1 From: Greg Kroah-Hartman <gregkh@suse.de>
2 Subject: Linux 2.6.27.5
4 Upstream 2.6.27.5 release from kernel.org
6 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
8 diff --git a/Documentation/i2c/busses/i2c-sis96x b/Documentation/i2c/busses/i2c-sis96x
9 index 266481f..70e6a0c 100644
10 --- a/Documentation/i2c/busses/i2c-sis96x
11 +++ b/Documentation/i2c/busses/i2c-sis96x
12 @@ -42,7 +42,7 @@ I suspect that this driver could be made to work for the following SiS
13 chipsets as well: 635, and 635T. If anyone owns a board with those chips
14 AND is willing to risk crashing & burning an otherwise well-behaved kernel
15 in the name of progress... please contact me at <mhoffman@lightlink.com> or
16 -via the project's mailing list: <i2c@lm-sensors.org>. Please send bug
17 +via the linux-i2c mailing list: <linux-i2c@vger.kernel.org>. Please send bug
18 reports and/or success stories as well.
21 diff --git a/MAINTAINERS b/MAINTAINERS
22 index 8dae455..ff24d01 100644
25 @@ -360,7 +360,7 @@ S: Maintained
28 M: r.marek@assembler.cz
29 -L: i2c@lm-sensors.org
30 +L: linux-i2c@vger.kernel.org
34 @@ -1681,7 +1681,7 @@ FREESCALE I2C CPM DRIVER
37 L: linuxppc-dev@ozlabs.org
38 -L: i2c@lm-sensors.org
39 +L: linux-i2c@vger.kernel.org
42 FREESCALE SOC FS_ENET DRIVER
43 @@ -1982,7 +1982,7 @@ S: Maintained
46 M: mhoffman@lightlink.com
47 -L: i2c@lm-sensors.org
48 +L: linux-i2c@vger.kernel.org
52 @@ -1990,14 +1990,14 @@ P: Jean Delvare (PC drivers, core)
54 P: Ben Dooks (embedded platforms)
55 M: ben-linux@fluff.org
56 -L: i2c@lm-sensors.org
57 +L: linux-i2c@vger.kernel.org
58 T: quilt http://khali.linux-fr.org/devel/linux-2.6/jdelvare-i2c/
64 -L: i2c@lm-sensors.org
65 +L: linux-i2c@vger.kernel.org
66 T: http://www.harbaum.org/till/i2c_tiny_usb
69 @@ -3070,7 +3070,7 @@ S: Maintained
70 OPENCORES I2C BUS DRIVER
73 -L: i2c@lm-sensors.org
74 +L: linux-i2c@vger.kernel.org
77 ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
78 @@ -3144,7 +3144,7 @@ S: Maintained
82 -L: i2c@lm-sensors.org
83 +L: linux-i2c@vger.kernel.org
87 @@ -3280,7 +3280,7 @@ S: Maintained
90 M: vitalywool@gmail.com
91 -L: i2c@lm-sensors.org
92 +L: linux-i2c@vger.kernel.org
95 PPP PROTOCOL DRIVERS AND COMPRESSORS
96 @@ -3725,7 +3725,7 @@ S: Maintained
97 SIS 96X I2C/SMBUS DRIVER
99 M: mhoffman@lightlink.com
100 -L: i2c@lm-sensors.org
101 +L: linux-i2c@vger.kernel.org
104 SIS FRAMEBUFFER DRIVER
105 @@ -4445,7 +4445,7 @@ S: Maintained
108 M: khali@linux-fr.org
109 -L: i2c@lm-sensors.org
110 +L: linux-i2c@vger.kernel.org
113 VIA VELOCITY NETWORK DRIVER
114 diff --git a/Makefile b/Makefile
115 index 7529a72..4ea7b3c 100644
124 NAME = Trembling Tortoise
127 diff --git a/arch/powerpc/configs/linkstation_defconfig b/arch/powerpc/configs/linkstation_defconfig
128 index 6fc4c21..d0846ec 100644
129 --- a/arch/powerpc/configs/linkstation_defconfig
130 +++ b/arch/powerpc/configs/linkstation_defconfig
133 # Automatically generated make config: don't edit
134 -# Linux kernel version: 2.6.27-rc4
135 -# Thu Aug 21 00:52:05 2008
136 +# Linux kernel version: 2.6.27
137 +# Fri Oct 24 00:42:39 2008
139 # CONFIG_PPC64 is not set
141 @@ -934,7 +934,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
143 CONFIG_SERIAL_CORE_CONSOLE=y
144 # CONFIG_SERIAL_JSM is not set
145 -CONFIG_SERIAL_OF_PLATFORM=y
146 +# CONFIG_SERIAL_OF_PLATFORM is not set
149 CONFIG_LEGACY_PTY_COUNT=256
150 @@ -1211,7 +1211,6 @@ CONFIG_USB_STORAGE=m
151 # CONFIG_USB_STORAGE_ALAUDA is not set
152 # CONFIG_USB_STORAGE_ONETOUCH is not set
153 # CONFIG_USB_STORAGE_KARMA is not set
154 -# CONFIG_USB_STORAGE_SIERRA is not set
155 # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
156 # CONFIG_USB_LIBUSUAL is not set
158 diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
159 index 8920eea..16319a5 100644
160 --- a/arch/powerpc/mm/hash_utils_64.c
161 +++ b/arch/powerpc/mm/hash_utils_64.c
162 @@ -381,8 +381,10 @@ static int __init htab_dt_scan_hugepage_blocks(unsigned long node,
163 printk(KERN_INFO "Huge page(16GB) memory: "
164 "addr = 0x%lX size = 0x%lX pages = %d\n",
165 phys_addr, block_size, expected_pages);
166 - lmb_reserve(phys_addr, block_size * expected_pages);
167 - add_gpage(phys_addr, block_size, expected_pages);
168 + if (phys_addr + (16 * GB) <= lmb_end_of_DRAM()) {
169 + lmb_reserve(phys_addr, block_size * expected_pages);
170 + add_gpage(phys_addr, block_size, expected_pages);
175 diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
176 index d9a1813..b5ae97e 100644
177 --- a/arch/powerpc/mm/numa.c
178 +++ b/arch/powerpc/mm/numa.c
179 @@ -89,6 +89,48 @@ static int __cpuinit fake_numa_create_new_node(unsigned long end_pfn,
184 + * get_active_region_work_fn - A helper function for get_node_active_region
185 + * Returns datax set to the start_pfn and end_pfn if they contain
186 + * the initial value of datax->start_pfn between them
187 + * @start_pfn: start page(inclusive) of region to check
188 + * @end_pfn: end page(exclusive) of region to check
189 + * @datax: comes in with ->start_pfn set to value to search for and
190 + * goes out with active range if it contains it
191 + * Returns 1 if search value is in range else 0
193 +static int __init get_active_region_work_fn(unsigned long start_pfn,
194 + unsigned long end_pfn, void *datax)
196 + struct node_active_region *data;
197 + data = (struct node_active_region *)datax;
199 + if (start_pfn <= data->start_pfn && end_pfn > data->start_pfn) {
200 + data->start_pfn = start_pfn;
201 + data->end_pfn = end_pfn;
209 + * get_node_active_region - Return active region containing start_pfn
210 + * Active range returned is empty if none found.
211 + * @start_pfn: The page to return the region for.
212 + * @node_ar: Returned set to the active region containing start_pfn
214 +static void __init get_node_active_region(unsigned long start_pfn,
215 + struct node_active_region *node_ar)
217 + int nid = early_pfn_to_nid(start_pfn);
219 + node_ar->nid = nid;
220 + node_ar->start_pfn = start_pfn;
221 + node_ar->end_pfn = start_pfn;
222 + work_with_active_regions(nid, get_active_region_work_fn, node_ar);
225 static void __cpuinit map_cpu_to_node(int cpu, int node)
227 numa_cpu_lookup_table[cpu] = node;
228 @@ -837,38 +879,53 @@ void __init do_init_bootmem(void)
231 free_bootmem_with_active_regions(nid, end_pfn);
234 - /* Mark reserved regions on this node */
235 - for (i = 0; i < lmb.reserved.cnt; i++) {
236 - unsigned long physbase = lmb.reserved.region[i].base;
237 - unsigned long size = lmb.reserved.region[i].size;
238 - unsigned long start_paddr = start_pfn << PAGE_SHIFT;
239 - unsigned long end_paddr = end_pfn << PAGE_SHIFT;
241 - if (early_pfn_to_nid(physbase >> PAGE_SHIFT) != nid &&
242 - early_pfn_to_nid((physbase+size-1) >> PAGE_SHIFT) != nid)
245 - if (physbase < end_paddr &&
246 - (physbase+size) > start_paddr) {
248 - if (physbase < start_paddr) {
249 - size -= start_paddr - physbase;
250 - physbase = start_paddr;
253 - if (size > end_paddr - physbase)
254 - size = end_paddr - physbase;
256 - dbg("reserve_bootmem %lx %lx\n", physbase,
258 - reserve_bootmem_node(NODE_DATA(nid), physbase,
259 - size, BOOTMEM_DEFAULT);
261 + /* Mark reserved regions */
262 + for (i = 0; i < lmb.reserved.cnt; i++) {
263 + unsigned long physbase = lmb.reserved.region[i].base;
264 + unsigned long size = lmb.reserved.region[i].size;
265 + unsigned long start_pfn = physbase >> PAGE_SHIFT;
266 + unsigned long end_pfn = ((physbase + size) >> PAGE_SHIFT);
267 + struct node_active_region node_ar;
269 + get_node_active_region(start_pfn, &node_ar);
270 + while (start_pfn < end_pfn &&
271 + node_ar.start_pfn < node_ar.end_pfn) {
272 + unsigned long reserve_size = size;
274 + * if reserved region extends past active region
275 + * then trim size to active region
277 + if (end_pfn > node_ar.end_pfn)
278 + reserve_size = (node_ar.end_pfn << PAGE_SHIFT)
279 + - (start_pfn << PAGE_SHIFT);
280 + dbg("reserve_bootmem %lx %lx nid=%d\n", physbase,
281 + reserve_size, node_ar.nid);
282 + reserve_bootmem_node(NODE_DATA(node_ar.nid), physbase,
283 + reserve_size, BOOTMEM_DEFAULT);
285 + * if reserved region is contained in the active region
288 + if (end_pfn <= node_ar.end_pfn)
292 + * reserved region extends past the active region
293 + * get next active region that contains this
296 + start_pfn = node_ar.end_pfn;
297 + physbase = start_pfn << PAGE_SHIFT;
298 + size = size - reserve_size;
299 + get_node_active_region(start_pfn, &node_ar);
302 - sparse_memory_present_with_active_regions(nid);
305 + for_each_online_node(nid)
306 + sparse_memory_present_with_active_regions(nid);
309 void __init paging_init(void)
310 diff --git a/arch/powerpc/platforms/embedded6xx/linkstation.c b/arch/powerpc/platforms/embedded6xx/linkstation.c
311 index eb5d74e..2ca7be6 100644
312 --- a/arch/powerpc/platforms/embedded6xx/linkstation.c
313 +++ b/arch/powerpc/platforms/embedded6xx/linkstation.c
315 #include <linux/kernel.h>
316 #include <linux/initrd.h>
317 #include <linux/mtd/physmap.h>
318 +#include <linux/of_platform.h>
320 #include <asm/time.h>
321 #include <asm/prom.h>
322 @@ -54,6 +55,19 @@ static struct mtd_partition linkstation_physmap_partitions[] = {
326 +static __initdata struct of_device_id of_bus_ids[] = {
327 + { .type = "soc", },
328 + { .compatible = "simple-bus", },
332 +static int __init declare_of_platform_devices(void)
334 + of_platform_bus_probe(NULL, of_bus_ids, NULL);
337 +machine_device_initcall(linkstation, declare_of_platform_devices);
339 static int __init linkstation_add_bridge(struct device_node *dev)
342 diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
343 index 00b9b4d..fdfca4f 100644
344 --- a/arch/s390/kernel/smp.c
345 +++ b/arch/s390/kernel/smp.c
346 @@ -1117,9 +1117,7 @@ out:
350 -static ssize_t __ref rescan_store(struct sys_device *dev,
351 - struct sysdev_attribute *attr,
353 +static ssize_t __ref rescan_store(struct sysdev_class *class, const char *buf,
357 @@ -1127,12 +1125,10 @@ static ssize_t __ref rescan_store(struct sys_device *dev,
358 rc = smp_rescan_cpus();
359 return rc ? rc : count;
361 -static SYSDEV_ATTR(rescan, 0200, NULL, rescan_store);
362 +static SYSDEV_CLASS_ATTR(rescan, 0200, NULL, rescan_store);
363 #endif /* CONFIG_HOTPLUG_CPU */
365 -static ssize_t dispatching_show(struct sys_device *dev,
366 - struct sysdev_attribute *attr,
368 +static ssize_t dispatching_show(struct sysdev_class *class, char *buf)
372 @@ -1142,9 +1138,8 @@ static ssize_t dispatching_show(struct sys_device *dev,
376 -static ssize_t dispatching_store(struct sys_device *dev,
377 - struct sysdev_attribute *attr,
378 - const char *buf, size_t count)
379 +static ssize_t dispatching_store(struct sysdev_class *dev, const char *buf,
384 @@ -1166,7 +1161,8 @@ out:
386 return rc ? rc : count;
388 -static SYSDEV_ATTR(dispatching, 0644, dispatching_show, dispatching_store);
389 +static SYSDEV_CLASS_ATTR(dispatching, 0644, dispatching_show,
390 + dispatching_store);
392 static int __init topology_init(void)
394 @@ -1176,13 +1172,11 @@ static int __init topology_init(void)
395 register_cpu_notifier(&smp_cpu_nb);
397 #ifdef CONFIG_HOTPLUG_CPU
398 - rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
399 - &attr_rescan.attr);
400 + rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_rescan);
404 - rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
405 - &attr_dispatching.attr);
406 + rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_dispatching);
409 for_each_present_cpu(cpu) {
410 diff --git a/arch/sparc64/kernel/trampoline.S b/arch/sparc64/kernel/trampoline.S
411 index 704a3af..83abd5a 100644
412 --- a/arch/sparc64/kernel/trampoline.S
413 +++ b/arch/sparc64/kernel/trampoline.S
414 @@ -328,6 +328,12 @@ after_lock_tlb:
418 + sethi %hi(prom_entry_lock), %g2
419 +1: ldstub [%g2 + %lo(prom_entry_lock)], %g1
420 + membar #StoreLoad | #StoreStore
424 /* As a hack, put &init_thread_union into %g6.
