]> git.ipfire.org Git - ipfire-2.x.git/blame - src/patches/suse-2.6.27.39/patches.kernel.org/patch-2.6.27.13-14
projects / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Fix oinkmaster patch.
[ipfire-2.x.git] / src / patches / suse-2.6.27.39 / patches.kernel.org / patch-2.6.27.13-14
CommitLineData
82094b55
AF		 1From: Greg Kroah-Hartman <gregkh@suse.de>
2Subject: Linux 2.6.27.14
3
4Upstream 2.6.27.14 release from kernel.org
5
6Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
7
8diff --git a/Makefile b/Makefile
9index d879e7d..b2263f8 100644
10--- a/Makefile
11+++ b/Makefile
12@@ -1,7 +1,7 @@
13 VERSION = 2
14 PATCHLEVEL = 6
15 SUBLEVEL = 27
16-EXTRAVERSION = .13
17+EXTRAVERSION = .14
18 NAME = Trembling Tortoise
19
20 # *DOCUMENTATION*
21diff --git a/arch/alpha/kernel/irq_srm.c b/arch/alpha/kernel/irq_srm.c
22index 3221201..a03fbca 100644
23--- a/arch/alpha/kernel/irq_srm.c
24+++ b/arch/alpha/kernel/irq_srm.c
25@@ -63,6 +63,8 @@ init_srm_irqs(long max, unsigned long ignore_mask)
26 {
27 long i;
28
29+ if (NR_IRQS <= 16)
30+ return;
31 for (i = 16; i < max; ++i) {
32 if (i < 64 && ((ignore_mask >> i) & 1))
33 continue;
34diff --git a/crypto/authenc.c b/crypto/authenc.c
35index fd9f06c..0861dc2 100644
36--- a/crypto/authenc.c
37+++ b/crypto/authenc.c
38@@ -157,16 +157,19 @@ static int crypto_authenc_genicv(struct aead_request *req, u8 *iv,
39 dstp = sg_page(dst);
40 vdst = PageHighMem(dstp) ? NULL : page_address(dstp) + dst->offset;
41
42- sg_init_table(cipher, 2);
43- sg_set_buf(cipher, iv, ivsize);
44- authenc_chain(cipher, dst, vdst == iv + ivsize);
45+ if (ivsize) {
46+ sg_init_table(cipher, 2);
47+ sg_set_buf(cipher, iv, ivsize);
48+ authenc_chain(cipher, dst, vdst == iv + ivsize);
49+ dst = cipher;
50+ }
51
52 cryptlen = req->cryptlen + ivsize;
53- hash = crypto_authenc_hash(req, flags, cipher, cryptlen);
54+ hash = crypto_authenc_hash(req, flags, dst, cryptlen);
55 if (IS_ERR(hash))
56 return PTR_ERR(hash);
57
58- scatterwalk_map_and_copy(hash, cipher, cryptlen,
59+ scatterwalk_map_and_copy(hash, dst, cryptlen,
60 crypto_aead_authsize(authenc), 1);
61 return 0;
62 }
63@@ -284,11 +287,14 @@ static int crypto_authenc_iverify(struct aead_request *req, u8 *iv,
64 srcp = sg_page(src);
65 vsrc = PageHighMem(srcp) ? NULL : page_address(srcp) + src->offset;
66
67- sg_init_table(cipher, 2);
68- sg_set_buf(cipher, iv, ivsize);
69- authenc_chain(cipher, src, vsrc == iv + ivsize);
70+ if (ivsize) {
71+ sg_init_table(cipher, 2);
72+ sg_set_buf(cipher, iv, ivsize);
73+ authenc_chain(cipher, src, vsrc == iv + ivsize);
74+ src = cipher;
75+ }
76
77- return crypto_authenc_verify(req, cipher, cryptlen + ivsize);
78+ return crypto_authenc_verify(req, src, cryptlen + ivsize);
79 }
80
81 static int crypto_authenc_decrypt(struct aead_request *req)
82diff --git a/crypto/ccm.c b/crypto/ccm.c
83index 7cf7e5a..c36d654 100644
84--- a/crypto/ccm.c
85+++ b/crypto/ccm.c
86@@ -266,6 +266,8 @@ static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain,
87 if (assoclen) {
88 pctx->ilen = format_adata(idata, assoclen);
89 get_data_to_compute(cipher, pctx, req->assoc, req->assoclen);
90+ } else {
91+ pctx->ilen = 0;
92 }
93
94 /* compute plaintext into mac */
95diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
96index 8fdb2ce..c5be6a1 100644
97--- a/drivers/ata/pata_via.c
98+++ b/drivers/ata/pata_via.c
99@@ -87,6 +87,10 @@ enum {
100 VIA_SATA_PATA = 0x800, /* SATA/PATA combined configuration */
101 };
102
103+enum {
104+ VIA_IDFLAG_SINGLE = (1 << 0), /* single channel controller) */
105+};
106+
107 /*
108 * VIA SouthBridge chips.
109 */
110@@ -98,8 +102,12 @@ static const struct via_isa_bridge {
111 u8 rev_max;
112 u16 flags;
113 } via_isa_bridges[] = {
114+ { "vx855", PCI_DEVICE_ID_VIA_VX855, 0x00, 0x2f,
115+ VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
116 { "vx800", PCI_DEVICE_ID_VIA_VX800, 0x00, 0x2f, VIA_UDMA_133 |
117 VIA_BAD_AST | VIA_SATA_PATA },
118+ { "vt8261", PCI_DEVICE_ID_VIA_8261, 0x00, 0x2f,
119+ VIA_UDMA_133 | VIA_BAD_AST },
120 { "vt8237s", PCI_DEVICE_ID_VIA_8237S, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
121 { "vt8251", PCI_DEVICE_ID_VIA_8251, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
122 { "cx700", PCI_DEVICE_ID_VIA_CX700, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
123@@ -123,6 +131,8 @@ static const struct via_isa_bridge {
124 { "vt82c586", PCI_DEVICE_ID_VIA_82C586_0, 0x00, 0x0f, VIA_UDMA_NONE | VIA_SET_FIFO },
125 { "vt82c576", PCI_DEVICE_ID_VIA_82C576, 0x00, 0x2f, VIA_UDMA_NONE | VIA_SET_FIFO | VIA_NO_UNMASK },
126 { "vt82c576", PCI_DEVICE_ID_VIA_82C576, 0x00, 0x2f, VIA_UDMA_NONE | VIA_SET_FIFO | VIA_NO_UNMASK | VIA_BAD_ID },
127+ { "vtxxxx", PCI_DEVICE_ID_VIA_ANON, 0x00, 0x2f,
128+ VIA_UDMA_133 | VIA_BAD_AST },
129 { NULL }
130 };
131
132@@ -461,6 +471,7 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
133 static int printed_version;
134 u8 enable;
135 u32 timing;
136+ unsigned long flags = id->driver_data;
137 int rc;
138
