Graham Cc: Alexey Dobriyan Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit cb01c9ddcbb5a1c8049bacf1f145b402f0ce3a0a Author: Balbir Singh Date: Tue Dec 9 13:14:07 2008 -0800 uml: boot broken due to buffer overrun commit 361371201b60ffd686a694c848c1d5ad6061725f upstream. mconsole_init() passed 256 bytes as length in os_create_unix_socket, while the sizeof UNIX_PATH_MAX is 108. This patch fixes that problem and avoids a big overrun bug reported on UML bootup. sockaddr_un.sun_path is UNIX_PATH_MAX long which causes the problem. Reported-by: Vikas K Managutte Reported-by: Sarvesh Kumar Lal Das Signed-off-by: Balbir Singh Reviewed-by: Pekka Enberg Reviewed-by: WANG Cong Cc: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 146f29f9da1334541858f1d89ae6b3ffeb33df45 Author: Thomas Renninger Date: Tue Dec 9 13:05:09 2008 +0100 PCIe: ASPM: Break out of endless loop waiting for PCI config bits to switch commit 2a42d9dba7842422ffb2c02e75288a8bc2fd5065 upstream. Makes a Compaq 6735s boot reliably again. It used to hang in the loop on some boots. Give the link one second to train, otherwise break out of the loop and reset the previously set clock bits. Signed-off-by: Thomas Renninger Signed-off-by: Shaohua Li Signed-off-by: Matthew Garrett Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit deb068ac802e7f3434cbd52565dc089dc154d868 Author: Alex Chiang Date: Mon Dec 1 18:17:21 2008 -0700 PCI: stop leaking 'slot_name' in pci_create_slot commit 3b5dd45e947ecd21491e1658fba7bb4bc4a54995 upstream. In pci_create_slot(), the local variable 'slot_name' is allocated by make_slot_name(), but never freed. We never use it after passing it to the kobject core, so we should free it upon function exit. Signed-off-by: Alex Chiang Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 053abaffaa8e536b489ff66b9882a9a60acf3025 Author: Brian King Date: Tue Dec 9 08:47:00 2008 -0600 sched: CPU remove deadlock fix commit 9a2bd244e18ffbb96c8b783210fda4eded7c7e6f upstream. Impact: fix possible deadlock in CPU hot-remove path This patch fixes a possible deadlock scenario in the CPU remove path. migration_call grabs rq->lock, then wakes up everything on rq->migration_queue with the lock held. Then one of the tasks on the migration queue ends up calling tg_shares_up which then also tries to acquire the same rq->lock. [c000000058eab2e0] c000000000502078 ._spin_lock_irqsave+0x98/0xf0 [c000000058eab370] c00000000008011c .tg_shares_up+0x10c/0x20c [c000000058eab430] c00000000007867c .walk_tg_tree+0xc4/0xfc [c000000058eab4d0] c0000000000840c8 .try_to_wake_up+0xb0/0x3c4 [c000000058eab590] c0000000000799a0 .__wake_up_common+0x6c/0xe0 [c000000058eab640] c00000000007ada4 .complete+0x54/0x80 [c000000058eab6e0] c000000000509fa8 .migration_call+0x5fc/0x6f8 [c000000058eab7c0] c000000000504074 .notifier_call_chain+0x68/0xe0 [c000000058eab860] c000000000506568 ._cpu_down+0x2b0/0x3f4 [c000000058eaba60] c000000000506750 .cpu_down+0xa4/0x108 [c000000058eabb10] c000000000507e54 .store_online+0x44/0xa8 [c000000058eabba0] c000000000396260 .sysdev_store+0x3c/0x50 [c000000058eabc10] c0000000001a39b8 .sysfs_write_file+0x124/0x18c [c000000058eabcd0] c00000000013061c .vfs_write+0xd0/0x1bc [c000000058eabd70] c0000000001308a4 .sys_write+0x68/0x114 [c000000058eabe30] c0000000000086b4 syscall_exit+0x0/0x40 Signed-off-by: Brian King Acked-by: Peter Zijlstra Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit b9d4b7312803c55d8c8c616334b38eae7852904a Author: Gary Hade Date: Tue Oct 28 16:43:14 2008 -0700 x86: remove debug code from arch_add_memory() commit fe8b868eccb9f85a0e231e35f0abac5b39bac801 upstream. Impact: remove incorrect WARN_ON(1) Gets rid of dmesg spam created during physical memory hot-add which will very likely confuse users. The change removes what appears to be debugging code which I assume was unintentionally included in: x86: arch/x86/mm/init_64.c printk fixes commit 10f22dde556d1ed41d55355d1fb8ad495f9810c8 Signed-off-by: Gary Hade Signed-off-by: Ingo Molnar Acked-by: Jeff Mahoney Signed-off-by: Greg Kroah-Hartman commit 05d7d06b6defd2778addbe70454667d00cfc37df Author: Shaohua Li Date: Mon Oct 27 13:03:18 2008 -0700 x86, memory hotplug: remove wrong -1 in calling init_memory_mapping() commit 60817c9b31ef7897d60bca2f384cbc316a3fdd8b upstream. Impact: fix crash with memory hotplug Shuahua Li found: | I just did some experiments on a desktop for memory hotplug and this bug | triggered a crash in my test. | | Yinghai's suggestion also fixed the bug. We don't need to round it, just remove that extra -1 Signed-off-by: Yinghai Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 11ab6487b5c44b37faaa0d01ad362d5afa4f3570 Author: Matt Fleming Date: Sun Nov 2 16:04:18 2008 +0000 x86: HPET: convert WARN_ON to WARN_ON_ONCE commit 1de5b0854623d30d01d72cd4ea323eb5f39d1f16 upstream. It is possible to flood the console with call traces if the WARN_ON condition is true because of the frequency with which this function is called. Signed-off-by: Matt Fleming Cc: mingo@elte.hu Cc: venkatesh.pallipadi@intel.com Signed-off-by: Thomas Gleixner Cc: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 1c03c0828f200dfde456836fe69febb72979b5c7 Author: Li Zefan Date: Thu Nov 6 09:45:16 2008 +0800 sched: fix a bug in sched domain degenerate commit f29c9b1ccb52904ee442a933cf3dee628f9f4e62 