commit 000d36ae52fc7df4be76719109180df61afbc7bc Author: Greg Kroah-Hartman Date: Fri Dec 18 13:47:01 2009 -0800 Linux 2.6.31.9 commit 66910003dbed5e9cc5499a8e3d207b96dd1c4026 Author: Li Peng Date: Wed Dec 16 16:33:26 2009 +0100 drm/i915: Fix sync to vblank when VGA output is turned off commit 778c902640530371a169ad1c03566e7c51b09874 upstream In current vblank-wait implementation, if we turn off VGA output, drm_wait_vblank will still wait on the disabled pipe until timeout, because vblank on the pipe is assumed be enabled. This would cause slow system response on some system such as moblin. This patch resolve the issue by adding a drm helper function drm_vblank_off which explicitly clear vblank_enabled[crtc], wake up any waiting queue and save last vblank counter before turning off crtc. It also slightly change drm_vblank_get to ensure that we will will return immediately if trying to wait on a disabled pipe. Signed-off-by: Li Peng Reviewed-by: Jesse Barnes [anholt: hand-applied for conflicts with overlay changes] Signed-off-by: Eric Anholt Cc: Stefan Bader Signed-off-by: Greg Kroah-Hartman commit 0b1b72ba20a7d73136f57bb57ff8e2f3f79e62ad Author: Darrick J. Wong Date: Thu Dec 3 16:19:59 2009 +0000 powerpc/therm_adt746x: Record pwm invert bit at module load time] commit 1496e89ae2a0962748e55165a590fa3209c6f158 upstream. In commit 0512a9a8e277a9de2820211eef964473b714ae65, we unilaterally zero the "pwm invert" bit in the fan behavior configuration register. On my PowerBook G4, this results in the fans going to full speed at low temperature and shutting off at high temperature because the pwm invert bit is supposed to be set. Therefore, record the pwm invert bit at driver load time, and write the bit into the fan behavior control register. This restores correct behavior on my PBG4 and should work around the bit being set to the wrong value after suspend/resume (which is what the original patch was trying to fix). It also fixes a minor omission where the pwm invert bit correction is NOT performed when switching into automatic mode. Signed-off-by: Darrick J. Wong Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 178b0bc768f87d3b1d32af590204d8162b517bf4 Author: Rafal Milecki Date: Fri Oct 2 03:54:44 2009 -0300 V4L/DVB (13116): gspca - ov519: Webcam 041e:4067 added. commit 518c8df77c21b7d1690dd8b96eb0e54c4ec1c9c1 upstream. Signed-off-by: Rafal Milecki Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab Cc: Surbhi Palande Signed-off-by: Greg Kroah-Hartman commit e6fc9f756c26ea7b474e2c312c0c4a52cf4e7ab9 Author: Henrique de Moraes Holschuh Date: Wed Dec 9 01:36:22 2009 +0000 thinkpad-acpi: preserve rfkill state across suspend/resume commit 208b996b6c460285650d39b2330f8ef82c007d10 upstream. Since the rfkill rework in 2.6.31, the driver is always resuming with the radios disabled. Change thinkpad-acpi to ask the firmware to resume with the radios in the last state. This fixes the Bluetooth and WWAN rfkill switches. Note that it means we respect the firmware's oddities. Should the user toggle the hardware rfkill switch on and off, it might cause the radios to resume enabled. UWB is an unknown quantity since it has nowhere the same level of firmware support (no control over state storage in NVRAM, for example), and might need further fixing. Testers welcome. This change fixes a regression from 2.6.30. Reported-by: Jerone Young Reported-by: Ian Molton Signed-off-by: Henrique de Moraes Holschuh Tested-by: Ian Molton Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 2ee1220bfed2bc6689be25b48d6840444c980647 Author: Henrique de Moraes Holschuh Date: Wed Dec 9 01:36:21 2009 +0000 thinkpad-acpi: fix default brightness_mode for R50e/R51 commit a9f8eacca4e9e8693de9b896c1fa7aadaa9402e8 upstream. According to a report, the R50e wants EC-based brightness control, even if it uses an Intel GPU. The current driver default was reported to not work at all. This bug can be worked around by the "brightness_mode=3" module parameter. Change the default of the R50e and R51 2xxx models (which use the same EC firmware, 1V) to TPACPI_BRGHT_Q_EC, but keep TPACPI_BRGHT_Q_ASK set for now, as I'd like to get more reports. This fixes a regression caused by commit 59fe4fe34d7afdf63208124f313be9056feaa2f4, "thinkpad-acpi: fix incorrect use of TPACPI_BRGHT_MODE_ECNVRAM" Kernel 2.6.31 also needs this fix. Reported-by: Ferenc Wagner Tested-by: Ferenc Wagner Signed-off-by: Henrique de Moraes Holschuh Cc: stable@kernel.org Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 0723f2f0124da4cb5ccf260bebfa703b24c199a4 Author: Eric W. Biederman Date: Sun Dec 13 22:39:28 2009 -0800 net: Fix userspace RTM_NEWLINK notifications. commit d90a909e1f3e006a1d57fe11fd417173b6494701 upstream. I received some bug reports about userspace programs having problems because after RTM_NEWLINK was received they could not immeidate access files under /proc/sys/net/ because they had not been registered yet. The problem was trivailly fixed by moving the userspace notification from rtnetlink_event to the end of register_netdevice. Signed-off-by: Eric W. Biederman Cc: David Miller Signed-off-by: Greg Kroah-Hartman commit 945d9a8325f6bc1f9fcb4221e5f8dab93e9e6718 Author: Alan Cox Date: Tue Dec 15 16:46:40 2009 -0800 matroxfb: fix problems with display stability commit 8c651311a3a08c1e4815de6933e00a760e498dae upstream. Regression caused in 2.6.23 and then despite repeated requests never fixed or dealt with (Petr promised to sort it in 2008 but seems to have forgotten). Enough is enough - remove the problem line that was added. If it upsets someone they've had two years to deal with it and at the very least it'll rattle their cage and wake them up. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9709 Signed-off-by: Alan Cox Reported-by: Damon Tested-by: Ruud van Melick Cc: Petr Vandrovec Cc: Pekka Enberg Cc: Paul A. Clarke Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 257d82180713789bf57e59c9d32bdd1531c63a44 Author: David Woodhouse Date: Wed Dec 16 03:27:20 2009 +0000 jffs2: Fix long-standing bug with symlink garbage collection. commit 2e16cfca6e17ae37ae21feca080a6f2eca9087dc upstream. Ever since jffs2_garbage_collect_metadata() was first half-written in February 2001, it's been broken on architectures where 'char' is signed. When garbage collecting a symlink with target length above 127, the payload length would end up negative, causing interesting and bad things to happen. Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman commit 2dcc81df4c1364aea736598cccbf751f03f5249b Author: Zhu Yi Date: Wed Dec 2 14:24:37 2009 +0800 ipw2100: fix rebooting hang with driver loaded commit 52ce3e9a7db754b78cf2cbabc87013f921b25b28 upstream. Add PCI .shutdown method so that we can disable the device during shutdown or reboot. Without this, the reboot doesn't work well on some platforms. This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2124 Tested-by: pablo Signed-off-by: Zhu Yi Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit bbf6e57f96f3a8d4b9e659aba01834b561f2abcd Author: Simon Horman Date: Tue Dec 15 17:01:25 2009 +0100 ipvs: zero usvc and udest commit 258c889362aa95d0ab534b38ce8c15d3009705b1 upstream. Make sure that any otherwise uninitialised fields of usvc are zero. This has been obvserved to cause a problem whereby the port of fwmark services may end up as a non-zero value which causes scheduling of a destination server to fail for persisitent services. As observed by Deon van der Merwe . This fix suggested by Julian Anastasov . For good measure also zero udest. Cc: Deon van der Merwe Acked-by: Julian Anastasov Signed-off-by: Simon Horman Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit e5a1a67df493b4c14a6e1e795b861d0dd8226529 Author: Jan Kara Date: Tue Dec 1 16:53:06 2009 +0100 ext3: Fix data / filesystem corruption when write fails to copy data commit 68eb3db08344286733adac48304d9fb7a0e53b27 upstream. When ext3_write_begin fails after allocating some blocks or generic_perform_write fails to copy data to write, we truncate blocks already instantiated beyond i_size. Although these blocks were never inside i_size, we have to truncate pagecache of these blocks so that corresponding buffers get unmapped. Otherwise subsequent __block_prepare_write (called because we are retrying the write) will find the buffers mapped, not call ->get_block, and thus the page will be backed by already freed blocks leading to filesystem and data corruption. Reported-by: James Y Knight Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman commit 1c1f916747265cd65ba1896c20a93034c6c1ec17 Author: Zhenyu Wang Date: Fri Nov 27 11:44:36 2009 +0800 drm/i915: PineView only has LVDS and CRT ports commit 103a196f4224dc6872081305cf7f82ebf67aa7bd upstream. PineView only has 2 ports for LVDS and CRT. Don't enable other ports for it. Cc: Shaohua Li Signed-off-by: Zhenyu Wang Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit ad7ce1cf569509e2f212267749f0ad75bd40b67a Author: Jesse Barnes Date: Wed Oct 14 12:33:41 2009 -0700 drm/i915: save/restore BLC histogram control reg across suspend/resume commit 0eb96d6ed38430b72897adde58f5477a6b71757a upstream. Turns out some machines, like the ThinkPad X40 don't come back if you don't save/restore this register. Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt Cc: Stefan Bader Signed-off-by: Greg Kroah-Hartman commit f316f8c1cc0a8449bc846bcb2839511198185db2 Author: Zhenyu Wang Date: Wed Nov 25 13:09:38 2009 +0800 drm/i915: Fix LVDS stability issue on Ironlake commit 1b3c7a47f993bf9ab6c4c7cc3bbf5588052b58f4 upstream. In disable sequence, all output ports on PCH have to be disabled before PCH transcoder, but LVDS port was left always enabled. This one fixes that by disable LVDS port properly during pipe disable process, and resolved stability issue seen on Ironlake. Also move panel fitting disable time just after pipe disable to align with the spec. Signed-off-by: Zhenyu Wang Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 28d6c0ba38968f5dcdcab5d861fc89eee20bf33f Author: Zhenyu Wang Date: Wed Nov 11 02:30:50 2009 +0000 drm/i915: Fix CRT hotplug detect by checking really no channels attached commit 8e9e0eea9955bffbe5e5cd6355157cabddc31f17 upstream. For CRT hotplug detect status, we have four test results as blue channel only, green channel only, both blue and green channel, and no channel attached. Origin code only marks both blue and green channel case as connected, but ignore other possible connected states. This one trys to detect CRT by checking no channel attached case instead. Signed-off-by: Zhenyu Wang Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 42af3061f5df34e985eb7b1f72f0e931207a6473 Author: Chris Wilson Date: Fri Nov 27 13:06:56 2009 +0000 drm/i915: Avoid NULL dereference with component_only tv_modes commit d271817baecbccb47da0d9f28c285a0dae8a06b7 upstream. In commit d2d9f2324, the guard for a valid video mode was removed. This caused the regression: kernel crash during kms graphic boot on Intel GM4500 platform https://bugzilla.redhat.com/show_bug.cgi?id=540218 This patches changes the logic slightly not to rely on a coupled variable, but to just check whether the video_modes is valid before dereferencing. Signed-off-by: Chris Wilson Cc: David Woodhouse Cc: Zhenyu Wang [ickle: Actually reference the correct bug report] Acked-by: Zhenyu Wang Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 176336ff117105de2d850a959ebd6142dafef2ee Author: Jean Delvare Date: Fri Oct 2 11:28:18 2009 +0200 backlight: lcd - Fix wrong sizeof commit 1e0fa6bd8c7468067f2e988c7a416dafd0651c34 upstream. Which is why I have always preferred sizeof(struct foo) over sizeof(var). Signed-off-by: Jean Delvare Signed-off-by: Richard Purdie Signed-off-by: Greg Kroah-Hartman commit 4874849b30b2e3050499b158c1f223f0d6ad5e57 Author: Corentin Chary Date: Mon Dec 7 22:05:50 2009 +0100 asus-laptop: change light sens default values. commit d951d4cc84e8b5ddb8e0ab81cf6a72cc73fdd668 upstream. The light sensor disable brightness key and /sys/class/backlight/ control. There was a lot of report from users who didn't understand why they couldn't change their brightness, including: https://bugs.launchpad.net/bugs/222171 https://bugzilla.novell.com/show_bug.cgi?id=514747 http://bugzilla.kernel.org/show_bug.cgi?id=13671 http://bugzilla.kernel.org/show_bug.cgi?id=14432 Now the light sensor is disabled, and if the user want to enable it, the level should be ok. The funny thing is that comments where ok, not code. Cc: stable@kernel.org Cc: Thomas Renninger Cc: Peter Küppers Cc: Michael Franzl Cc: Ian Turner Signed-off-by: Corentin Chary Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 7aea74857b397f343696a468e569486cff76ff29 Author: Zhao Yakui Date: Fri Dec 11 15:17:20 2009 +0800 ACPI: Use the ARB_DISABLE for the CPU which model id is less than 0x0f. commit 03a05ed1152944000151d57b71000de287a1eb02 upstream. Currently, ARB_DISABLE is a NOP on all of the recent Intel platforms. For such platforms, reduce contention on c3_lock by skipping the fake ARB_DISABLE. The cpu model id on one laptop is 14. If we disable ARB_DISABLE on this box, the box can't be booted correctly. But if we still enable ARB_DISABLE on this box, the box can be booted correctly. So we still use the ARB_DISABLE for the cpu which mode id is less than 0x0f. http://bugzilla.kernel.org/show_bug.cgi?id=14700 Signed-off-by: Zhao Yakui Acked-by: Venkatesh Pallipadi Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit a845dbd1d7be1e7cc7bfa2fbaa3fc73933411700 Author: Yong Wang Date: Wed Dec 16 13:25:10 2009 +0800 x86: Under BIOS control, restore AP's APIC_LVTTHMR to the BSP value Upstream commit a2202aa29289db64ca7988b12343158b67b27f10. On platforms where bios handles the thermal monitor interrupt, APIC_LVTTHMR on each logical CPU is programmed to generate a SMI and OS can't touch it. Unfortunately AP bringup sequence using INIT-SIPI-SIPI clear all the LVT entries except the mask bit. Essentially this results in all LVT entries including the thermal monitoring interrupt set to masked (clearing the bios programmed value for APIC_LVTTHMR). And this leads to kernel take over the thermal monitoring interrupt on AP's but not on BSP (leaving the bios programmed value only on BSP). As a result of this, we have seen system hangs when the thermal monitoring interrupt is generated. Fix this by reading the initial value of thermal LVT entry on BSP and if bios has taken over the control, then program the same value on all AP's and leave the thermal monitoring interrupt control on all the logical cpu's to the bios. Signed-off-by: Yong Wang Reviewed-by: Suresh Siddha Cc: Borislav Petkov Cc: Arjan van de Ven LKML-Reference: <20091110013824.GA24940@ywang-moblin2.bj.intel.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 310c71f78108501de013b0af91214cfa92f1cbdd Author: Larry Finger Date: Wed Nov 11 18:02:29 2009 -0600 p54usb: Remove DMA buffer from stack commit 21d6c270f11c7d0ab5aafa48a6e79ba514f4e5e7 upstream. On 2.6.32-rc6 from wireless-testing, the following warning is emitted: ------------[ cut here ]------------ WARNING: at lib/dma-debug.c:860 check_for_stack+0xaa/0xe0() Hardware name: HP Pavilion dv2700 Notebook PC ehci_hcd 0000:00:02.1: DMA-API: device driver maps memory fromstack [addr=ffff8800b6e2bca8] Modules linked in: Pid: 16378, comm: modprobe Not tainted 2.6.32-rc6-wl #244 Call Trace: [] warn_slowpath_common+0x78/0xb0 [] warn_slowpath_fmt+0x3c/0x40 [] check_for_stack+0xaa/0xe0 [] debug_dma_map_page+0xfd/0x170 [] usb_hcd_submit_urb+0x3da/0x9c0 [usbcore] [] ? lockdep_init_map+0x5f/0x5d0 [] usb_submit_urb+0xe5/0x260 [usbcore] [] usb_start_wait_urb+0x5e/0xf0 [usbcore] [] ? usb_init_urb+0x23/0x40 [usbcore] [] usb_bulk_msg+0xc4/0x150 [usbcore] [] T.719+0x31/0x40 [p54usb] [] p54u_upload_firmware_3887+0x2f/0x490 [p54usb] [] ? p54_parse_firmware+0x427/0x450 [p54common] ---[ end trace f77df0316ddad3de ]--- Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit ad7aadeeb580cbba64b211943fde3cd6e62708f1 Author: Larry Finger Date: Mon Nov 23 18:42:36 2009 -0600 b43legacy: avoid PPC fault during resume commit 316a4d966cae3c2dec83ebb1ee1a3515f97b30ff upstream. For PPC architecture with PHY Revision < 3, a read of the register B43_MMIO_HWENABLED_LO will cause a CPU fault unless b43legacy_status() returns a value of 2 (B43legacy_STAT_STARTED); however, one finds that the driver is unable to associate after resuming from hibernation unless this routine returns 1. To satisfy both conditions, the routine is rewritten to return TRUE whenever b43legacy_status() returns a value < 2. This patch fixes the second problem listed in the postings for Red Hat Bugzilla #538523. Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 013fecfdb1d018458327634840f905249dc9b51d Author: Jan Beulich Date: Tue Dec 8 11:21:37 2009 +0900 x86/mce: Set up timer unconditionally commit bc09effabf0c5c6c7021e5ef9af15a23579b32a8 upstream. mce_timer must be passed to setup_timer() in all cases, no matter whether it is going to be actually used. Otherwise, when the CPU gets brought down, its call to del_timer_sync() will never return, as the timer won't have a base associated, and hence lock_timer_base() will loop infinitely. Signed-off-by: Jan Beulich Signed-off-by: Hidetoshi Seto LKML-Reference: <4B1DB831.2030801@jp.fujitsu.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit b77a21835581b8e2f7ee79dfe762ea5a2069ac6c Author: David S. Miller Date: Sat Dec 5 17:17:55 2009 -0800 sparc: Set UTS_MACHINE correctly. [ Upstream commit 7f5620a5fcd658f219e85831d3691908f1eccbde ] "ARCH" can be just about anything, so we shouldn't end up with UTS_MACHINE of "sparc" in a 64-bit kernel build just because someone set the personality using 'sparc32' or similar. CONFIG_SPARC64 drives the compilation and therefore provides the definitive value, not "ARCH". This mirrors commit 8c6531f7a99f29ba8817ffb12cc9ecf190049bd6 (x86: correctly set UTS_MACHINE for "make ARCH=x86") Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2b8d879954ca74e594fe17e30c2ea3a2b4ec893b Author: David S. Miller Date: Wed Dec 9 01:43:45 2009 -0800 sparc64: Fix stack debugging IRQ stack regression. [ Upstream commit 166e553a575f09485f6d0df8a1ef3c5991f7d953 ] Commit 4f70f7a91bffdcc39f088748dc678953eb9a3fbd (sparc64: Implement IRQ stacks.) has two bugs. First, the softirq range check forgets to subtract STACK_BIAS before comparing with %sp. Next, on failure the wrong label is jumped to, resulting in a bogus stack being loaded. Reported-by: Igor Kovalenko Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ec5e87a33f85e49acde6ee737c27d48595dd456a Author: David S. Miller Date: Wed Dec 9 01:39:09 2009 -0800 sparc64: Fix overly strict range type matching for PCI devices. [ Upstream commit 4230fa3b89ea1c413766bd411a8315a3d05aa6c7 ] When we are trying to see if a range property entry applies to a given address, we are overly strict about the type. We should only allow I/O ranges for I/O addresses, and only allow CONFIG space ranges for CONFIG space address. However for MEM ranges, they come in 32-bit and 64-bit flavors. And a lack of an exact match is OK if the range is 32-bit and the address is 64-bit. We can assign a 64-bit address properly into a 32-bit parent range just fine. So allow it. Reported-by: Patrick Finnegan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 91c1e7f6a857670528d6dec7640e5c305cee14e6 Author: David S. Miller Date: Wed Dec 9 23:44:43 2009 -0800 sparc64: Don't specify IRQF_SHARED for LDC interrupts. [ Upstream commit 08a036d583409e3517e3d15b7478d029b25f2cf2 ] IRQF_SHARED and IRQF_DISABLED don't mix. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit da92966f64dbb6604c4a8fa8e35cc460cb1b9ee2 Author: David S. Miller Date: Tue Nov 24 14:12:50 2009 -0800 sunsu: Use sunserial_console_termios() in sunsu_console_setup(). [ Upstream commit be24656a5e2d68bfd0744f0742c4aceef2cf44b5 ] Be like the other Sun serial drivers otherwise the special handling of OpenFirmware options and hard-coded overrides for LOM/RSC consoles will not be handled. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7e75549c4c038ed122b885316a42da25eb0dff79 Author: David S. Miller Date: Tue Nov 24 14:11:40 2009 -0800 sunsu: Pass true 'ignore_line' to console match when RSC or LOM console. [ Upstream commit 1917d17b903955b8b2903626a2e01d071a5d0ec9 ] Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit d96dc1bbc3a283da689c2ffd3c285056749c1956 Author: David S. Miller Date: Tue Nov 24 14:09:56 2009 -0800 serial: suncore: Fix RSC/LOM handling in sunserial_console_termios(). [ Upstream commit 457931de3b0925dc2eb941bc7d611a509be36dff ] RSC and LOM devices have fixed speed settings. We already had some code to match and handle "rsc" named devices on E250 systems, but we also have to handle 'rsc-console', 'rsc-control', and 'lom-console'. Also, in order to get this right regardless of what 'output-device' happens to be, explicitly pass the UART device node pointer to this routine. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit b4570691ba0d353bd98f5314685a7d9aa1e4b2db Author: David S. Miller Date: Tue Nov 24 14:03:34 2009 -0800 serial: suncore: Add 'ignore_line' argument to sunserial_console_match(). [ Upstream commit 4e3533d05b6e5e66d1cda27f6671251c99c62894 ] This tells the logic to ignore the line match when deciding whether the device is the OpenFirmware specified console device or not. This is going to be used in the SU driver for rsc-console detection. There is probably a better way to handle this, but this is the least intrusive solution for now which we can validate won't break any other cases. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 93e2a9c73973b7f01cb56b33db8c9ac7bf35cfa7 Author: David S. Miller Date: Tue Nov 24 13:58:52 2009 -0800 sunsu: Fix detection of SU ports which are RSC console or control. [ Upstream commit 8301d386afc55c877bafe2c6c7dc75a96ddd2838 ] These device nodes are named "rsc-console" and "rsc-control" rather than 'serial', but the device_type property is 'serial' so we'll tip off of that for detection. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 313775a1ae8d7d951810e173ce9295f07e5f2f78 Author: David S. Miller Date: Tue Nov 24 13:56:39 2009 -0800 sunsab: Do not set sunsab_reg.cons right before registering minors. [ Upstream commit 4e68e188411ea98e40309700cf0c89ad4469ac1d ] Other Sun serial drivers do not do this, and if we keep it this way it ends up registering all serial devices as consoles rather than just the one which we explicitly register via sunserial_console_match() which uses add_preferred_console(). Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit bcb7797d596b725c2b6b11f24b9254385297261f Author: David S. Miller Date: Mon Nov 23 16:38:56 2009 -0800 sparc64: Fix definition of VMEMMAP_SIZE. [ Upstream commit bffbc94a4d2c1769c3826fceddd2dbb75e72c80b ] This was the cause of various boot failures on V480, V880, etc. systems. Kernel image memory was being overwritten because the vmemmap[] array was being sized to small. So if you had physical memory addresses past a certain point, the early bootup would spam all over variables in the kernel data section. The vmemmap mappings map page structs, not page struct pointers. And that was the key thinko in the macro definition. This was fixable thanks to the help, reports, and tireless patience of Hermann Lauer. Reported-by: Hermann Lauer Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a5ad94d1e45df0cc29918fb5309ef85b99fc58c5 Author: Eric Dumazet Date: Tue Nov 17 06:45:04 2009 -0800 vlan: Fix register_vlan_dev() error path [ Upstream commit 6b863d1d3239eff0f45c2e6e672f5b56db828db0 ] In case register_netdevice() returns an error, and a new vlan_group was allocated and inserted in vlan_group_hash[] we call vlan_group_free() without deleting group from hash table. Future lookups can give infinite loops or crashes. We must delete the vlan_group using RCU safe procedure. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 0d1bb4e684935fce3fc71bdeb6c1fc89af8e59bb Author: Steve Glendinning Date: Sun Nov 29 23:14:45 2009 -0800 smsc9420: prevent BUG() if ethtool is called with interface down [ Upstream commit 6c53b1b15e222244358d3cbbefd2a13920faa352 ] This patch fixes a null pointer dereference BUG() if ethtool is used on an smsc9420 interface while it is down, because the phy_dev is only allocated while the interface is up. Signed-off-by: Steve Glendinning Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 3681f3e31bbe46da8c7fd3490f41e0abe93c0084 Author: Russell King - ARM Linux Date: Sat Nov 28 00:13:23 2009 +0000 NET: smc91x: Fix irq flags [ Upstream commit d5ccd67bb77ced5249067d05171992a7d5020393 ] smc91x.h defines SMC_IRQ_FLAGS to be -1 when it wants the interrupt flags to be taken from the resource structure. However, d280ead changed this to checking for non-zero resource flags. Unfortunately, this means that on some platforms, we end up passing '-1' to request_irq rather than the desired result. Combine the two conditions into one so that the IRQ flags are taken from the resource if either SMC_IRQ_FLAGS is -1 or the resource flags specify an interrupt trigger. This restores network on at least the Versatile platform. Signed-off-by: Russell King Acked-by: Eric Miao Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit d65e5e58537d8b09972ac37974d40d0ef7cec019 Author: Eric Dumazet Date: Sun Nov 15 23:30:24 2009 +0000 net: Fix the rollback test in dev_change_name() [ Upstream commit 91e9c07bd635353d1a278bdb38dbb56ac371bcb8 ] net: Fix the rollback test in dev_change_name() In dev_change_name() an err variable is used for storing the original call_netdevice_notifiers() errno (negative) and testing for a rollback error later, but the test for non-zero is wrong, because the err might have positive value as well - from dev_alloc_name(). It means the rollback for a netdevice with a number > 0 will never happen. (The err test is reordered btw. to make it more readable.) Signed-off-by: Jarek Poplawski Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f9e03b95ee4186dcaabea36d6d285ee99d8f2db4 Author: David S. Miller Date: Sun Nov 15 22:23:47 2009 -0800 Revert "isdn: isdn_ppp: Use SKB list facilities instead of home-grown implementation." [ Upstream commit e29d4363174949a7a4e46f670993d7ff43342c1c ] This reverts commit 38783e671399b5405f1fd177d602c400a9577ae6. It causes kernel bugzilla #14594 Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit b1589c33ceab093fc7b5cb21b5116bc15965b081 Author: Patrick McHardy Date: Tue Dec 1 15:53:57 2009 -0800 ip_fragment: also adjust skb->truesize for packets not owned by a socket [ Upstream commit b2722b1c3a893ec6021508da15b32282ec79f4da ] When a large packet gets reassembled by ip_defrag(), the head skb accounts for all the fragments in skb->truesize. If this packet is refragmented again, skb->truesize is not re-adjusted to reflect only the head size since its not owned by a socket. If the head fragment then gets recycled and reused for another received fragment, it might exceed the defragmentation limits due to its large truesize value. skb_recycle_check() explicitly checks for linear skbs, so any recycled skb should reflect its true size in skb->truesize. Change ip_fragment() to also adjust the truesize value of skbs not owned by a socket. Reported-and-tested-by: Ben Menchaca Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ffa495ef3bad15580cfa8c119d15fe0227ee629c Author: Herbert Xu Date: Tue Nov 17 05:18:18 2009 -0800 gro: Fix illegal merging of trailer trash [ Upstream commit 69c0cab120a85471054614418b447349caba22d7 ] When we've merged skb's with page frags, and subsequently receive a trailer skb (< MSS) that is not completely non-linear (this can occur on Intel NICs if the packet size falls below the threshold), GRO ends up producing an illegal GSO skb with a frag_list. This is harmless unless the skb is then forwarded through an interface that requires software GSO, whereupon the GSO code will BUG. This patch detects this case in GRO and avoids merging the trailer skb. Reported-by: Mark Wagner Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 88f921f674f5cca15fb550003d2d6cb83450e262 Author: David S. Miller Date: Mon Nov 30 00:13:28 2009 -0800 b44: Fix wedge when using netconsole. [ Upstream commit 0cae200eec6330cd2c20b24279597be1da50dc93 ] Fixes kernel bugzilla #14691 Due to the way netpoll works, it is perfectly legal to see NAPI already scheduled when new device events are pending in b44_interrupt(). So logging a message about it is wrong and in fact harmful. Based upon a patch by Andreas Mohr. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 74dd6a2e8c47d58c362408d5c7ffa225ce955dbf Author: Stanislav Brabec Date: Tue Dec 8 21:00:22 2009 -0800 b44 WOL setup: one-bit-off stack corruption kernel panic fix [ Upstream commit: e0188829cb724e7d12a2d4e343b368ff1d6e1471 ] About 50% of shutdowns of b44 Ethernet adapter ends by kernel panic with kernels compiled with stack-protector. Checking b44_magic_pattern() return values, one call of b44_magic_pattern() returns 127. It means, that set_bit(128, pmask) was called on line 1509. It means that bit 0 of 17th byte of pmask was overwritten. But pmask has only 16 bytes. Stack corruption happens. It seems that set_bit() on line 1509 always writes one bit off. The fix does not only solve the stack corruption, but also makes Wake On LAN working on my onboard B44 on Asus A7V-333X mainboard. It seems that this problem affects all kernel versions since commit 725ad800 ([PATCH] b44: add wol for old nic) on 2006-06-20. Signed-off-by: Stanislav Brabec Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 325e42185846fd6d82fdedc4010c6b2605fa7eb2 Author: Alexander Beregalov Date: Sun Nov 22 20:40:52 2009 -0800 Au1x00: fix crash when trying register_netdev() [ Upstream commit 63edaf647607795a065e6956a79c47f500dc8447 ] Andreas Lohre reported that the driver crashes when trying to register_netdev(), he sugessted to move dev->netdev_ops initialization before calling register_netdev(), it worked for him. Reported-by: Andreas Lohre Signed-off-by: Alexander Beregalov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 3b2ba9246647a216dcc03f4484849c8c77601dd6 Author: Bartlomiej Zolnierkiewicz Date: Mon Nov 30 08:55:18 2009 +0000 slc90e66: fix UDMA handling [ Upstream commit ee31527a02b0a8e1aa4a5e4084d2db5fa34737ed ] Fix checking of the currently programmed UDMA mode. Signed-off-by: Bartlomiej Zolnierkiewicz Acked-by: Sergei Shtylyov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 5ca1ee47549f9b269d062cb3c85cef89bfc5597a Author: David S. Miller Date: Fri Nov 6 04:52:50 2009 -0800 Revert "ide: try to use PIO Mode 0 during probe if possible" [ Upstream commit 0fb18c4777ff424c1db694af98443a201fa4fc30 ] This reverts commit 6029336426a2b43e4bc6f4a84be8789a047d139e. Ok, we really do need to revert this, even with Bart's sis5513.c fix in there. The problem is that several driver's ->set_pio_mode() method depends upon the drive->media type being set properly. Most of them use this to enable prefetching, which can only be done for disk media. But the commit being reverted here calls ->set_pio_mode() before it's setup. Actually it considers everything disk because that is the default media type set by ide_port_init_devices_data(). The set of drivers that depend upon the media type in their ->set_pio_method() are: drivers/ide/alim15x3.c drivers/ide/it8172.c drivers/ide/it8213.c drivers/ide/pdc202xx_old.c drivers/ide/piix.c drivers/ide/qd65xx.c drivers/ide/sis5513.c drivers/ide/slc90e66.c And it is possible that we could fix this by guarding the prefetching and other media dependent setting changes with a test on IDE_PFLAG_PROBING in hwif->port_flags, that's simply too risky for 2.6.32-rcX and -stable. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e7019386657e13cb3d82a5633a391c9af8a922a9 Author: Hemant Pedanekar Date: Wed Nov 25 15:04:54 2009 -0800 ide: fix ioctl to pass requested transfer mode to ide_find_dma_mode instead of UDMA6 [ Upstream commit 28c1969ff887bc2a7df39272850dece01de03285 ] Currently, ide_cmd_ioctl when invoked for setting DMA transfer mode calls ide_find_dma_mode with requested mode as XFER_UDMA_6. This prevents setting DMA mode to any other value than the default (maximum) supported by the device (or UDMA6, if supported) irrespective of the actual requested transfer mode and returns error. For example, setting mode to UDMA2 using hdparm, where UDMA4 is the default transfer mode gives following error: # ./hdparm -d1 -Xudma2 /dev/hda /dev/hda:hda: UDMA/66 mode selected setting using_dma to 1 (on) hda: UDMA/66 mode selected setting xfermode to 66 (UltraDMA mode2) HDIO_DRIVE_CMD(setxfermode) failed: Invalid argument using_dma = 1 (on) This patch fixes the issue. Signed-off-by: Hemant Pedanekar Acked-by: Bartlomiej Zolnierkiewicz Acked-by: Sergei Shtylyov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 006e58040fd635e02d3edbbb85504e4231256390 Author: Mikulas Patocka Date: Wed Oct 21 08:55:28 2009 +0000 ide: Serialize CMD643 and CMD646 to fix a hardware bug with SSD [ Upstream commit 9bd7496f5dd488e109e91d9d5743915fb4dfbfde ] CMD646 corrupts data on concurrent transfers on both channels when IDE SSD is connected to one of the channels. Setup that demonstrates this hardware bug: Ultra 5, onboard CMD646, rev 3. /dev/hda is 8GB Seagate ST38410A in MWDMA2 /dev/hdd is 32GB SSD SiliconHardDisk in MWDMA2 - When reading /dev/hdd (for example with dd or fsck), reads from /dev/hda are corrupted, there are twiddled single bits 1->0 and some full 32-bit words corrupted, sometimes commands fail (which switches /dev/hda to PIO mode but the corruptions happen even in PIO). - Reads from /dev/hdd don't seem to be corrupted (i.e. fsck passes fine). - When I connected normal rotating harddisk to /dev/hdd, there was no corruption, so the corruption is something specific to SSD. - I tried the same setup on a PCI card with CMD649 and saw no corruption. This patch serializes the operation for CMD646 and 643 (I didn't test CMD643 but it may have the same hw bug too because it's earlier design). CMD649 is good. I don't know anything about CMD 648. Signed-off-by: Mikulas Patocka Tested-by: Frans Pop Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 77e856d7f3de1bfb26f96314ed6e868fe4f38877 Author: Ian Jackson Date: Wed Nov 18 11:08:11 2009 +0100 Serial: Do not read IIR in serial8250_start_tx when UART_BUG_TXEN commit 68cb4f8e246bbbc649980be0628cae9265870a91 upstream. Do not read IIR in serial8250_start_tx when UART_BUG_TXEN Reading the IIR clears some oustanding interrupts so it is not safe. Instead, simply transmit immediately if the buffer is empty without regard to IIR. Signed-off-by: Ian Jackson Reviewed-by: Markus Armbruster Reviewed-by: Jiri Kosina Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 7c52c4436288e1eec78edaca6366658b33fb54e2 Author: Benjamin Herrenschmidt Date: Tue Dec 8 18:45:45 2009 +0000 powerpc: Fix usage of 64-bit instruction in 32-bit altivec code commit e090aa80321b64c3b793f3b047e31ecf1af9538d upstream. e821ea70f3b4873b50056a1e0f74befed1014c09 introduced a bug by copying some 64-bit originated code as-is to be used by both 32 and 64-bit but this code contains a 64-bit ony "cmpdi" instruction. This changes it to cmpwi, which is fine since VRSAVE can only contains a 32-bit value anyway. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 6d56cf9ae2582f7b35975368f4d2569833d20bc3 Author: Naoya Horiguchi Date: Mon Dec 14 17:59:59 2009 -0800 mm: hugetlb: fix hugepage memory leak in walk_page_range() commit d33b9f45bd24a6391bc05e2b5a13c1b5787ca9c2 upstream. Most callers of pmd_none_or_clear_bad() check whether the target page is in a hugepage or not, but walk_page_range() do not check it. So if we read /proc/pid/pagemap for the hugepage on x86 machine, the hugepage memory is leaked as shown below. This patch fixes it. Details ======= My test program (leak_pagemap) works as follows: - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,) - read()/write() something on it, - call page-types with option -p (walk around the page tables), - munmap() and unlink() the file on hugetlbfs Without my patches ------------------ $ cat /proc/meminfo |grep "HugePage" HugePages_Total: 1000 HugePages_Free: 1000 HugePages_Rsvd: 0 HugePages_Surp: 0 $ ./leak_pagemap [snip output] $ cat /proc/meminfo |grep "HugePage" HugePages_Total: 1000 HugePages_Free: 900 HugePages_Rsvd: 0 HugePages_Surp: 0 $ ls /hugetlbfs/ $ 100 hugepages are accounted as used while there is no file on hugetlbfs. With my patches --------------- $ cat /proc/meminfo |grep "HugePage" HugePages_Total: 1000 HugePages_Free: 1000 HugePages_Rsvd: 0 HugePages_Surp: 0 $ ./leak_pagemap [snip output] $ cat /proc/meminfo |grep "HugePage" HugePages_Total: 1000 HugePages_Free: 1000 HugePages_Rsvd: 0 HugePages_Surp: 0 $ ls /hugetlbfs $ No memory leaks. Signed-off-by: Naoya Horiguchi Cc: Andi Kleen Cc: Wu Fengguang Cc: Hugh Dickins Cc: Mel Gorman Cc: Lee Schermerhorn Cc: Andy Whitcroft Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 58493110046c7217f6171aa5f73cbfe30b3e7a43 Author: Naoya Horiguchi Date: Mon Dec 14 17:59:58 2009 -0800 mm: hugetlb: fix hugepage memory leak in mincore() commit 4f16fc107d9c9b8a72aa19b189a9216e90a7aaef upstream. Most callers of pmd_none_or_clear_bad() check whether the target page is in a hugepage or not, but mincore() and walk_page_range() do not check it. So if we use mincore() on a hugepage on x86 machine, the hugepage memory is leaked as shown below. This patch fixes it by extending mincore() system call to support hugepages. Details ======= My test program (leak_mincore) works as follows: - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,) - read()/write() something on it, - call mincore() for first ten pages and printf() the values of *vec - munmap() and unlink() the file on hugetlbfs Without my patch ---------------- $ cat /proc/meminfo| grep "HugePage" HugePages_Total: 1000 HugePages_Free: 1000 HugePages_Rsvd: 0 HugePages_Surp: 0 $ ./leak_mincore vec[0] 0 vec[1] 0 vec[2] 0 vec[3] 0 vec[4] 0 vec[5] 0 vec[6] 0 vec[7] 0 vec[8] 0 vec[9] 0 $ cat /proc/meminfo |grep "HugePage" HugePages_Total: 1000 HugePages_Free: 999 HugePages_Rsvd: 0 HugePages_Surp: 0 $ ls /hugetlbfs/ $ Return values in *vec from mincore() are set to 0, while the hugepage should be in memory, and 1 hugepage is still accounted as used while there is no file on hugetlbfs. With my patch ------------- $ cat /proc/meminfo| grep "HugePage" HugePages_Total: 1000 HugePages_Free: 1000 HugePages_Rsvd: 0 HugePages_Surp: 0 $ ./leak_mincore vec[0] 1 vec[1] 1 vec[2] 1 vec[3] 1 vec[4] 1 vec[5] 1 vec[6] 1 vec[7] 1 vec[8] 1 vec[9] 1 $ cat /proc/meminfo |grep "HugePage" HugePages_Total: 1000 HugePages_Free: 1000 HugePages_Rsvd: 0 HugePages_Surp: 0 $ ls /hugetlbfs/ $ Return value in *vec set to 1 and no memory leaks. [akpm@linux-foundation.org: cleanup] [akpm@linux-foundation.org: build fix] Signed-off-by: Naoya Horiguchi Cc: Andi Kleen Cc: Wu Fengguang Cc: Hugh Dickins Cc: Mel Gorman Cc: Lee Schermerhorn Cc: Andy Whitcroft Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2a4a323ff6d44b68fb7013f1233a61becdf03951 Author: Vasanthakumar Thiagarajan Date: Fri Dec 4 17:41:34 2009 +0530 mac80211: Fix bug in computing crc over dynamic IEs in beacon commit 1814077fd12a9cdf478c10076e9c42094e9d9250 upstream. On a 32-bit machine, BIT() macro does not give the required bit value if the bit is mroe than 31. In ieee802_11_parse_elems_crc(), BIT() is suppossed to get the bit value more than 31 (42 (id of ERP_INFO_IE), 37 (CHANNEL_SWITCH_IE), (42), 32 (POWER_CONSTRAINT_IE), 45 (HT_CAP_IE), 61 (HT_INFO_IE)). As we do not get the required bit value for the above IEs, crc over these IEs are never calculated, so any dynamic change in these IEs after the association is not really handled on 32-bit platforms. This patch fixes this issue. Signed-off-by: Vasanthakumar Thiagarajan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c632519756afce9ab483a1bdd3f14d09f00c2c55 Author: Alex Deucher Date: Thu Dec 3 12:15:54 2009 -0500 drm/radeon/kms: fix legacy crtc2 dpms commit 8de21525439e6b5bb8d8c81e49094d867bf82f6d upstream. noticed by Matthijs Kooijman on fdo bug 22140 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 75471a7fb71d281a64cde5594a8bd3227f852af2 Author: Alex Deucher Date: Tue Dec 1 14:49:50 2009 -0500 drm/radeon/kms: Add quirk for HIS X1300 board commit 4e3f9b78ff917cc5c833858fdb5d96bc262e0bf3 upstream. Board is DVI+VGA, not DVI+DVI Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit ca1e562dec3a5a740b775c88eb90c1104545d44b Author: Joe Perches Date: Mon Nov 9 17:58:50 2009 -0800 x86: GART: pci-gart_64.c: Use correct length in strncmp commit 41855b77547fa18d90ed6a5d322983d3fdab1959 upstream. Signed-off-by: Joe Perches LKML-Reference: <1257818330.12852.72.camel@Joe-Laptop.home> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 122bf2b6785292c8ac1bda3dcd438f2a83007ece Author: Dave Jones Date: Tue Nov 10 15:01:20 2009 -0500 x86: Fix typo in Intel CPU cache size descriptor commit e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 upstream. I double-checked the datasheet. One of the existing descriptors has a typo: it should be 2MB not 2038 KB. Signed-off-by: Dave Jones LKML-Reference: <20091110200120.GA27090@redhat.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 671ca70a2f70399b42e632211f4c9c0c553506e9 Author: Tejun Heo Date: Mon Oct 26 15:41:46 2009 +0100 x86: Fix iommu=nodac parameter handling commit 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 upstream. iommu=nodac should forbid dac instead of enabling it. Fix it. Signed-off-by: Tejun Heo Acked-by: FUJITA Tomonori Cc: Matteo Frigo LKML-Reference: <4AE5B52A.4050408@kernel.org> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 03146ec8b52708f80f1bb5f90d27f090c60541ab Author: Darrick J. Wong Date: Wed Dec 2 15:05:56 2009 -0800 x86, Calgary IOMMU quirk: Find nearest matching Calgary while walking up the PCI tree commit 4528752f49c1f4025473d12bc5fa9181085c3f22 upstream. On a multi-node x3950M2 system, there's a slight oddity in the PCI device tree for all secondary nodes: 30:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) \-33:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) \-34:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) ...as compared to the primary node: 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) \-01:00.0 VGA compatible controller: ATI Technologies Inc ES1000 (rev 02) 03:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) \-04:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) In both nodes, the LSI RAID controller hangs off a CalIOC2 device, but on the secondary nodes, the BIOS hides the VGA device and substitutes the device tree ending with the disk controller. It would seem that Calgary devices don't necessarily appear at the top of the PCI tree, which means that the current code to find the Calgary IOMMU that goes with a particular device is buggy. Rather than walk all the way to the top of the PCI device tree and try to match bus number with Calgary descriptor, the code needs to examine each parent of the particular device; if it encounters a Calgary with a matching bus number, simply use that. Otherwise, we BUG() when the bus number of the Calgary doesn't match the bus number of whatever's at the top of the device tree. Extra note: This patch appears to work correctly for the x3950 that came before the x3950 M2. Signed-off-by: Darrick J. Wong Acked-by: Muli Ben-Yehuda Cc: FUJITA Tomonori Cc: Joerg Roedel Cc: Yinghai Lu Cc: Jon D. Mason Cc: Corinna Schultz LKML-Reference: <20091202230556.GG10295@tux1.beaverton.ibm.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 066658b78bf5c50a6272603824851b327da5646f Author: Leann Ogasawara Date: Fri Dec 4 15:42:22 2009 -0800 x86: ASUS P4S800 reboot=bios quirk commit 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 upstream. Bug reporter noted their system with an ASUS P4S800 motherboard would hang when rebooting unless reboot=b was specified. Their dmidecode didn't contain descriptive System Information for Manufacturer or Product Name, so I used their Base Board Information to create a reboot quirk patch. The bug reporter confirmed this patch resolves the reboot hang. Handle 0x0001, DMI type 1, 25 bytes System Information Manufacturer: System Manufacturer Product Name: System Name Version: System Version Serial Number: SYS-1234567890 UUID: E0BFCD8B-7948-D911-A953-E486B4EEB67F Wake-up Type: Power Switch Handle 0x0002, DMI type 2, 8 bytes Base Board Information Manufacturer: ASUSTeK Computer INC. Product Name: P4S800 Version: REV 1.xx Serial Number: xxxxxxxxxxx BugLink: http://bugs.launchpad.net/bugs/366682 ASUS P4S800 will hang when rebooting unless reboot=b is specified. Add a quirk to reboot through the bios. Signed-off-by: Leann Ogasawara LKML-Reference: <1259972107.4629.275.camel@emiko> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 8a44f81934aa1d687551dc20077dcb82af02b8a4 Author: Mikael Pettersson Date: Thu Dec 3 15:52:44 2009 +0100 x86, apic: Enable lapic nmi watchdog on AMD Family 11h commit 7d1849aff6687a135a8da3a75e32a00e3137a5e2 upstream. The x86 lapic nmi watchdog does not recognize AMD Family 11h, resulting in: NMI watchdog: CPU not supported As far as I can see from available documentation (the BKDM), family 11h looks identical to family 10h as far as the PMU is concerned. Extending the check to accept family 11h results in: Testing NMI watchdog ... OK. I've been running with this change on a Turion X2 Ultra ZM-82 laptop for a couple of weeks now without problems. Signed-off-by: Mikael Pettersson Cc: Andreas Herrmann Cc: Joerg Roedel LKML-Reference: <19223.53436.931768.278021@pilspetsen.it.uu.se> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit c165ffd0ee7e641d104fd419109be30edcf2622c Author: Joerg Roedel Date: Mon Nov 23 12:45:25 2009 +0100 x86/amd-iommu: un__init iommu_setup_msi commit 9f800de38b05d84809e89f16671d636a140eede7 upstream. This function may be called on the resume path and can not be dropped after booting. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 8126ef0cb78bd3c269566b275e631a4c94f0bede Author: Joerg Roedel Date: Mon Nov 23 12:50:00 2009 +0100 x86/amd-iommu: attach devices to pre-allocated domains early commit be831297716036de5b24308447ecb69f1706a846 upstream. For some devices the ACPI table may define unity map requirements which must me met when the IOMMU is enabled. So we need to attach devices to their domains as early as possible so that these mappings are in place when needed. This patch assigns the domains right after they are allocated. Otherwise this can result in I/O page faults before a driver binds to a device and BIOS is still using it. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit ba585c2b49ddcbfe80d59f7e85251da800dea5d9 Author: Dave Jones Date: Tue Nov 10 13:49:24 2009 -0500 x86: Add new Intel CPU cache size descriptors commit 85160b92fbd35321104819283c91bfed2b553e3c upstream. The latest rev of Intel doc AP-485 details new cache descriptors that we don't yet support. 12MB, 18MB and 24MB 24-way assoc L3 caches. Signed-off-by: Dave Jones LKML-Reference: <20091110184924.GA20337@redhat.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 7803a65d537d5155d295ea6d0db79ee14cebf777 Author: Roel Kluin Date: Fri Nov 20 15:34:13 2009 -0300 V4L/DVB: Fix test in copy_reg_bits() commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream. The reg_pair2[j].reg was tested twice. Signed-off-by: Roel Kluin Acked-by: Michael Krufky Signed-off-by: Andrew Morton Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 0e8bd42b299f811fd38b5f1117127db741113b04 Author: Andre Herms Date: Thu Nov 19 18:14:49 2009 +0100 USB: usbtmc: repeat usb_bulk_msg until whole message is transfered commit ec412b92dbe3ea839716853eea058d1bcc5e6ca4 upstream. usb_bulk_msg() transfers only bytes up to the maximum packet size. It must be repeated by the usbtmc driver until all bytes of a TMC message are transfered. Without this patch, ETIMEDOUT is reported when writing TMC messages larger than the maximum USB bulk size and the transfer remains incomplete. The user will notice that the device hangs and must be reset by either closing the application or pulling the plug. Signed-off-by: Andre Herms Signed-off-by: Greg Kroah-Hartman commit 2e8ca1b618a6df647e0557317a8c0fc7f17c5988 Author: Alan Stern Date: Mon Dec 7 16:39:16 2009 -0500 USB: usb-storage: add BAD_SENSE flag commit a0bb108112a872c0b0c4b3ef4974f95fb75b155d upstream. This patch (as1311) fixes a problem in usb-storage: Some devices are pretty broken when it comes to reporting sense data. The information they send back indicates that they have more than 18 bytes of sense data available, but when the system asks for more than 18 they fail or hang. The symptom is that probing fails with multiple resets. The patch adds a new BAD_SENSE flag to indicate that usb-storage should never ask for more than 18 bytes of sense data. The flag can be set in an unusual_devs entry or via the "quirks=" module parameter, and it is set automatically whenever a REQUEST SENSE command for more than 18 bytes fails or times out. An unusual_devs entry is added for the Agfa photo frame, which uses a Prolific chip having this bug. Signed-off-by: Alan Stern Tested-by: Daniel Kukula Signed-off-by: Greg Kroah-Hartman commit 670c58208d3b8c86e52fd5bcf43186c5f45aa8be Author: Zhang Le Date: Tue Nov 17 14:53:42 2009 -0800 USB: option.c: add support for D-Link DWM-162-U5 commit 54a8e144acad6506920f385f4ef2779664f05b21 upstream. Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device has 4 interfaces, of which 1 is handled by storage and the other 3 by option driver. The device appears first as CD-only 05c6:2100 device and must be switched to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch. The MessageContent for usb_modeswitch.conf is: "55534243e0c26a85000000000000061b000000020000000000000000000000" Signed-off-by: Zhang Le Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 8820f3f2ebca46c9bd408d47e54c565fa92ca4e3 Author: Sergei Shtylyov Date: Mon Nov 16 16:24:05 2009 +0530 USB: musb_gadget_ep0: fix unhandled endpoint 0 IRQs, again commit 196f1b7a387546f425df2f1fad26772e3d513aea upstream. Commit a5073b52833e4df8e16c93dc4cbb7e0c558c74a2 (musb_gadget: fix unhandled endpoint 0 IRQs) somehow missed its key change: "The gadget EP0 code routinely ignores an interrupt at end of the data phase because of musb_g_ep0_giveback() resetting the state machine to "idle, waiting for SETUP" phase prematurely." So, the majority of the cases of unhandled IRQs is still unfixed... Signed-off-by: Sergei Shtylyov Signed-off-by: Anand Gadiyar Signed-off-by: Greg Kroah-Hartman commit fa72330af584dc6d360f29493bf8c11b59f7cdf1 Author: Russ Dill Date: Mon Dec 14 21:45:35 2009 -0700 USB: Close usb_find_interface race v3 commit c2d284ee04ab6f6718de2ddcf1b43160e046c41d upstream. USB drivers that create character devices call usb_register_dev in their probe function. This associates the usb_interface device with that minor number and creates the character device and announces it to the world. However, the driver's probe function is called before the new usb_interface is added to the driver's klist_devices. This is a problem because userspace will respond to the character device creation announcement by opening the character device. The driver's open function will the call usb_find_interface to find the usb_interface associated with that minor number. usb_find_interface will walk the driver's list of devices and find the usb_interface with the matching minor number. Because the announcement happens before the usb_interface is added to the driver's klist_devices, a race condition exists. A straightforward fix is to walk the list of devices on usb_bus_type instead since the device is added to that list before the announcement occurs. bus_find_device calls get_device to bump the reference count on the found device. It is arguable that the reference count should be dropped by the caller of usb_find_interface instead of usb_find_interface, however, the current users of usb_find_interface do not expect this. The original version of this patch only matched against minor number instead of driver and minor number. This version matches against both. Signed-off-by: Russ Dill Signed-off-by: Greg Kroah-Hartman commit d3854d8c3d27532a6c0fa988c3c6679c47e89ea5 Author: Roel Kluin Date: Tue Dec 8 13:13:03 2009 -0500 SUNRPC: IS_ERR/PTR_ERR confusion commit 480e3243df156e39eea6c91057e2ae612a6bbe19 upstream. IS_ERR returns 1 or 0, PTR_ERR returns the error value. Signed-off-by: Roel Kluin Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit c80c320eb1a88f22001e2083aa2472e0fa7c7f11 Author: Michael Buesch Date: Mon Nov 23 20:58:06 2009 +0100 ssb: Fix range check in sprom write commit e33761e6f23881de9f3ee77cc2204ab2e26f3d9a upstream. The range check in the sprom image parser hex2sprom() is broken. One sprom word is 4 hex characters. This fixes the check and also adds much better sanity checks to the code. We better make sure the image is OK by doing some sanity checks to avoid bricking the device by accident. Signed-off-by: Michael Buesch Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 4fe58b9c552130fed9f71ef071a1befc7b9f67e8 Author: Igor Grinberg Date: Sun Dec 6 15:45:43 2009 +0200 pxa/em-x270: fix usb hub power up/reset sequence commit 1b82e4c32fba96d8805b1e2126ba5382e56fac32 upstream. Signed-off-by: Igor Grinberg Signed-off-by: Mike Rapoport Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman commit 0454815409609fa916aef4e4ebea2ba1f5491532 Author: Sergei Shtylyov Date: Fri Nov 27 22:29:02 2009 +0400 pata_hpt{37x|3x2n}: fix timing register masks (take 2) commit 5600c70e576199a7552e1c0fff43f3fe16f5566e upstream. These drivers inherited from the older 'hpt366' IDE driver the buggy timing register masks in their set_piomode() metods. As a result, too low command cycle active time is programmed for slow PIO modes. Quite fortunately, it's later "fixed up" by the set_dmamode() methods which also "helpfully" reprogram the command timings, usually to PIO mode 4; unfortunately, setting an UltraDMA mode #N also reprograms already set PIO data timings, usually to MWDMA mode # max(N, 2) timings... However, the drivers added some breakage of their own too: the bit that they set/clear to control the FIFO is sometimes wrong -- it's actually the MSB of the command cycle setup time; also, setting it in DMA mode is wrong as this bit is only for PIO actually and clearing it for PIO modes is not needed as no mode in any timing table has it set... Fix all this, inverting the masks while at it, like in the 'hpt366' and 'pata_hpt366' drivers; bump the drivers' versions, accounting for recent patches that forgot to do it... Signed-off-by: Sergei Shtylyov Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit daa991df23561fabbcbe1a6995f706de36a095ac Author: NeilBrown Date: Mon Dec 14 12:49:46 2009 +1100 md/bitmap: protect against bitmap removal while being updated. commit aa5cbd103887011b4830355f88fb055f9ad2d556 upstream. A write intent bitmap can be removed from an array while the array is active. When this happens, all IO is suspended and flushed before the bitmap is removed. However it is possible that bitmap_daemon_work is still running to clear old bits from the bitmap. If it is, it can dereference the bitmap after it has been freed. So introduce a new mutex to protect bitmap_daemon_work and get it before destroying a bitmap. This is suitable for any current -stable kernel. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit b5939fce19ddfb6fd1edb613278d9b44d3f25e0a Author: Carsten Otte Date: Thu Nov 19 14:21:16 2009 +0100 KVM: s390: Make psw available on all exits, not just a subset commit d7b0b5eb3000c6fb902f08c619fcd673a23d8fab upstream. This patch moves s390 processor status word into the base kvm_run struct and keeps it up-to date on all userspace exits. The userspace ABI is broken by this, however there are no applications in the wild using this. A capability check is provided so users can verify the updated API exists. Signed-off-by: Carsten Otte Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 92f045e6754b67fdf6f32a5adafd48dbfa941192 Author: Theodore Ts'o Date: Sun Nov 15 15:31:37 2009 -0500 jbd2: don't wipe the journal on a failed journal checksum commit e6a47428de84e19fda52f21ab73fde2906c40d09 upstream. If there is a failed journal checksum, don't reset the journal. This allows for userspace programs to decide how to recover from this situation. It may be that ignoring the journal checksum failure might be a better way of recovering the file system. Once we add per-block checksums, we can definitely do better. Until then, a system administrator can try backing up the file system image (or taking a snapshot) and and trying to determine experimentally whether ignoring the checksum failure or aborting the journal replay results in less data loss. Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 083e53a1b85947aa77a62d94aa5edc8b049e346f Author: Feng Tang Date: Thu Sep 3 16:32:53 2009 +0800 hrtimer: Fix /proc/timer_list regression commit 8629ea2eaba8ca0de2e38ce1b4a825e16255976e upstream. commit 507e1231 (timer stats: Optimize by adding quick check to avoid function calls) introduced a regression in /proc/timer_list. /proc/timer_list shows now #0: , tick_sched_timer, S:01, <(null)>, /-1 instead of #0: , tick_sched_timer, S:01, hrtimer_start, swapper/0 Revert the hrtimer quick check for now. The optimization needs more thought, but this is neither 2.6.32-rc7 nor stable material. [ tglx: - Removed unrelated changes from the original patch - Prevent unneccesary call to timer_stats_update_stats - massaged the changelog ] Signed-off-by: Feng Tang LKML-Reference: Cc: Heiko Carstens Signed-off-by: Andrew Morton Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 1bbb1bc059ba2a38659b46d0be9bc58521373356 Author: Amerigo Wang Date: Mon Dec 14 17:57:37 2009 -0800 hfs: fix a potential buffer overflow commit ec81aecb29668ad71f699f4e7b96ec46691895b6 upstream. A specially-crafted Hierarchical File System (HFS) filesystem could cause a buffer overflow to occur in a process's kernel stack during a memcpy() call within the hfs_bnode_read() function (at fs/hfs/bnode.c:24). The attacker can provide the source buffer and length, and the destination buffer is a local variable of a fixed length. This local variable (passed as "&entry" from fs/hfs/dir.c:112 and allocated on line 60) is stored in the stack frame of hfs_bnode_read()'s caller, which is hfs_readdir(). Because the hfs_readdir() function executes upon any attempt to read a directory on the filesystem, it gets called whenever a user attempts to inspect any filesystem contents. [amwang@redhat.com: modify this patch and fix coding style problems] Signed-off-by: WANG Cong Cc: Eugene Teo Cc: Roman Zippel Cc: Al Viro Cc: Christoph Hellwig Cc: Alexey Dobriyan Cc: Dave Anderson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 7098a7420bc7c75253d785119d91be6ab15e18e5 Author: Andi Kleen Date: Tue Dec 8 13:19:42 2009 +0100 futex: Take mmap_sem for get_user_pages in fault_in_user_writeable commit 722d0172377a5697919b9f7e5beb95165b1dec4e upstream. get_user_pages() must be called with mmap_sem held. Signed-off-by: Andi Kleen Cc: Andrew Morton Cc: Nick Piggin Cc: Darren Hart Cc: Peter Zijlstra LKML-Reference: <20091208121942.GA21298@basil.fritz.box> Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 1f5c6cef516b8ff4d5fe5f6976a5aad5b4ee9c06 Author: Sukadev Bhattiprolu Date: Tue Nov 17 18:35:43 2009 -0800 devpts_get_tty() should validate inode commit edfacdd6f81119b9005615593f2cbd94b8c7e2d8 upstream. devpts_get_tty() assumes that the inode passed in is associated with a valid pty. But if the only reference to the pty is via a bind-mount, the inode passed to devpts_get_tty() while valid, would refer to a pty that no longer exists. With a lot of debug effort, Grzegorz Nosek developed a small program (see below) to reproduce a crash on recent kernels. This crash is a regression introduced by the commit: commit 527b3e4773628b30d03323a2cb5fb0d84441990f Author: Sukadev Bhattiprolu Date: Mon Oct 13 10:43:08 2008 +0100 To fix, ensure that the dentry associated with the inode has not yet been deleted/unhashed by devpts_pty_kill(). See also: https://lists.linux-foundation.org/pipermail/containers/2009-July/019273.html tty-bug.c: #define _GNU_SOURCE #include #include #include #include #include #include #include #include void dummy(int sig) { } static int child(void *unused) { int fd; signal(SIGINT, dummy); signal(SIGHUP, dummy); pause(); /* cheesy synchronisation to wait for /dev/pts/0 to appear */ mount("/dev/pts/0", "/dev/console", NULL, MS_BIND, NULL); sleep(2); fd = open("/dev/console", O_RDWR); dup(0); dup(0); write(1, "Hello world!\n", sizeof("Hello world!\n")-1); return 0; } int main(void) { pid_t pid; char *stack; stack = malloc(16384); pid = clone(child, stack+16384, CLONE_NEWNS|SIGCHLD, NULL); open("/dev/ptmx", O_RDWR|O_NOCTTY|O_NONBLOCK); unlockpt(fd); grantpt(fd); sleep(2); kill(pid, SIGHUP); sleep(1); return 0; /* exit before child opens /dev/console */ } Reported-by: Grzegorz Nosek Signed-off-by: Sukadev Bhattiprolu Tested-by: Serge Hallyn Signed-off-by: Greg Kroah-Hartman commit f4173b24e1f6072177cf2354bb9e4337c99f4fa6 Author: Mathieu Desnoyers Date: Tue Nov 17 14:40:26 2009 -0800 debugfs: fix create mutex racy fops and private data commit d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc upstream. Setting fops and private data outside of the mutex at debugfs file creation introduces a race where the files can be opened with the wrong file operations and private data. It is easy to trigger with a process waiting on file creation notification. Signed-off-by: Mathieu Desnoyers Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 946b3840c95bab8ef96de7b1f6f738eb9ec08373 Author: Alexey Dobriyan Date: Mon Dec 14 17:57:34 2009 -0800 bsdacct: fix uid/gid misreporting commit 4b731d50ff3df6b9141a6c12b088e8eb0109e83c upstream. commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 "bsdacct: switch credentials for writing to the accounting file" introduced credential switching during final acct data collecting. However, uid/gid pair continued to be collected from current which became credentials of who created acct file, not who exits. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14676 Signed-off-by: Alexey Dobriyan Reported-by: Juho K. Juopperi Acked-by: Serge Hallyn Acked-by: David Howells Reviewed-by: Michal Schmidt Cc: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 0027ce4116e62c943f61f8db8cd92e0d538257a4 Author: Luis R. Rodriguez Date: Wed Nov 25 17:23:26 2009 -0500 ath5k: enable EEPROM checksum check commit 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc upstream. Without this we have no gaurantee of the integrity of the EEPROM and are likely to encounter a lot of bogus bug reports due to actual issues on the EEPROM. With the EEPROM checksum check in place we can easily rule those issues out. If you run patch during a revert *you* have a card with a busted EEPROM and only older kernel will support that concoction. This patch is a trade off between not accepitng bogus EEPROMs and avoiding bogus bug reports allowing developers to focus instead on real concrete issues. If stable keeps bogus bug reports because of a possibly busted EEPROM feel free to apply this there too. Tested on an AR5414 Cc: jirislaby@gmail.com Cc: akpm@linux-foundation.org Cc: rjw@sisk.pl Cc: me@bobcopeland.com Cc: david.quan@atheros.com Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 264eaee38a94afb926d57e5c6df52013092d27bf Author: Bob Copeland Date: Mon Nov 16 08:30:29 2009 -0500 ath5k: allow setting txpower to 0 commit 2eb2fa67e5462a36e98172fb92c78bc405b3035f upstream. As a holdover from earlier code when we used to set the power limit to '0' after a reset to configure the default transmit power, ath5k interprets txpower=0 as 12.5 dBm. Fix that by just passing 0 through. This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14567 Reported-by: Daniel Folkers Tested-by: Daniel Folkers Signed-off-by: Bob Copeland Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 417cb778fa991b562e4c98151b274bd77d1a8b09 Author: Takashi Iwai Date: Fri Dec 11 12:51:05 2009 +0100 ALSA: hrtimer - Fix lock-up commit fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 upstream. The timer stop callback can be called from snd_timer_interrupt(), which is called from the hrtimer callback. Since hrtimer_cancel() waits for the callback completion, this eventually results in a lock-up. This patch fixes the problem by just toggling a flag at stop callback and call hrtimer_cancel() later. Reported-and-tested-by: Wojtek Zabolotny Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 11df973c127790d451a4365de7180c4f3f6ba030 Author: Jaroslav Kysela Date: Wed Dec 9 10:44:47 2009 +0100 ALSA: hda - Terradici HDA controllers does not support 64-bit mode commit 396087eaead95fcb29eb36f1e59517aeb58c545e upstream. Confirmed from vendor and tests in RedHat bugzilla #536782 . Signed-off-by: Jaroslav Kysela Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit ed033bf1ff69361887b6a79cdf6131ed0931fbbc Author: Jay Fenlason Date: Fri Dec 11 14:23:58 2009 -0500 firewire: ohci: handle receive packets with a data length of zero commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream. Queueing to receive an ISO packet with a payload length of zero silently does nothing in dualbuffer mode, and crashes the kernel in packet-per-buffer mode. Return an error in dualbuffer mode, because the DMA controller won't let us do what we want, and work correctly in packet-per-buffer mode. Signed-off-by: Jay Fenlason Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit 9b6950a5e8986e97dd195070443f866035dfc5ef Author: Alan Stern Date: Mon Dec 7 16:47:43 2009 -0500 USB: usb-storage: fix bug in fill_inquiry commit f3f6faa9edf67c1018270793e0547b0f81abb47e upstream. This patch (as1312) fixes a minor bug in usb-storage. The fill_inquiry() routine neglects to pre-load the inquiry data buffer with spaces. As a result, if the vendor name is shorter than 8 characters or the product name is shorter than 16, the remainder will be filled with garbage. The patch also removes some unnecessary calls to strlen(). Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 944c010bcef4f0e4e5167121dab6b3a09c90ba87 Author: zhao.ming9@zte.com.cn Date: Mon Dec 7 11:36:34 2009 +0800 USB: option: add pid for ZTE commit 8d87cacda7c8db5c131bfcaaa1d90bfe918c2ebc upstream. This patch adds ZTE modem devices. Signed-off-by: Ming Zhao Signed-off-by: Greg Kroah-Hartman