425 * prom_world() loads from here to restore the %asi
427 @@ -337,7 +343,7 @@ after_lock_tlb:
429 sethi %hi(is_sun4v), %o0
430 lduw [%o0 + %lo(is_sun4v)], %o0
435 TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
436 @@ -369,10 +375,10 @@ after_lock_tlb:
438 add %sp, (2047 + 128), %o0
444 -1: sethi %hi(sparc64_ttable_tl0), %o0
445 +2: sethi %hi(sparc64_ttable_tl0), %o0
446 set prom_set_trap_table_name, %g2
447 stx %g2, [%sp + 2047 + 128 + 0x00]
449 @@ -386,7 +392,11 @@ after_lock_tlb:
451 add %sp, (2047 + 128), %o0
454 +3: sethi %hi(prom_entry_lock), %g2
455 + stb %g0, [%g2 + %lo(prom_entry_lock)]
456 + membar #StoreStore | #StoreLoad
459 ldx [%g6 + TI_TASK], %g4
462 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
463 index e12e0e4..5a7c539 100644
464 --- a/arch/x86/kernel/process_64.c
465 +++ b/arch/x86/kernel/process_64.c
466 @@ -729,12 +729,12 @@ unsigned long get_wchan(struct task_struct *p)
467 if (!p || p == current || p->state==TASK_RUNNING)
469 stack = (unsigned long)task_stack_page(p);
470 - if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
471 + if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
473 fp = *(u64 *)(p->thread.sp);
475 if (fp < (unsigned long)stack ||
476 - fp > (unsigned long)stack+THREAD_SIZE)
477 + fp >= (unsigned long)stack+THREAD_SIZE)
480 if (!in_sched_functions(ip))
481 diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
482 index 05191bb..0a23b57 100644
483 --- a/arch/x86/kernel/rtc.c
484 +++ b/arch/x86/kernel/rtc.c
485 @@ -223,11 +223,25 @@ static struct platform_device rtc_device = {
486 static __init int add_rtc_cmos(void)
489 - if (!pnp_platform_devices)
490 - platform_device_register(&rtc_device);
492 + static const char *ids[] __initconst =
493 + { "PNP0b00", "PNP0b01", "PNP0b02", };
494 + struct pnp_dev *dev;
498 + pnp_for_each_dev(dev) {
499 + for (id = dev->id; id; id = id->next) {
500 + for (i = 0; i < ARRAY_SIZE(ids); i++) {
501 + if (compare_pnp_id(id, ids[i]) != 0)
508 platform_device_register(&rtc_device);
509 -#endif /* CONFIG_PNP */
510 + dev_info(&rtc_device.dev,
511 + "registered platform RTC device (no PNP device found)\n");
514 device_initcall(add_rtc_cmos);
515 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
516 index 2a50e0f..ac144c2 100644
517 --- a/arch/x86/mm/pat.c
518 +++ b/arch/x86/mm/pat.c
519 @@ -403,12 +403,16 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
523 +/* This check is needed to avoid cache aliasing when PAT is enabled */
524 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
526 u64 from = ((u64)pfn) << PAGE_SHIFT;
527 u64 to = from + size;
533 while (cursor < to) {
534 if (!devmem_is_allowed(pfn)) {
536 diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
537 index 1dfec41..59352d9 100644
538 --- a/drivers/acpi/button.c
539 +++ b/drivers/acpi/button.c
540 @@ -262,6 +262,7 @@ static int acpi_lid_send_state(struct acpi_button *button)
542 /* input layer checks if event is redundant */
543 input_report_switch(button->input, SW_LID, !state);
544 + input_sync(button->input);
548 @@ -285,8 +286,8 @@ static void acpi_button_notify(acpi_handle handle, u32 event, void *data)
549 input_report_key(input, keycode, 1);
551 input_report_key(input, keycode, 0);
556 acpi_bus_generate_proc_event(button->device, event,
558 diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
559 index 13593f9..444cd9e 100644
560 --- a/drivers/acpi/ec.c
561 +++ b/drivers/acpi/ec.c
564 - * ec.c - ACPI Embedded Controller Driver (v2.0)
565 + * ec.c - ACPI Embedded Controller Driver (v2.1)
567 - * Copyright (C) 2006, 2007 Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>
568 + * Copyright (C) 2006-2008 Alexey Starikovskiy <astarikovskiy@suse.de>
569 * Copyright (C) 2006 Denis Sadykov <denis.m.sadykov@intel.com>
570 * Copyright (C) 2004 Luming Yu <luming.yu@intel.com>
571 * Copyright (C) 2001, 2002 Andy Grover <andrew.grover@intel.com>
573 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
576 -/* Uncomment next line to get verbose print outs*/
577 +/* Uncomment next line to get verbose printout */
580 #include <linux/kernel.h>
582 #include <linux/seq_file.h>
583 #include <linux/interrupt.h>
584 #include <linux/list.h>
585 +#include <linux/spinlock.h>
587 #include <acpi/acpi_bus.h>
588 #include <acpi/acpi_drivers.h>
589 @@ -65,22 +66,21 @@ enum ec_command {
590 ACPI_EC_COMMAND_QUERY = 0x84,
595 - ACPI_EC_EVENT_OBF_1 = 1, /* Output buffer full */
596 - ACPI_EC_EVENT_IBF_0, /* Input buffer empty */
599 #define ACPI_EC_DELAY 500 /* Wait 500ms max. during EC ops */
600 #define ACPI_EC_UDELAY_GLK 1000 /* Wait 1ms max. to get global lock */
601 #define ACPI_EC_UDELAY 100 /* Wait 100us before polling EC again */
603 +#define ACPI_EC_STORM_THRESHOLD 20 /* number of false interrupts
604 + per one transaction */
607 - EC_FLAGS_WAIT_GPE = 0, /* Don't check status until GPE arrives */
608 EC_FLAGS_QUERY_PENDING, /* Query is pending */
609 - EC_FLAGS_GPE_MODE, /* Expect GPE to be sent for status change */
610 + EC_FLAGS_GPE_MODE, /* Expect GPE to be sent
611 + * for status change */
612 EC_FLAGS_NO_GPE, /* Don't use GPE mode */
613 - EC_FLAGS_RESCHEDULE_POLL /* Re-schedule poll */
614 + EC_FLAGS_GPE_STORM, /* GPE storm detected */
615 + EC_FLAGS_HANDLERS_INSTALLED /* Handlers for GPE and
616 + * OpReg are installed */
619 /* If we find an EC via the ECDT, we need to keep a ptr to its context */
620 @@ -95,6 +95,15 @@ struct acpi_ec_query_handler {
624 +struct transaction {
627 + unsigned short irq_count;
633 static struct acpi_ec {
636 @@ -105,9 +114,8 @@ static struct acpi_ec {
638 wait_queue_head_t wait;
639 struct list_head list;
640 - struct delayed_work work;
641 - atomic_t irq_count;
642 - u8 handlers_installed;
643 + struct transaction *curr;
644 + spinlock_t curr_lock;
645 } *boot_ec, *first_ec;
648 @@ -150,7 +158,7 @@ static inline u8 acpi_ec_read_data(struct acpi_ec *ec)
650 u8 x = inb(ec->data_addr);
651 pr_debug(PREFIX "---> data = 0x%2.2x\n", x);
652 - return inb(ec->data_addr);
656 static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command)
657 @@ -165,158 +173,172 @@ static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
658 outb(data, ec->data_addr);
661 -static inline int acpi_ec_check_status(struct acpi_ec *ec, enum ec_event event)
662 +static int ec_transaction_done(struct acpi_ec *ec)
664 - if (test_bit(EC_FLAGS_WAIT_GPE, &ec->flags))
666 - if (event == ACPI_EC_EVENT_OBF_1) {
667 - if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_OBF)
669 - } else if (event == ACPI_EC_EVENT_IBF_0) {
670 - if (!(acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF))
675 + unsigned long flags;
677 + spin_lock_irqsave(&ec->curr_lock, flags);
678 + if (!ec->curr || (!ec->curr->wlen && !ec->curr->rlen))
680 + spin_unlock_irqrestore(&ec->curr_lock, flags);
684 -static void ec_schedule_ec_poll(struct acpi_ec *ec)
685 +static void gpe_transaction(struct acpi_ec *ec, u8 status)
687 - if (test_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags))
688 - schedule_delayed_work(&ec->work,
689 - msecs_to_jiffies(ACPI_EC_DELAY));
690 + unsigned long flags;
691 + spin_lock_irqsave(&ec->curr_lock, flags);
694 + if (ec->curr->wlen > 0) {
695 + if ((status & ACPI_EC_FLAG_IBF) == 0) {
696 + acpi_ec_write_data(ec, *(ec->curr->wdata++));
699 + /* false interrupt, state didn't change */
700 + ++ec->curr->irq_count;
702 + } else if (ec->curr->rlen > 0) {
703 + if ((status & ACPI_EC_FLAG_OBF) == 1) {
704 + *(ec->curr->rdata++) = acpi_ec_read_data(ec);
707 + /* false interrupt, state didn't change */
708 + ++ec->curr->irq_count;
711 + spin_unlock_irqrestore(&ec->curr_lock, flags);
714 -static void ec_switch_to_poll_mode(struct acpi_ec *ec)
715 +static int acpi_ec_wait(struct acpi_ec *ec)
717 + if (wait_event_timeout(ec->wait, ec_transaction_done(ec),
718 + msecs_to_jiffies(ACPI_EC_DELAY)))
720 + /* missing GPEs, switch back to poll mode */
721 + if (printk_ratelimit())
722 + pr_info(PREFIX "missing confirmations, "
723 + "switch off interrupt mode.\n");
724 set_bit(EC_FLAGS_NO_GPE, &ec->flags);
725 clear_bit(EC_FLAGS_GPE_MODE, &ec->flags);
726 - acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
727 - set_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
731 -static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, int force_poll)
732 +static void acpi_ec_gpe_query(void *ec_cxt);
734 +static int ec_check_sci(struct acpi_ec *ec, u8 state)
736 - atomic_set(&ec->irq_count, 0);
737 - if (likely(test_bit(EC_FLAGS_GPE_MODE, &ec->flags)) &&
738 - likely(!force_poll)) {
739 - if (wait_event_timeout(ec->wait, acpi_ec_check_status(ec, event),
740 - msecs_to_jiffies(ACPI_EC_DELAY)))
742 - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
743 - if (acpi_ec_check_status(ec, event)) {
744 - /* missing GPEs, switch back to poll mode */
745 - if (printk_ratelimit())
746 - pr_info(PREFIX "missing confirmations, "
747 - "switch off interrupt mode.\n");
748 - ec_switch_to_poll_mode(ec);