upstream. Impact: re-add incorrectly eliminated sched domain layers (1) on i386 with SCHED_SMT and SCHED_MC enabled # mount -t cgroup -o cpuset xxx /mnt # echo 0 > /mnt/cpuset.sched_load_balance # mkdir /mnt/0 # echo 0 > /mnt/0/cpuset.cpus # dmesg CPU0 attaching sched-domain: domain 0: span 0 level CPU groups: 0 (2) on i386 with SCHED_MC enabled but SCHED_SMT disabled # same with (1) # dmesg CPU0 attaching NULL sched-domain. The bug is that some sched domains may be skipped unintentionally when degenerating (optimizing) sched domains. Signed-off-by: Li Zefan Acked-by: Peter Zijlstra Signed-off-by: Ingo Molnar Cc: Gregory Haskins Signed-off-by: Greg Kroah-Hartman commit 8695c0e41ee6fcfce99b7335565d6b1a2e2fbda8 Author: Divy Le Ray Date: Thu Sep 4 22:34:13 2008 -0700 cxgb3 - remove duplicate tests in lro commit 004f23b9d3874efc81d2d1cf18fd0fe48dc2f26f upstream. The generic lro code checks TCP flags/options. Remove duplicate tests done in the driver. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik Cc: Hannes Reinecke Signed-off-by: Greg Kroah-Hartman commit 12fbd593c2d5f88f30bb00f80f8dc3d174dae2ba Author: Divy Le Ray Date: Thu Sep 25 14:05:28 2008 +0000 cxgb3 - fix race in EEH commit 0ca41c0413a4d9ca58767d53d23accea9aa1cdef upstream. A SGE queue set timer might access registers while in EEH recovery, triggering an EEH error loop. Stop all timers early in EEH process. Signed-off-by: Divy Le Ray Signed-off-by: David S. Miller Cc: Karsten Keil Signed-off-by: Greg Kroah-Hartman commit acc826f16b53e7443aee91d098970eb3b96c56f5 Author: Takashi Iwai Date: Mon Nov 3 10:21:36 2008 +0100 ALSA: emu10k1 - Add more invert_shared_spdif flag to Audigy models commit 55e03a68d2489d116a5c5e8111ecef3f69831ed6 upstream. Reported in Novell bnc#440862: https://bugzilla.novell.com/show_bug.cgi?id=440862 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 332ddbaaa9c684bd7d549f20efc2eee1b2203226 Author: Takashi Iwai Date: Fri Nov 21 18:01:44 2008 +0100 ALSA: hda - mark Dell studio 1535 quirk commit c65574abad288d7123bd49e7906fa53b7e420239 upstream Fixed the quirk string for Dell studio 1535 (the product name wasn't published at the time the patch was made). Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e47433f59a45c7e5d3ab54d8d7eabb91aa202da7 Author: Takashi Iwai Date: Mon Nov 24 07:51:11 2008 +0100 ALSA: hda - No 'Headphone as Line-out' swich without line-outs commit 95026623da32848bc93fbfb472dc8737487df450 upstream STAC/IDT driver creates "Headphone as Line-Out" switch even if there is no line-out pins on the machine. For devices only with headpohnes and speaker-outs, this switch shouldn't be created. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit c7b7f1613bcfdd8e6ccaeea8a57daf9a3a122fc2 Author: Takashi Iwai Date: Fri Nov 21 08:37:03 2008 +0100 ALSA: hda - Add a quirk for Dell Studio 15 commit b0fc5e043401df4cd243352f1030c4d23e767347 upstream Added the matching model=dell-m6 for Dell Studio 15 laptop. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 574c90a3146e9e479806e9a51fa694338cc57645 Author: Travis Place Date: Mon Nov 10 17:56:23 2008 +0100 ALSA: hda - Make the HP EliteBook 8530p use AD1884A model laptop commit 254248313aed7e6ff295ca21a82ca989b1f69c16 upstream Added a QUIRK to patch_analog.c for the HP Elitebook 8530p (IDs 0x103c:0x30e7) to use AD1884A model 'laptop' by default. Playback and Capture confirmed working. Signed-off-by: Travis Place Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 8a18e96e4052f3897e9e3392d5175d99a4611e49 Author: Michel Marti Date: Sat Nov 8 11:33:32 2008 +0100 ALSA: hda - Add another HP model (6730s) for AD1884A commit 65b92e5cbc8acd14ea83190b4d016f765dce6075 upstream Added model=laptop for another HP machine (103c:3614) with AD1884A codec. Signed-off-by: Michel Marti Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 4402cb9ec9c2fe9d6424794aa6eba51898cccd6e Author: Takashi Iwai Date: Wed Nov 5 11:30:56 2008 +0100 ALSA: hda - Add a quirk for MEDION MD96630 commit 959973b92d3ba235edfa5dcb5df1be1e5d1deba2 upstream Use model=lenovo-ms7195-dig for MEDION MD96630 laptop (17c0:4085) with ALC888 codec. Reference: Novell bnc#412548 https://bugzilla.novell.com/show_bug.cgi?id=412528 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 432a1fa76a48e5ac001381a20d89648a138add28 Author: Takashi Iwai Date: Mon Nov 3 10:07:43 2008 +0100 ALSA: hda - Add a quirk for another Acer Aspire (1025:0090) commit 69e50282b726bab75c8050c4836dc89b7eb7bf1a upstream Added a quirk for another Acer Aspier laptop (1025:0090) with ALC883 codec. Reported in Novell bnc#426935: https://bugzilla.novell.com/show_bug.cgi?id=426935 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 4297d7a64791a5d3e1eb22f489a70f0d67cd4e68 Author: Takashi Iwai Date: Tue Oct 28 15:39:26 2008 +0100 ALSA: hda - Add another HP model for AD1884A commit 5695ff44160e62d9193c0201706853bcfe2a077f upstream Added a quirk entry for another HP mobile device with AD1884A codec. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 730e94ec78ec5a278a6a61d1df531f17545a0f70 Author: Takashi Iwai Date: Mon Oct 27 16:56:24 2008 +0100 ALSA: hda - Restore default pin configs for realtek codecs commit e044c39ae258678d6ebb09fccb2a0fdf7ec51847 upstream Some machines have broken BIOS resume that doesn't restore the default pin configuration properly, which results in a wrong detection of HP pin. This causes a silent speaker output due to missing HP detection. Related bug: Novell bug#406101 https://bugzilla.novell.com/show_bug.cgi?id=406101 This patch fixes the issue by saving/restoring the default pin configs by the driver itself. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit ab76143d7746113d74cab836abb62bb08760ed72 Author: Kailang Yang Date: Wed Oct 15 11:22:09 2008 +0200 ALSA: hda - Add support of ALC272 commit 01afd41f55524e8378601dbf33b858d8dd4b3f31 upstream Added the support of ALC272 codec. It's almost compatible with ALC663. Signed-off-by: Kailang Yang Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 0f988538acf662bd25602e641fd4eccbd405dcc9 Author: Kailang Yang Date: Wed Oct 15 11:20:21 2008 +0200 ALSA: hda - Add ALC887 support commit a385a52925398e53bedf1a8b30a9a3e002569f27 upstream Added ALC887 support. It's almost compatible with ALC883/888. Signed-off-by: Kailang Yang Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 01bc0a517071f657f60b034937724cb718e20f99 Author: Clive Messer Date: Tue Sep 30 15:49:13 2008 +0200 ALSA: hda - Fix another ALC889A (rev 0x100101) commit 669faba27f2f7b04b9228d20e30e7f584f0becd5 upstream ALC889A hardware (id 0x10ec0885 rev 0x100101) to use patch_alc883 Signed-off-by: Clive Messer Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 45160728628ef10be4de432729751aa08af590a3 Author: Peter Korsgaard Date: Sat Sep 27 09:13:45 2008 +0200 ALSA: hda: appletv support commit f3911c5ab93e4295938b2013104d2986ea601454 upstream The AppleTV needs the same handling as the 24" iMac. Signed-off-by: Peter Korsgaard Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 86010551faed7e8091d0b6ad8a7fcebd9e6a3da7 Author: Robin H. Johnson Date: Sat Sep 13 16:55:01 2008 -0700 ALSA: HDA: patch_analog: Quirk for Asus P5Q Premium/Pro boards. commit f51ff9937bc6732ed5fc08088fdbe89ab8ed27c3 upstream Use 6STACK_DIG for the AD2000BX variant of the AD1989B chip used by Asus on their Asus P5Q Premium and Pro boards. Signed-off-by: Robin H. Johnson Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit ff741bcd03720f79336ccc0e72b33be915de8824 Author: Robin H. Johnson Date: Sat Sep 13 16:55:00 2008 -0700 ALSA: HDA: patch_analog: Fix SPDIF output on AD1989B commit e8bfc6c1d22395ab706784cb1bcd60f6f9569ed6 upstream The SPDIF pins for AD1989 are not enabled by default. Set OUT bit so that they actually work. Also initialize the HDMI SPDIF at the same time. Signed-off-by: Robin H. Johnson Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 2d34669f55693d3955e27ce5d51c6d0f691326dd Author: Matthew Ranostay Date: Sat Sep 13 10:36:58 2008 -0400 ALSA: hda: fixed hp_nid DAC for DELL_M6 commit f7cf0a7ce56eb91752fa441cff2669f8d61d4e5e upstream This patch sets the HP out not used by the "Headphone to Line Out" switch to the hp_nid. Signed-off-by: Matthew Ranostay Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit ca7ca88cd322604bd3fb7b9dc932b1a6fd4c7911 Author: Travis Place Date: Mon Sep 1 08:24:00 2008 +0200 ALSA: hda - Add model for Toshiba L305 laptop commit 2346d0cde544179a8d235375f1bfbca5c141a31b upstream Added Subsystem IDs (0x1179, 0xff64) for the Toshiba Satellite L305 laptop, so it automatically uses the ALC268_TOSHIBA quirk. Signed-off-by: Travis Place Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 18e62de5f9634304632c2427723d30af46ede54e Author: Takashi Iwai Date: Thu Aug 21 16:25:07 2008 +0200 ALSA: hda - Fix ALC269 capture source commit e01bf5091f044011823aefa1882eb3fba0434918 upstream ALC269 capture source wasn't properly set up. It's an independent MUX (0x23), not a source of ADC. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 0e3e1289992a87eec1a5c6ef5a7b14125a423d97 Author: Mauro Carvalho Chehab Date: Mon Aug 4 10:39:59 2008 -0300 ALSA: hda: Add support for ECS/PC Chips boards with Sigmatel codecs commit 8c650087992f1d7a3a7be2e632f4e85a52d20619 upstream Thanks to Sistema Fenix (http://www.sistemafenix.com.br/) and CDI Brasil (www.cdibrasil.com.br/) for sponsoring this development. Signed-off-by: Gilberto Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit fb511b1fd4a905bcbf5881fb28606c6101922a4d Author: Pascal Terjan Date: Mon Aug 4 14:36:05 2008 +0200 ALSA: hda - Fix sound on NEC Versa S9100 commit e8f9ae2a4a0654e7798b8c0ae956e3f0fdc23c8d upstream This patch adds sound support for NEC Versa S9100 With it, we get sound on the internal speaker and headphone (with automute working) while there is no sound by default. External mic also works fine but I don't know if there is an internal one (if there is an internal mic it does not work currently), and I had to send back the hardware. Signed-off-by: Pascal Terjan Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit b387e1146d8ca640e6c562aa2f49247fc799967c Author: Robin H. Johnson Date: Sat Sep 13 16:54:57 2008 -0700 ALSA: HDA: hda_proc: Fix printf format specifier commit 0481f4534910e644626a3607b2a1a979420a2d05 upstream. The Pincap output had a typod format specifier, leading to an extraneous "08" in the output, which is a reserved bit of the Vref field, and was really confused :-). Signed-off-by: Robin H. Johnson Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit f7693442d9e7dee10664d8da50284d436a3cbb1b Author: Tobias Kunze Briseño Date: Mon Nov 24 11:28:31 2008 -0500 USB: usb-storage: unusual_devs entry for Nikon D2H commit 621b239d75b790ac66854d46b094874f69e6776e upstream This patch adds an unusual_devs entry for the Nikon D2H camera. From: Tobias Kunze Briseño , Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 051091fcc654c1835a1ba4b4dd73239a51d0a0ea Author: Alan Stern Date: Fri Nov 21 16:15:12 2008 -0500 USB: storage: unusual_devs entry for Mio C520-GPS commit a6b7b034d7f20761c55743be2acb762ce09a0c6b upstream This patch (as1176) adds an unusual_devs entry for the Mio C520 GPS unit. Other devices also based on the Mitac hardware use the same USB interface firmware, so the Vendor and Product names are generalized. This fixes Bugzilla #11583. Signed-off-by: Alan Stern Tested-by: Tamas Kerecsen Signed-off-by: Greg Kroah-Hartman commit 29bc812827d0e87e34feb3e48ea612828ae312e6 Author: Alan Stern Date: Mon Nov 17 14:32:16 2008 -0500 USB: storage: update unusual_devs entries for Nokia 5300 and 5310 commit 589afd3bec907f02c133d7b8185b8af534f14a8e upstream This patch (as1168) updates the unusual_devs entry for the Nokia 5300. According to Jorge Lucangeli Obes , some existing models have a revision number lower than the lower limit of the current entry. The patch also moves the entry for the Nokia 5310 to its correct place in the file. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit fa47430033c1aa18dbdefb56896fffb6579b5743 Author: Alan Stern Date: Mon Nov 17 16:12:32 2008 -0500 USB: storage: updates unusual_devs entry for the Nokia 6300 commit 9beba53dc5c330d781ecc0ad8ea081c2d100ff9f upstream This patch (as1169) modifies the unusual_devs entry for the Nokia 6300. According to Maciej Gierok and David McBride , the revision limits need to be wider. This fixes Bugzilla #11768. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 1d3810721e53e9997caeaa6829b8e8967e79b1f8 Author: Ricky Wong Date: Tue Nov 4 19:13:45 2008 +0800 USB: unusual devs patch for Nokia 7610 Supernova commit ed4103b3fcf38985995e732dab6c3e2b9693f6cb upstream. Additional sectors were reported by the Nokia 7610 Supernova phone in usb storage mode. The following patch rectifies the aforementioned problem. Signed-off-by: Ricky Wong Yung Fei Signed-off-by: Greg Kroah-Hartman commit f90987699f97f81e55a38f99d252978727afd58d Author: Paul Ready Date: Wed Oct 29 14:25:50 2008 -0700 USB: add Nikon D300 camera to unusual_devs commit 0047ca0a45c6a481abd467fb52d2a480ffc8c6b9 upstream Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11685 When A Nikon D300 camera is connected to a system it is seen in /proc/bus/pci/devices but is not accessible. This is seen in the above file: T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=03 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=04b0 ProdID=041a Rev= 1.03 S: Manufacturer=NIKON S: Product=NIKON DSC D300 S: SerialNumber=000008014379 C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr= 2mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=06(still) Sub=01 Prot=01 Driver=usbfs E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=32ms Cc: Alan Stern Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 9e476b4dad7ea3b7eb5805aea772b3623cda59d2 Author: Jens Taprogge Date: Sun Oct 26 18:16:09 2008 +0100 USB: Unusual dev for the "Kyocera / Contax SL300R T*" digital camera. commit 74511bb340059be5a3fceb032213c7f325344694 upstream The camera reports an incorrect size and fails to handle PREVENT-ALLOW MEDIUM REMOVAL commands. The patch marks the camera as an unusual dev and adds the flags to enable the workarounds for both shortcomings. Signed-off-by: Jens Taprogge Cc: Alan Stern Cc: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 4ddd49abd9a5efada809f9c8c971e816193043ed Author: Frédéric Marchal Date: Mon Oct 13 14:00:11 2008 +0200 USB: Unusual dev for Mio moov 330 gps commit e8fab4ce763c36869624c5388714ff19c30a91a7 upstream Here is an entry for the unusual_devs.h file to handle a Mio Moov 330 GPS that stops responding when it is requested to transfer more than 64KB. The patch is taken against kernel-2.6.27-git3. Signed-off-by: Frédéric Marchal Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit e04dc148cc682e147f0443cef97e00f5865dd5a6 Author: fangxiaozhi Date: Wed Oct 15 14:15:36 2008 +0800 USB: unusual-devs: support Huawei data card product IDs commit 1460e5e44cc5ecad7704f63b10dcb3a59d0e008b upstream. In this patch, we want to do one thing: add more Huawei product IDs into the USB driver. Then it can support more Huawei data card devices. So to declare the unusual device for new Huawei data card devices in unusual_devs.h and to declare more new product IDs in option.c. To modify the data value and length in the function of usb_stor_huawei_e220_init in initializers.c That's because based on the USB standard, while sending SET_FETURE_D to the device, it requires the corresponding data to be zero, and its sending length also must be zero. In our old solution, it can be compatible with our WCDMA data card devices, but can not support our CDMA data card devices. But in this new solution, it can be compatible with all of our data card devices. Signed-off-by: fangxiaozhi Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 30b30aeb5f0da22072a260f7ffe40f3531b8a2c6 Author: Greg Kroah-Hartman Date: Sat Nov 29 11:46:21 2008 -0800 USB: serial: add more Onda device ids to option driver commit 5bb4bd9895df508ed2bd8b3280252d8a8170e4ac upstream. Thanks to Domenico Riccio for pointing these out. Cc: Domenico Riccio Signed-off-by: Greg Kroah-Hartman commit 660d395f607f7d781f74c1c0a710e8d7d088a607 Author: Leslie Watter Date: Wed Nov 12 15:10:07 2008 -0200 USB: Add YISO u893 usb modem vendor and product IDs to option driver commit c6206faa4f18bcc837a12552b8c184ab1668fdea upstream This patch adds YISO u893 usb modem vendor and product ID to option.c. I had a better experience using this modification and the same system. Signed-off-by: Leslie Harlley Watter Signed-off-by: Greg Kroah-Hartman commit e42fe0c3de9893bff374d78cc668bbe8473e943e Author: fangxiaozhi Date: Wed Oct 15 14:15:36 2008 +0800 USB: support Huawei data card product IDs commit 1460e5e44cc5ecad7704f63b10dcb3a59d0e008b upstream In this patch, we want to do one thing: add more Huawei product IDs into the USB driver. Then it can support more Huawei data card devices. So to declare the unusual device for new Huawei data card devices in unusual_devs.h and to declare more new product IDs in option.c. To modify the data value and length in the function of usb_stor_huawei_e220_init in initializers.c That's because based on the USB standard, while sending SET_FETURE_D to the device, it requires the corresponding data to be zero, and its sending length also must be zero. In our old solution, it can be compatible with our WCDMA data card devices, but can not support our CDMA data card devices. But in this new solution, it can be compatible with all of our data card devices. Signed-off-by: fangxiaozhi Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 781c5e154708196d485a1726ebce36cfc6218393 Author: Mikhail Gusarov Date: Sat Oct 18 18:20:02 2008 +0700 USB: add ZTE MF626 USB GSM modem entry commit bfd8408d68975759aba1b466af6f5388d7adb836 upstream Signed-off-by: Mikhail Gusarov Signed-off-by: Greg Kroah-Hartman commit 1cd8fd71309569b4f7798bbb8331833172fdc184 Author: Dan Williams Date: Fri Oct 10 06:41:16 2008 -0400 USB: option: add Pantech cards commit 8b6346ec899713a90890c9e832f7eff91ea73504 upstream Add some Pantech mobile broadband IDs. Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 83c29eb8a4d32e9263200540dd165fadd35be79a Author: Jon K Hellan Date: Fri Oct 3 10:36:16 2008 +0200 USB: Option / AnyData new modem, same ID commit bb78a825fa91621e52b9a5409fd9ef07895275bf upstream. The AnyData ADU-310 series of wireless modems uses the same product ID as the ADU-E100 series. Signed-off-by: Jon K Hellan Signed-off-by: Greg Kroah-Hartman commit 71cea81eb9ed46c44a7556a7b027e6fdd2730d81 Author: Denis Joseph Barrow Date: Tue Sep 30 16:49:22 2008 +0200 USB: option.c remove duplicate device ids now supported in hso.c commit 631556a0763ac155c82bbcbeed7e4b28bd737927 upstream. Remove duplicate device ids which are now supported by drivers/usb/net/hso.c Signed-off-by: Denis Joseph Barrow Signed-off-by: Greg Kroah-Hartman commit a3fdc04b7a496acf926c7b127602c216f84e2720 Author: Dan Williams Date: Wed Sep 24 11:49:19 2008 -0400 USB: option: add Ericsson F3507g and Dell 5530 commit b064eca9b0cdbb2b8f731ae2e44fa02194a1219a upstream. Add a few more mobile broadband cards. Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 443affd2a495b0c9cfbcffd5cfe8022f91292672 Author: Benjamin Herrenschmidt Date: Wed Oct 29 14:01:00 2008 -0700 edac: fix enabling of polling cell module commit 992b692dcf43612be805465ca4b76f434c715023 upstream. The edac driver on cell turned out to be not enabled because of a missing op_state. This patch introduces it. Verified to work on top of Ben's next branch. Signed-off-by: Arnd Bergmann Signed-off-by: Jens Osterkamp Acked-by: Benjamin Herrenschmidt Signed-off-by: Doug Thompson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 57fca816daae0c4b7dbb699538b528051f51e91c Author: Dmitry Torokhov Date: Fri Nov 14 13:32:42 2008 -0500 Input: i8042 - add Compal Hel80 laptop to nomux blacklist commit 5f4ba04ffd8fc9f6b15b92270ef0517ae52dcf3a upstream. Reported-by: Jaime Cura Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 080f5082e7bc2cfe5f03b3b368945f70f6fe0e7c Author: Herton Ronaldo Krzesinski Date: Tue Nov 11 09:37:14 2008 -0500 Input: i8042 - add Dell XPS M1530 to nomux list commit 786b11cc0f505e44c29f778fd329dafafafed76c upstream. Dell XPS M1530 needs i8042.nomux=1 for ALPS touchpad to work as reported on https://qa.mandriva.com/show_bug.cgi?id=43532 It is said that before A08 bios version this isn't needed (I don't have the hardware so can't check), and suppose this will not break with bios versions before A08. Signed-off-by: Herton Ronaldo Krzesinski Tested-by: Andreas Ericsson Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit eb3357f5e5e8c9caa00f2b684f747497cb2d219e Author: Stefan Bader Date: Thu Oct 16 22:00:56 2008 -0400 Input: i8042 - add Blue FB5601 to noloop exception table commit 2c6f2cb83b239b7d45da9246cafd27ee615ee35b upstream. Signed-off-by: Stefan Bader Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 70c90738cc8627c9a964cb1489519bb1fb801cb3 Author: Colin B Macdonald Date: Sat Oct 11 18:16:38 2008 -0400 Input: i8042 - add Thinkpad R31 to nomux list commit 5bd8a05e937b3ab88cd7ea569e32738f36c42bd0 upstream. Thinkpad R31 needs i8042 nomux quirk. Stops