139 if (!printed_version++)
140@@ -470,9 +481,13 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
141 if (rc)
142 return rc;
143
144+ if (flags & VIA_IDFLAG_SINGLE)
145+ ppi[1] = &ata_dummy_port_info;
146+
147 /* To find out how the IDE will behave and what features we
148 actually have to look at the bridge not the IDE controller */
149- for (config = via_isa_bridges; config->id; config++)
150+ for (config = via_isa_bridges; config->id != PCI_DEVICE_ID_VIA_ANON;
151+ config++)
152 if ((isa = pci_get_device(PCI_VENDOR_ID_VIA +
153 !!(config->flags & VIA_BAD_ID),
154 config->id, NULL))) {
155@@ -483,10 +498,6 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
156 pci_dev_put(isa);
157 }
158
159- if (!config->id) {
160- printk(KERN_WARNING "via: Unknown VIA SouthBridge, disabling.\n");
161- return -ENODEV;
162- }
163 pci_dev_put(isa);
164
165 if (!(config->flags & VIA_NO_ENABLES)) {
166@@ -588,6 +599,7 @@ static const struct pci_device_id via[] = {
167 { PCI_VDEVICE(VIA, 0x1571), },
168 { PCI_VDEVICE(VIA, 0x3164), },
169 { PCI_VDEVICE(VIA, 0x5324), },
170+ { PCI_VDEVICE(VIA, 0xC409), VIA_IDFLAG_SINGLE },
171
172 { },
173 };
174diff --git a/drivers/ide/pci/it821x.c b/drivers/ide/pci/it821x.c
175index 4a1508a..7e975eb 100644
176--- a/drivers/ide/pci/it821x.c
177+++ b/drivers/ide/pci/it821x.c
178@@ -69,6 +69,8 @@
179
180 #define DRV_NAME "it821x"
181
182+#define QUIRK_VORTEX86 1
183+
184 struct it821x_dev
185 {
186 unsigned int smart:1, /* Are we in smart raid mode */
187@@ -80,6 +82,7 @@ struct it821x_dev
188 u16 pio[2]; /* Cached PIO values */
189 u16 mwdma[2]; /* Cached MWDMA values */
190 u16 udma[2]; /* Cached UDMA values (per drive) */
191+ u16 quirks;
192 };
193
194 #define ATA_66 0
195@@ -586,6 +589,12 @@ static void __devinit init_hwif_it821x(ide_hwif_t *hwif)
196
197 hwif->ultra_mask = ATA_UDMA6;
198 hwif->mwdma_mask = ATA_MWDMA2;
199+
200+ /* Vortex86SX quirk: prevent Ultra-DMA mode to fix BadCRC issue */
201+ if (idev->quirks & QUIRK_VORTEX86) {
202+ if (dev->revision == 0x11)
203+ hwif->ultra_mask = 0;
204+ }
205 }
206
207 static void __devinit it8212_disable_raid(struct pci_dev *dev)
208@@ -658,6 +667,8 @@ static int __devinit it821x_init_one(struct pci_dev *dev, const struct pci_devic
209 return -ENOMEM;
210 }
211
212+ itdevs->quirks = id->driver_data;
213+
214 rc = ide_pci_init_one(dev, &it821x_chipset, itdevs);
215 if (rc)
216 kfree(itdevs);
217@@ -677,6 +688,7 @@ static void __devexit it821x_remove(struct pci_dev *dev)
218 static const struct pci_device_id it821x_pci_tbl[] = {
219 { PCI_VDEVICE(ITE, PCI_DEVICE_ID_ITE_8211), 0 },
220 { PCI_VDEVICE(ITE, PCI_DEVICE_ID_ITE_8212), 0 },
221+ { PCI_VDEVICE(RDC, PCI_DEVICE_ID_RDC_D1010), QUIRK_VORTEX86 },
222 { 0, },
223 };
224
225diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
226index d32c1ee..59ff816 100644
227--- a/drivers/misc/sgi-xp/xpc_sn2.c
228+++ b/drivers/misc/sgi-xp/xpc_sn2.c
229@@ -1841,6 +1841,7 @@ xpc_process_msg_chctl_flags_sn2(struct xpc_partition *part, int ch_number)
230 */
231 xpc_clear_remote_msgqueue_flags_sn2(ch);
232
233+ smp_wmb(); /* ensure flags have been cleared before bte_copy */
234 ch_sn2->w_remote_GP.put = ch_sn2->remote_GP.put;
235
236 dev_dbg(xpc_chan, "w_remote_GP.put changed to %ld, partid=%d, "
237@@ -1939,7 +1940,7 @@ xpc_get_deliverable_payload_sn2(struct xpc_channel *ch)
238 break;
239
240 get = ch_sn2->w_local_GP.get;
241- rmb(); /* guarantee that .get loads before .put */
242+ smp_rmb(); /* guarantee that .get loads before .put */
243 if (get == ch_sn2->w_remote_GP.put)
244 break;
245
246@@ -1961,11 +1962,13 @@ xpc_get_deliverable_payload_sn2(struct xpc_channel *ch)
247
248 msg = xpc_pull_remote_msg_sn2(ch, get);
249
250- DBUG_ON(msg != NULL && msg->number != get);
251- DBUG_ON(msg != NULL && (msg->flags & XPC_M_SN2_DONE));
252- DBUG_ON(msg != NULL && !(msg->flags & XPC_M_SN2_READY));
253+ if (msg != NULL) {
254+ DBUG_ON(msg->number != get);
255+ DBUG_ON(msg->flags & XPC_M_SN2_DONE);
256+ DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
257
258- payload = &msg->payload;
259+ payload = &msg->payload;
260+ }
261 break;
262 }
263
264@@ -2058,7 +2061,7 @@ xpc_allocate_msg_sn2(struct xpc_channel *ch, u32 flags,
265 while (1) {
266
267 put = ch_sn2->w_local_GP.put;
268- rmb(); /* guarantee that .put loads before .get */
269+ smp_rmb(); /* guarantee that .put loads before .get */
270 if (put - ch_sn2->w_remote_GP.get < ch->local_nentries) {
271
272 /* There are available message entries. We need to try
273@@ -2191,7 +2194,7 @@ xpc_send_payload_sn2(struct xpc_channel *ch, u32 flags, void *payload,
274 * The preceding store of msg->flags must occur before the following
275 * load of local_GP->put.
276 */
277- mb();
278+ smp_mb();
279
280 /* see if the message is next in line to be sent, if so send it */
281
282@@ -2292,7 +2295,7 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
283 * The preceding store of msg->flags must occur before the following
284 * load of local_GP->get.