749 - ec_schedule_ec_poll(ec);
753 - unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
754 - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
755 - while (time_before(jiffies, delay)) {
756 - if (acpi_ec_check_status(ec, event))
760 - if (acpi_ec_check_status(ec,event))
761 + if (state & ACPI_EC_FLAG_SCI) {
762 + if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
763 + return acpi_os_execute(OSL_EC_BURST_HANDLER,
764 + acpi_ec_gpe_query, ec);
769 +static int ec_poll(struct acpi_ec *ec)
771 + unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
773 + while (time_before(jiffies, delay)) {
774 + gpe_transaction(ec, acpi_ec_read_status(ec));
776 + if (ec_transaction_done(ec))
779 - pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n",
780 - acpi_ec_read_status(ec),
781 - (event == ACPI_EC_EVENT_OBF_1) ? "\"b0=1\"" : "\"b1=0\"");
785 -static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command,
786 - const u8 * wdata, unsigned wdata_len,
787 - u8 * rdata, unsigned rdata_len,
788 +static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
789 + struct transaction *t,
793 - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
796 pr_debug(PREFIX "transaction start\n");
797 - acpi_ec_write_cmd(ec, command);
798 - for (; wdata_len > 0; --wdata_len) {
799 - result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll);
802 - "write_cmd timeout, command = %d\n", command);
805 - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
806 - acpi_ec_write_data(ec, *(wdata++));
807 + /* disable GPE during transaction if storm is detected */
808 + if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
809 + clear_bit(EC_FLAGS_GPE_MODE, &ec->flags);
810 + acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
814 - result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll);
817 - "finish-write timeout, command = %d\n", command);
820 - } else if (command == ACPI_EC_COMMAND_QUERY)
821 + /* start transaction */
822 + spin_lock_irqsave(&ec->curr_lock, tmp);
823 + /* following two actions should be kept atomic */
826 + acpi_ec_write_cmd(ec, ec->curr->command);
827 + if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
828 clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
830 - for (; rdata_len > 0; --rdata_len) {
831 - result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1, force_poll);
833 - pr_err(PREFIX "read timeout, command = %d\n", command);
836 - /* Don't expect GPE after last read */
838 - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
839 - *(rdata++) = acpi_ec_read_data(ec);
842 + spin_unlock_irqrestore(&ec->curr_lock, tmp);
843 + /* if we selected poll mode or failed in GPE-mode do a poll loop */
845 + !test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ||
848 pr_debug(PREFIX "transaction end\n");
850 + spin_lock_irqsave(&ec->curr_lock, tmp);
852 + spin_unlock_irqrestore(&ec->curr_lock, tmp);
853 + if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
854 + /* check if we received SCI during transaction */
855 + ec_check_sci(ec, acpi_ec_read_status(ec));
856 + /* it is safe to enable GPE outside of transaction */
857 + acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
858 + } else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
859 + t->irq_count > ACPI_EC_STORM_THRESHOLD) {
860 + pr_debug(PREFIX "GPE storm detected\n");
861 + set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
866 +static int ec_check_ibf0(struct acpi_ec *ec)
868 + u8 status = acpi_ec_read_status(ec);
869 + return (status & ACPI_EC_FLAG_IBF) == 0;
872 -static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
873 - const u8 * wdata, unsigned wdata_len,
874 - u8 * rdata, unsigned rdata_len,
875 +static int ec_wait_ibf0(struct acpi_ec *ec)
877 + unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
878 + /* interrupt wait manually if GPE mode is not active */
879 + unsigned long timeout = test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ?
880 + msecs_to_jiffies(ACPI_EC_DELAY) : msecs_to_jiffies(1);
881 + while (time_before(jiffies, delay))
882 + if (wait_event_timeout(ec->wait, ec_check_ibf0(ec), timeout))
887 +static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t,
893 - if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata))
894 + if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))
898 - memset(rdata, 0, rdata_len);
901 + memset(t->rdata, 0, t->rlen);
902 mutex_lock(&ec->lock);
903 if (ec->global_lock) {
904 status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
905 if (ACPI_FAILURE(status)) {
906 - mutex_unlock(&ec->lock);
913 - status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, 0);
915 + if (ec_wait_ibf0(ec)) {
916 pr_err(PREFIX "input buffer is not empty, "
917 "aborting transaction\n");
922 - status = acpi_ec_transaction_unlocked(ec, command,
929 + status = acpi_ec_transaction_unlocked(ec, t, force_poll);
932 acpi_release_global_lock(glk);
934 mutex_unlock(&ec->lock);
939 @@ -327,21 +349,32 @@ static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
940 int acpi_ec_burst_enable(struct acpi_ec *ec)
943 - return acpi_ec_transaction(ec, ACPI_EC_BURST_ENABLE, NULL, 0, &d, 1, 0);
944 + struct transaction t = {.command = ACPI_EC_BURST_ENABLE,
945 + .wdata = NULL, .rdata = &d,
946 + .wlen = 0, .rlen = 1};
948 + return acpi_ec_transaction(ec, &t, 0);
951 int acpi_ec_burst_disable(struct acpi_ec *ec)
953 - return acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE, NULL, 0, NULL, 0, 0);
954 + struct transaction t = {.command = ACPI_EC_BURST_DISABLE,
955 + .wdata = NULL, .rdata = NULL,
956 + .wlen = 0, .rlen = 0};
958 + return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ?
959 + acpi_ec_transaction(ec, &t, 0) : 0;
962 static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
966 + struct transaction t = {.command = ACPI_EC_COMMAND_READ,
967 + .wdata = &address, .rdata = &d,
968 + .wlen = 1, .rlen = 1};
970 - result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_READ,
971 - &address, 1, &d, 1, 0);
972 + result = acpi_ec_transaction(ec, &t, 0);
976 @@ -349,8 +382,11 @@ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
977 static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
979 u8 wdata[2] = { address, data };
980 - return acpi_ec_transaction(ec, ACPI_EC_COMMAND_WRITE,
981 - wdata, 2, NULL, 0, 0);
982 + struct transaction t = {.command = ACPI_EC_COMMAND_WRITE,
983 + .wdata = wdata, .rdata = NULL,
984 + .wlen = 2, .rlen = 0};
986 + return acpi_ec_transaction(ec, &t, 0);
990 @@ -412,12 +448,13 @@ int ec_transaction(u8 command,
991 u8 * rdata, unsigned rdata_len,
994 + struct transaction t = {.command = command,
995 + .wdata = wdata, .rdata = rdata,
996 + .wlen = wdata_len, .rlen = rdata_len};
1000 - return acpi_ec_transaction(first_ec, command, wdata,
1001 - wdata_len, rdata, rdata_len,
1003 + return acpi_ec_transaction(first_ec, &t, force_poll);
1006 EXPORT_SYMBOL(ec_transaction);
1007 @@ -426,7 +463,9 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 * data)
1012 + struct transaction t = {.command = ACPI_EC_COMMAND_QUERY,
1013 + .wdata = NULL, .rdata = &d,
1014 + .wlen = 0, .rlen = 1};
1018 @@ -436,7 +475,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 * data)
1019 * bit to be cleared (and thus clearing the interrupt source).
1022 - result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_QUERY, NULL, 0, &d, 1, 0);
1023 + result = acpi_ec_transaction(ec, &t, 0);
1027 @@ -513,46 +552,26 @@ static void acpi_ec_gpe_query(void *ec_cxt)
1029 static u32 acpi_ec_gpe_handler(void *data)
1031 - acpi_status status = AE_OK;
1032 struct acpi_ec *ec = data;
1033 - u8 state = acpi_ec_read_status(ec);
1036 pr_debug(PREFIX "~~~> interrupt\n");
1037 - atomic_inc(&ec->irq_count);
1038 - if (atomic_read(&ec->irq_count) > 5) {
1039 - pr_err(PREFIX "GPE storm detected, disabling EC GPE\n");
1040 - ec_switch_to_poll_mode(ec);
1043 - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
1044 - if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags))
1045 + status = acpi_ec_read_status(ec);
1047 + gpe_transaction(ec, status);
1048 + if (ec_transaction_done(ec) && (status & ACPI_EC_FLAG_IBF) == 0)
1051 - if (state & ACPI_EC_FLAG_SCI) {
1052 - if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
1053 - status = acpi_os_execute(OSL_EC_BURST_HANDLER,
1054 - acpi_ec_gpe_query, ec);
1055 - } else if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
1056 - !test_bit(EC_FLAGS_NO_GPE, &ec->flags) &&
1058 + ec_check_sci(ec, status);
1059 + if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
1060 + !test_bit(EC_FLAGS_NO_GPE, &ec->flags)) {
1061 /* this is non-query, must be confirmation */
1062 if (printk_ratelimit())
1063 pr_info(PREFIX "non-query interrupt received,"
1064 " switching to interrupt mode\n");
1065 set_bit(EC_FLAGS_GPE_MODE, &ec->flags);
1066 - clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
1069 - ec_schedule_ec_poll(ec);
1070 - return ACPI_SUCCESS(status) ?
1071 - ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED;
1074 -static void do_ec_poll(struct work_struct *work)
1076 - struct acpi_ec *ec = container_of(work, struct acpi_ec, work.work);
1077 - atomic_set(&ec->irq_count, 0);
1078 - (void)acpi_ec_gpe_handler(ec);
1079 + return ACPI_INTERRUPT_HANDLED;
1082 /* --------------------------------------------------------------------------
1083 @@ -696,8 +715,7 @@ static struct acpi_ec *make_acpi_ec(void)
1084 mutex_init(&ec->lock);
1085 init_waitqueue_head(&ec->wait);
1086 INIT_LIST_HEAD(&ec->list);
1087 - INIT_DELAYED_WORK_DEFERRABLE(&ec->work, do_ec_poll);
1088 - atomic_set(&ec->irq_count, 0);
1089 + spin_lock_init(&ec->curr_lock);
1093 @@ -736,22 +754,15 @@ ec_parse_device(acpi_handle handle, u32 Level, void *context, void **retval)
1094 return AE_CTRL_TERMINATE;
1097 -static void ec_poll_stop(struct acpi_ec *ec)
1099 - clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
1100 - cancel_delayed_work(&ec->work);
1103 static void ec_remove_handlers(struct acpi_ec *ec)
1106 if (ACPI_FAILURE(acpi_remove_address_space_handler(ec->handle,
1107 ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
1108 pr_err(PREFIX "failed to remove space handler\n");
1109 if (ACPI_FAILURE(acpi_remove_gpe_handler(NULL, ec->gpe,
1110 &acpi_ec_gpe_handler)))
1111 pr_err(PREFIX "failed to remove gpe handler\n");
1112 - ec->handlers_installed = 0;
1113 + clear_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
1116 static int acpi_ec_add(struct acpi_device *device)
1117 @@ -846,17 +857,15 @@ ec_parse_io_ports(struct acpi_resource *resource, void *context)
1118 static int ec_install_handlers(struct acpi_ec *ec)
1121 - if (ec->handlers_installed)
1122 + if (test_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags))
1124 status = acpi_install_gpe_handler(NULL, ec->gpe,
1125 - ACPI_GPE_EDGE_TRIGGERED,
1126 - &acpi_ec_gpe_handler, ec);
1127 + ACPI_GPE_EDGE_TRIGGERED,
1128 + &acpi_ec_gpe_handler, ec);
1129 if (ACPI_FAILURE(status))
1132 acpi_set_gpe_type(NULL, ec->gpe, ACPI_GPE_TYPE_RUNTIME);
1133 acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
1135 status = acpi_install_address_space_handler(ec->handle,
1137 &acpi_ec_space_handler,
1138 @@ -866,7 +875,7 @@ static int ec_install_handlers(struct acpi_ec *ec)
1142 - ec->handlers_installed = 1;
1143 + set_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
1147 @@ -887,7 +896,6 @@ static int acpi_ec_start(struct acpi_device *device)
1149 /* EC is fully operational, allow queries */
1150 clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
1151 - ec_schedule_ec_poll(ec);
1155 @@ -906,7 +914,7 @@ static int acpi_ec_stop(struct acpi_device *device, int type)
1157 int __init acpi_boot_ec_enable(void)
1159 - if (!boot_ec || boot_ec->handlers_installed)
1160 + if (!boot_ec || test_bit(EC_FLAGS_HANDLERS_INSTALLED, &boot_ec->flags))
1162 if (!ec_install_handlers(boot_ec)) {
1164 diff --git a/drivers/acpi/hardware/hwsleep.c b/drivers/acpi/hardware/hwsleep.c
1165 index ecb6ace..25dccdf 100644
1166 --- a/drivers/acpi/hardware/hwsleep.c
1167 +++ b/drivers/acpi/hardware/hwsleep.c
1168 @@ -612,6 +612,13 @@ acpi_status acpi_leave_sleep_state(u8 sleep_state)
1170 /* TBD: _WAK "sometimes" returns stuff - do we want to look at it? */
1173 + * Some BIOSes assume that WAK_STS will be cleared on resume and use
1174 + * it to determine whether the system is rebooting or resuming. Clear
1175 + * it for compatibility.
1177 + acpi_set_register(ACPI_BITREG_WAKE_STATUS, 1);
1179 acpi_gbl_system_awake_and_running = TRUE;
1181 /* Enable power button */
1182 diff --git a/drivers/acpi/reboot.c b/drivers/acpi/reboot.c
1183 index a6b662c..755baf2 100644
1184 --- a/drivers/acpi/reboot.c
1185 +++ b/drivers/acpi/reboot.c
1186 @@ -15,9 +15,28 @@ void acpi_reboot(void)
1188 rr = &acpi_gbl_FADT.reset_register;
1190 - /* Is the reset register supported? */
1191 - if (!(acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER) ||
1192 - rr->bit_width != 8 || rr->bit_offset != 0)
1194 + * Is the ACPI reset register supported?
1196 + * According to ACPI 3.0, FADT.flags.RESET_REG_SUP indicates
1197 + * whether the ACPI reset mechanism is supported.
1199 + * However, some boxes have this bit clear, yet a valid
1200 + * ACPI_RESET_REG & RESET_VALUE, and ACPI reboot is the only
1201 + * mechanism that works for them after S3.
1203 + * This suggests that other operating systems may not be checking
1204 + * the RESET_REG_SUP bit, and are using other means to decide
1205 + * whether to use the ACPI reboot mechanism or not.
1207 + * So when acpi reboot is requested,
1208 + * only the reset_register is checked. If the following
1209 + * conditions are met, it indicates that the reset register is supported.
1210 + * a. reset_register is not zero
1211 + * b. the access width is eight
1212 + * c. the bit_offset is zero
1214 + if (!(rr->address) || rr->bit_width != 8 || rr->bit_offset != 0)
1217 reset_value = acpi_gbl_FADT.reset_value;
1218 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
1219 index 79e3a8e..8228ae3 100644
1220 --- a/drivers/ata/libata-core.c
1221 +++ b/drivers/ata/libata-core.c
1222 @@ -5259,6 +5259,8 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
1224 #ifdef CONFIG_ATA_SFF
1225 INIT_DELAYED_WORK(&ap->port_task, ata_pio_task);
1227 + INIT_DELAYED_WORK(&ap->port_task, NULL);
1229 INIT_DELAYED_WORK(&ap->hotplug_task, ata_scsi_hotplug);
1230 INIT_WORK(&ap->scsi_rescan_task, ata_scsi_dev_rescan);
1231 diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
1232 index 0221c9a..35fd67d 100644
1233 --- a/drivers/ata/pata_it821x.c
1234 +++ b/drivers/ata/pata_it821x.c
1235 @@ -557,9 +557,8 @@ static unsigned int it821x_read_id(struct ata_device *adev,
1236 if (strstr(model_num, "Integrated Technology Express")) {
1237 /* Set feature bits the firmware neglects */
1238 id[49] |= 0x0300; /* LBA, DMA */
1239 - id[82] |= 0x0400; /* LBA48 */
1241 - id[83] |= 0x4000; /* Word 83 is valid */
1242 + id[83] |= 0x4400; /* Word 83 is valid and LBA48 */
1243 id[86] |= 0x0400; /* LBA48 on */
1244 id[ATA_ID_MAJOR_VER] |= 0x1F;
1246 diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
1247 index 14601dc..8714c36 100644
1248 --- a/drivers/ata/sata_nv.c
1249 +++ b/drivers/ata/sata_nv.c
1250 @@ -307,10 +307,10 @@ static int nv_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
1252 static void nv_nf2_freeze(struct ata_port *ap);
1253 static void nv_nf2_thaw(struct ata_port *ap);
1254 +static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
1255 + unsigned long deadline);
1256 static void nv_ck804_freeze(struct ata_port *ap);
1257 static void nv_ck804_thaw(struct ata_port *ap);
1258 -static int nv_hardreset(struct ata_link *link, unsigned int *class,
1259 - unsigned long deadline);
1260 static int nv_adma_slave_config(struct scsi_device *sdev);
1261 static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
1262 static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
1263 @@ -405,17 +405,8 @@ static struct scsi_host_template nv_swncq_sht = {
1264 .slave_configure = nv_swncq_slave_config,
1267 -/* OSDL bz3352 reports that some nv controllers can't determine device
1268 - * signature reliably and nv_hardreset is implemented to work around
1269 - * the problem. This was reported on nf3 and it's unclear whether any
1270 - * other controllers are affected. However, the workaround has been
1271 - * applied to all variants and there isn't much to gain by trying to
1272 - * find out exactly which ones are affected at this point especially
1273 - * because NV has moved over to ahci for newer controllers.
1275 static struct ata_port_operations nv_common_ops = {
1276 .inherits = &ata_bmdma_port_ops,
1277 - .hardreset = nv_hardreset,
1278 .scr_read = nv_scr_read,
1279 .scr_write = nv_scr_write,
1281 @@ -429,12 +420,22 @@ static struct ata_port_operations nv_generic_ops = {
1282 .hardreset = ATA_OP_NULL,
1285 +/* OSDL bz3352 reports that nf2/3 controllers can't determine device
1286 + * signature reliably. Also, the following thread reports detection
1287 + * failure on cold boot with the standard debouncing timing.
1289 + * http://thread.gmane.org/gmane.linux.ide/34098
1291 + * Debounce with hotplug timing and request follow-up SRST.
1293 static struct ata_port_operations nv_nf2_ops = {
1294 .inherits = &nv_common_ops,
1295 .freeze = nv_nf2_freeze,
1296 .thaw = nv_nf2_thaw,
1297 + .hardreset = nv_nf2_hardreset,
1300 +/* CK804 finally gets hardreset right */
1301 static struct ata_port_operations nv_ck804_ops = {
1302 .inherits = &nv_common_ops,
1303 .freeze = nv_ck804_freeze,
1304 @@ -443,7 +444,7 @@ static struct ata_port_operations nv_ck804_ops = {
1307 static struct ata_port_operations nv_adma_ops = {
1308 - .inherits = &nv_common_ops,
1309 + .inherits = &nv_ck804_ops,
1311 .check_atapi_dma = nv_adma_check_atapi_dma,
1312 .sff_tf_read = nv_adma_tf_read,
1313 @@ -467,7 +468,7 @@ static struct ata_port_operations nv_adma_ops = {
1316 static struct ata_port_operations nv_swncq_ops = {
1317 - .inherits = &nv_common_ops,
1318 + .inherits = &nv_generic_ops,
1320 .qc_defer = ata_std_qc_defer,
1321 .qc_prep = nv_swncq_qc_prep,
1322 @@ -1553,6 +1554,17 @@ static void nv_nf2_thaw(struct ata_port *ap)
1323 iowrite8(mask, scr_addr + NV_INT_ENABLE);
1326 +static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
1327 + unsigned long deadline)
1332 + rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
1334 + return online ? -EAGAIN : rc;
1337 static void nv_ck804_freeze(struct ata_port *ap)
1339 void __iomem *mmio_base = ap->host->iomap[NV_MMIO_BAR];
1340 @@ -1605,21 +1617,6 @@ static void nv_mcp55_thaw(struct ata_port *ap)
1344 -static int nv_hardreset(struct ata_link *link, unsigned int *class,
1345 - unsigned long deadline)
1349 - /* SATA hardreset fails to retrieve proper device signature on
1350 - * some controllers. Request follow up SRST. For more info,
1351 - * see http://bugzilla.kernel.org/show_bug.cgi?id=3352
1353 - rc = sata_sff_hardreset(link, class, deadline);
1359 static void nv_adma_error_handler(struct ata_port *ap)
1361 struct nv_adma_port_priv *pp = ap->private_data;
1362 diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
1363 index 030665b..b26885f 100644
1364 --- a/drivers/ata/sata_promise.c
1365 +++ b/drivers/ata/sata_promise.c
1366 @@ -153,6 +153,10 @@ static void pdc_freeze(struct ata_port *ap);
1367 static void pdc_sata_freeze(struct ata_port *ap);
1368 static void pdc_thaw(struct ata_port *ap);
1369 static void pdc_sata_thaw(struct ata_port *ap);
1370 +static int pdc_pata_softreset(struct ata_link *link, unsigned int *class,
1371 + unsigned long deadline);
1372 +static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class,
1373 + unsigned long deadline);
1374 static void pdc_error_handler(struct ata_port *ap);
1375 static void pdc_post_internal_cmd(struct ata_queued_cmd *qc);
1376 static int pdc_pata_cable_detect(struct ata_port *ap);
1377 @@ -186,6 +190,7 @@ static struct ata_port_operations pdc_sata_ops = {
1378 .scr_read = pdc_sata_scr_read,
1379 .scr_write = pdc_sata_scr_write,
1380 .port_start = pdc_sata_port_start,
1381 + .hardreset = pdc_sata_hardreset,
1384 /* First-generation chips need a more restrictive ->check_atapi_dma op */
1385 @@ -200,6 +205,7 @@ static struct ata_port_operations pdc_pata_ops = {
1386 .freeze = pdc_freeze,
1388 .port_start = pdc_common_port_start,
1389 + .softreset = pdc_pata_softreset,
1392 static const struct ata_port_info pdc_port_info[] = {
1393 @@ -691,6 +697,20 @@ static void pdc_sata_thaw(struct ata_port *ap)
1394 readl(host_mmio + hotplug_offset); /* flush */
1397 +static int pdc_pata_softreset(struct ata_link *link, unsigned int *class,
1398 + unsigned long deadline)
1400 + pdc_reset_port(link->ap);
1401 + return ata_sff_softreset(link, class, deadline);
1404 +static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class,
1405 + unsigned long deadline)
1407 + pdc_reset_port(link->ap);
1408 + return sata_sff_hardreset(link, class, deadline);
1411 static void pdc_error_handler(struct ata_port *ap)
1413 if (!(ap->pflags & ATA_PFLAG_FROZEN))
1414 diff --git a/drivers/base/sys.c b/drivers/base/sys.c
1415 index 75dd6e2..70499cb 100644
1416 --- a/drivers/base/sys.c
1417 +++ b/drivers/base/sys.c
1418 @@ -488,7 +488,8 @@ ssize_t sysdev_store_ulong(struct sys_device *sysdev,
1421 *(unsigned long *)(ea->var) = new;
1423 + /* Always return full write size even if we didn't consume all */
1426 EXPORT_SYMBOL_GPL(sysdev_store_ulong);
1428 @@ -511,7 +512,8 @@ ssize_t sysdev_store_int(struct sys_device *sysdev,
1429 if (end == buf || new > INT_MAX || new < INT_MIN)
1431 *(int *)(ea->var) = new;
1433 + /* Always return full write size even if we didn't consume all */
1436 EXPORT_SYMBOL_GPL(sysdev_store_int);
1438 diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
1439 index 016fdf0..f1fe749 100644
1440 --- a/drivers/char/agp/intel-agp.c
1441 +++ b/drivers/char/agp/intel-agp.c
1443 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965Q_HB || \
1444 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB || \
1445 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GM_HB || \
1446 - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB || \
1447 - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
1448 + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB)
1450 #define IS_G33 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G33_HB || \
1451 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q35_HB || \
1454 #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGD_E_HB || \
1455 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
1456 - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB)
1457 + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
1458 + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
1460 extern int agp_memory_reserved;
1462 @@ -525,8 +525,10 @@ static void intel_i830_init_gtt_entries(void)
1464 } else if (IS_G4X) {
1465 /* On 4 series hardware, GTT stolen is separate from graphics
1466 - * stolen, ignore it in stolen gtt entries counting */
1468 + * stolen, ignore it in stolen gtt entries counting. However,
1469 + * 4KB of the stolen memory doesn't get mapped to the GTT.
1473 /* On previous hardware, the GTT size was just what was
1474 * required to map the aperture.
1475 diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
1476 index 64e1c16..ecaf369 100644
1477 --- a/drivers/char/ipmi/ipmi_devintf.c
1478 +++ b/drivers/char/ipmi/ipmi_devintf.c
1479 @@ -957,3 +957,4 @@ module_exit(cleanup_ipmi);
1480 MODULE_LICENSE("GPL");
1481 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
1482 MODULE_DESCRIPTION("Linux device interface for the IPMI message handler.");
1483 +MODULE_ALIAS("platform:ipmi_si");
1484 diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
1485 index 2e6d584..ed03234 100644
1486 --- a/drivers/firewire/fw-cdev.c
1487 +++ b/drivers/firewire/fw-cdev.c
1488 @@ -720,8 +720,8 @@ static int ioctl_create_iso_context(struct client *client, void *buffer)
1489 #define GET_PAYLOAD_LENGTH(v) ((v) & 0xffff)
1490 #define GET_INTERRUPT(v) (((v) >> 16) & 0x01)
1491 #define GET_SKIP(v) (((v) >> 17) & 0x01)
1492 -#define GET_TAG(v) (((v) >> 18) & 0x02)
1493 -#define GET_SY(v) (((v) >> 20) & 0x04)
1494 +#define GET_TAG(v) (((v) >> 18) & 0x03)
1495 +#define GET_SY(v) (((v) >> 20) & 0x0f)
1496 #define GET_HEADER_LENGTH(v) (((v) >> 24) & 0xff)
1498 static int ioctl_queue_iso(struct client *client, void *buffer)
1499 @@ -913,7 +913,7 @@ dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg)
1508 diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
1509 index aaff50e..4f73537 100644
1510 --- a/drivers/firewire/fw-sbp2.c
1511 +++ b/drivers/firewire/fw-sbp2.c
1512 @@ -172,6 +172,9 @@ struct sbp2_target {
1513 int blocked; /* ditto */
1516 +/* Impossible login_id, to detect logout attempt before successful login */
1517 +#define INVALID_LOGIN_ID 0x10000
1520 * Per section 7.4.8 of the SBP-2 spec, a mgt_ORB_timeout value can be
1521 * provided in the config rom. Most devices do provide a value, which
1522 @@ -791,9 +794,20 @@ static void sbp2_release_target(struct kref *kref)
1523 scsi_remove_device(sdev);
1524 scsi_device_put(sdev);
1526 - sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
1527 - SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
1529 + if (lu->login_id != INVALID_LOGIN_ID) {
1530 + int generation, node_id;
1532 + * tgt->node_id may be obsolete here if we failed
1533 + * during initial login or after a bus reset where
1534 + * the topology changed.
1536 + generation = device->generation;
1537 + smp_rmb(); /* node_id vs. generation */
1538 + node_id = device->node_id;
1539 + sbp2_send_management_orb(lu, node_id, generation,
1540 + SBP2_LOGOUT_REQUEST,
1541 + lu->login_id, NULL);
1543 fw_core_remove_address_handler(&lu->address_handler);
1544 list_del(&lu->link);
1546 @@ -808,19 +822,20 @@ static void sbp2_release_target(struct kref *kref)
1548 static struct workqueue_struct *sbp2_wq;
1550 +static void sbp2_target_put(struct sbp2_target *tgt)
1552 + kref_put(&tgt->kref, sbp2_release_target);
1556 * Always get the target's kref when scheduling work on one its units.
1557 * Each workqueue job is responsible to call sbp2_target_put() upon return.
1559 static void sbp2_queue_work(struct sbp2_logical_unit *lu, unsigned long delay)
1561 - if (queue_delayed_work(sbp2_wq, &lu->work, delay))
1562 - kref_get(&lu->tgt->kref);
1565 -static void sbp2_target_put(struct sbp2_target *tgt)
1567 - kref_put(&tgt->kref, sbp2_release_target);
1568 + kref_get(&lu->tgt->kref);
1569 + if (!queue_delayed_work(sbp2_wq, &lu->work, delay))
1570 + sbp2_target_put(lu->tgt);
1574 @@ -993,6 +1008,7 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
1577 lu->lun = lun_entry & 0xffff;
1578 + lu->login_id = INVALID_LOGIN_ID;
1580 lu->has_sdev = false;
1581 lu->blocked = false;
1582 @@ -1158,7 +1174,7 @@ static int sbp2_probe(struct device *dev)
1584 /* Do the login in a workqueue so we can easily reschedule retries. */
1585 list_for_each_entry(lu, &tgt->lu_list, link)
1586 - sbp2_queue_work(lu, 0);
1587 + sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
1591 diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
1592 index c1b8107..5e20471 100644
1593 --- a/drivers/firewire/fw-topology.c
1594 +++ b/drivers/firewire/fw-topology.c
1595 @@ -413,7 +413,7 @@ static void
1596 update_tree(struct fw_card *card, struct fw_node *root)
1598 struct list_head list0, list1;
1599 - struct fw_node *node0, *node1;
1600 + struct fw_node *node0, *node1, *next1;
1603 INIT_LIST_HEAD(&list0);
1604 @@ -485,7 +485,9 @@ update_tree(struct fw_card *card, struct fw_node *root)
1607 node0 = fw_node(node0->link.next);
1608 - node1 = fw_node(node1->link.next);
1609 + next1 = fw_node(node1->link.next);
1610 + fw_node_put(node1);
1615 diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
1616 index 2ae1b0d..81b15ba 100644
1617 --- a/drivers/firewire/fw-transaction.h
1618 +++ b/drivers/firewire/fw-transaction.h
1619 @@ -248,7 +248,7 @@ struct fw_card {
1620 struct fw_node *local_node;
1621 struct fw_node *root_node;
1622 struct fw_node *irm_node;
1624 + u8 color; /* must be u8 to match the definition in struct fw_node */
1626 bool beta_repeaters_present;
1628 diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
1629 index b15f882..49144cb 100644
1630 --- a/drivers/hid/usbhid/hid-quirks.c
1631 +++ b/drivers/hid/usbhid/hid-quirks.c
1633 #define USB_DEVICE_ID_LD_MACHINETEST 0x2040
1635 #define USB_VENDOR_ID_LOGITECH 0x046d
1636 -#define USB_DEVICE_ID_LOGITECH_LX3 0xc044
1637 -#define USB_DEVICE_ID_LOGITECH_V150 0xc047
1638 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
1639 #define USB_DEVICE_ID_LOGITECH_HARMONY 0xc110
1640 #define USB_DEVICE_ID_LOGITECH_HARMONY_2 0xc111
1641 @@ -603,8 +601,6 @@ static const struct hid_blacklist {
1643 { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
1644 { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
1645 - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_LX3, HID_QUIRK_INVERT_HWHEEL },
1646 - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_V150, HID_QUIRK_INVERT_HWHEEL },
1648 { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K, HID_QUIRK_MICROSOFT_KEYS },
1649 { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K, HID_QUIRK_MICROSOFT_KEYS },
1650 diff --git a/drivers/i2c/busses/scx200_i2c.c b/drivers/i2c/busses/scx200_i2c.c
1651 index c3022a0..e4c9853 100644
1652 --- a/drivers/i2c/busses/scx200_i2c.c
1653 +++ b/drivers/i2c/busses/scx200_i2c.c
1654 @@ -81,6 +81,7 @@ static struct i2c_algo_bit_data scx200_i2c_data = {
1656 static struct i2c_adapter scx200_i2c_ops = {
1657 .owner = THIS_MODULE,
1658 + .class = I2C_CLASS_HWMON | I2C_CLASS_SPD,
1659 .id = I2C_HW_B_SCX200,
1660 .algo_data = &scx200_i2c_data,
1661 .name = "NatSemi SCx200 I2C",
1662 diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
1663 index b1ce10f..e32c24d 100644
1664 --- a/drivers/input/keyboard/atkbd.c
1665 +++ b/drivers/input/keyboard/atkbd.c
1666 @@ -834,10 +834,10 @@ static void atkbd_disconnect(struct serio *serio)
1670 - * Most special keys (Fn+F?) on Dell Latitudes do not generate release
1671 + * Most special keys (Fn+F?) on Dell laptops do not generate release
1672 * events so we have to do it ourselves.
1674 -static void atkbd_latitude_keymap_fixup(struct atkbd *atkbd)
1675 +static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
1677 const unsigned int forced_release_keys[] = {
1678 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93,
1679 @@ -1461,13 +1461,13 @@ static int __init atkbd_setup_fixup(const struct dmi_system_id *id)
1681 static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
1683 - .ident = "Dell Latitude series",
1684 + .ident = "Dell Laptop",
1686 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
1687 - DMI_MATCH(DMI_PRODUCT_NAME, "Latitude"),
1688 + DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
1690 .callback = atkbd_setup_fixup,
1691 - .driver_data = atkbd_latitude_keymap_fixup,
1692 + .driver_data = atkbd_dell_laptop_keymap_fixup,
1696 diff --git a/drivers/media/dvb/frontends/s5h1411.c b/drivers/media/dvb/frontends/s5h1411.c
1697 index 2da1a37..a92ee16 100644
1698 --- a/drivers/media/dvb/frontends/s5h1411.c
1699 +++ b/drivers/media/dvb/frontends/s5h1411.c
1700 @@ -471,6 +471,20 @@ static int s5h1411_set_spectralinversion(struct dvb_frontend *fe, int inversion)
1701 return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0x24, val);
1704 +static int s5h1411_set_serialmode(struct dvb_frontend *fe, int serial)
1706 + struct s5h1411_state *state = fe->demodulator_priv;
1709 + dprintk("%s(%d)\n", __func__, serial);
1710 + val = s5h1411_readreg(state, S5H1411_I2C_TOP_ADDR, 0xbd) & ~0x100;
1715 + return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, val);
1718 static int s5h1411_enable_modulation(struct dvb_frontend *fe,
1721 @@ -535,7 +549,7 @@ static int s5h1411_set_gpio(struct dvb_frontend *fe, int enable)
1722 return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xe0, val);
1725 -static int s5h1411_sleep(struct dvb_frontend *fe, int enable)
1726 +static int s5h1411_set_powerstate(struct dvb_frontend *fe, int enable)
1728 struct s5h1411_state *state = fe->demodulator_priv;
1730 @@ -551,6 +565,11 @@ static int s5h1411_sleep(struct dvb_frontend *fe, int enable)
1734 +static int s5h1411_sleep(struct dvb_frontend *fe)
1736 + return s5h1411_set_powerstate(fe, 1);
1739 static int s5h1411_register_reset(struct dvb_frontend *fe)
1741 struct s5h1411_state *state = fe->demodulator_priv;
1742 @@ -574,9 +593,6 @@ static int s5h1411_set_frontend(struct dvb_frontend *fe,
1744 s5h1411_enable_modulation(fe, p->u.vsb.modulation);
1746 - /* Allow the demod to settle */
1749 if (fe->ops.tuner_ops.set_params) {
1750 if (fe->ops.i2c_gate_ctrl)
1751 fe->ops.i2c_gate_ctrl(fe, 1);
1752 @@ -587,6 +603,10 @@ static int s5h1411_set_frontend(struct dvb_frontend *fe,
1753 fe->ops.i2c_gate_ctrl(fe, 0);
1756 + /* Issue a reset to the demod so it knows to resync against the
1757 + newly tuned frequency */
1758 + s5h1411_softreset(fe);
1763 @@ -599,7 +619,7 @@ static int s5h1411_init(struct dvb_frontend *fe)
1765 dprintk("%s()\n", __func__);
1767 - s5h1411_sleep(fe, 0);
1768 + s5h1411_set_powerstate(fe, 0);
1769 s5h1411_register_reset(fe);
1771 for (i = 0; i < ARRAY_SIZE(init_tab); i++)
1772 @@ -612,10 +632,10 @@ static int s5h1411_init(struct dvb_frontend *fe)
1774 if (state->config->output_mode == S5H1411_SERIAL_OUTPUT)
1776 - s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1101);
1777 + s5h1411_set_serialmode(fe, 1);
1780 - s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1001);
1781 + s5h1411_set_serialmode(fe, 0);
1783 s5h1411_set_spectralinversion(fe, state->config->inversion);
1784 s5h1411_set_if_freq(fe, state->config->vsb_if);
1785 @@ -863,6 +883,7 @@ static struct dvb_frontend_ops s5h1411_ops = {
1788 .init = s5h1411_init,
1789 + .sleep = s5h1411_sleep,
1790 .i2c_gate_ctrl = s5h1411_i2c_gate_ctrl,
1791 .set_frontend = s5h1411_set_frontend,
1792 .get_frontend = s5h1411_get_frontend,
1793 diff --git a/drivers/media/video/pvrusb2/pvrusb2-encoder.c b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
1794 index a1252d6..273d2a1 100644
1795 --- a/drivers/media/video/pvrusb2/pvrusb2-encoder.c
1796 +++ b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
1797 @@ -402,6 +402,10 @@ static int pvr2_encoder_prep_config(struct pvr2_hdw *hdw)
1798 ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 0,3,0,0);
1799 ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4,15,0,0,0);
1801 + /* prevent the PTSs from slowly drifting away in the generated
1803 + ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC, 2, 4, 1);
1808 diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
1809 index e23ce77..b46e599 100644
1810 --- a/drivers/net/atlx/atl1.c
1811 +++ b/drivers/net/atlx/atl1.c
1812 @@ -2317,7 +2317,8 @@ static void atl1_tx_queue(struct atl1_adapter *adapter, u16 count,
1814 memcpy(tpd, ptpd, sizeof(struct tx_packet_desc));
1815 tpd->buffer_addr = cpu_to_le64(buffer_info->dma);
1816 - tpd->word2 = (cpu_to_le16(buffer_info->length) &
1817 + tpd->word2 &= ~(TPD_BUFLEN_MASK << TPD_BUFLEN_SHIFT);
1818 + tpd->word2 |= (cpu_to_le16(buffer_info->length) &
1819 TPD_BUFLEN_MASK) << TPD_BUFLEN_SHIFT;
1822 @@ -2426,8 +2427,8 @@ static int atl1_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
1823 vlan_tag = (vlan_tag << 4) | (vlan_tag >> 13) |
1824 ((vlan_tag >> 9) & 0x8);
1825 ptpd->word3 |= 1 << TPD_INS_VL_TAG_SHIFT;
1826 - ptpd->word3 |= (vlan_tag & TPD_VL_TAGGED_MASK) <<
1827 - TPD_VL_TAGGED_SHIFT;
1828 + ptpd->word2 |= (vlan_tag & TPD_VLANTAG_MASK) <<
1829 + TPD_VLANTAG_SHIFT;
1832 tso = atl1_tso(adapter, skb, ptpd);
1833 diff --git a/drivers/net/atlx/atl1.h b/drivers/net/atlx/atl1.h
1834 index a5015b1..ffa73fc 100644
1835 --- a/drivers/net/atlx/atl1.h
1836 +++ b/drivers/net/atlx/atl1.h
1837 @@ -504,7 +504,7 @@ struct rx_free_desc {
1838 #define TPD_PKTNT_MASK 0x0001
1839 #define TPD_PKTINT_SHIFT 15
1840 #define TPD_VLANTAG_MASK 0xFFFF
1841 -#define TPD_VLAN_SHIFT 16
1842 +#define TPD_VLANTAG_SHIFT 16
1844 /* tpd word 3 bits 0:13 */
1845 #define TPD_EOP_MASK 0x0001
1846 diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
1847 index b211486..4489e58 100644
1848 --- a/drivers/net/bonding/bond_alb.c
1849 +++ b/drivers/net/bonding/bond_alb.c
1850 @@ -167,11 +167,14 @@ static void tlb_clear_slave(struct bonding *bond, struct slave *slave, int save_
1851 /* clear slave from tx_hashtbl */
1852 tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl;
1854 - index = SLAVE_TLB_INFO(slave).head;
1855 - while (index != TLB_NULL_INDEX) {
1856 - u32 next_index = tx_hash_table[index].next;
1857 - tlb_init_table_entry(&tx_hash_table[index], save_load);
1858 - index = next_index;
1859 + /* skip this if we've already freed the tx hash table */
1860 + if (tx_hash_table) {
1861 + index = SLAVE_TLB_INFO(slave).head;
1862 + while (index != TLB_NULL_INDEX) {
1863 + u32 next_index = tx_hash_table[index].next;
1864 + tlb_init_table_entry(&tx_hash_table[index], save_load);
1865 + index = next_index;
1869 tlb_init_slave(slave);
1870 diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
1871 index 4b27456..50927ea 100644
1872 --- a/drivers/net/wireless/libertas/scan.c
1873 +++ b/drivers/net/wireless/libertas/scan.c
1874 @@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_descriptor *bss,
1877 case MFIE_TYPE_SSID:
1878 - bss->ssid_len = elem->len;
1879 - memcpy(bss->ssid, elem->data, elem->len);
1880 + bss->ssid_len = min_t(int, 32, elem->len);
1881 + memcpy(bss->ssid, elem->data, bss->ssid_len);
1882 lbs_deb_scan("got SSID IE: '%s', len %u\n",
1883 escape_essid(bss->ssid, bss->ssid_len),
1885 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
1886 index 36698e5..bcafbd6 100644
1887 --- a/drivers/pci/probe.c
1888 +++ b/drivers/pci/probe.c
1889 @@ -219,7 +219,7 @@ static inline enum pci_bar_type decode_bar(struct resource *res, u32 bar)
1891 res->flags = bar & ~PCI_BASE_ADDRESS_MEM_MASK;
1893 - if (res->flags == PCI_BASE_ADDRESS_MEM_TYPE_64)
1894 + if (res->flags & PCI_BASE_ADDRESS_MEM_TYPE_64)
1895 return pci_bar_mem64;
1896 return pci_bar_mem32;
1898 diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
1899 index b184367..6ad46d7 100644
1900 --- a/drivers/rtc/rtc-cmos.c
1901 +++ b/drivers/rtc/rtc-cmos.c
1902 @@ -1030,29 +1030,32 @@ static struct platform_driver cmos_platform_driver = {
1904 static int __init cmos_init(void)
1909 - if (pnp_platform_devices)
1910 - return pnp_register_driver(&cmos_pnp_driver);
1912 - return platform_driver_probe(&cmos_platform_driver,
1913 - cmos_platform_probe);
1915 - return platform_driver_probe(&cmos_platform_driver,
1916 - cmos_platform_probe);
1917 -#endif /* CONFIG_PNP */
1918 + pnp_register_driver(&cmos_pnp_driver);
1921 + if (!cmos_rtc.dev)
1922 + retval = platform_driver_probe(&cmos_platform_driver,
1923 + cmos_platform_probe);
1929 + pnp_unregister_driver(&cmos_pnp_driver);
1933 module_init(cmos_init);
1935 static void __exit cmos_exit(void)
1938 - if (pnp_platform_devices)
1939 - pnp_unregister_driver(&cmos_pnp_driver);
1941 - platform_driver_unregister(&cmos_platform_driver);
1943 + pnp_unregister_driver(&cmos_pnp_driver);
1945 platform_driver_unregister(&cmos_platform_driver);
1946 -#endif /* CONFIG_PNP */
1948 module_exit(cmos_exit);
1950 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
1951 index e5e7d78..b7ea69c 100644
1952 --- a/drivers/scsi/sd.c
1953 +++ b/drivers/scsi/sd.c
1954 @@ -1047,7 +1047,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
1955 good_bytes = sd_completed_bytes(SCpnt);
1957 case RECOVERED_ERROR:
1959 /* Inform the user, but make sure that it's not treated
1962 @@ -1056,6 +1055,15 @@ static int sd_done(struct scsi_cmnd *SCpnt)
1963 memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
1964 good_bytes = scsi_bufflen(SCpnt);
1967 + /* This indicates a false check condition, so ignore it. An
1968 + * unknown amount of data was transferred so treat it as an
1971 + scsi_print_sense("sd", SCpnt);
1972 + SCpnt->result = 0;
1973 + memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
1975 case ABORTED_COMMAND:
1976 if (sshdr.asc == 0x10) { /* DIF: Disk detected corruption */
1977 scsi_print_result(SCpnt);
1978 diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
1979 index 706f3e6..7a4ccf5 100644
1980 --- a/drivers/usb/core/hcd.c
1981 +++ b/drivers/usb/core/hcd.c
1982 @@ -106,6 +106,9 @@ static DEFINE_SPINLOCK(hcd_root_hub_lock);
1983 /* used when updating an endpoint's URB list */
1984 static DEFINE_SPINLOCK(hcd_urb_list_lock);
1986 +/* used to protect against unlinking URBs after the device is gone */
1987 +static DEFINE_SPINLOCK(hcd_urb_unlink_lock);
1989 /* wait queue for synchronous unlinks */
1990 DECLARE_WAIT_QUEUE_HEAD(usb_kill_urb_queue);
1992 @@ -1377,10 +1380,25 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status)
1993 int usb_hcd_unlink_urb (struct urb *urb, int status)
1995 struct usb_hcd *hcd;
1997 + int retval = -EIDRM;
1998 + unsigned long flags;
2000 - hcd = bus_to_hcd(urb->dev->bus);
2001 - retval = unlink1(hcd, urb, status);
2002 + /* Prevent the device and bus from going away while
2003 + * the unlink is carried out. If they are already gone
2004 + * then urb->use_count must be 0, since disconnected
2005 + * devices can't have any active URBs.
2007 + spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
2008 + if (atomic_read(&urb->use_count) > 0) {
2010 + usb_get_dev(urb->dev);
2012 + spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
2013 + if (retval == 0) {
2014 + hcd = bus_to_hcd(urb->dev->bus);
2015 + retval = unlink1(hcd, urb, status);
2016 + usb_put_dev(urb->dev);
2020 retval = -EINPROGRESS;
2021 @@ -1529,6 +1547,17 @@ void usb_hcd_disable_endpoint(struct usb_device *udev,
2022 hcd->driver->endpoint_disable(hcd, ep);
2025 +/* Protect against drivers that try to unlink URBs after the device
2026 + * is gone, by waiting until all unlinks for @udev are finished.
2027 + * Since we don't currently track URBs by device, simply wait until
2028 + * nothing is running in the locked region of usb_hcd_unlink_urb().
2030 +void usb_hcd_synchronize_unlinks(struct usb_device *udev)
2032 + spin_lock_irq(&hcd_urb_unlink_lock);
2033 + spin_unlock_irq(&hcd_urb_unlink_lock);
2036 /*-------------------------------------------------------------------------*/
2038 /* called in any context */
2039 diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
2040 index 2dcde61..9465e70 100644
2041 --- a/drivers/usb/core/hcd.h
2042 +++ b/drivers/usb/core/hcd.h
2043 @@ -232,6 +232,7 @@ extern void usb_hcd_flush_endpoint(struct usb_device *udev,
2044 struct usb_host_endpoint *ep);
2045 extern void usb_hcd_disable_endpoint(struct usb_device *udev,
2046 struct usb_host_endpoint *ep);
2047 +extern void usb_hcd_synchronize_unlinks(struct usb_device *udev);
2048 extern int usb_hcd_get_frame_number(struct usb_device *udev);
2050 extern struct usb_hcd *usb_create_hcd(const struct hc_driver *driver,
2051 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
2052 index 875de9a..769f80f 100644
2053 --- a/drivers/usb/core/hub.c
2054 +++ b/drivers/usb/core/hub.c
2055 @@ -1349,6 +1349,7 @@ void usb_disconnect(struct usb_device **pdev)
2057 dev_dbg (&udev->dev, "unregistering device\n");
2058 usb_disable_device(udev, 0);
2059 + usb_hcd_synchronize_unlinks(udev);
2061 usb_unlock_device(udev);
2063 diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
2064 index 47111e8..db72269 100644
2065 --- a/drivers/usb/core/urb.c
2066 +++ b/drivers/usb/core/urb.c
2067 @@ -465,6 +465,12 @@ EXPORT_SYMBOL_GPL(usb_submit_urb);
2068 * indicating that the request has been canceled (rather than any other
2071 + * Drivers should not call this routine or related routines, such as
2072 + * usb_kill_urb() or usb_unlink_anchored_urbs(), after their disconnect
2073 + * method has returned. The disconnect function should synchronize with
2074 + * a driver's I/O routines to insure that all URB-related activity has
2075 + * completed before it returns.
2077 * This request is always asynchronous. Success is indicated by
2078 * returning -EINPROGRESS, at which time the URB will probably not yet
2079 * have been given back to the device driver. When it is eventually
2080 @@ -541,6 +547,9 @@ EXPORT_SYMBOL_GPL(usb_unlink_urb);
2081 * This routine may not be used in an interrupt context (such as a bottom
2082 * half or a completion handler), or when holding a spinlock, or in other
2083 * situations where the caller can't schedule().
2085 + * This routine should not be called by a driver after its disconnect
2086 + * method has returned.
2088 void usb_kill_urb(struct urb *urb)
2090 @@ -568,6 +577,9 @@ EXPORT_SYMBOL_GPL(usb_kill_urb);
2092 * this allows all outstanding URBs to be killed starting
2093 * from the back of the queue
2095 + * This routine should not be called by a driver after its disconnect
2096 + * method has returned.
2098 void usb_kill_anchored_urbs(struct usb_anchor *anchor)
2100 @@ -597,6 +609,9 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
2101 * from the back of the queue. This function is asynchronous.
2102 * The unlinking is just tiggered. It may happen after this
2103 * function has returned.
2105 + * This routine should not be called by a driver after its disconnect
2106 + * method has returned.
2108 void usb_unlink_anchored_urbs(struct usb_anchor *anchor)
2110 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
2111 index cd15547..061df9b 100644
2112 --- a/drivers/usb/storage/unusual_devs.h
2113 +++ b/drivers/usb/storage/unusual_devs.h
2114 @@ -1745,6 +1745,15 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
2115 US_SC_DEVICE, US_PR_DEVICE, NULL,
2116 US_FL_IGNORE_RESIDUE ),
2118 +/* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
2119 + * JMicron responds to USN and several other SCSI ioctls with a
2120 + * residue that causes subsequent I/O requests to fail. */
2121 +UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
2123 + "USB to ATA/ATAPI Bridge",
2124 + US_SC_DEVICE, US_PR_DEVICE, NULL,
2125 + US_FL_IGNORE_RESIDUE ),
2127 /* Reported by Robert Schedel <r.schedel@yahoo.de>
2128 * Note: this is a 'super top' device like the above 14cd/6600 device */
2129 UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
2130 diff --git a/fs/hfsplus/bitmap.c b/fs/hfsplus/bitmap.c
2131 index d128a25..ea30afc 100644
2132 --- a/fs/hfsplus/bitmap.c
2133 +++ b/fs/hfsplus/bitmap.c
2134 @@ -32,6 +32,10 @@ int hfsplus_block_allocate(struct super_block *sb, u32 size, u32 offset, u32 *ma
2135 mutex_lock(&HFSPLUS_SB(sb).alloc_file->i_mutex);
2136 mapping = HFSPLUS_SB(sb).alloc_file->i_mapping;
2137 page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, NULL);
2138 + if (IS_ERR(page)) {
2143 curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32;
2145 @@ -73,6 +77,10 @@ int hfsplus_block_allocate(struct super_block *sb, u32 size, u32 offset, u32 *ma
2147 page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
2149 + if (IS_ERR(page)) {
2153 curr = pptr = kmap(page);
2154 if ((size ^ offset) / PAGE_CACHE_BITS)
2155 end = pptr + PAGE_CACHE_BITS / 32;
2156 @@ -120,6 +128,10 @@ found:
2157 offset += PAGE_CACHE_BITS;
2158 page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
2160 + if (IS_ERR(page)) {
2166 end = pptr + PAGE_CACHE_BITS / 32;
2167 diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
2168 index ba117c4..f6874ac 100644
2169 --- a/fs/hfsplus/catalog.c
2170 +++ b/fs/hfsplus/catalog.c
2171 @@ -168,6 +168,11 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
2175 + if (be16_to_cpu(tmp.thread.nodeName.length) > 255) {
2176 + printk(KERN_ERR "hfs: catalog name length corrupted\n");
2180 hfsplus_cat_build_key_uni(fd->search_key, be32_to_cpu(tmp.thread.parentID),
2181 &tmp.thread.nodeName);
2182 return hfs_brec_find(fd);
2183 diff --git a/include/linux/sched.h b/include/linux/sched.h
2184 index 3d9120c..6bfb849 100644
2185 --- a/include/linux/sched.h
2186 +++ b/include/linux/sched.h
2187 @@ -1286,7 +1286,9 @@ struct task_struct {
2188 atomic_t fs_excl; /* holding fs exclusive resources */
2189 struct rcu_head rcu;
2192 + struct list_head *scm_work_list;
2195 * cache last used pipe for splice
2197 struct pipe_inode_info *splice_pipe;
2198 diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
2199 index bb46e76..408f743 100644
2200 --- a/include/math-emu/op-common.h
2201 +++ b/include/math-emu/op-common.h
2202 @@ -139,18 +139,27 @@ do { \
2203 if (X##_e <= _FP_WFRACBITS_##fs) \
2205 _FP_FRAC_SRS_##wc(X, X##_e, _FP_WFRACBITS_##fs); \
2206 - _FP_ROUND(wc, X); \
2207 if (_FP_FRAC_HIGH_##fs(X) \
2208 & (_FP_OVERFLOW_##fs >> 1)) \
2211 _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
2212 - FP_SET_EXCEPTION(FP_EX_INEXACT); \
2217 - _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
2218 + _FP_ROUND(wc, X); \
2219 + if (_FP_FRAC_HIGH_##fs(X) \
2220 + & (_FP_OVERFLOW_##fs >> 1)) \
2223 + _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
2224 + FP_SET_EXCEPTION(FP_EX_INEXACT); \
2229 + _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
2232 if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
2233 (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \
2234 diff --git a/include/net/scm.h b/include/net/scm.h
2235 index 06df126..33e9986 100644
2236 --- a/include/net/scm.h
2237 +++ b/include/net/scm.h
2243 - struct file *fp[SCM_MAX_FD];
2244 + struct list_head list;
2246 + struct file *fp[SCM_MAX_FD];
2250 diff --git a/kernel/sched_clock.c b/kernel/sched_clock.c
2251 index e8ab096..8178724 100644
2252 --- a/kernel/sched_clock.c
2253 +++ b/kernel/sched_clock.c
2254 @@ -118,13 +118,13 @@ static u64 __update_sched_clock(struct sched_clock_data *scd, u64 now)
2257 * scd->clock = clamp(scd->tick_gtod + delta,
2258 - * max(scd->tick_gtod, scd->clock),
2259 - * scd->tick_gtod + TICK_NSEC);
2260 + * max(scd->tick_gtod, scd->clock),
2261 + * max(scd->clock, scd->tick_gtod + TICK_NSEC));
2264 clock = scd->tick_gtod + delta;
2265 min_clock = wrap_max(scd->tick_gtod, scd->clock);
2266 - max_clock = scd->tick_gtod + TICK_NSEC;
2267 + max_clock = wrap_max(scd->clock, scd->tick_gtod + TICK_NSEC);
2269 clock = wrap_max(clock, min_clock);
2270 clock = wrap_min(clock, max_clock);
2271 diff --git a/kernel/sched_features.h b/kernel/sched_features.h
2272 index 9353ca7..c4c88ae 100644
2273 --- a/kernel/sched_features.h
2274 +++ b/kernel/sched_features.h
2275 @@ -5,7 +5,7 @@ SCHED_FEAT(START_DEBIT, 1)
2276 SCHED_FEAT(AFFINE_WAKEUPS, 1)
2277 SCHED_FEAT(CACHE_HOT_BUDDY, 1)
2278 SCHED_FEAT(SYNC_WAKEUPS, 1)
2279 -SCHED_FEAT(HRTICK, 1)
2280 +SCHED_FEAT(HRTICK, 0)
2281 SCHED_FEAT(DOUBLE_TICK, 0)
2282 SCHED_FEAT(ASYM_GRAN, 1)
2283 SCHED_FEAT(LB_BIAS, 1)
2284 diff --git a/net/core/scm.c b/net/core/scm.c
2285 index 10f5c65..ab242cc 100644
2286 --- a/net/core/scm.c
2287 +++ b/net/core/scm.c
2288 @@ -75,6 +75,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
2292 + INIT_LIST_HEAD(&fpl->list);
2295 fpp = &fpl->fp[fpl->count];
2296 @@ -106,9 +107,25 @@ void __scm_destroy(struct scm_cookie *scm)
2300 - for (i=fpl->count-1; i>=0; i--)
2303 + if (current->scm_work_list) {
2304 + list_add_tail(&fpl->list, current->scm_work_list);
2306 + LIST_HEAD(work_list);
2308 + current->scm_work_list = &work_list;
2310 + list_add(&fpl->list, &work_list);
2311 + while (!list_empty(&work_list)) {
2312 + fpl = list_first_entry(&work_list, struct scm_fp_list, list);
2314 + list_del(&fpl->list);
2315 + for (i=fpl->count-1; i>=0; i--)
2320 + current->scm_work_list = NULL;
2325 @@ -284,6 +301,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
2327 new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
2329 + INIT_LIST_HEAD(&new_fpl->list);
2330 for (i=fpl->count-1; i>=0; i--)
2331 get_file(fpl->fp[i]);
2332 memcpy(new_fpl, fpl, sizeof(*fpl));
2333 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
2334 index 8165f5a..d083f9a 100644
2335 --- a/net/ipv4/tcp_output.c
2336 +++ b/net/ipv4/tcp_output.c
2337 @@ -357,6 +357,17 @@ struct tcp_out_options {
2338 __u32 tsval, tsecr; /* need to include OPTION_TS */
2341 +/* Beware: Something in the Internet is very sensitive to the ordering of
2342 + * TCP options, we learned this through the hard way, so be careful here.
2343 + * Luckily we can at least blame others for their non-compliance but from
2344 + * inter-operatibility perspective it seems that we're somewhat stuck with
2345 + * the ordering which we have been using if we want to keep working with
2346 + * those broken things (not that it currently hurts anybody as there isn't
2347 + * particular reason why the ordering would need to be changed).
2349 + * At least SACK_PERM as the first option is known to lead to a disaster
2350 + * (but it may well be that other scenarios fail similarly).
2352 static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
2353 const struct tcp_out_options *opts,
2355 @@ -371,6 +382,12 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
2359 + if (unlikely(opts->mss)) {
2360 + *ptr++ = htonl((TCPOPT_MSS << 24) |
2361 + (TCPOLEN_MSS << 16) |
2365 if (likely(OPTION_TS & opts->options)) {
2366 if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) {
2367 *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
2368 @@ -387,12 +404,6 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
2369 *ptr++ = htonl(opts->tsecr);
2372 - if (unlikely(opts->mss)) {
2373 - *ptr++ = htonl((TCPOPT_MSS << 24) |
2374 - (TCPOLEN_MSS << 16) |
2378 if (unlikely(OPTION_SACK_ADVERTISE & opts->options &&
2379 !(OPTION_TS & opts->options))) {
2380 *ptr++ = htonl((TCPOPT_NOP << 24) |
2381 @@ -2266,6 +2277,11 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
2384 memset(&opts, 0, sizeof(opts));
2385 +#ifdef CONFIG_SYN_COOKIES
2386 + if (unlikely(req->cookie_ts))
2387 + TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
2390 TCP_SKB_CB(skb)->when = tcp_time_stamp;
2391 tcp_header_size = tcp_synack_options(sk, req,
2392 dst_metric(dst, RTAX_ADVMSS),
2393 @@ -2292,11 +2308,6 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
2395 /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
2396 th->window = htons(min(req->rcv_wnd, 65535U));
2397 -#ifdef CONFIG_SYN_COOKIES
2398 - if (unlikely(req->cookie_ts))
2399 - TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
2402 tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
2403 th->doff = (tcp_header_size >> 2);
2404 TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
2405 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
2406 index 10e22fd..245cbc5 100644
2407 --- a/net/ipv6/tcp_ipv6.c
2408 +++ b/net/ipv6/tcp_ipv6.c
2409 @@ -1087,7 +1087,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
2410 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
2411 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
2412 *topt++ = htonl(tcp_time_stamp);
2413 - *topt = htonl(ts);
2414 + *topt++ = htonl(ts);
2417 #ifdef CONFIG_TCP_MD5SIG
2418 diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
2419 index ec0a083..700ae9e 100644
2420 --- a/net/sched/sch_generic.c
2421 +++ b/net/sched/sch_generic.c
2422 @@ -319,6 +319,7 @@ struct Qdisc_ops noop_qdisc_ops __read_mostly = {
2424 static struct netdev_queue noop_netdev_queue = {
2425 .qdisc = &noop_qdisc,
2426 + .qdisc_sleeping = &noop_qdisc,
2429 struct Qdisc noop_qdisc = {
2430 @@ -344,6 +345,7 @@ static struct Qdisc_ops noqueue_qdisc_ops __read_mostly = {
2431 static struct Qdisc noqueue_qdisc;
2432 static struct netdev_queue noqueue_netdev_queue = {
2433 .qdisc = &noqueue_qdisc,
2434 + .qdisc_sleeping = &noqueue_qdisc,
2437 static struct Qdisc noqueue_qdisc = {
2438 diff --git a/scripts/package/mkspec b/scripts/package/mkspec
2439 index ffd61fe..62c5ffd 100755
2440 --- a/scripts/package/mkspec
2441 +++ b/scripts/package/mkspec
2442 @@ -64,8 +64,10 @@ fi
2445 echo 'mkdir -p $RPM_BUILD_ROOT/boot/efi $RPM_BUILD_ROOT/lib/modules'
2446 +echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
2448 echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules'
2449 +echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
2452 echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} modules_install'
2453 @@ -92,5 +94,6 @@ echo "%files"
2454 echo '%defattr (-, root, root)'
2455 echo "%dir /lib/modules"
2456 echo "/lib/modules/$KERNELRELEASE"
2457 +echo "/lib/firmware"
2460 diff --git a/security/commoncap.c b/security/commoncap.c
2461 index e4c4b3f..378172b 100644
2462 --- a/security/commoncap.c
2463 +++ b/security/commoncap.c
2464 @@ -279,10 +279,10 @@ static int get_file_caps(struct linux_binprm *bprm)
2465 struct vfs_cap_data vcaps;
2466 struct inode *inode;
2468 - if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
2469 - bprm_clear_caps(bprm);
2470 + bprm_clear_caps(bprm);
2472 + if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
2476 dentry = dget(bprm->file->f_dentry);
2477 inode = dentry->d_inode;
2478 diff --git a/sound/core/control.c b/sound/core/control.c
2479 index 281b2e2..236bbb1 100644
2480 --- a/sound/core/control.c
2481 +++ b/sound/core/control.c
2482 @@ -1427,12 +1427,12 @@ static int snd_ctl_dev_disconnect(struct snd_device *device)
2483 cardnum = card->number;
2484 snd_assert(cardnum >= 0 && cardnum < SNDRV_CARDS, return -ENXIO);
2486 - down_read(&card->controls_rwsem);
2487 + read_lock(&card->ctl_files_rwlock);
2488 list_for_each_entry(ctl, &card->ctl_files, list) {
2489 wake_up(&ctl->change_sleep);
2490 kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
2492 - up_read(&card->controls_rwsem);
2493 + read_unlock(&card->ctl_files_rwlock);
2495 if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL,
2497 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
2498 index 1c53e33..0f014b1 100644
2499 --- a/sound/pci/hda/hda_intel.c
2500 +++ b/sound/pci/hda/hda_intel.c
2502 #include <linux/slab.h>
2503 #include <linux/pci.h>
2504 #include <linux/mutex.h>
2505 +#include <linux/reboot.h>
2506 #include <sound/core.h>
2507 #include <sound/initval.h>
2508 #include "hda_codec.h"
2509 @@ -385,6 +386,9 @@ struct azx {
2511 /* for pending irqs */
2512 struct work_struct irq_pending_work;
2514 + /* reboot notifier (for mysterious hangup problem at power-down) */
2515 + struct notifier_block reboot_notifier;
2519 @@ -1890,12 +1894,36 @@ static int azx_resume(struct pci_dev *pci)
2523 + * reboot notifier for hang-up problem at power-down
2525 +static int azx_halt(struct notifier_block *nb, unsigned long event, void *buf)
2527 + struct azx *chip = container_of(nb, struct azx, reboot_notifier);
2528 + azx_stop_chip(chip);
2532 +static void azx_notifier_register(struct azx *chip)
2534 + chip->reboot_notifier.notifier_call = azx_halt;
2535 + register_reboot_notifier(&chip->reboot_notifier);
2538 +static void azx_notifier_unregister(struct azx *chip)
2540 + if (chip->reboot_notifier.notifier_call)
2541 + unregister_reboot_notifier(&chip->reboot_notifier);
2547 static int azx_free(struct azx *chip)
2551 + azx_notifier_unregister(chip);
2553 if (chip->initialized) {
2554 azx_clear_irq_pending(chip);
2555 for (i = 0; i < chip->num_streams; i++)
2556 @@ -2250,6 +2278,7 @@ static int __devinit azx_probe(struct pci_dev *pci,
2557 pci_set_drvdata(pci, card);
2559 power_down_all_codecs(chip);
2560 + azx_notifier_register(chip);