jittery jumping mouse and random keyboard input. Fixes kernel bug #11723. Cherry picked from Ubuntu who have sometimes (on-again-off-again) had a fix in their patched kernels. Signed-off-by: Colin B Macdonald Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit d9ede5db9ab5226df0931a6eaef53f00c838646c Author: Arnd Bergmann Date: Fri Nov 28 09:51:23 2008 +0000 powerpc/mpic: Don't reset affinity for secondary MPIC on boot commit cc353c30bbdb84f4317a6c149ebb11cde2232e40 upstream. Kexec/kdump currently fails on the IBM QS2x blades when the kexec happens on a CPU other than the initial boot CPU. It turns out that this is the result of mpic_init trying to set affinity of each interrupt vector to the current boot CPU. As far as I can tell, the same problem is likely to exist on any secondary MPIC, because they have to deliver interrupts to the first output all the time. There are two potential solutions for this: either not set up affinity at all for secondary MPICs, or assume that a single CPU output is connected to the upstream interrupt controller and hardcode affinity to that per architecture. This patch implements the second approach, defaulting to the first output. Currently, all known secondary MPICs are routed to their upstream port using the first destination, so we hardcode that. Signed-off-by: Arnd Bergmann Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit 408ed10553e708166cdee751cf0e1babc602ee17 Author: Chas Williams Date: Thu Dec 4 14:58:13 2008 -0800 ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc table commit 17b24b3c97498935a2ef9777370b1151dfed3f6f upstream. As reported by Hugo Dias that it is possible to cause a local denial of service attack by calling the svc_listen function twice on the same socket and reading /proc/net/atm/*vc Signed-off-by: Chas Williams Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2eb6821ec73274ceff92174175d4b373aa3e28b1 Author: Wolfgang Ocker Date: Mon Dec 1 13:13:52 2008 -0800 spi: avoid spidev crash when device is removed commit aaacf4bb51b243875b203e6ff73b5047636b4efa upstream. I saw a kernel oops in spidev_remove() when a spidev device was registered and I unloaded the SPI master driver: Unable to handle kernel paging request for data at address 0x00000004 Faulting instruction address: 0xc01c0c50 Oops: Kernel access of bad area, sig: 11 [#1] CDSPR Modules linked in: spi_ppc4xx(-) NIP: c01c0c50 LR: c01bf9e4 CTR: c01c0c34 REGS: cec89c30 TRAP: 0300 Not tainted (2.6.27.3izt) MSR: 00021000 CR: 24000228 XER: 20000007 DEAR: 00000004, ESR: 00800000 TASK = cf889040[2070] 'rmmod' THREAD: cec88000 GPR00: 00000000 cec89ce0 cf889040 cec8e000 00000004 cec8e000 ffffffff 00000000 GPR08: 0000001c c0336380 00000000 c01c0c34 00000001 1001a338 100e0000 100df49c GPR16: 100b54c0 100df49c 100ddd20 100f05a8 100b5340 100efd68 00000000 00000000 GPR24: 100ec008 100f0428 c0327788 c0327794 cec8e0ac cec8e000 c0336380 00000000 NIP [c01c0c50] spidev_remove+0x1c/0xe4 LR [c01bf9e4] spi_drv_remove+0x2c/0x3c Call Trace: [cec89d00] [c01bf9e4] spi_drv_remove+0x2c/0x3c [cec89d10] [c01859a0] __device_release_driver+0x78/0xb4 [cec89d20] [c0185ab0] device_release_driver+0x28/0x44 [cec89d40] [c0184be8] bus_remove_device+0xac/0xd8 [cec89d60] [c0183094] device_del+0x100/0x194 [cec89d80] [c0183140] device_unregister+0x18/0x30 [cec89da0] [c01bf30c] __unregister+0x20/0x34 [cec89db0] [c0182778] device_for_each_child+0x38/0x74 [cec89de0] [c01bf2d0] spi_unregister_master+0x28/0x44 [cec89e00] [c01bfeac] spi_bitbang_stop+0x1c/0x58 [cec89e20] [d908a5e0] spi_ppc4xx_of_remove+0x24/0x7c [spi_ppc4xx] [...] IMHO a call to spi_set_drvdata() is missing in spidev_probe(). The patch below helped. Signed-off-by: Wolfgang Ocker Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit eb6abcfe147282b257b5411a31a91ae1d083ec82 Author: Hidehiro Kawai Date: Wed Oct 22 14:15:02 2008 -0700 jbd: test BH_Write_EIO to detect errors on metadata buffers commit 9f818b4ac04f53458d0354950b4f229f54be4dbf upstream. __try_to_free_cp_buf(), __process_buffer(), and __wait_cp_io() test BH_Uptodate flag to detect write I/O errors on metadata buffers. But by commit 95450f5a7e53d5752ce1a0d0b8282e10fe745ae0 "ext3: don't read inode block if the buffer has a write error"(*), BH_Uptodate flag can be set to inode buffers with BH_Write_EIO in order to avoid reading old inode data. So now, we have to test BH_Write_EIO flag of checkpointing inode buffers instead of BH_Uptodate. This patch does it. Signed-off-by: Hidehiro Kawai Acked-by: Jan Kara Acked-by: Eric Sandeen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b43a0b325c7e28db51c3f4a0aaa8499518fa9b3b Author: Hidehiro Kawai Date: Wed Oct 22 14:15:00 2008 -0700 jbd: fix error handling for checkpoint io commit 4afe978530702c934dfdb11f54073136818b2119 upstream. When a checkpointing IO fails, current JBD code doesn't check the error and continue journaling. This means latest metadata can be lost from both the journal and filesystem. This patch leaves the failed metadata blocks in the journal space and aborts journaling in the case of log_do_checkpoint(). To achieve this, we need to do: 1. don't remove the failed buffer from the checkpoint list where in the case of __try_to_free_cp_buf() because it may be released or overwritten by a later transaction 2. log_do_checkpoint() is the last