285 */
286- mb();
287+ smp_mb();
288
289 /*
290 * See if this message is next in line to be acknowledged as having
291diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
292index 1ac694c..b8f8d50 100644
293--- a/drivers/misc/sgi-xp/xpc_uv.c
294+++ b/drivers/misc/sgi-xp/xpc_uv.c
295@@ -1238,7 +1238,7 @@ xpc_send_payload_uv(struct xpc_channel *ch, u32 flags, void *payload,
296 atomic_inc(&ch->n_to_notify);
297
298 msg_slot->key = key;
299- wmb(); /* a non-NULL func must hit memory after the key */
300+ smp_wmb(); /* a non-NULL func must hit memory after the key */
301 msg_slot->func = func;
302
303 if (ch->flags & XPC_C_DISCONNECTING) {
304diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
305index 53459db..8d44404 100644
306--- a/drivers/net/bnx2x_main.c
307+++ b/drivers/net/bnx2x_main.c
308@@ -8078,6 +8078,9 @@ static int bnx2x_get_eeprom(struct net_device *dev,
309 struct bnx2x *bp = netdev_priv(dev);
310 int rc;
311
312+ if (!netif_running(dev))
313+ return -EAGAIN;
314+
315 DP(BNX2X_MSG_NVM, "ethtool_eeprom: cmd %d\n"
316 DP_LEVEL " magic 0x%x offset 0x%x (%d) len 0x%x (%d)\n",
317 eeprom->cmd, eeprom->magic, eeprom->offset, eeprom->offset,
318diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
319index 1640096..ef84732 100644
320--- a/drivers/net/wireless/rtl8187_dev.c
321+++ b/drivers/net/wireless/rtl8187_dev.c
322@@ -263,6 +263,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
323
324 usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, ep),
325 buf, skb->len, rtl8187_tx_cb, skb);
326+ urb->transfer_flags |= URB_ZERO_PACKET;
327 rc = usb_submit_urb(urb, GFP_ATOMIC);
328 if (rc < 0) {
329 usb_free_urb(urb);
330diff --git a/drivers/net/wireless/rtl8187_rtl8225.c b/drivers/net/wireless/rtl8187_rtl8225.c
331index 1bae899..487593f 100644
332--- a/drivers/net/wireless/rtl8187_rtl8225.c
333+++ b/drivers/net/wireless/rtl8187_rtl8225.c
334@@ -287,7 +287,10 @@ static void rtl8225_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
335 ofdm_power = priv->channels[channel - 1].hw_value >> 4;
336
337 cck_power = min(cck_power, (u8)11);
338- ofdm_power = min(ofdm_power, (u8)35);
339+ if (ofdm_power > (u8)15)
340+ ofdm_power = 25;
341+ else
342+ ofdm_power += 10;
343
344 rtl818x_iowrite8(priv, &priv->map->TX_GAIN_CCK,
345 rtl8225_tx_gain_cck_ofdm[cck_power / 6] >> 1);
346@@ -540,7 +543,10 @@ static void rtl8225z2_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
347 cck_power += priv->txpwr_base & 0xF;
348 cck_power = min(cck_power, (u8)35);
349
350- ofdm_power = min(ofdm_power, (u8)15);
351+ if (ofdm_power > (u8)15)
352+ ofdm_power = 25;
353+ else
354+ ofdm_power += 10;
355 ofdm_power += priv->txpwr_base >> 4;
356 ofdm_power = min(ofdm_power, (u8)35);
357
358diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
359index 6e18736..6d9b074 100644
360--- a/drivers/pci/hotplug/pciehp_core.c
361+++ b/drivers/pci/hotplug/pciehp_core.c
362@@ -126,8 +126,10 @@ static int set_lock_status(struct hotplug_slot *hotplug_slot, u8 status)
363 mutex_lock(&slot->ctrl->crit_sect);
364
365 /* has it been >1 sec since our last toggle? */
366- if ((get_seconds() - slot->last_emi_toggle) < 1)
367+ if ((get_seconds() - slot->last_emi_toggle) < 1) {
368+ mutex_unlock(&slot->ctrl->crit_sect);
369 return -EINVAL;
370+ }
371
372 /* see what our current state is */
373 retval = get_lock_status(hotplug_slot, &value);
374diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
375index c2f2393..fd0695b 100644
376--- a/drivers/serial/8250_pci.c
377+++ b/drivers/serial/8250_pci.c
378@@ -2190,6 +2190,9 @@ static struct pci_device_id serial_pci_tbl[] = {
379 { PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_COMM8,
380 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
381 pbn_b2_8_115200 },
382+ { PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_7803,
383+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
384+ pbn_b2_8_460800 },
385 { PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_UCOMM8,
386 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
387 pbn_b2_8_115200 },
388diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
389index 20290c5..e52e54e 100644
390--- a/drivers/usb/core/devio.c
391+++ b/drivers/usb/core/devio.c
392@@ -1700,7 +1700,7 @@ const struct file_operations usbdev_file_operations = {
393 .release = usbdev_release,
394 };
395
396-void usb_fs_classdev_common_remove(struct usb_device *udev)
397+static void usbdev_remove(struct usb_device *udev)
398 {
399 struct dev_state *ps;
400 struct siginfo sinfo;
401@@ -1742,10 +1742,15 @@ static void usb_classdev_remove(struct usb_device *dev)
402 {
403 if (dev->usb_classdev)
404 device_unregister(dev->usb_classdev);
405- usb_fs_classdev_common_remove(dev);
406 }
407
408-static int usb_classdev_notify(struct notifier_block *self,
409+#else
410+#define usb_classdev_add(dev) 0
411+#define usb_classdev_remove(dev) do {} while (0)
412+
413+#endif
414+
415+static int usbdev_notify(struct notifier_block *self,
416 unsigned long action, void *dev)
417 {
418 switch (action) {
419@@ -1755,15 +1760,15 @@ static int usb_classdev_notify(struct notifier_block *self,
420 break;
421 case USB_DEVICE_REMOVE:
422 usb_classdev_remove(dev);
423+ usbdev_remove(dev);
424 break;
425 }
426 return NOTIFY_OK;
427 }
428
429 static struct notifier_block usbdev_nb = {
430- .notifier_call = usb_classdev_notify,
431+ .notifier_call = usbdev_notify,
432 };
433-#endif
434
435 static struct cdev usb_device_cdev;
436
437@@ -1797,9 +1802,8 @@ int __init usb_devio_init(void)
438 * to /sys/dev
439 */
440 usb_classdev_class->dev_kobj = NULL;
441-
442- usb_register_notify(&usbdev_nb);
443 #endif
444+ usb_register_notify(&usbdev_nb);
445 out:
446 return retval;
447
448@@ -1810,8 +1814,8 @@ error_cdev:
449
450 void usb_devio_cleanup(void)
451 {
452-#ifdef CONFIG_USB_DEVICE_CLASS
453 usb_unregister_notify(&usbdev_nb);
454+#ifdef CONFIG_USB_DEVICE_CLASS
455 class_destroy(usb_classdev_class);
456 #endif
457 cdev_del(&usb_device_cdev);
458diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
459index db410e9..83887ff 100644
460--- a/drivers/usb/core/inode.c
461+++ b/drivers/usb/core/inode.c
462@@ -716,7 +716,6 @@ static void usbfs_remove_device(struct usb_device *dev)
463 fs_remove_file (dev->usbfs_dentry);
464 dev->usbfs_dentry = NULL;
465 }
466- usb_fs_classdev_common_remove(dev);
467 }
468
469 static int usbfs_notify(struct notifier_block *self, unsigned long action, void *dev)
470diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
471index 9a1a45a..a9a6397 100644
472--- a/drivers/usb/core/usb.h
473+++ b/drivers/usb/core/usb.h
474@@ -145,7 +145,6 @@ extern struct usb_driver usbfs_driver;
475 extern const struct file_operations usbfs_devices_fops;
476 extern const struct file_operations usbdev_file_operations;
477 extern void usbfs_conn_disc_event(void);
478-extern void usb_fs_classdev_common_remove(struct usb_device *udev);
479
480 extern int usb_devio_init(void);
481 extern void usb_devio_cleanup(void);
482diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
483index 0ada0fc..c542a98 100644
484--- a/drivers/usb/mon/mon_bin.c
485+++ b/drivers/usb/mon/mon_bin.c
486@@ -37,6 +37,7 @@
487 #define MON_IOCX_GET _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get)
488 #define MON_IOCX_MFETCH _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch)
489 #define MON_IOCH_MFLUSH _IO(MON_IOC_MAGIC, 8)
490+
491 #ifdef CONFIG_COMPAT
492 #define MON_IOCX_GET32 _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get32)
493 #define MON_IOCX_MFETCH32 _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch32)
494@@ -921,21 +922,6 @@ static int mon_bin_ioctl(struct inode *inode, struct file *file,
495 }
496 break;
497
498-#ifdef CONFIG_COMPAT
499- case MON_IOCX_GET32: {
500- struct mon_bin_get32 getb;
501-
502- if (copy_from_user(&getb, (void __user *)arg,
503- sizeof(struct mon_bin_get32)))
504- return -EFAULT;
505-
506- ret = mon_bin_get_event(file, rp,
507- compat_ptr(getb.hdr32), compat_ptr(getb.data32),
508- getb.alloc32);
509- }
510- break;
511-#endif
512-
513 case MON_IOCX_MFETCH:
514 {
515 struct mon_bin_mfetch mfetch;
516@@ -962,7 +948,57 @@ static int mon_bin_ioctl(struct inode *inode, struct file *file,
517 }
518 break;
519
520+ case MON_IOCG_STATS: {
521+ struct mon_bin_stats __user *sp;
522+ unsigned int nevents;
523+ unsigned int ndropped;
524+
525+ spin_lock_irqsave(&rp->b_lock, flags);
526+ ndropped = rp->cnt_lost;
527+ rp->cnt_lost = 0;
528+ spin_unlock_irqrestore(&rp->b_lock, flags);
529+ nevents = mon_bin_queued(rp);
530+
531+ sp = (struct mon_bin_stats __user *)arg;
532+ if (put_user(rp->cnt_lost, &sp->dropped))
533+ return -EFAULT;
534+ if (put_user(nevents, &sp->queued))
535+ return -EFAULT;
536+
537+ }
538+ break;
539+
540+ default:
541+ return -ENOTTY;
542+ }
543+
544+ return ret;
545+}
546+
547 #ifdef CONFIG_COMPAT
548+static long mon_bin_compat_ioctl(struct file *file,
549+ unsigned int cmd, unsigned long arg)
550+{
551+ struct mon_reader_bin *rp = file->private_data;
552+ int ret;
553+
554+ switch (cmd) {
555+
556+ case MON_IOCX_GET32: {
557+ struct mon_bin_get32 getb;
558+
559+ if (copy_from_user(&getb, (void __user *)arg,
560+ sizeof(struct mon_bin_get32)))
561+ return -EFAULT;
562+
563+ ret = mon_bin_get_event(file, rp,
564+ compat_ptr(getb.hdr32), compat_ptr(getb.data32),
565+ getb.alloc32);
566+ if (ret < 0)
567+ return ret;
568+ }
569+ return 0;
570+
571 case MON_IOCX_MFETCH32:
572 {
573 struct mon_bin_mfetch32 mfetch;
574@@ -986,37 +1022,25 @@ static int mon_bin_ioctl(struct inode *inode, struct file *file,
575 return ret;
576 if (put_user(ret, &uptr->nfetch32))
577 return -EFAULT;
578- ret = 0;
579 }
580- break;
581-#endif
582-
583- case MON_IOCG_STATS: {
584- struct mon_bin_stats __user *sp;
585- unsigned int nevents;
586- unsigned int ndropped;
587-
588- spin_lock_irqsave(&rp->b_lock, flags);
589- ndropped = rp->cnt_lost;
590- rp->cnt_lost = 0;
591- spin_unlock_irqrestore(&rp->b_lock, flags);
592- nevents = mon_bin_queued(rp);
593+ return 0;
594
595- sp = (struct mon_bin_stats __user *)arg;
596- if (put_user(rp->cnt_lost, &sp->dropped))
597- return -EFAULT;
598- if (put_user(nevents, &sp->queued))
599- return -EFAULT;
600+ case MON_IOCG_STATS:
601+ return mon_bin_ioctl(NULL, file, cmd,
602+ (unsigned long) compat_ptr(arg));
603
604- }
605- break;
606+ case MON_IOCQ_URB_LEN:
607+ case MON_IOCQ_RING_SIZE:
608+ case MON_IOCT_RING_SIZE:
609+ case MON_IOCH_MFLUSH:
610+ return mon_bin_ioctl(NULL, file, cmd, arg);
611
612 default:
613- return -ENOTTY;
614+ ;
615 }
616-
617- return ret;
618+ return -ENOTTY;
619 }
620+#endif /* CONFIG_COMPAT */
621
622 static unsigned int
623 mon_bin_poll(struct file *file, struct poll_table_struct *wait)
624@@ -1094,6 +1118,9 @@ static const struct file_operations mon_fops_binary = {
625 /* .write = mon_text_write, */
626 .poll = mon_bin_poll,
627 .ioctl = mon_bin_ioctl,
628+#ifdef CONFIG_COMPAT
629+ .compat_ioctl = mon_bin_compat_ioctl,
630+#endif
631 .release = mon_bin_release,
632 .mmap = mon_bin_mmap,
633 };
634diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
635index 6fcb6d1..aae786c 100644
636--- a/drivers/usb/storage/unusual_devs.h
637+++ b/drivers/usb/storage/unusual_devs.h
638@@ -2047,6 +2047,12 @@ UNUSUAL_DEV( 0x19d2, 0x2000, 0x0000, 0x0000,
639 US_SC_DEVICE, US_PR_DEVICE, NULL,
640 US_FL_IGNORE_DEVICE),
641
642+UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
643+ "ST",
644+ "2A",
645+ US_SC_DEVICE, US_PR_DEVICE, NULL,
646+ US_FL_FIX_CAPACITY),
647+
648 /* patch submitted by Davide Perini <perini.davide@dpsoftware.org>
649 * and Renato Perini <rperini@email.it>
650 */
651diff --git a/fs/eventpoll.c b/fs/eventpoll.c
652index cb60f92..801de2c 100644
653--- a/fs/eventpoll.c
654+++ b/fs/eventpoll.c
655@@ -234,8 +234,6 @@ struct ep_pqueue {
656 /*
657 * Configuration options available inside /proc/sys/fs/epoll/
658 */
659-/* Maximum number of epoll devices, per user */
660-static int max_user_instances __read_mostly;
661 /* Maximum number of epoll watched descriptors, per user */
662 static int max_user_watches __read_mostly;
663
664@@ -261,14 +259,6 @@ static int zero;
665
666 ctl_table epoll_table[] = {
667 {
668- .procname = "max_user_instances",
669- .data = &max_user_instances,
670- .maxlen = sizeof(int),
671- .mode = 0644,
672- .proc_handler = &proc_dointvec_minmax,
673- .extra1 = &zero,
674- },
675- {
676 .procname = "max_user_watches",
677 .data = &max_user_watches,
678 .maxlen = sizeof(int),
679@@ -491,7 +481,6 @@ static void ep_free(struct eventpoll *ep)
680
681 mutex_unlock(&epmutex);
682 mutex_destroy(&ep->mtx);
683- atomic_dec(&ep->user->epoll_devs);
684 free_uid(ep->user);
685 kfree(ep);
686 }
687@@ -581,10 +570,6 @@ static int ep_alloc(struct eventpoll **pep)
688 struct eventpoll *ep;
689
690 user = get_current_user();
691- error = -EMFILE;
692- if (unlikely(atomic_read(&user->epoll_devs) >=
693- max_user_instances))
694- goto free_uid;
695 error = -ENOMEM;
696 ep = kzalloc(sizeof(*ep), GFP_KERNEL);
697 if (unlikely(!ep))
698@@ -1137,7 +1122,6 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
699 flags & O_CLOEXEC);
700 if (fd < 0)
701 ep_free(ep);
702- atomic_inc(&ep->user->epoll_devs);
703
704 error_return:
705 DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",
706@@ -1362,8 +1346,10 @@ static int __init eventpoll_init(void)
707 struct sysinfo si;
708
709 si_meminfo(&si);
710- max_user_instances = 128;
711- max_user_watches = (((si.totalram - si.totalhigh) / 32) << PAGE_SHIFT) /
712+ /*
713+ * Allows top 4% of lomem to be allocated for epoll watches (per user).
714+ */
715+ max_user_watches = (((si.totalram - si.totalhigh) / 25) << PAGE_SHIFT) /
716 EP_ITEM_COST;
717
718 /* Initialize the structure used to perform safe poll wait head wake ups */
719diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
720index 1f55382..89b1c93 100644
721--- a/fs/ext3/namei.c
722+++ b/fs/ext3/namei.c
723@@ -1374,7 +1374,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
724 struct fake_dirent *fde;
725
726 blocksize = dir->i_sb->s_blocksize;
727- dxtrace(printk("Creating index\n"));
728+ dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
729 retval = ext3_journal_get_write_access(handle, bh);
730 if (retval) {
731 ext3_std_error(dir->i_sb, retval);
732@@ -1383,6 +1383,19 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
733 }
734 root = (struct dx_root *) bh->b_data;
735
736+ /* The 0th block becomes the root, move the dirents out */
737+ fde = &root->dotdot;
738+ de = (struct ext3_dir_entry_2 *)((char *)fde +
739+ ext3_rec_len_from_disk(fde->rec_len));
740+ if ((char *) de >= (((char *) root) + blocksize)) {
741+ ext3_error(dir->i_sb, __func__,
742+ "invalid rec_len for '..' in inode %lu",
743+ dir->i_ino);
744+ brelse(bh);
745+ return -EIO;
746+ }
747+ len = ((char *) root) + blocksize - (char *) de;
748+
749 bh2 = ext3_append (handle, dir, &block, &retval);
750 if (!(bh2)) {
751 brelse(bh);
752@@ -1391,11 +1404,6 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
753 EXT3_I(dir)->i_flags |= EXT3_INDEX_FL;
754 data1 = bh2->b_data;
755
756- /* The 0th block becomes the root, move the dirents out */
757- fde = &root->dotdot;
758- de = (struct ext3_dir_entry_2 *)((char *)fde +
759- ext3_rec_len_from_disk(fde->rec_len));
760- len = ((char *) root) + blocksize - (char *) de;
761 memcpy (data1, de, len);
762 de = (struct ext3_dir_entry_2 *) data1;
763 top = data1 + len;
764diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
765index 87250b6..279734f 100644
766--- a/fs/fuse/dev.c
767+++ b/fs/fuse/dev.c
768@@ -281,7 +281,8 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
769 fc->blocked = 0;
770 wake_up_all(&fc->blocked_waitq);
771 }
772- if (fc->num_background == FUSE_CONGESTION_THRESHOLD) {
773+ if (fc->num_background == FUSE_CONGESTION_THRESHOLD &&
774+ fc->connected) {
775 clear_bdi_congested(&fc->bdi, READ);
776 clear_bdi_congested(&fc->bdi, WRITE);
777 }
778diff --git a/fs/fuse/file.c b/fs/fuse/file.c
779index c8206db..3ada9d7 100644
780--- a/fs/fuse/file.c
781+++ b/fs/fuse/file.c
782@@ -54,7 +54,7 @@ struct fuse_file *fuse_file_alloc(void)
783 ff->reserved_req = fuse_request_alloc();
784 if (!ff->reserved_req) {
785 kfree(ff);
786- ff = NULL;
787+ return NULL;
788 } else {
789 INIT_LIST_HEAD(&ff->write_entry);
790 atomic_set(&ff->count, 0);
791diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
792index d2249f1..57342a6 100644
793--- a/fs/fuse/inode.c
794+++ b/fs/fuse/inode.c
795@@ -292,6 +292,7 @@ static void fuse_put_super(struct super_block *sb)
796 list_del(&fc->entry);
797 fuse_ctl_remove_conn(fc);
798 mutex_unlock(&fuse_mutex);
799+ bdi_destroy(&fc->bdi);
800 fuse_conn_put(fc);
801 }
802
803@@ -531,7 +532,6 @@ void fuse_conn_put(struct fuse_conn *fc)
804 if (fc->destroy_req)
805 fuse_request_free(fc->destroy_req);
806 mutex_destroy(&fc->inst_mutex);
807- bdi_destroy(&fc->bdi);
808 kfree(fc);
809 }
810 }
811@@ -832,12 +832,16 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
812 if (!file)
813 return -EINVAL;
814
815- if (file->f_op != &fuse_dev_operations)
816+ if (file->f_op != &fuse_dev_operations) {
817+ fput(file);
818 return -EINVAL;
819+ }
820
821 fc = new_conn(sb);
822- if (!fc)
823+ if (!fc) {
824+ fput(file);
825 return -ENOMEM;
826+ }
827
828 fc->flags = d.flags;
829 fc->user_id = d.user_id;
830diff --git a/fs/inotify_user.c b/fs/inotify_user.c
831index a13f487..5c92d90 100644
832--- a/fs/inotify_user.c
833+++ b/fs/inotify_user.c
834@@ -427,10 +427,61 @@ static unsigned int inotify_poll(struct file *file, poll_table *wait)
835 return ret;
836 }
837
838+/*
839+ * Get an inotify_kernel_event if one exists and is small
840+ * enough to fit in "count". Return an error pointer if
841+ * not large enough.
842+ *
843+ * Called with the device ev_mutex held.
844+ */
845+static struct inotify_kernel_event *get_one_event(struct inotify_device *dev,
846+ size_t count)
847+{
848+ size_t event_size = sizeof(struct inotify_event);
849+ struct inotify_kernel_event *kevent;
850+
851+ if (list_empty(&dev->events))
852+ return NULL;
853+
854+ kevent = inotify_dev_get_event(dev);
855+ if (kevent->name)
856+ event_size += kevent->event.len;
857+
858+ if (event_size > count)
859+ return ERR_PTR(-EINVAL);
860+
861+ remove_kevent(dev, kevent);
862+ return kevent;
863+}
864+
865+/*
866+ * Copy an event to user space, returning how much we copied.
867+ *
868+ * We already checked that the event size is smaller than the
869+ * buffer we had in "get_one_event()" above.
870+ */
871+static ssize_t copy_event_to_user(struct inotify_kernel_event *kevent,
872+ char __user *buf)
873+{
874+ size_t event_size = sizeof(struct inotify_event);
875+
876+ if (copy_to_user(buf, &kevent->event, event_size))
877+ return -EFAULT;
878+
879+ if (kevent->name) {
880+ buf += event_size;
881+
882+ if (copy_to_user(buf, kevent->name, kevent->event.len))
883+ return -EFAULT;
884+
885+ event_size += kevent->event.len;
886+ }
887+ return event_size;
888+}
889+
890 static ssize_t inotify_read(struct file *file, char __user *buf,
891 size_t count, loff_t *pos)
892 {
893- size_t event_size = sizeof (struct inotify_event);
894 struct inotify_device *dev;
895 char __user *start;
896 int ret;
897@@ -440,81 +491,43 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
898 dev = file->private_data;
899
900 while (1) {
901+ struct inotify_kernel_event *kevent;
902
903 prepare_to_wait(&dev->wq, &wait, TASK_INTERRUPTIBLE);
904
905 mutex_lock(&dev->ev_mutex);
906- if (!list_empty(&dev->events)) {
907- ret = 0;
908- break;
909- }
910+ kevent = get_one_event(dev, count);
911 mutex_unlock(&dev->ev_mutex);
912
913- if (file->f_flags & O_NONBLOCK) {
914- ret = -EAGAIN;
915- break;
916- }
917-
918- if (signal_pending(current)) {
919- ret = -EINTR;
920- break;
921+ if (kevent) {
922+ ret = PTR_ERR(kevent);
923+ if (IS_ERR(kevent))
924+ break;
925+ ret = copy_event_to_user(kevent, buf);
926+ free_kevent(kevent);
927+ if (ret < 0)
928+ break;
929+ buf += ret;
930+ count -= ret;
931+ continue;
932 }
933
934- schedule();
935- }
936-
937- finish_wait(&dev->wq, &wait);
938- if (ret)
939- return ret;
940-
941- while (1) {
942- struct inotify_kernel_event *kevent;
943-
944- ret = buf - start;
945- if (list_empty(&dev->events))
946+ ret = -EAGAIN;
947+ if (file->f_flags & O_NONBLOCK)
948 break;
949-
950- kevent = inotify_dev_get_event(dev);
951- if (event_size + kevent->event.len > count) {
952- if (ret == 0 && count > 0) {
953- /*
954- * could not get a single event because we
955- * didn't have enough buffer space.
956- */
957- ret = -EINVAL;
958- }
959+ ret = -EINTR;
960+ if (signal_pending(current))
961 break;
962- }
963- remove_kevent(dev, kevent);
964
965- /*
966- * Must perform the copy_to_user outside the mutex in order
967- * to avoid a lock order reversal with mmap_sem.
968- */
969- mutex_unlock(&dev->ev_mutex);
970-
971- if (copy_to_user(buf, &kevent->event, event_size)) {
972- ret = -EFAULT;
973+ if (start != buf)
974 break;
975- }
976- buf += event_size;
977- count -= event_size;
978-
979- if (kevent->name) {
980- if (copy_to_user(buf, kevent->name, kevent->event.len)){
981- ret = -EFAULT;
982- break;
983- }
984- buf += kevent->event.len;
985- count -= kevent->event.len;
986- }
987-
988- free_kevent(kevent);
989
990- mutex_lock(&dev->ev_mutex);
991+ schedule();
992 }
993- mutex_unlock(&dev->ev_mutex);
994
995+ finish_wait(&dev->wq, &wait);
996+ if (start != buf && ret != -EFAULT)
997+ ret = buf - start;
998 return ret;
999 }
1000
1001diff --git a/fs/sysfs/bin.c b/fs/sysfs/bin.c
1002index 006fc64..aa24484 100644
1003--- a/fs/sysfs/bin.c
1004+++ b/fs/sysfs/bin.c
1005@@ -62,6 +62,9 @@ read(struct file *file, char __user *userbuf, size_t bytes, loff_t *off)
1006 loff_t offs = *off;
1007 int count = min_t(size_t, bytes, PAGE_SIZE);
1008
1009+ if (!bytes)
1010+ return 0;
1011+
1012 if (size) {
1013 if (offs > size)
1014 return 0;
1015@@ -119,6 +122,9 @@ static ssize_t write(struct file *file, const char __user *userbuf,
1016 loff_t offs = *off;
1017 int count = min_t(size_t, bytes, PAGE_SIZE);
1018
1019+ if (!bytes)
1020+ return 0;
1021+
1022 if (size) {
1023 if (offs > size)
1024 return 0;
1025diff --git a/include/asm-x86/pgalloc.h b/include/asm-x86/pgalloc.h
1026index d63ea43..36ef40d 100644
1027--- a/include/asm-x86/pgalloc.h
1028+++ b/include/asm-x86/pgalloc.h
1029@@ -42,6 +42,7 @@ static inline void pte_free_kernel(struct mm_struct *mm, pte_t *pte)
1030
1031 static inline void pte_free(struct mm_struct *mm, struct page *pte)
1032 {
1033+ pgtable_page_dtor(pte);
1034 __free_page(pte);
1035 }
1036
1037diff --git a/include/linux/Kbuild b/include/linux/Kbuild
1038index b68ec09..d5eb2e7 100644
1039--- a/include/linux/Kbuild
1040+++ b/include/linux/Kbuild
1041@@ -41,6 +41,7 @@ header-y += baycom.h
1042 header-y += bfs_fs.h
1043 header-y += blkpg.h
1044 header-y += bpqether.h
1045+header-y += bsg.h
1046 header-y += can.h
1047 header-y += cdk.h
1048 header-y += chio.h
1049diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
1050index f1624b3..391cbf3 100644
1051--- a/include/linux/pci_ids.h
1052+++ b/include/linux/pci_ids.h
1053@@ -1346,6 +1346,7 @@
1054 #define PCI_DEVICE_ID_VIA_8783_0 0x3208
1055 #define PCI_DEVICE_ID_VIA_8237 0x3227
1056 #define PCI_DEVICE_ID_VIA_8251 0x3287
1057+#define PCI_DEVICE_ID_VIA_8261 0x3402
1058 #define PCI_DEVICE_ID_VIA_8237A 0x3337
1059 #define PCI_DEVICE_ID_VIA_8237S 0x3372
1060 #define PCI_DEVICE_ID_VIA_SATA_EIDE 0x5324
1061@@ -1355,10 +1356,13 @@
1062 #define PCI_DEVICE_ID_VIA_CX700 0x8324
1063 #define PCI_DEVICE_ID_VIA_CX700_IDE 0x0581
1064 #define PCI_DEVICE_ID_VIA_VX800 0x8353
1065+#define PCI_DEVICE_ID_VIA_VX855 0x8409
1066 #define PCI_DEVICE_ID_VIA_8371_1 0x8391
1067 #define PCI_DEVICE_ID_VIA_82C598_1 0x8598
1068 #define PCI_DEVICE_ID_VIA_838X_1 0xB188
1069 #define PCI_DEVICE_ID_VIA_83_87XX_1 0xB198
1070+#define PCI_DEVICE_ID_VIA_C409_IDE 0XC409
1071+#define PCI_DEVICE_ID_VIA_ANON 0xFFFF
1072
1073 #define PCI_VENDOR_ID_SIEMENS 0x110A
1074 #define PCI_DEVICE_ID_SIEMENS_DSCC4 0x2102
1075@@ -1780,6 +1784,7 @@
1076 #define PCI_DEVICE_ID_SEALEVEL_UCOMM232 0x7202
1077 #define PCI_DEVICE_ID_SEALEVEL_COMM4 0x7401
1078 #define PCI_DEVICE_ID_SEALEVEL_COMM8 0x7801
1079+#define PCI_DEVICE_ID_SEALEVEL_7803 0x7803
1080 #define PCI_DEVICE_ID_SEALEVEL_UCOMM8 0x7804
1081
1082 #define PCI_VENDOR_ID_HYPERCOPE 0x1365
1083@@ -2148,6 +2153,7 @@
1084 #define PCI_DEVICE_ID_RDC_R6040 0x6040
1085 #define PCI_DEVICE_ID_RDC_R6060 0x6060
1086 #define PCI_DEVICE_ID_RDC_R6061 0x6061
1087+#define PCI_DEVICE_ID_RDC_D1010 0x1010
1088
1089 #define PCI_VENDOR_ID_LENOVO 0x17aa
1090
1091diff --git a/include/linux/sched.h b/include/linux/sched.h
1092index 086f5e1..03e0902 100644
1093--- a/include/linux/sched.h
1094+++ b/include/linux/sched.h
1095@@ -588,7 +588,6 @@ struct user_struct {
1096 atomic_t inotify_devs; /* How many inotify devs does this user have opened? */
1097 #endif
1098 #ifdef CONFIG_EPOLL
1099- atomic_t epoll_devs; /* The number of epoll descriptors currently open */
1100 atomic_t epoll_watches; /* The number of file descriptors currently watched */
1101 #endif
1102 #ifdef CONFIG_POSIX_MQUEUE
1103diff --git a/kernel/relay.c b/kernel/relay.c
1104index 8d13a78..b0bbf6f 100644
1105--- a/kernel/relay.c
1106+++ b/kernel/relay.c
1107@@ -664,8 +664,10 @@ int relay_late_setup_files(struct rchan *chan,
1108
1109 mutex_lock(&relay_channels_mutex);
1110 /* Is chan already set up? */
1111- if (unlikely(chan->has_base_filename))
1112+ if (unlikely(chan->has_base_filename)) {
1113+ mutex_unlock(&relay_channels_mutex);
1114 return -EEXIST;
1115+ }
1116 chan->has_base_filename = 1;
1117 chan->parent = parent;
1118 curr_cpu = get_cpu();
1119diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
1120index 4788f7b..56ad58d 100644
1121--- a/net/mac80211/tx.c
1122+++ b/net/mac80211/tx.c
1123@@ -1335,8 +1335,10 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
1124 if (is_multicast_ether_addr(hdr->addr3))
1125 memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
1126 else
1127- if (mesh_nexthop_lookup(skb, odev))
1128+ if (mesh_nexthop_lookup(skb, odev)) {
1129+ dev_put(odev);
1130 return 0;
1131+ }
1132 if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
1133 IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.sta,
1134 fwded_frames);
1135diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
1136index 24db2b4..0a22f00 100644
1137--- a/net/sunrpc/rpcb_clnt.c
1138+++ b/net/sunrpc/rpcb_clnt.c
1139@@ -469,6 +469,28 @@ static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbi
1140 return rpc_run_task(&task_setup_data);
1141 }
1142
1143+/*
1144+ * In the case where rpc clients have been cloned, we want to make
1145+ * sure that we use the program number/version etc of the actual
1146+ * owner of the xprt. To do so, we walk back up the tree of parents
1147+ * to find whoever created the transport and/or whoever has the
1148+ * autobind flag set.
1149+ */
1150+static struct rpc_clnt *rpcb_find_transport_owner(struct rpc_clnt *clnt)
1151+{
1152+ struct rpc_clnt *parent = clnt->cl_parent;
1153+
1154+ while (parent != clnt) {
1155+ if (parent->cl_xprt != clnt->cl_xprt)
1156+ break;
1157+ if (clnt->cl_autobind)
1158+ break;
1159+ clnt = parent;
1160+ parent = parent->cl_parent;
1161+ }
1162+ return clnt;
1163+}
1164+
1165 /**
1166 * rpcb_getport_async - obtain the port for a given RPC service on a given host
1167 * @task: task that is waiting for portmapper request
1168@@ -478,10 +500,10 @@ static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbi
1169 */
1170 void rpcb_getport_async(struct rpc_task *task)
1171 {
1172- struct rpc_clnt *clnt = task->tk_client;
1173+ struct rpc_clnt *clnt;
1174 struct rpc_procinfo *proc;
1175 u32 bind_version;
1176- struct rpc_xprt *xprt = task->tk_xprt;
1177+ struct rpc_xprt *xprt;
1178 struct rpc_clnt *rpcb_clnt;
1179 static struct rpcbind_args *map;
1180 struct rpc_task *child;
1181@@ -490,13 +512,13 @@ void rpcb_getport_async(struct rpc_task *task)
1182 size_t salen;
1183 int status;
1184
1185+ clnt = rpcb_find_transport_owner(task->tk_client);
1186+ xprt = clnt->cl_xprt;
1187+
1188 dprintk("RPC: %5u %s(%s, %u, %u, %d)\n",
1189 task->tk_pid, __func__,
1190 clnt->cl_server, clnt->cl_prog, clnt->cl_vers, xprt->prot);
1191
1192- /* Autobind on cloned rpc clients is discouraged */
1193- BUG_ON(clnt->cl_parent != clnt);
1194-
1195 /* Put self on the wait queue to ensure we get notified if
1196 * some other task is already attempting to bind the port */
1197 rpc_sleep_on(&xprt->binding, task, NULL);
1198@@ -558,7 +580,7 @@ void rpcb_getport_async(struct rpc_task *task)
1199 status = -ENOMEM;
1200 dprintk("RPC: %5u %s: no memory available\n",
1201 task->tk_pid, __func__);
1202- goto bailout_nofree;
1203+ goto bailout_release_client;
1204 }
1205 map->r_prog = clnt->cl_prog;
1206 map->r_vers = clnt->cl_vers;
1207@@ -578,11 +600,13 @@ void rpcb_getport_async(struct rpc_task *task)
1208 task->tk_pid, __func__);
1209 return;
1210 }
1211- rpc_put_task(child);
1212
1213- task->tk_xprt->stat.bind_count++;
1214+ xprt->stat.bind_count++;
1215+ rpc_put_task(child);
1216 return;
1217
1218+bailout_release_client:
1219+ rpc_release_client(rpcb_clnt);
1220 bailout_nofree:
1221 rpcb_wake_rpcbind_waiters(xprt, status);
1222 task->tk_status = status;
1223diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
1224index 7c1eb23..a50089f 100644
1225--- a/sound/pci/hda/patch_conexant.c
1226+++ b/sound/pci/hda/patch_conexant.c
1227@@ -1470,6 +1470,7 @@ static struct snd_pci_quirk cxt5047_cfg_tbl[] = {
1228 SND_PCI_QUIRK(0x103c, 0x30a5, "HP DV5200T/DV8000T", CXT5047_LAPTOP_HP),
1229 SND_PCI_QUIRK(0x103c, 0x30b2, "HP DV2000T/DV3000T", CXT5047_LAPTOP),
1230 SND_PCI_QUIRK(0x103c, 0x30b5, "HP DV2000Z", CXT5047_LAPTOP),
1231+ SND_PCI_QUIRK(0x103c, 0x30cf, "HP DV6700", CXT5047_LAPTOP),
1232 SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P100", CXT5047_LAPTOP_EAPD),
1233 {}
1234 };
1235diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
1236index 7225f0f..aa7dc03 100644
1237--- a/sound/pci/hda/patch_realtek.c
1238+++ b/sound/pci/hda/patch_realtek.c
1239@@ -6631,6 +6631,7 @@ static int patch_alc882(struct hda_codec *codec)
1240 case 0x106b00a1: /* Macbook (might be wrong - PCI SSID?) */
1241 case 0x106b2c00: /* Macbook Pro rev3 */
1242 case 0x106b3600: /* Macbook 3.1 */
1243+ case 0x106b3800: /* MacbookPro4,1 - latter revision */
1244 board_config = ALC885_MBP3;
1245 break;
1246 default:
1247diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
1248index fdef553..2f52cf1 100644
1249--- a/sound/pci/hda/patch_sigmatel.c
1250+++ b/sound/pci/hda/patch_sigmatel.c
1251@@ -2048,6 +2048,8 @@ static int stac92xx_build_pcms(struct hda_codec *codec)
1252
1253 info->name = "STAC92xx Analog";
1254 info->stream[SNDRV_PCM_STREAM_PLAYBACK] = stac92xx_pcm_analog_playback;
1255+ info->stream[SNDRV_PCM_STREAM_PLAYBACK].nid =
1256+ spec->multiout.dac_nids[0];
1257 info->stream[SNDRV_PCM_STREAM_CAPTURE] = stac92xx_pcm_analog_capture;
1258 info->stream[SNDRV_PCM_STREAM_CAPTURE].nid = spec->adc_nids[0];
1259 info->stream[SNDRV_PCM_STREAM_CAPTURE].substreams = spec->num_adcs;
1260diff --git a/sound/pci/oxygen/virtuoso.c b/sound/pci/oxygen/virtuoso.c
1261index 01d7b75..82a7814 100644
1262--- a/sound/pci/oxygen/virtuoso.c
1263+++ b/sound/pci/oxygen/virtuoso.c
1264@@ -26,7 +26,7 @@
1265 * SPI 0 -> 1st PCM1796 (front)
1266 * SPI 1 -> 2nd PCM1796 (surround)
1267 * SPI 2 -> 3rd PCM1796 (center/LFE)
1268- * SPI 4 -> 4th PCM1796 (back)
1269+ * SPI 4 -> 4th PCM1796 (back) and EEPROM self-destruct (do not use!)
1270 *
1271 * GPIO 2 -> M0 of CS5381
1272 * GPIO 3 -> M1 of CS5381
1273@@ -142,6 +142,12 @@ struct xonar_data {
1274 static void pcm1796_write(struct oxygen *chip, unsigned int codec,
1275 u8 reg, u8 value)
1276 {
1277+ /*
1278+ * We don't want to do writes on SPI 4 because the EEPROM, which shares
1279+ * the same pin, might get confused and broken. We'd better take care
1280+ * that the driver works with the default register values ...
1281+ */
1282+#if 0
1283 /* maps ALSA channel pair number to SPI output */
1284 static const u8 codec_map[4] = {
1285 0, 1, 2, 4
1286@@ -152,6 +158,7 @@ static void pcm1796_write(struct oxygen *chip, unsigned int codec,
1287 (codec_map[codec] << OXYGEN_SPI_CODEC_SHIFT) |
1288 OXYGEN_SPI_CEN_LATCH_CLOCK_HI,
1289 (reg << 8) | value);
1290+#endif
1291 }
1292
1293 static void cs4398_write(struct oxygen *chip, u8 reg, u8 value)
1294@@ -539,6 +546,9 @@ static const DECLARE_TLV_DB_SCALE(cs4362a_db_scale, -12700, 100, 0);
1295
1296 static int xonar_d2_control_filter(struct snd_kcontrol_new *template)
1297 {
1298+ if (!strncmp(template->name, "Master Playback ", 16))
1299+ /* disable volume/mute because they would require SPI writes */
1300+ return 1;
1301 if (!strncmp(template->name, "CD Capture ", 11))
1302 /* CD in is actually connected to the video in pin */
1303 template->private_value ^= AC97_CD ^ AC97_VIDEO;
1304@@ -588,9 +598,8 @@ static const struct oxygen_model xonar_models[] = {
1305 .dac_volume_min = 0x0f,
1306 .dac_volume_max = 0xff,
1307 .misc_flags = OXYGEN_MISC_MIDI,
1308- .function_flags = OXYGEN_FUNCTION_SPI |
1309- OXYGEN_FUNCTION_ENABLE_SPI_4_5,
1310- .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
1311+ .function_flags = OXYGEN_FUNCTION_SPI,
1312+ .dac_i2s_format = OXYGEN_I2S_FORMAT_I2S,
1313 .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
1314 },
1315 [MODEL_D2X] = {
1316@@ -619,9 +628,8 @@ static const struct oxygen_model xonar_models[] = {
1317 .dac_volume_min = 0x0f,
1318 .dac_volume_max = 0xff,
1319 .misc_flags = OXYGEN_MISC_MIDI,
1320- .function_flags = OXYGEN_FUNCTION_SPI |
1321- OXYGEN_FUNCTION_ENABLE_SPI_4_5,
1322- .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
1323+ .function_flags = OXYGEN_FUNCTION_SPI,
1324+ .dac_i2s_format = OXYGEN_I2S_FORMAT_I2S,
1325 .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
1326 },
1327 [MODEL_D1] = {
IPFire 2.x development tree