chance, remove the failed buffer from the checkpoint list and abort the journal 3. when checkpointing fails, don't update the journal super block to prevent the journaled contents from being cleaned. For safety, don't update j_tail and j_tail_sequence either 4. when checkpointing fails, notify this error to the ext3 layer so that ext3 don't clear the needs_recovery flag, otherwise the journaled contents are ignored and cleaned in the recovery phase 5. if the recovery fails, keep the needs_recovery flag 6. prevent cleanup_journal_tail() from being called between __journal_drop_transaction() and journal_abort() (a race issue between journal_flush() and __log_wait_for_space() Signed-off-by: Hidehiro Kawai Acked-by: Jan Kara Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5894153d2c263436ed4a138a2939ea32cf154495 Author: Rafael J. Wysocki Date: Wed Nov 26 17:53:13 2008 -0500 ACPI suspend: Blacklist boxes that require us to set SCI_EN directly on resume commit 65df78473ffbf3bff5e2034df1638acc4f3ddd50 upstream. Some Apple boxes evidently require us to set SCI_EN on resume directly, because if we don't do that, they hung somewhere in the resume code path. Moreover, on these boxes it is not sufficient to use acpi_enable() to turn ACPI on during resume. All of this is against the ACPI specification which states that (1) the BIOS is supposed to return from the S3 sleep state with ACPI enabled (SCI_EN set) and (2) the SCI_EN bit is owned by the hardware and we are not supposed to change it. For this reason, blacklist the affected systems so that the SCI_EN bit is set during resume on them. [NOTE: Unconditional setting SCI_EN for all system on resume doesn't work, because it makes some other systems crash (that's to be expected). Also, it is not entirely clear right now if all of the Apple boxes require this workaround.] This patch fixes the recent regression tracked as http://bugzilla.kernel.org/show_bug.cgi?id=12038 Signed-off-by: Rafael J. Wysocki Tested-by: Tino Keitel Tested-by: Bob Copeland Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 21b7c0e824f0e98242e625a15bea368ea72ebcbb Author: Jonathan Corbet Date: Fri Dec 5 16:12:48 2008 -0700 Fix a race condition in FASYNC handling commit 218d11a8b071b23b76c484fd5f72a4fe3306801e upstream. Changeset a238b790d5f99c7832f9b73ac8847025815b85f7 (Call fasync() functions without the BKL) introduced a race which could leave file->f_flags in a state inconsistent with what the underlying driver/filesystem believes. Revert that change, and also fix the same races in ioctl_fioasync() and ioctl_fionbio(). This is a minimal, short-term fix; the real fix will not involve the BKL. Reported-by: Oleg Nesterov Cc: Andi Kleen Cc: Al Viro Signed-off-by: Jonathan Corbet Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5c7c64831c51516034a7099ba25718f7aaed19e4 Author: Linus Torvalds Date: Fri Dec 5 14:49:18 2008 -0800 Enforce a minimum SG_IO timeout commit f2f1fa78a155524b849edf359e42a3001ea652c0 upstream. There's no point in having too short SG_IO timeouts, since if the command does end up timing out, we'll end up through the reset sequence that is several seconds long in order to abort the command that timed out. As a result, shorter timeouts than a few seconds simply do not make sense, as the recovery would be longer than the timeout itself. Add a BLK_MIN_SG_TIMEOUT to match the existign BLK_DEFAULT_SG_TIMEOUT. Suggested-by: Alan Cox Acked-by: Tejun Heo Acked-by: Jens Axboe Cc: Jeff Garzik Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit fc27e1db48a5b3d551a50bbe6770577ce4e64d51 Author: Hong H. Pham Date: Thu Dec 4 09:12:57 2008 -0800 sparc64: Sync FPU state in VIS emulation handler. [ Upstream commit 410d2c8187ed969238ba98008c1d57307a56cfd8 ] Copy the FPU state to the task's thread_info->fpregs for the VIS emulation functions to access. Signed-off-by: Hong H. Pham Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 1922738d51d26b4c204d8a55c552d58c74ae011d Author: Joseph Myers Date: Wed Dec 3 19:36:05 2008 -0800 sparc64: Fix VIS emulation bugs [ Upstream commit 726c12f57d7e3ff43693d88e13b1ff02464c75d3 ] This patch fixes some bugs in VIS emulation that cause the GCC test failure FAIL: gcc.target/sparc/pdist-3.c execution test for both 32-bit and 64-bit testing on hardware lacking these instructions. The emulation code for the pdist instruction uses RS1(insn) for both source registers rs1 and rs2, which is obviously wrong and leads to the instruction doing nothing (the observed problem), and further inspection of the code shows that RS1 uses a shift of 24 and RD a shift of 25, which clearly cannot both be right; examining SPARC documentation indicates the correct shift for RS1 is 14. This patch fixes the bug if single-stepping over the affected instruction in the debugger, but not if the testcase is run standalone. For that, Wind River has another patch I hope they will send as a followup to this patch submission. Signed-off-by: Joseph Myers Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 93d46994d103bf8b7ca27355bf3351bb25a99b04 Author: Chris Torek Date: Wed Dec 3 00:47:28 2008 -0800 sparc64: Fix bug in PTRACE_SETFPREGS64 handling. [ Upstream commit 5769907ade8dda7002b304c03ef9e4ee5c1e0821 ] From: Chris Torek >The SPARC64 kernel code for PTRACE_SETFPREGS64 appears to be an exact copy >of that for PTRACE_GETFPREGS64. This means that gdbserver and native >64-bit GDB cannot set floating-point registers. It looks like a simple typo. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 867d011598fd1fec105752ecf09927fb444c5d9f Author: Max Dmitrichenko Date: Sun Nov 2 00:34:10 2008 -0700 sparc64: Fix PCI resource mapping on sparc64 [ Upstream commit 145e1c0023585e0e8f6df22316308ec61c5066b2 ] There is a problem discovered in recent versions of ATI Mach64 driver in X.org on sparc64 architecture. In short, the driver fails to mmap MMIO aperture (PCI resource #2). I've found that kernel's __pci_mmap_make_offset() returns EINVAL. It checks whether user attempts to mmap more than the resource length, which is 0x1000 bytes in our case. But PAGE_SIZE on SPARC64 is 0x2000 and this is what actually is being mmaped. So __pci_mmap_make_offset() failed for this PCI resource. Signed-off-by: Max Dmitrichenko Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8067dfc2222e797ff8c6a3713d4ac5559d25ab1e Author: Hugh Dickins Date: Sat Nov 1 21:41:40 2008 -0700 sparc64: Fix __copy_{to,from}_user_inatomic defines. [ Upstream commit b270ee8a9fc9547eb781ce9ccd379450bcf9a204 ] Alexander Beregalov reports oops in __bzero() called from copy_from_user_fixup() called from iov_iter_copy_from_user_atomic(), when running dbench on tmpfs on sparc64: its __copy_from_user_inatomic and __copy_to_user_inatomic should be avoiding, not calling, the fixups. Signed-off-by: Hugh Dickins Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6a42ebd5cf9a62212017fe944d0eea2a9af29981 Author: David S. Miller Date: Mon Dec 1 02:48:26 2008 -0800 sparc64: Fix offset calculation in compute_size() [ Upstream commit b270ee8a9fc9547eb781ce9ccd379450bcf9a204 ] The fault address is somewhere inside of the buffer, not before it. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6e7f7429b1f5a151943d920e52fdd59b5e7d13ba Author: Eric Dumazet Date: Mon Dec 8 02:12:16 2008 -0800 udp: multicast packets need to check namespace [ Upstream commit 920a46115ca3fa88990276d98520abab85495b2d ] Current UDP multicast delivery is not namespace aware. Signed-off-by: Eric Dumazet Acked-by: Pavel Emelyanov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7bbe882cb07909b6a77fb4418184c30748491b7b Author: Frédéric Moulins Date: Fri Nov 28 22:12:02 2008 -0800 pppol2tp: Add missing sock_put() in pppol2tp_release() [ Upstream commit e6358135147807351db3b7782d3e198a1bba8b62 ] pppol2tp_sock_to_session() do sock_hold() if the session to release is not NULL. Signed-off-by: Frédéric Moulins Signed-off-by: David S. Miller commit 2e7cb04dcda1dd2dcc49f3a679da9bf59f1cabec Author: David S. Miller Date: Wed Nov 12 14:32:54 2008 -0800 niu: Fix readq implementation when architecture does not provide one. [ Upstream commit e23a59e1ca6d177a57a7791b3629db93ff1d9813 ] This fixes a TX hang reported by Jesper Dangaard Brouer. When an architecutre cannot provide a fully functional 64-bit atomic readq/writeq, the driver must implement it's own. This is because only the driver can say whether doing something like using two 32-bit reads to implement the full 64-bit read will actually work properly. In particular one of the issues is whether the top 32-bits or the bottom 32-bits of the 64-bit register should be read first. There could be side effects, and in fact that is exactly the problem here. The TX_CS register has counters in the upper 32-bits and state bits in the lower 32-bits. A read clears the state bits. We would read the counter half before the state bit half. That first read would clear the state bits, and then the driver thinks that no interrupts are pending because the interrupt indication state bits are seen clear every time. Fix this by reading the bottom half before the upper half. Tested-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 0a2093552fba5f5e06bd81e413f62f60880dd182 Author: Jianjun Kong Date: Sat Nov 1 21:37:27 2008 -0700 af_unix: netns: fix problem of return value [ Upstream commit 48dcc33e5e11de0f76b65b113988dbc930d17395 ] fix problem of return value net/unix/af_unix.c: unix_net_init() when error appears, it should return 'error', not always return 0. Signed-off-by: Jianjun Kong Signed-off-by: David S. Miller commit fa14e851ddc9049b39271980e2d24734c0c477e3 Author: Tejun Heo Date: Thu Nov 13 10:04:46 2008 +0900 libata: improve phantom device detection commit 6a6b97d360702b98c02c7fca4c4e088dcf3a2985 upstream. Currently libata uses four methods to detect device presence. 1. PHY status if available. 2. TF register R/W test (only promotes presence, never demotes) 3. device signature after reset 4. IDENTIFY failure detection in SFF state machine Combination of the above works well in most cases but recently there have been a few reports where a phantom device causes unnecessary delay during probe. In both cases, PHY status wasn't available. In one case, it passed #2 and #3 and failed IDENTIFY with ATA_ERR which didn't qualify as #4. The other failed #2 but as it passed #3 and #4, it still caused failure. In both cases, phantom device reported diagnostic failure, so these cases can be safely worked around by considering any !ATA_DRQ IDENTIFY failure as NODEV_HINT if diagnostic failure is set. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman