From 5ec3cec5e9b2b11eeb1294668bd865fabe8437a8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 4 Nov 2008 16:26:53 -0800 Subject: [PATCH] start 2.6.27.5 review cycle --- ...ce-in-arch-sparc64-kernel-trampoline.patch | 0 ...-inclusion-of-tcp-options-in-syn-ack.patch | 0 ...gnalling-of-underflow-and-inexact-wh.patch | 0 ...ering-of-TCP-options-for-the-sake-of.patch | 0 ...v6-fix-option-space-offsets-with-md5.patch | 0 ...hed-sch_generic-Fix-oops-in-sch_teql.patch | 0 ...-sync-event-after-a-lid-state-change.patch | 0 .../acpi-clear-wak_sts-on-resume.patch | 0 ...bf-0-periodically-if-not-in-gpe-mode.patch | 0 ...o-transaction-from-interrupt-context.patch | 0 .../acpi-ec-rename-some-variables.patch | 0 ...-bit-when-using-acpi-reset-mechanism.patch | 0 ...gp-fix-stolen-memory-counting-on-g4x.patch | 0 .../alsa-hda-add-reboot-notifier.patch | 0 ...rrect-lock-in-snd_ctl_dev_disconnect.patch | 0 .../atl1-fix-vlan-tag-regression.patch | 0 ...nterface-down-before-removing-module.patch | 0 ...-or-parallel-mode-could-destroy-bits.patch | 0 ...form-s5h1411-soft-reset-after-tuning.patch | 0 ...1-power-down-s5h1411-when-not-in-use.patch | 0 ...s-always-start-with-clear-bprm-caps_.patch | 0 .../firewire-fix-ioctl-return-code.patch | 0 ...tting-tag-and-sy-in-iso-transmission.patch | 0 ...ewire-fix-struct-fw_node-memory-leak.patch | 0 ...2-delay-first-login-to-avoid-retries.patch | 0 .../firewire-fw-sbp2-fix-races.patch | 0 ...ire-survive-more-than-256-bus-resets.patch | 0 ...check-read_mapping_page-return-value.patch | 0 ...ffer-overflow-with-a-corrupted-image.patch | 0 .../i2c-the-i2c-mailing-list-is-moving.patch | 0 ...s-force-release-quirk-to-other-dells.patch | 0 ...as-to-load-ipmi_devintf-with-ipmi_si.patch | 0 .../kbuild-mkspec-fix-build-rpm.patch | 0 ...ix-lba48-on-pata_it821x-raid-volumes.patch | 0 ...ialize-port_task-when-config_ata_sff.patch | 0 .../libertas-fix-buffer-overrun.patch | 0 review-2.6.27/mbox | 6425 +++++++++++++++++ ...it-prefetchable-memory-resource-bars.patch | 0 ...-use-a-16g-page-if-beyond-mem-limits.patch | 0 ...-on-ppc-linkstation-kurobox-machines.patch | 0 ...make-memory-reserve-code-more-robust.patch | 0 ...served-regions-that-cross-numa-nodes.patch | 0 ...heel-mappings-for-some-logitech-mice.patch | 0 ...-pnp-rtc-first-then-for-platform-rtc.patch | 0 .../s390-fix-sysdev-class-file-creation.patch | 0 ...x-generic-nf2-3-detection-regression.patch | 0 ...se-add-ata-engine-reset-to-reset-ops.patch | 0 .../sched-disable-the-hrtick-for-now.patch | 0 ...vent-scd-clock-from-moving-backwards.patch | 0 ...handling-of-no_sense-check-condition.patch | 0 ...x200_i2c-add-missing-class-parameter.patch | 0 {queue-2.6.27 => review-2.6.27}/series | 0 ...n-values-for-sysdev_store_-ulong-int.patch | 0 ...re-unlinked-after-the-device-is-gone.patch | 0 ...csi-ioctls-to-jmicron-usb-ata-bridge.patch | 0 ...b2-keep-mpeg-ptss-from-drifting-away.patch | 0 ...referencing-beyond-stack-thread_size.patch | 0 ...m-mmap-breakage-when-pat-is-disabled.patch | 0 ...tc-device-if-pnp-doesn-t-describe-it.patch | 0 59 files changed, 6425 insertions(+) rename {queue-2.6.27 => review-2.6.27}/0001-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch (100%) rename {queue-2.6.27 => review-2.6.27}/0001-syncookies-fix-inclusion-of-tcp-options-in-syn-ack.patch (100%) rename {queue-2.6.27 => review-2.6.27}/0002-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch (100%) rename {queue-2.6.27 => review-2.6.27}/0002-tcp-Restore-ordering-of-TCP-options-for-the-sake-of.patch (100%) rename {queue-2.6.27 => review-2.6.27}/0003-tcpv6-fix-option-space-offsets-with-md5.patch (100%) rename {queue-2.6.27 => review-2.6.27}/0004-pkt_sched-sch_generic-Fix-oops-in-sch_teql.patch (100%) rename {queue-2.6.27 => review-2.6.27}/acpi-always-report-a-sync-event-after-a-lid-state-change.patch (100%) rename {queue-2.6.27 => review-2.6.27}/acpi-clear-wak_sts-on-resume.patch (100%) rename {queue-2.6.27 => review-2.6.27}/acpi-ec-check-for-ibf-0-periodically-if-not-in-gpe-mode.patch (100%) rename {queue-2.6.27 => review-2.6.27}/acpi-ec-do-transaction-from-interrupt-context.patch (100%) rename {queue-2.6.27 => review-2.6.27}/acpi-ec-rename-some-variables.patch (100%) rename {queue-2.6.27 => review-2.6.27}/acpi-ingore-the-reset_reg_sup-bit-when-using-acpi-reset-mechanism.patch (100%) rename {queue-2.6.27 => review-2.6.27}/agp-fix-stolen-memory-counting-on-g4x.patch (100%) rename {queue-2.6.27 => review-2.6.27}/alsa-hda-add-reboot-notifier.patch (100%) rename {queue-2.6.27 => review-2.6.27}/alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch (100%) rename {queue-2.6.27 => review-2.6.27}/atl1-fix-vlan-tag-regression.patch (100%) rename {queue-2.6.27 => review-2.6.27}/bonding-fix-panic-when-taking-bond-interface-down-before-removing-module.patch (100%) rename {queue-2.6.27 => review-2.6.27}/dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch (100%) rename {queue-2.6.27 => review-2.6.27}/dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch (100%) rename {queue-2.6.27 => review-2.6.27}/dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch (100%) rename {queue-2.6.27 => review-2.6.27}/file-caps-always-start-with-clear-bprm-caps_.patch (100%) rename {queue-2.6.27 => review-2.6.27}/firewire-fix-ioctl-return-code.patch (100%) rename {queue-2.6.27 => review-2.6.27}/firewire-fix-setting-tag-and-sy-in-iso-transmission.patch (100%) rename {queue-2.6.27 => review-2.6.27}/firewire-fix-struct-fw_node-memory-leak.patch (100%) rename {queue-2.6.27 => review-2.6.27}/firewire-fw-sbp2-delay-first-login-to-avoid-retries.patch (100%) rename {queue-2.6.27 => review-2.6.27}/firewire-fw-sbp2-fix-races.patch (100%) rename {queue-2.6.27 => review-2.6.27}/firewire-survive-more-than-256-bus-resets.patch (100%) rename {queue-2.6.27 => review-2.6.27}/hfsplus-check-read_mapping_page-return-value.patch (100%) rename {queue-2.6.27 => review-2.6.27}/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch (100%) rename {queue-2.6.27 => review-2.6.27}/i2c-the-i2c-mailing-list-is-moving.patch (100%) rename {queue-2.6.27 => review-2.6.27}/input-atkbd-expand-latitude-s-force-release-quirk-to-other-dells.patch (100%) rename {queue-2.6.27 => review-2.6.27}/ipmi-add-module_alias-to-load-ipmi_devintf-with-ipmi_si.patch (100%) rename {queue-2.6.27 => review-2.6.27}/kbuild-mkspec-fix-build-rpm.patch (100%) rename {queue-2.6.27 => review-2.6.27}/libata-fix-lba48-on-pata_it821x-raid-volumes.patch (100%) rename {queue-2.6.27 => review-2.6.27}/libata-initialize-port_task-when-config_ata_sff.patch (100%) rename {queue-2.6.27 => review-2.6.27}/libertas-fix-buffer-overrun.patch (100%) create mode 100644 review-2.6.27/mbox rename {queue-2.6.27 => review-2.6.27}/pci-fix-64-vbit-prefetchable-memory-resource-bars.patch (100%) rename {queue-2.6.27 => review-2.6.27}/powerpc-don-t-use-a-16g-page-if-beyond-mem-limits.patch (100%) rename {queue-2.6.27 => review-2.6.27}/powerpc-fix-i2c-on-ppc-linkstation-kurobox-machines.patch (100%) rename {queue-2.6.27 => review-2.6.27}/powerpc-numa-make-memory-reserve-code-more-robust.patch (100%) rename {queue-2.6.27 => review-2.6.27}/powerpc-reserve-in-bootmem-lmb-reserved-regions-that-cross-numa-nodes.patch (100%) rename {queue-2.6.27 => review-2.6.27}/revert-hid-invert-hwheel-mappings-for-some-logitech-mice.patch (100%) rename {queue-2.6.27 => review-2.6.27}/rtc-cmos-look-for-pnp-rtc-first-then-for-platform-rtc.patch (100%) rename {queue-2.6.27 => review-2.6.27}/s390-fix-sysdev-class-file-creation.patch (100%) rename {queue-2.6.27 => review-2.6.27}/sata_nv-fix-generic-nf2-3-detection-regression.patch (100%) rename {queue-2.6.27 => review-2.6.27}/sata_promise-add-ata-engine-reset-to-reset-ops.patch (100%) rename {queue-2.6.27 => review-2.6.27}/sched-disable-the-hrtick-for-now.patch (100%) rename {queue-2.6.27 => review-2.6.27}/sched_clock-prevent-scd-clock-from-moving-backwards.patch (100%) rename {queue-2.6.27 => review-2.6.27}/scsi-sd-fix-handling-of-no_sense-check-condition.patch (100%) rename {queue-2.6.27 => review-2.6.27}/scx200_i2c-add-missing-class-parameter.patch (100%) rename {queue-2.6.27 => review-2.6.27}/series (100%) rename {queue-2.6.27 => review-2.6.27}/sysfs-fix-return-values-for-sysdev_store_-ulong-int.patch (100%) rename {queue-2.6.27 => review-2.6.27}/usb-fix-crash-when-urbs-are-unlinked-after-the-device-is-gone.patch (100%) rename {queue-2.6.27 => review-2.6.27}/usb-storage-avoid-i-o-errors-when-issuing-scsi-ioctls-to-jmicron-usb-ata-bridge.patch (100%) rename {queue-2.6.27 => review-2.6.27}/v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch (100%) rename {queue-2.6.27 => review-2.6.27}/x86-avoid-dereferencing-beyond-stack-thread_size.patch (100%) rename {queue-2.6.27 => review-2.6.27}/x86-fix-dev-mem-mmap-breakage-when-pat-is-disabled.patch (100%) rename {queue-2.6.27 => review-2.6.27}/x86-register-a-platform-rtc-device-if-pnp-doesn-t-describe-it.patch (100%) diff --git a/queue-2.6.27/0001-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch b/review-2.6.27/0001-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch similarity index 100% rename from queue-2.6.27/0001-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch rename to review-2.6.27/0001-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch diff --git a/queue-2.6.27/0001-syncookies-fix-inclusion-of-tcp-options-in-syn-ack.patch b/review-2.6.27/0001-syncookies-fix-inclusion-of-tcp-options-in-syn-ack.patch similarity index 100% rename from queue-2.6.27/0001-syncookies-fix-inclusion-of-tcp-options-in-syn-ack.patch rename to review-2.6.27/0001-syncookies-fix-inclusion-of-tcp-options-in-syn-ack.patch diff --git a/queue-2.6.27/0002-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch b/review-2.6.27/0002-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch similarity index 100% rename from queue-2.6.27/0002-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch rename to review-2.6.27/0002-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch diff --git a/queue-2.6.27/0002-tcp-Restore-ordering-of-TCP-options-for-the-sake-of.patch b/review-2.6.27/0002-tcp-Restore-ordering-of-TCP-options-for-the-sake-of.patch similarity index 100% rename from queue-2.6.27/0002-tcp-Restore-ordering-of-TCP-options-for-the-sake-of.patch rename to review-2.6.27/0002-tcp-Restore-ordering-of-TCP-options-for-the-sake-of.patch diff --git a/queue-2.6.27/0003-tcpv6-fix-option-space-offsets-with-md5.patch b/review-2.6.27/0003-tcpv6-fix-option-space-offsets-with-md5.patch similarity index 100% rename from queue-2.6.27/0003-tcpv6-fix-option-space-offsets-with-md5.patch rename to review-2.6.27/0003-tcpv6-fix-option-space-offsets-with-md5.patch diff --git a/queue-2.6.27/0004-pkt_sched-sch_generic-Fix-oops-in-sch_teql.patch b/review-2.6.27/0004-pkt_sched-sch_generic-Fix-oops-in-sch_teql.patch similarity index 100% rename from queue-2.6.27/0004-pkt_sched-sch_generic-Fix-oops-in-sch_teql.patch rename to review-2.6.27/0004-pkt_sched-sch_generic-Fix-oops-in-sch_teql.patch diff --git a/queue-2.6.27/acpi-always-report-a-sync-event-after-a-lid-state-change.patch b/review-2.6.27/acpi-always-report-a-sync-event-after-a-lid-state-change.patch similarity index 100% rename from queue-2.6.27/acpi-always-report-a-sync-event-after-a-lid-state-change.patch rename to review-2.6.27/acpi-always-report-a-sync-event-after-a-lid-state-change.patch diff --git a/queue-2.6.27/acpi-clear-wak_sts-on-resume.patch b/review-2.6.27/acpi-clear-wak_sts-on-resume.patch similarity index 100% rename from queue-2.6.27/acpi-clear-wak_sts-on-resume.patch rename to review-2.6.27/acpi-clear-wak_sts-on-resume.patch diff --git a/queue-2.6.27/acpi-ec-check-for-ibf-0-periodically-if-not-in-gpe-mode.patch b/review-2.6.27/acpi-ec-check-for-ibf-0-periodically-if-not-in-gpe-mode.patch similarity index 100% rename from queue-2.6.27/acpi-ec-check-for-ibf-0-periodically-if-not-in-gpe-mode.patch rename to review-2.6.27/acpi-ec-check-for-ibf-0-periodically-if-not-in-gpe-mode.patch diff --git a/queue-2.6.27/acpi-ec-do-transaction-from-interrupt-context.patch b/review-2.6.27/acpi-ec-do-transaction-from-interrupt-context.patch similarity index 100% rename from queue-2.6.27/acpi-ec-do-transaction-from-interrupt-context.patch rename to review-2.6.27/acpi-ec-do-transaction-from-interrupt-context.patch diff --git a/queue-2.6.27/acpi-ec-rename-some-variables.patch b/review-2.6.27/acpi-ec-rename-some-variables.patch similarity index 100% rename from queue-2.6.27/acpi-ec-rename-some-variables.patch rename to review-2.6.27/acpi-ec-rename-some-variables.patch diff --git a/queue-2.6.27/acpi-ingore-the-reset_reg_sup-bit-when-using-acpi-reset-mechanism.patch b/review-2.6.27/acpi-ingore-the-reset_reg_sup-bit-when-using-acpi-reset-mechanism.patch similarity index 100% rename from queue-2.6.27/acpi-ingore-the-reset_reg_sup-bit-when-using-acpi-reset-mechanism.patch rename to review-2.6.27/acpi-ingore-the-reset_reg_sup-bit-when-using-acpi-reset-mechanism.patch diff --git a/queue-2.6.27/agp-fix-stolen-memory-counting-on-g4x.patch b/review-2.6.27/agp-fix-stolen-memory-counting-on-g4x.patch similarity index 100% rename from queue-2.6.27/agp-fix-stolen-memory-counting-on-g4x.patch rename to review-2.6.27/agp-fix-stolen-memory-counting-on-g4x.patch diff --git a/queue-2.6.27/alsa-hda-add-reboot-notifier.patch b/review-2.6.27/alsa-hda-add-reboot-notifier.patch similarity index 100% rename from queue-2.6.27/alsa-hda-add-reboot-notifier.patch rename to review-2.6.27/alsa-hda-add-reboot-notifier.patch diff --git a/queue-2.6.27/alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch b/review-2.6.27/alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch similarity index 100% rename from queue-2.6.27/alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch rename to review-2.6.27/alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch diff --git a/queue-2.6.27/atl1-fix-vlan-tag-regression.patch b/review-2.6.27/atl1-fix-vlan-tag-regression.patch similarity index 100% rename from queue-2.6.27/atl1-fix-vlan-tag-regression.patch rename to review-2.6.27/atl1-fix-vlan-tag-regression.patch diff --git a/queue-2.6.27/bonding-fix-panic-when-taking-bond-interface-down-before-removing-module.patch b/review-2.6.27/bonding-fix-panic-when-taking-bond-interface-down-before-removing-module.patch similarity index 100% rename from queue-2.6.27/bonding-fix-panic-when-taking-bond-interface-down-before-removing-module.patch rename to review-2.6.27/bonding-fix-panic-when-taking-bond-interface-down-before-removing-module.patch diff --git a/queue-2.6.27/dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch b/review-2.6.27/dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch similarity index 100% rename from queue-2.6.27/dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch rename to review-2.6.27/dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch diff --git a/queue-2.6.27/dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch b/review-2.6.27/dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch similarity index 100% rename from queue-2.6.27/dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch rename to review-2.6.27/dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch diff --git a/queue-2.6.27/dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch b/review-2.6.27/dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch similarity index 100% rename from queue-2.6.27/dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch rename to review-2.6.27/dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch diff --git a/queue-2.6.27/file-caps-always-start-with-clear-bprm-caps_.patch b/review-2.6.27/file-caps-always-start-with-clear-bprm-caps_.patch similarity index 100% rename from queue-2.6.27/file-caps-always-start-with-clear-bprm-caps_.patch rename to review-2.6.27/file-caps-always-start-with-clear-bprm-caps_.patch diff --git a/queue-2.6.27/firewire-fix-ioctl-return-code.patch b/review-2.6.27/firewire-fix-ioctl-return-code.patch similarity index 100% rename from queue-2.6.27/firewire-fix-ioctl-return-code.patch rename to review-2.6.27/firewire-fix-ioctl-return-code.patch diff --git a/queue-2.6.27/firewire-fix-setting-tag-and-sy-in-iso-transmission.patch b/review-2.6.27/firewire-fix-setting-tag-and-sy-in-iso-transmission.patch similarity index 100% rename from queue-2.6.27/firewire-fix-setting-tag-and-sy-in-iso-transmission.patch rename to review-2.6.27/firewire-fix-setting-tag-and-sy-in-iso-transmission.patch diff --git a/queue-2.6.27/firewire-fix-struct-fw_node-memory-leak.patch b/review-2.6.27/firewire-fix-struct-fw_node-memory-leak.patch similarity index 100% rename from queue-2.6.27/firewire-fix-struct-fw_node-memory-leak.patch rename to review-2.6.27/firewire-fix-struct-fw_node-memory-leak.patch diff --git a/queue-2.6.27/firewire-fw-sbp2-delay-first-login-to-avoid-retries.patch b/review-2.6.27/firewire-fw-sbp2-delay-first-login-to-avoid-retries.patch similarity index 100% rename from queue-2.6.27/firewire-fw-sbp2-delay-first-login-to-avoid-retries.patch rename to review-2.6.27/firewire-fw-sbp2-delay-first-login-to-avoid-retries.patch diff --git a/queue-2.6.27/firewire-fw-sbp2-fix-races.patch b/review-2.6.27/firewire-fw-sbp2-fix-races.patch similarity index 100% rename from queue-2.6.27/firewire-fw-sbp2-fix-races.patch rename to review-2.6.27/firewire-fw-sbp2-fix-races.patch diff --git a/queue-2.6.27/firewire-survive-more-than-256-bus-resets.patch b/review-2.6.27/firewire-survive-more-than-256-bus-resets.patch similarity index 100% rename from queue-2.6.27/firewire-survive-more-than-256-bus-resets.patch rename to review-2.6.27/firewire-survive-more-than-256-bus-resets.patch diff --git a/queue-2.6.27/hfsplus-check-read_mapping_page-return-value.patch b/review-2.6.27/hfsplus-check-read_mapping_page-return-value.patch similarity index 100% rename from queue-2.6.27/hfsplus-check-read_mapping_page-return-value.patch rename to review-2.6.27/hfsplus-check-read_mapping_page-return-value.patch diff --git a/queue-2.6.27/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch b/review-2.6.27/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch similarity index 100% rename from queue-2.6.27/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch rename to review-2.6.27/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch diff --git a/queue-2.6.27/i2c-the-i2c-mailing-list-is-moving.patch b/review-2.6.27/i2c-the-i2c-mailing-list-is-moving.patch similarity index 100% rename from queue-2.6.27/i2c-the-i2c-mailing-list-is-moving.patch rename to review-2.6.27/i2c-the-i2c-mailing-list-is-moving.patch diff --git a/queue-2.6.27/input-atkbd-expand-latitude-s-force-release-quirk-to-other-dells.patch b/review-2.6.27/input-atkbd-expand-latitude-s-force-release-quirk-to-other-dells.patch similarity index 100% rename from queue-2.6.27/input-atkbd-expand-latitude-s-force-release-quirk-to-other-dells.patch rename to review-2.6.27/input-atkbd-expand-latitude-s-force-release-quirk-to-other-dells.patch diff --git a/queue-2.6.27/ipmi-add-module_alias-to-load-ipmi_devintf-with-ipmi_si.patch b/review-2.6.27/ipmi-add-module_alias-to-load-ipmi_devintf-with-ipmi_si.patch similarity index 100% rename from queue-2.6.27/ipmi-add-module_alias-to-load-ipmi_devintf-with-ipmi_si.patch rename to review-2.6.27/ipmi-add-module_alias-to-load-ipmi_devintf-with-ipmi_si.patch diff --git a/queue-2.6.27/kbuild-mkspec-fix-build-rpm.patch b/review-2.6.27/kbuild-mkspec-fix-build-rpm.patch similarity index 100% rename from queue-2.6.27/kbuild-mkspec-fix-build-rpm.patch rename to review-2.6.27/kbuild-mkspec-fix-build-rpm.patch diff --git a/queue-2.6.27/libata-fix-lba48-on-pata_it821x-raid-volumes.patch b/review-2.6.27/libata-fix-lba48-on-pata_it821x-raid-volumes.patch similarity index 100% rename from queue-2.6.27/libata-fix-lba48-on-pata_it821x-raid-volumes.patch rename to review-2.6.27/libata-fix-lba48-on-pata_it821x-raid-volumes.patch diff --git a/queue-2.6.27/libata-initialize-port_task-when-config_ata_sff.patch b/review-2.6.27/libata-initialize-port_task-when-config_ata_sff.patch similarity index 100% rename from queue-2.6.27/libata-initialize-port_task-when-config_ata_sff.patch rename to review-2.6.27/libata-initialize-port_task-when-config_ata_sff.patch diff --git a/queue-2.6.27/libertas-fix-buffer-overrun.patch b/review-2.6.27/libertas-fix-buffer-overrun.patch similarity index 100% rename from queue-2.6.27/libertas-fix-buffer-overrun.patch rename to review-2.6.27/libertas-fix-buffer-overrun.patch diff --git a/review-2.6.27/mbox b/review-2.6.27/mbox new file mode 100644 index 00000000000..84d926ed5ba --- /dev/null +++ b/review-2.6.27/mbox @@ -0,0 +1,6425 @@ +From gregkh@mini.kroah.org Tue Nov 4 15:23:17 2008 +Message-Id: <20081104232317.715134241@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:45 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Anholt , + Dave Airlie +Subject: [patch 01/57] agp: Fix stolen memory counting on G4X. +Content-Disposition: inline; filename=agp-fix-stolen-memory-counting-on-g4x.patch +Content-Length: 2325 +Lines: 58 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Anholt + +commit 82e14a6215cbc9804ecc35281e973c6c8ce22fe7 upstream + +On the GM45, the amount of stolen memory mapped to the GTT was underestimated, +even though we had 508KB more available since the GTT doesn't take from +stolen memory. On the non-GM45 G4X, we overestimated how much stolen was +mapped to the GTT by 4KB, resulting in GPU page faults when that page was +accessed. + +This update requires a corresponding update to xf86-video-intel to work +correctly. + +Signed-off-by: Eric Anholt +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/agp/intel-agp.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -54,8 +54,7 @@ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965Q_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GM_HB || \ +- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB || \ +- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB) ++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB) + + #define IS_G33 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G33_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q35_HB || \ +@@ -63,7 +62,8 @@ + + #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGD_E_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \ +- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB) ++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \ ++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB) + + extern int agp_memory_reserved; + +@@ -525,8 +525,10 @@ static void intel_i830_init_gtt_entries( + size += 4; + } else if (IS_G4X) { + /* On 4 series hardware, GTT stolen is separate from graphics +- * stolen, ignore it in stolen gtt entries counting */ +- size = 0; ++ * stolen, ignore it in stolen gtt entries counting. However, ++ * 4KB of the stolen memory doesn't get mapped to the GTT. ++ */ ++ size = 4; + } else { + /* On previous hardware, the GTT size was just what was + * required to map the aperture. + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008 +Message-Id: <20081104232317.891267458@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:46 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jamie Wellnitz , + James Bottomley +Subject: [patch 02/57] SCSI: sd: Fix handling of NO_SENSE check condition +Content-Disposition: inline; filename=scsi-sd-fix-handling-of-no_sense-check-condition.patch +Content-Length: 1842 +Lines: 51 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jamie Wellnitz + +commit 10dab22664914505dcb804d9ad09cad6bc94d349 upstream + +The current handling of NO_SENSE check condition is the same as +RECOVERED_ERROR, and assumes that in both cases, the I/O was fully +transferred. + +We have seen cases of arrays returning with NO_SENSE (no error), but +the I/O was not completely transferred, thus residual set. Thus, +rather than return good_bytes as the entire transfer, set good_bytes +to 0, so that the midlayer then applies the residual in calculating +the transfer, and for sd, will fail the I/O and fall into a retry +path. + +Signed-off-by: Jamie Wellnitz +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1047,7 +1047,6 @@ static int sd_done(struct scsi_cmnd *SCp + good_bytes = sd_completed_bytes(SCpnt); + break; + case RECOVERED_ERROR: +- case NO_SENSE: + /* Inform the user, but make sure that it's not treated + * as a hard error. + */ +@@ -1056,6 +1055,15 @@ static int sd_done(struct scsi_cmnd *SCp + memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE); + good_bytes = scsi_bufflen(SCpnt); + break; ++ case NO_SENSE: ++ /* This indicates a false check condition, so ignore it. An ++ * unknown amount of data was transferred so treat it as an ++ * error. ++ */ ++ scsi_print_sense("sd", SCpnt); ++ SCpnt->result = 0; ++ memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE); ++ break; + case ABORTED_COMMAND: + if (sshdr.asc == 0x10) { /* DIF: Disk detected corruption */ + scsi_print_result(SCpnt); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008 +Message-Id: <20081104232318.060575154@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:47 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Heiko Carstens , + Martin Schwidefsky +Subject: [patch 03/57] S390: Fix sysdev class file creation. +Content-Disposition: inline; filename=s390-fix-sysdev-class-file-creation.patch +Content-Length: 2909 +Lines: 88 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Heiko Carstens + +commit da5aae7036692fa8d03da1b705c76fd750ed9e38 upstream + +Use sysdev_class_create_file() to create create sysdev class attributes +instead of sysfs_create_file(). Using sysfs_create_file() wasn't a very +good idea since the show and store functions have a different amount of +parameters for sysfs files and sysdev class files. +In particular the pointer to the buffer is the last argument and +therefore accesses to random memory regions happened. +Still worked surprisingly well until we got a kernel panic. + +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/smp.c | 24 +++++++++--------------- + 1 file changed, 9 insertions(+), 15 deletions(-) + +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -1117,9 +1117,7 @@ out: + return rc; + } + +-static ssize_t __ref rescan_store(struct sys_device *dev, +- struct sysdev_attribute *attr, +- const char *buf, ++static ssize_t __ref rescan_store(struct sysdev_class *class, const char *buf, + size_t count) + { + int rc; +@@ -1127,12 +1125,10 @@ static ssize_t __ref rescan_store(struct + rc = smp_rescan_cpus(); + return rc ? rc : count; + } +-static SYSDEV_ATTR(rescan, 0200, NULL, rescan_store); ++static SYSDEV_CLASS_ATTR(rescan, 0200, NULL, rescan_store); + #endif /* CONFIG_HOTPLUG_CPU */ + +-static ssize_t dispatching_show(struct sys_device *dev, +- struct sysdev_attribute *attr, +- char *buf) ++static ssize_t dispatching_show(struct sysdev_class *class, char *buf) + { + ssize_t count; + +@@ -1142,9 +1138,8 @@ static ssize_t dispatching_show(struct s + return count; + } + +-static ssize_t dispatching_store(struct sys_device *dev, +- struct sysdev_attribute *attr, +- const char *buf, size_t count) ++static ssize_t dispatching_store(struct sysdev_class *dev, const char *buf, ++ size_t count) + { + int val, rc; + char delim; +@@ -1166,7 +1161,8 @@ out: + put_online_cpus(); + return rc ? rc : count; + } +-static SYSDEV_ATTR(dispatching, 0644, dispatching_show, dispatching_store); ++static SYSDEV_CLASS_ATTR(dispatching, 0644, dispatching_show, ++ dispatching_store); + + static int __init topology_init(void) + { +@@ -1176,13 +1172,11 @@ static int __init topology_init(void) + register_cpu_notifier(&smp_cpu_nb); + + #ifdef CONFIG_HOTPLUG_CPU +- rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj, +- &attr_rescan.attr); ++ rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_rescan); + if (rc) + return rc; + #endif +- rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj, +- &attr_dispatching.attr); ++ rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_dispatching); + if (rc) + return rc; + for_each_present_cpu(cpu) { + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008 +Message-Id: <20081104232318.234852040@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andi Kleen +Subject: [patch 04/57] sysfs: Fix return values for sysdev_store_{ulong, int} +Content-Disposition: inline; filename=sysfs-fix-return-values-for-sysdev_store_-ulong-int.patch +Content-Length: 1234 +Lines: 42 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andi Kleen + +commit 4e318d7c6c9dd5cdae48bcf61558bbc0c09b12ac upstream + +SYSFS: Fix return values for sysdev_store_{ulong,int} + +Always return the full size instead of the consumed +length of the string in sysdev_store_{ulong,int} + +This avoids EINVAL errors in some echo versions. + +Signed-off-by: Andi Kleen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/sys.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/base/sys.c ++++ b/drivers/base/sys.c +@@ -488,7 +488,8 @@ ssize_t sysdev_store_ulong(struct sys_de + if (end == buf) + return -EINVAL; + *(unsigned long *)(ea->var) = new; +- return end - buf; ++ /* Always return full write size even if we didn't consume all */ ++ return size; + } + EXPORT_SYMBOL_GPL(sysdev_store_ulong); + +@@ -511,7 +512,8 @@ ssize_t sysdev_store_int(struct sys_devi + if (end == buf || new > INT_MAX || new < INT_MIN) + return -EINVAL; + *(int *)(ea->var) = new; +- return end - buf; ++ /* Always return full write size even if we didn't consume all */ ++ return size; + } + EXPORT_SYMBOL_GPL(sysdev_store_int); + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008 +Message-Id: <20081104232318.398108411@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Scott James Remnant , + Tim Gardner , + Corey Minyard +Subject: [patch 05/57] ipmi: add MODULE_ALIAS to load ipmi_devintf with ipmi_si +Content-Disposition: inline; filename=ipmi-add-module_alias-to-load-ipmi_devintf-with-ipmi_si.patch +Content-Length: 1192 +Lines: 31 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Scott James Remnant + +commit 6c89161b10f5771ee0b51ada0fce0e8835e72ade upstream + +The ipmi_devintf module contains the userspace interface for IPMI devices, +yet will not be loaded automatically with a system interface handler +driver. + +Add a MODULE_ALIAS for the "platform:ipmi_si" MODALIAS exported by the +ipmi_si driver, so that userspace knows of the recommendation. + +Signed-off-by: Scott James Remnant +Cc: Tim Gardner +Cc: Corey Minyard +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/ipmi/ipmi_devintf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/char/ipmi/ipmi_devintf.c ++++ b/drivers/char/ipmi/ipmi_devintf.c +@@ -957,3 +957,4 @@ module_exit(cleanup_ipmi); + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Corey Minyard "); + MODULE_DESCRIPTION("Linux device interface for the IPMI message handler."); ++MODULE_ALIAS("platform:ipmi_si"); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008 +Message-Id: <20081104232318.572456971@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [patch 06/57] USB: fix crash when URBs are unlinked after the device is gone +Content-Disposition: inline; filename=usb-fix-crash-when-urbs-are-unlinked-after-the-device-is-gone.patch +Content-Length: 5889 +Lines: 157 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Stern + +commit cde217a556ec552d28ac9e136c5a94684a69ae94 upstream + +This patch (as1151) protects usbcore against drivers that try to +unlink an URB after the URB's device or bus have been removed. The +core does not currently check for this, and certain drivers can cause +a crash if they are running while an HCD is unloaded. + +Certainly it would be best to fix the guilty drivers. But a little +defensive programming doesn't hurt, especially since it appears that +quite a few drivers need to be fixed. + +The patch prevents the problem by grabbing a reference to the device +while an unlink is in progress and using a new spinlock to synchronize +unlinks with device removal. (There's no need to acquire a reference +to the bus as well, since the device structure itself keeps a +reference to the bus.) In addition, the kerneldoc is updated to +indicate that URBs should not be unlinked after the disconnect method +returns. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 35 ++++++++++++++++++++++++++++++++--- + drivers/usb/core/hcd.h | 1 + + drivers/usb/core/hub.c | 1 + + drivers/usb/core/urb.c | 15 +++++++++++++++ + 4 files changed, 49 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -106,6 +106,9 @@ static DEFINE_SPINLOCK(hcd_root_hub_lock + /* used when updating an endpoint's URB list */ + static DEFINE_SPINLOCK(hcd_urb_list_lock); + ++/* used to protect against unlinking URBs after the device is gone */ ++static DEFINE_SPINLOCK(hcd_urb_unlink_lock); ++ + /* wait queue for synchronous unlinks */ + DECLARE_WAIT_QUEUE_HEAD(usb_kill_urb_queue); + +@@ -1377,10 +1380,25 @@ static int unlink1(struct usb_hcd *hcd, + int usb_hcd_unlink_urb (struct urb *urb, int status) + { + struct usb_hcd *hcd; +- int retval; ++ int retval = -EIDRM; ++ unsigned long flags; + +- hcd = bus_to_hcd(urb->dev->bus); +- retval = unlink1(hcd, urb, status); ++ /* Prevent the device and bus from going away while ++ * the unlink is carried out. If they are already gone ++ * then urb->use_count must be 0, since disconnected ++ * devices can't have any active URBs. ++ */ ++ spin_lock_irqsave(&hcd_urb_unlink_lock, flags); ++ if (atomic_read(&urb->use_count) > 0) { ++ retval = 0; ++ usb_get_dev(urb->dev); ++ } ++ spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags); ++ if (retval == 0) { ++ hcd = bus_to_hcd(urb->dev->bus); ++ retval = unlink1(hcd, urb, status); ++ usb_put_dev(urb->dev); ++ } + + if (retval == 0) + retval = -EINPROGRESS; +@@ -1529,6 +1547,17 @@ void usb_hcd_disable_endpoint(struct usb + hcd->driver->endpoint_disable(hcd, ep); + } + ++/* Protect against drivers that try to unlink URBs after the device ++ * is gone, by waiting until all unlinks for @udev are finished. ++ * Since we don't currently track URBs by device, simply wait until ++ * nothing is running in the locked region of usb_hcd_unlink_urb(). ++ */ ++void usb_hcd_synchronize_unlinks(struct usb_device *udev) ++{ ++ spin_lock_irq(&hcd_urb_unlink_lock); ++ spin_unlock_irq(&hcd_urb_unlink_lock); ++} ++ + /*-------------------------------------------------------------------------*/ + + /* called in any context */ +--- a/drivers/usb/core/hcd.h ++++ b/drivers/usb/core/hcd.h +@@ -232,6 +232,7 @@ extern void usb_hcd_flush_endpoint(struc + struct usb_host_endpoint *ep); + extern void usb_hcd_disable_endpoint(struct usb_device *udev, + struct usb_host_endpoint *ep); ++extern void usb_hcd_synchronize_unlinks(struct usb_device *udev); + extern int usb_hcd_get_frame_number(struct usb_device *udev); + + extern struct usb_hcd *usb_create_hcd(const struct hc_driver *driver, +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1349,6 +1349,7 @@ void usb_disconnect(struct usb_device ** + */ + dev_dbg (&udev->dev, "unregistering device\n"); + usb_disable_device(udev, 0); ++ usb_hcd_synchronize_unlinks(udev); + + usb_unlock_device(udev); + +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -465,6 +465,12 @@ EXPORT_SYMBOL_GPL(usb_submit_urb); + * indicating that the request has been canceled (rather than any other + * code). + * ++ * Drivers should not call this routine or related routines, such as ++ * usb_kill_urb() or usb_unlink_anchored_urbs(), after their disconnect ++ * method has returned. The disconnect function should synchronize with ++ * a driver's I/O routines to insure that all URB-related activity has ++ * completed before it returns. ++ * + * This request is always asynchronous. Success is indicated by + * returning -EINPROGRESS, at which time the URB will probably not yet + * have been given back to the device driver. When it is eventually +@@ -541,6 +547,9 @@ EXPORT_SYMBOL_GPL(usb_unlink_urb); + * This routine may not be used in an interrupt context (such as a bottom + * half or a completion handler), or when holding a spinlock, or in other + * situations where the caller can't schedule(). ++ * ++ * This routine should not be called by a driver after its disconnect ++ * method has returned. + */ + void usb_kill_urb(struct urb *urb) + { +@@ -568,6 +577,9 @@ EXPORT_SYMBOL_GPL(usb_kill_urb); + * + * this allows all outstanding URBs to be killed starting + * from the back of the queue ++ * ++ * This routine should not be called by a driver after its disconnect ++ * method has returned. + */ + void usb_kill_anchored_urbs(struct usb_anchor *anchor) + { +@@ -597,6 +609,9 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs + * from the back of the queue. This function is asynchronous. + * The unlinking is just tiggered. It may happen after this + * function has returned. ++ * ++ * This routine should not be called by a driver after its disconnect ++ * method has returned. + */ + void usb_unlink_anchored_urbs(struct usb_anchor *anchor) + { + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008 +Message-Id: <20081104232318.757214800@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:51 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 07/57] ALSA: hda - Add reboot notifier +Content-Disposition: inline; filename=alsa-hda-add-reboot-notifier.patch +Content-Length: 2410 +Lines: 87 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Takashi Iwai + +commit 0cbf00980f0fc4cc064a15ab3dfce19b5fae9130 upstream + +The current snd-hda-intel driver seems blocking the power-off on some +devices like eeepc. Although this is likely a BIOS problem, we can add +a workaround by disabling IRQ lines before power-off operation. +This patch adds the reboot notifier to achieve it. + +The detailed problem description is found in bug#11889: + http://bugme.linux-foundation.org/show_bug.cgi?id=11889 + +Tested-by: Luiz Fernando N. Capitulino +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + #include + #include + #include "hda_codec.h" +@@ -385,6 +386,9 @@ struct azx { + + /* for pending irqs */ + struct work_struct irq_pending_work; ++ ++ /* reboot notifier (for mysterious hangup problem at power-down) */ ++ struct notifier_block reboot_notifier; + }; + + /* driver types */ +@@ -1890,12 +1894,36 @@ static int azx_resume(struct pci_dev *pc + + + /* ++ * reboot notifier for hang-up problem at power-down ++ */ ++static int azx_halt(struct notifier_block *nb, unsigned long event, void *buf) ++{ ++ struct azx *chip = container_of(nb, struct azx, reboot_notifier); ++ azx_stop_chip(chip); ++ return NOTIFY_OK; ++} ++ ++static void azx_notifier_register(struct azx *chip) ++{ ++ chip->reboot_notifier.notifier_call = azx_halt; ++ register_reboot_notifier(&chip->reboot_notifier); ++} ++ ++static void azx_notifier_unregister(struct azx *chip) ++{ ++ if (chip->reboot_notifier.notifier_call) ++ unregister_reboot_notifier(&chip->reboot_notifier); ++} ++ ++/* + * destructor + */ + static int azx_free(struct azx *chip) + { + int i; + ++ azx_notifier_unregister(chip); ++ + if (chip->initialized) { + azx_clear_irq_pending(chip); + for (i = 0; i < chip->num_streams; i++) +@@ -2250,6 +2278,7 @@ static int __devinit azx_probe(struct pc + pci_set_drvdata(pci, card); + chip->running = 1; + power_down_all_codecs(chip); ++ azx_notifier_register(chip); + + dev++; + return err; + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008 +Message-Id: <20081104232318.926549738@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:52 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Evgeniy Manachkin , + Alan Cox , + Sam Ravnborg +Subject: [patch 08/57] kbuild: mkspec - fix build rpm +Content-Disposition: inline; filename=kbuild-mkspec-fix-build-rpm.patch +Content-Length: 1413 +Lines: 41 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Evgeniy Manachkin + +commit 46dca86cb93db80992a45e4b55737ff2b2f61cd0 upstream +Date: Wed, 15 Oct 2008 23:37:26 +0600 +Subject: [patch 08/57] kbuild: mkspec - fix build rpm + +This is patch to fix incorrect mkspec script to make rpm correctly at 2.6.27 vanilla kernel. +This is regression in 2.6.27. 2.6.26 make rpm work good. +In 2.6.27 'make rpm' say error from rpmbuild "Many unpacked files (*.fw)." + +Signed-off-by: Evgeniy Manachkin +Acked-by: Alan Cox +Signed-off-by: Sam Ravnborg +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/package/mkspec | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/scripts/package/mkspec ++++ b/scripts/package/mkspec +@@ -64,8 +64,10 @@ fi + echo "%install" + echo "%ifarch ia64" + echo 'mkdir -p $RPM_BUILD_ROOT/boot/efi $RPM_BUILD_ROOT/lib/modules' ++echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware' + echo "%else" + echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules' ++echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware' + echo "%endif" + + echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} modules_install' +@@ -92,5 +94,6 @@ echo "%files" + echo '%defattr (-, root, root)' + echo "%dir /lib/modules" + echo "/lib/modules/$KERNELRELEASE" ++echo "/lib/firmware" + echo "/boot/*" + echo "" + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008 +Message-Id: <20081104232319.099400407@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:53 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ravikiran Thirumalai , + "H. Peter Anvin" , + Ingo Molnar +Subject: [patch 09/57] x86: fix /dev/mem mmap breakage when PAT is disabled +Content-Disposition: inline; filename=x86-fix-dev-mem-mmap-breakage-when-pat-is-disabled.patch +Content-Length: 1576 +Lines: 50 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ravikiran G Thirumalai + +commit 9e41bff2708e420e61e6b89a54c15232857069b1 upstream + +Impact: allow /dev/mem mmaps on non-PAT CPUs/platforms + +Fix mmap to /dev/mem when CONFIG_X86_PAT is off and CONFIG_STRICT_DEVMEM is +off + +mmap to /dev/mem on kernel memory has been failing since the +introduction of PAT (CONFIG_STRICT_DEVMEM=n case). Seems like +the check to avoid cache aliasing with PAT is kicking in even +when PAT is disabled. The bug seems to have crept in 2.6.26. + +This patch makes sure that the mmap to regular +kernel memory succeeds if CONFIG_STRICT_DEVMEM=n and +PAT is disabled, and the checks to avoid cache aliasing +still happens if PAT is enabled. + +Signed-off-by: Ravikiran Thirumalai +Tested-by: Tim Sirianni +Acked-by: H. Peter Anvin +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/pat.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/x86/mm/pat.c ++++ b/arch/x86/mm/pat.c +@@ -403,12 +403,16 @@ static inline int range_is_allowed(unsig + return 1; + } + #else ++/* This check is needed to avoid cache aliasing when PAT is enabled */ + static inline int range_is_allowed(unsigned long pfn, unsigned long size) + { + u64 from = ((u64)pfn) << PAGE_SHIFT; + u64 to = from + size; + u64 cursor = from; + ++ if (!pat_enabled) ++ return 1; ++ + while (cursor < to) { + if (!devmem_is_allowed(pfn)) { + printk(KERN_INFO + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008 +Message-Id: <20081104232319.263910694@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:54 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jay Cliburn , + Jeff Garzik +Subject: [patch 10/57] atl1: fix vlan tag regression +Content-Disposition: inline; filename=atl1-fix-vlan-tag-regression.patch +Content-Length: 1920 +Lines: 56 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jay Cliburn + +commit dc5596d920b504d263c7ca38bd76326179b13dee upstream + +Commit 401c0aabec4b97320f962a0161a846d230a6f7aa introduced a regression +in the atl1 driver by storing the VLAN tag in the wrong TX descriptor +field. + +This patch causes the VLAN tag to be stored in its proper location. + +Tested-by: Ramon Casellas +Signed-off-by: Jay Cliburn +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/atlx/atl1.c | 7 ++++--- + drivers/net/atlx/atl1.h | 2 +- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/net/atlx/atl1.c ++++ b/drivers/net/atlx/atl1.c +@@ -2317,7 +2317,8 @@ static void atl1_tx_queue(struct atl1_ad + if (tpd != ptpd) + memcpy(tpd, ptpd, sizeof(struct tx_packet_desc)); + tpd->buffer_addr = cpu_to_le64(buffer_info->dma); +- tpd->word2 = (cpu_to_le16(buffer_info->length) & ++ tpd->word2 &= ~(TPD_BUFLEN_MASK << TPD_BUFLEN_SHIFT); ++ tpd->word2 |= (cpu_to_le16(buffer_info->length) & + TPD_BUFLEN_MASK) << TPD_BUFLEN_SHIFT; + + /* +@@ -2426,8 +2427,8 @@ static int atl1_xmit_frame(struct sk_buf + vlan_tag = (vlan_tag << 4) | (vlan_tag >> 13) | + ((vlan_tag >> 9) & 0x8); + ptpd->word3 |= 1 << TPD_INS_VL_TAG_SHIFT; +- ptpd->word3 |= (vlan_tag & TPD_VL_TAGGED_MASK) << +- TPD_VL_TAGGED_SHIFT; ++ ptpd->word2 |= (vlan_tag & TPD_VLANTAG_MASK) << ++ TPD_VLANTAG_SHIFT; + } + + tso = atl1_tso(adapter, skb, ptpd); +--- a/drivers/net/atlx/atl1.h ++++ b/drivers/net/atlx/atl1.h +@@ -504,7 +504,7 @@ struct rx_free_desc { + #define TPD_PKTNT_MASK 0x0001 + #define TPD_PKTINT_SHIFT 15 + #define TPD_VLANTAG_MASK 0xFFFF +-#define TPD_VLAN_SHIFT 16 ++#define TPD_VLANTAG_SHIFT 16 + + /* tpd word 3 bits 0:13 */ + #define TPD_EOP_MASK 0x0001 + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008 +Message-Id: <20081104232319.486492836@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johannes Berg , + "John W. Linville" +Subject: [patch 11/57] libertas: fix buffer overrun +Content-Disposition: inline; filename=libertas-fix-buffer-overrun.patch +Content-Length: 1203 +Lines: 31 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johannes Berg + +commit 48735d8d8bd701b1e0cd3d49c21e5e385ddcb077 upstream + +If somebody sends an invalid beacon/probe response, that can trash the +whole BSS descriptor. The descriptor is, luckily, large enough so that +it cannot scribble past the end of it; it's well above 400 bytes long. + +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/libertas/scan.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/libertas/scan.c ++++ b/drivers/net/wireless/libertas/scan.c +@@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_de + + switch (elem->id) { + case MFIE_TYPE_SSID: +- bss->ssid_len = elem->len; +- memcpy(bss->ssid, elem->data, elem->len); ++ bss->ssid_len = min_t(int, 32, elem->len); ++ memcpy(bss->ssid, elem->data, bss->ssid_len); + lbs_deb_scan("got SSID IE: '%s', len %u\n", + escape_essid(bss->ssid, bss->ssid_len), + bss->ssid_len); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008 +Message-Id: <20081104232319.598652687@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dan Nicholson , + Jiri Kosina +Subject: [patch 12/57] Revert "HID: Invert HWHEEL mappings for some Logitech mice" +Content-Disposition: inline; filename=revert-hid-invert-hwheel-mappings-for-some-logitech-mice.patch +Content-Length: 2107 +Lines: 48 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Dan Nicholson + +commit 022b7024d4bb1f9a2f30021a2672a0f940ebfa7a upstream. + +This reverts commit 740f370dc61dc478d891d7d47660bb3ae39ddb4f. + +It turned out to be correct in the first place: a positive value should +be sent when the wheel is moved to the right, and a negative value when +moved to the left. This is the behavior expected by the Xorg evdev +driver. I must have had a remapping somewhere else in my system when +originally testing this. Testing on another system shows that the +unpatched kernel is correct. + +Here is a bug report from Mandriva that brought the problem to my +attention: + + https://qa.mandriva.com/show_bug.cgi?id=44309#c19 + +Signed-off-by: Dan Nicholson +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/usbhid/hid-quirks.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -247,8 +247,6 @@ + #define USB_DEVICE_ID_LD_MACHINETEST 0x2040 + + #define USB_VENDOR_ID_LOGITECH 0x046d +-#define USB_DEVICE_ID_LOGITECH_LX3 0xc044 +-#define USB_DEVICE_ID_LOGITECH_V150 0xc047 + #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101 + #define USB_DEVICE_ID_LOGITECH_HARMONY 0xc110 + #define USB_DEVICE_ID_LOGITECH_HARMONY_2 0xc111 +@@ -603,8 +601,6 @@ static const struct hid_blacklist { + + { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP }, + { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP }, +- { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_LX3, HID_QUIRK_INVERT_HWHEEL }, +- { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_V150, HID_QUIRK_INVERT_HWHEEL }, + + { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K, HID_QUIRK_MICROSOFT_KEYS }, + { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K, HID_QUIRK_MICROSOFT_KEYS }, + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008 +Message-Id: <20081104232319.770397762@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Larry Finger , + Jeff Garzik +Subject: [patch 13/57] libata: initialize port_task when !CONFIG_ATA_SFF +Content-Disposition: inline; filename=libata-initialize-port_task-when-config_ata_sff.patch +Content-Length: 976 +Lines: 31 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +commit f667fdbbbea8bcce6cf9f7acb51b7cb4c264cc61 upstream + +ap->port_task was not initialized if !CONFIG_ATA_SFF later triggering +lockdep warning. Make sure it's initialized. + +Reported by Larry Finger. + +Signed-off-by: Tejun Heo +Cc: Larry Finger +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5259,6 +5259,8 @@ struct ata_port *ata_port_alloc(struct a + + #ifdef CONFIG_ATA_SFF + INIT_DELAYED_WORK(&ap->port_task, ata_pio_task); ++#else ++ INIT_DELAYED_WORK(&ap->port_task, NULL); + #endif + INIT_DELAYED_WORK(&ap->hotplug_task, ata_scsi_hotplug); + INIT_WORK(&ap->scsi_rescan_task, ata_scsi_dev_rescan); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008 +Message-Id: <20081104232319.936950853@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Florian Westphal , + "David S. Miller" +Subject: [patch 14/57] syncookies: fix inclusion of tcp options in syn-ack +Content-Disposition: inline; filename=0001-syncookies-fix-inclusion-of-tcp-options-in-syn-ack.patch +Content-Length: 1654 +Lines: 48 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Florian Westphal + +[ Upstream commit 8b5f12d04b2e93842f3dda01f029842047bf3f81 ] + +David Miller noticed that commit +33ad798c924b4a1afad3593f2796d465040aadd5 '(tcp: options clean up') +did not move the req->cookie_ts check. +This essentially disabled commit 4dfc2817025965a2fc78a18c50f540736a6b5c24 +'[Syncookies]: Add support for TCP options via timestamps.'. + +This restores the original logic. + +Signed-off-by: Florian Westphal +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_output.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2266,6 +2266,11 @@ struct sk_buff *tcp_make_synack(struct s + } + + memset(&opts, 0, sizeof(opts)); ++#ifdef CONFIG_SYN_COOKIES ++ if (unlikely(req->cookie_ts)) ++ TCP_SKB_CB(skb)->when = cookie_init_timestamp(req); ++ else ++#endif + TCP_SKB_CB(skb)->when = tcp_time_stamp; + tcp_header_size = tcp_synack_options(sk, req, + dst_metric(dst, RTAX_ADVMSS), +@@ -2292,11 +2297,6 @@ struct sk_buff *tcp_make_synack(struct s + + /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */ + th->window = htons(min(req->rcv_wnd, 65535U)); +-#ifdef CONFIG_SYN_COOKIES +- if (unlikely(req->cookie_ts)) +- TCP_SKB_CB(skb)->when = cookie_init_timestamp(req); +- else +-#endif + tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location); + th->doff = (tcp_header_size >> 2); + TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008 +Message-Id: <20081104232320.111650217@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Ilpo=20J=C3=A4rvinen?= , + "David S. Miller" +Subject: [patch 15/57] tcp: Restore ordering of TCP options for the sake of inter-operability +Content-Disposition: inline; filename=0002-tcp-Restore-ordering-of-TCP-options-for-the-sake-of.patch +Content-Length: 3224 +Lines: 80 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ilpo Järvinen + +[ Upstream commit fd6149d332973bafa50f03ddb0ea9513e67f4517 ] + +This is not our bug! Sadly some devices cannot cope with the change +of TCP option ordering which was a result of the recent rewrite of +the option code (not that there was some particular reason steming +from the rewrite for the reordering) though any ordering of TCP +options is perfectly legal. Thus we restore the original ordering +to allow interoperability with/through such broken devices and add +some warning about this trap. Since the reordering just happened +without any particular reason, this change shouldn't cost us +anything. + +There are already couple of known failure reports (within close +proximity of the last release), so the problem might be more +wide-spread than a single device. And other reports which may +be due to the same problem though the symptoms were less obvious. +Analysis of one of the case revealed (with very high probability) +that sack capability cannot be negotiated as the first option +(SYN never got a response). + +Signed-off-by: Ilpo Järvinen +Reported-by: Aldo Maggi +Tested-by: Aldo Maggi +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_output.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -357,6 +357,17 @@ struct tcp_out_options { + __u32 tsval, tsecr; /* need to include OPTION_TS */ + }; + ++/* Beware: Something in the Internet is very sensitive to the ordering of ++ * TCP options, we learned this through the hard way, so be careful here. ++ * Luckily we can at least blame others for their non-compliance but from ++ * inter-operatibility perspective it seems that we're somewhat stuck with ++ * the ordering which we have been using if we want to keep working with ++ * those broken things (not that it currently hurts anybody as there isn't ++ * particular reason why the ordering would need to be changed). ++ * ++ * At least SACK_PERM as the first option is known to lead to a disaster ++ * (but it may well be that other scenarios fail similarly). ++ */ + static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp, + const struct tcp_out_options *opts, + __u8 **md5_hash) { +@@ -371,6 +382,12 @@ static void tcp_options_write(__be32 *pt + *md5_hash = NULL; + } + ++ if (unlikely(opts->mss)) { ++ *ptr++ = htonl((TCPOPT_MSS << 24) | ++ (TCPOLEN_MSS << 16) | ++ opts->mss); ++ } ++ + if (likely(OPTION_TS & opts->options)) { + if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) { + *ptr++ = htonl((TCPOPT_SACK_PERM << 24) | +@@ -387,12 +404,6 @@ static void tcp_options_write(__be32 *pt + *ptr++ = htonl(opts->tsecr); + } + +- if (unlikely(opts->mss)) { +- *ptr++ = htonl((TCPOPT_MSS << 24) | +- (TCPOLEN_MSS << 16) | +- opts->mss); +- } +- + if (unlikely(OPTION_SACK_ADVERTISE & opts->options && + !(OPTION_TS & opts->options))) { + *ptr++ = htonl((TCPOPT_NOP << 24) | + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008 +Message-Id: <20081104232320.277160144@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Ilpo=20J=C3=A4rvinen?= , + "David S. Miller" +Subject: [patch 16/57] tcpv6: fix option space offsets with md5 +Content-Disposition: inline; filename=0003-tcpv6-fix-option-space-offsets-with-md5.patch +Content-Length: 876 +Lines: 28 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ilpo Järvinen + +[ Upstream commit 53b125779fb0b29e5b316bf3dc7d199e6dcea567 ] + +More breakage :-), part of timestamps just were previously +overwritten. + +Signed-off-by: Ilpo Järvinen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/tcp_ipv6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1087,7 +1087,7 @@ static void tcp_v6_send_ack(struct sk_bu + *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | + (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP); + *topt++ = htonl(tcp_time_stamp); +- *topt = htonl(ts); ++ *topt++ = htonl(ts); + } + + #ifdef CONFIG_TCP_MD5SIG + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008 +Message-Id: <20081104232320.442963768@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jarek Poplawski , + "David S. Miller" +Subject: [patch 17/57] pkt_sched: sch_generic: Fix oops in sch_teql +Content-Disposition: inline; filename=0004-pkt_sched-sch_generic-Fix-oops-in-sch_teql.patch +Content-Length: 1435 +Lines: 43 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jarek Poplawski + +[ Upstream commit 9f3ffae0dbce491a3e9871b686342fd5aa854f05 ] + +After these commands: +# modprobe sch_teql +# tc qdisc add dev eth0 root teql0 +# tc qdisc del dev eth0 root +we get an oops in teql_destroy() when spin_lock is taken from a null +qdisc_sleeping pointer. It's because at the moment teql0 dev haven't +been activated yet, and a qdisc_root_sleeping() is pointing to noop +qdisc's netdev_queue with qdisc_sleeping uninitialized. This patch +fixes this both for noop and noqueue netdev_queues to avoid similar +problems in the future. + +Signed-off-by: Jarek Poplawski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_generic.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -319,6 +319,7 @@ struct Qdisc_ops noop_qdisc_ops __read_m + + static struct netdev_queue noop_netdev_queue = { + .qdisc = &noop_qdisc, ++ .qdisc_sleeping = &noop_qdisc, + }; + + struct Qdisc noop_qdisc = { +@@ -344,6 +345,7 @@ static struct Qdisc_ops noqueue_qdisc_op + static struct Qdisc noqueue_qdisc; + static struct netdev_queue noqueue_netdev_queue = { + .qdisc = &noqueue_qdisc, ++ .qdisc_sleeping = &noqueue_qdisc, + }; + + static struct Qdisc noqueue_qdisc = { + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008 +Message-Id: <20081104232320.620281550@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andrea Shepard , + "David S. Miller" +Subject: [patch 18/57] sparc64: Fix race in arch/sparc64/kernel/trampoline.S +Content-Disposition: inline; filename=0001-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch +Content-Length: 1907 +Lines: 70 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andrea Shepard + +[ Upstream commit e0037df3852b4b60edbe01f70f4968e4a9fdb272 ] + +Make arch/sparc64/kernel/trampoline.S in 2.6.27.1 lock prom_entry_lock +when calling the PROM. This prevents a race condition that I observed +causing a hang on startup on a 12-CPU E4500. + +I am not subscribed to this list, so please CC me on replies. + +Signed-off-by: Andrea Shepard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/trampoline.S | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/arch/sparc64/kernel/trampoline.S ++++ b/arch/sparc64/kernel/trampoline.S +@@ -328,6 +328,12 @@ after_lock_tlb: + + wrpr %g0, 0, %wstate + ++ sethi %hi(prom_entry_lock), %g2 ++1: ldstub [%g2 + %lo(prom_entry_lock)], %g1 ++ membar #StoreLoad | #StoreStore ++ brnz,pn %g1, 1b ++ nop ++ + /* As a hack, put &init_thread_union into %g6. + * prom_world() loads from here to restore the %asi + * register. +@@ -337,7 +343,7 @@ after_lock_tlb: + + sethi %hi(is_sun4v), %o0 + lduw [%o0 + %lo(is_sun4v)], %o0 +- brz,pt %o0, 1f ++ brz,pt %o0, 2f + nop + + TRAP_LOAD_TRAP_BLOCK(%g2, %g3) +@@ -369,10 +375,10 @@ after_lock_tlb: + call %o1 + add %sp, (2047 + 128), %o0 + +- ba,pt %xcc, 2f ++ ba,pt %xcc, 3f + nop + +-1: sethi %hi(sparc64_ttable_tl0), %o0 ++2: sethi %hi(sparc64_ttable_tl0), %o0 + set prom_set_trap_table_name, %g2 + stx %g2, [%sp + 2047 + 128 + 0x00] + mov 1, %g2 +@@ -386,7 +392,11 @@ after_lock_tlb: + call %o1 + add %sp, (2047 + 128), %o0 + +-2: ldx [%l0], %g6 ++3: sethi %hi(prom_entry_lock), %g2 ++ stb %g0, [%g2 + %lo(prom_entry_lock)] ++ membar #StoreStore | #StoreLoad ++ ++ ldx [%l0], %g6 + ldx [%g6 + TI_TASK], %g4 + + mov 1, %g5 + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008 +Message-Id: <20081104232320.795317339@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [patch 19/57] math-emu: Fix signalling of underflow and inexact while packing result. +Content-Disposition: inline; filename=0002-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch +Content-Length: 3676 +Lines: 116 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kumar Gala + +[ Upstream commit 930cc144a043ff95e56b6888fa51c618b33f89e7 ] + +I'm trying to move the powerpc math-emu code to use the include/math-emu bits. + +In doing so I've been using TestFloat to see how good or bad we are +doing. For the most part the current math-emu code that PPC uses has +a number of issues that the code in include/math-emu seems to solve +(plus bugs we've had for ever that no one every realized). + +Anyways, I've come across a case that we are flagging underflow and +inexact because we think we have a denormalized result from a double +precision divide: + +000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE + soft: 001.0000000000000 ..... syst: 001.0000000000000 ...ux + +What it looks like is the results out of FP_DIV_D are: + +D: +sign: 0 +mantissa: 01000000 00000000 +exp: -1023 (0) + +The problem seems like we aren't normalizing the result and bumping the exp. + +Now that I'm digging into this a bit I'm thinking my issue has to do with +the fix DaveM put in place from back in Aug 2007 (commit +405849610fd96b4f34cd1875c4c033228fea6c0f): + +[MATH-EMU]: Fix underflow exception reporting. + + 2) we ended up rounding back up to normal (this is the case where + we set the exponent to 1 and set the fraction to zero), this + should set inexact too +... + + Another example, "0x0.0000000000001p-1022 / 16.0", should signal both + inexact and underflow. The cpu implementations and ieee1754 + literature is very clear about this. This is case #2 above. + +Here is the distilled glibc test case from Jakub Jelinek which prompted that +commit: + +-------------------- +#include +#include +#include + +volatile double d = DBL_MIN; +volatile double e = 0x0.0000000000001p-1022; +volatile double f = 16.0; +int +main (void) +{ + printf ("%x\n", fetestexcept (FE_UNDERFLOW)); + d /= f; + printf ("%x\n", fetestexcept (FE_UNDERFLOW)); + e /= f; + printf ("%x\n", fetestexcept (FE_UNDERFLOW)); + return 0; +} +-------------------- + +It looks like the case I have we are exact before rounding, but think it +looks like the rounding case since it appears as if "overflow is set". + +000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE = 001.0000000000000 + +I think the following adds the check for my case and still works for the +issue your commit was trying to resolve. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/math-emu/op-common.h | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/include/math-emu/op-common.h ++++ b/include/math-emu/op-common.h +@@ -139,18 +139,27 @@ do { \ + if (X##_e <= _FP_WFRACBITS_##fs) \ + { \ + _FP_FRAC_SRS_##wc(X, X##_e, _FP_WFRACBITS_##fs); \ +- _FP_ROUND(wc, X); \ + if (_FP_FRAC_HIGH_##fs(X) \ + & (_FP_OVERFLOW_##fs >> 1)) \ + { \ + X##_e = 1; \ + _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \ +- FP_SET_EXCEPTION(FP_EX_INEXACT); \ + } \ + else \ + { \ +- X##_e = 0; \ +- _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \ ++ _FP_ROUND(wc, X); \ ++ if (_FP_FRAC_HIGH_##fs(X) \ ++ & (_FP_OVERFLOW_##fs >> 1)) \ ++ { \ ++ X##_e = 1; \ ++ _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \ ++ FP_SET_EXCEPTION(FP_EX_INEXACT); \ ++ } \ ++ else \ ++ { \ ++ X##_e = 0; \ ++ _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \ ++ } \ + } \ + if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \ + (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \ + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008 +Message-Id: <20081104232320.967296679@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux1394-devel@lists.sourceforge.net, + Stefan Richter +Subject: [patch 20/57] firewire: fix setting tag and sy in iso transmission +Content-Disposition: inline; filename=firewire-fix-setting-tag-and-sy-in-iso-transmission.patch +Content-Length: 1053 +Lines: 29 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stefan Richter + +commit 7a1003449c693f0d57443c8786bbf19717921ae0 upstream + +Reported by Jay Fenlason: +The iso packet control accessors in fw-cdev.c had bogus masks. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-cdev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/firewire/fw-cdev.c ++++ b/drivers/firewire/fw-cdev.c +@@ -720,8 +720,8 @@ static int ioctl_create_iso_context(stru + #define GET_PAYLOAD_LENGTH(v) ((v) & 0xffff) + #define GET_INTERRUPT(v) (((v) >> 16) & 0x01) + #define GET_SKIP(v) (((v) >> 17) & 0x01) +-#define GET_TAG(v) (((v) >> 18) & 0x02) +-#define GET_SY(v) (((v) >> 20) & 0x04) ++#define GET_TAG(v) (((v) >> 18) & 0x03) ++#define GET_SY(v) (((v) >> 20) & 0x0f) + #define GET_HEADER_LENGTH(v) (((v) >> 24) & 0xff) + + static int ioctl_queue_iso(struct client *client, void *buffer) + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008 +Message-Id: <20081104232321.143395169@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux1394-devel@lists.sourceforge.net, + Stefan Richter +Subject: [patch 21/57] firewire: fix ioctl() return code +Content-Disposition: inline; filename=firewire-fix-ioctl-return-code.patch +Content-Length: 785 +Lines: 30 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stefan Richter + +commit 99692f71ee04c6f249d0bf6a581359f32f409a38 upstream + +Reported by Jay Fenlason: ioctl() did not return as intended + - the size of data read into ioctl_send_request, + - the number of datagrams enqueued by ioctl_queue_iso. + + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-cdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/firewire/fw-cdev.c ++++ b/drivers/firewire/fw-cdev.c +@@ -913,7 +913,7 @@ dispatch_ioctl(struct client *client, un + return -EFAULT; + } + +- return 0; ++ return retval; + } + + static long + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008 +Message-Id: <20081104232321.306177799@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux1394-devel@lists.sourceforge.net, + Jay Fenlason , + Stefan Richter +Subject: [patch 22/57] firewire: Survive more than 256 bus resets +Content-Disposition: inline; filename=firewire-survive-more-than-256-bus-resets.patch +Content-Length: 1163 +Lines: 34 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jay Fenlason + +Same as commit 4f9740d4f5a17fa6a1b097fa3ccdfb7246660307 upstream + +The "color" is used during the topology building after a bus reset, +hovever in "struct fw_node"s it is stored in a u8, but in struct fw_card +it is stored in an int. When the value wraps in one struct, but not +the other, disaster strikes. + +Fixes http://bugzilla.kernel.org/show_bug.cgi?id=10922 - +machine locks up solid if a series of bus resets occurs. + + +Signed-off-by: Jay Fenlason +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-transaction.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/firewire/fw-transaction.h ++++ b/drivers/firewire/fw-transaction.h +@@ -248,7 +248,7 @@ struct fw_card { + struct fw_node *local_node; + struct fw_node *root_node; + struct fw_node *irm_node; +- int color; ++ u8 color; /* must be u8 to match the definition in struct fw_node */ + int gap_count; + bool beta_repeaters_present; + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008 +Message-Id: <20081104232321.466568445@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux1394-devel@lists.sourceforge.net, + Jay Fenlason , + Stefan Richter +Subject: [patch 23/57] firewire: fix struct fw_node memory leak +Content-Disposition: inline; filename=firewire-fix-struct-fw_node-memory-leak.patch +Content-Length: 1155 +Lines: 39 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jay Fenlason + +commit 77e557191701afa55ae7320d42ad6458a2ad292e upstream + +With the bus_resets patch applied, it is easy to see this memory leak +by repeatedly resetting the firewire bus while running slabtop in +another window. Just watch kmalloc-32 grow and grow... + +Signed-off-by: Jay Fenlason +Signed-off-by: Stefan Richter + +--- + drivers/firewire/fw-topology.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/firewire/fw-topology.c ++++ b/drivers/firewire/fw-topology.c +@@ -413,7 +413,7 @@ static void + update_tree(struct fw_card *card, struct fw_node *root) + { + struct list_head list0, list1; +- struct fw_node *node0, *node1; ++ struct fw_node *node0, *node1, *next1; + int i, event; + + INIT_LIST_HEAD(&list0); +@@ -485,7 +485,9 @@ update_tree(struct fw_card *card, struct + } + + node0 = fw_node(node0->link.next); +- node1 = fw_node(node1->link.next); ++ next1 = fw_node(node1->link.next); ++ fw_node_put(node1); ++ node1 = next1; + } + } + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008 +Message-Id: <20081104232321.635495424@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux1394-devel@lists.sourceforge.net, + Stefan Richter +Subject: [patch 24/57] firewire: fw-sbp2: delay first login to avoid retries +Content-Disposition: inline; filename=firewire-fw-sbp2-delay-first-login-to-avoid-retries.patch +Content-Length: 1702 +Lines: 43 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stefan Richter + +commit 0dcfeb7e3c8695c5aa3677dda8efb9bef2e7e64d upstream + +This optimizes firewire-sbp2's device probe for the case that the local +node and the SBP-2 node were discovered at the same time. In this case, +fw-core's bus management work and fw-sbp2's login and SCSI probe work +are scheduled in parallel (in the globally shared workqueue and in +fw-sbp2's workqueue, respectively). The bus reset from fw-core may then +disturb and extremely delay the login and SCSI probe because the latter +fails with several command timeouts and retries and has to be retried +from scratch. + +We avoid this particular situation of sbp2_login() and fw_card_bm_work() +running in parallel by delaying the first sbp2_login() a little bit. + +This is meant to be a short-term fix for +https://bugzilla.redhat.com/show_bug.cgi?id=466679. In the long run, +the SCSI probe, i.e. fw-sbp2's call of __scsi_add_device(), should be +parallelized with sbp2_reconnect(). + +Problem reported and fix tested and confirmed by Alex Kanavin. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-sbp2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/firewire/fw-sbp2.c ++++ b/drivers/firewire/fw-sbp2.c +@@ -1158,7 +1158,7 @@ static int sbp2_probe(struct device *dev + + /* Do the login in a workqueue so we can easily reschedule retries. */ + list_for_each_entry(lu, &tgt->lu_list, link) +- sbp2_queue_work(lu, 0); ++ sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5)); + return 0; + + fail_tgt_put: + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008 +Message-Id: <20081104232321.794834597@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux1394-devel@lists.sourceforge.net, + Jay Fenlason , + Stefan Richter +Subject: [patch 25/57] firewire: fw-sbp2: fix races +Content-Disposition: inline; filename=firewire-fw-sbp2-fix-races.patch +Content-Length: 3328 +Lines: 98 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jay Fenlason + +Same as commit cd1f70fdb4823c97328a1f151f328eb36fafd579 upstream + +1: There is a small race between queue_delayed_work() and its + corresponding kref_get(). Do the kref_get first, and _put it again + if the queue_delayed_work() failed, so there is no chance of the + kref going to zero while the work is scheduled. +2: An SBP2_LOGOUT_REQUEST could be sent out with a login_id full of + garbage. Initialize it to an invalid value so we can tell if we + ever got a valid login_id. +3: The node ID and generation may have changed but the new values may + not yet have been recorded in lu and tgt when the final logout is + attempted. Use the latest values from the device in + sbp2_release_target(). + +Signed-off-by: Jay Fenlason +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-sbp2.c | 36 ++++++++++++++++++++++++++---------- + 1 file changed, 26 insertions(+), 10 deletions(-) + +--- a/drivers/firewire/fw-sbp2.c ++++ b/drivers/firewire/fw-sbp2.c +@@ -172,6 +172,9 @@ struct sbp2_target { + int blocked; /* ditto */ + }; + ++/* Impossible login_id, to detect logout attempt before successful login */ ++#define INVALID_LOGIN_ID 0x10000 ++ + /* + * Per section 7.4.8 of the SBP-2 spec, a mgt_ORB_timeout value can be + * provided in the config rom. Most devices do provide a value, which +@@ -791,9 +794,20 @@ static void sbp2_release_target(struct k + scsi_remove_device(sdev); + scsi_device_put(sdev); + } +- sbp2_send_management_orb(lu, tgt->node_id, lu->generation, +- SBP2_LOGOUT_REQUEST, lu->login_id, NULL); +- ++ if (lu->login_id != INVALID_LOGIN_ID) { ++ int generation, node_id; ++ /* ++ * tgt->node_id may be obsolete here if we failed ++ * during initial login or after a bus reset where ++ * the topology changed. ++ */ ++ generation = device->generation; ++ smp_rmb(); /* node_id vs. generation */ ++ node_id = device->node_id; ++ sbp2_send_management_orb(lu, node_id, generation, ++ SBP2_LOGOUT_REQUEST, ++ lu->login_id, NULL); ++ } + fw_core_remove_address_handler(&lu->address_handler); + list_del(&lu->link); + kfree(lu); +@@ -808,19 +822,20 @@ static void sbp2_release_target(struct k + + static struct workqueue_struct *sbp2_wq; + ++static void sbp2_target_put(struct sbp2_target *tgt) ++{ ++ kref_put(&tgt->kref, sbp2_release_target); ++} ++ + /* + * Always get the target's kref when scheduling work on one its units. + * Each workqueue job is responsible to call sbp2_target_put() upon return. + */ + static void sbp2_queue_work(struct sbp2_logical_unit *lu, unsigned long delay) + { +- if (queue_delayed_work(sbp2_wq, &lu->work, delay)) +- kref_get(&lu->tgt->kref); +-} +- +-static void sbp2_target_put(struct sbp2_target *tgt) +-{ +- kref_put(&tgt->kref, sbp2_release_target); ++ kref_get(&lu->tgt->kref); ++ if (!queue_delayed_work(sbp2_wq, &lu->work, delay)) ++ sbp2_target_put(lu->tgt); + } + + static void +@@ -993,6 +1008,7 @@ static int sbp2_add_logical_unit(struct + + lu->tgt = tgt; + lu->lun = lun_entry & 0xffff; ++ lu->login_id = INVALID_LOGIN_ID; + lu->retries = 0; + lu->has_sdev = false; + lu->blocked = false; + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008 +Message-Id: <20081104232321.969662832@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-acpi@vger.kernel.org, + Guillem Jover , + Dmitry Torokhov , + Len Brown +Subject: [patch 26/57] ACPI: Always report a sync event after a lid state change +Content-Disposition: inline; filename=acpi-always-report-a-sync-event-after-a-lid-state-change.patch +Content-Length: 1286 +Lines: 40 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Guillem Jover + +upstream commit df316e939100e789b3c5d4d102619ccf5834bd00 + +Currently not always an EV_SYN event is reported to userland +after the EV_SW SW_LID event has been sent. This is easy to verify +by using “input-events” from input-utils and just closing and opening +the lid. + +Signed-off-by: Guillem Jover +Acked-by: Dmitry Torokhov +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/button.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -262,6 +262,7 @@ static int acpi_lid_send_state(struct ac + return -ENODEV; + /* input layer checks if event is redundant */ + input_report_switch(button->input, SW_LID, !state); ++ input_sync(button->input); + return 0; + } + +@@ -285,8 +286,8 @@ static void acpi_button_notify(acpi_hand + input_report_key(input, keycode, 1); + input_sync(input); + input_report_key(input, keycode, 0); ++ input_sync(input); + } +- input_sync(input); + + acpi_bus_generate_proc_event(button->device, event, + ++button->pushed); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008 +Message-Id: <20081104232322.133279291@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Guennadi Liakhovetski , + Kumar Gala +Subject: [patch 27/57] powerpc: fix i2c on PPC linkstation / kurobox machines +Content-Disposition: inline; filename=powerpc-fix-i2c-on-ppc-linkstation-kurobox-machines.patch +Content-Length: 2482 +Lines: 79 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Guennadi Liakhovetski + +commit 22e181ba7f09197dd6f35a48013cb86289644eb6 upstream. + +The i2c bus defn is broken on linkstation / kurobox machines since at +least 2.6.27. Fix it. Also remove CONFIG_SERIAL_OF_PLATFORM, which, if +enabled, breaks the serial console after the +"console handover: boot [udbg0] -> real [ttyS1]" message. + +Signed-off-by: Guennadi Liakhovetski +Signed-off-by: Kumar Gala +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/configs/linkstation_defconfig | 7 +++---- + arch/powerpc/platforms/embedded6xx/linkstation.c | 14 ++++++++++++++ + 2 files changed, 17 insertions(+), 4 deletions(-) + +--- a/arch/powerpc/configs/linkstation_defconfig ++++ b/arch/powerpc/configs/linkstation_defconfig +@@ -1,7 +1,7 @@ + # + # Automatically generated make config: don't edit +-# Linux kernel version: 2.6.27-rc4 +-# Thu Aug 21 00:52:05 2008 ++# Linux kernel version: 2.6.27 ++# Fri Oct 24 00:42:39 2008 + # + # CONFIG_PPC64 is not set + +@@ -934,7 +934,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4 + CONFIG_SERIAL_CORE=y + CONFIG_SERIAL_CORE_CONSOLE=y + # CONFIG_SERIAL_JSM is not set +-CONFIG_SERIAL_OF_PLATFORM=y ++# CONFIG_SERIAL_OF_PLATFORM is not set + CONFIG_UNIX98_PTYS=y + CONFIG_LEGACY_PTYS=y + CONFIG_LEGACY_PTY_COUNT=256 +@@ -1211,7 +1211,6 @@ CONFIG_USB_STORAGE=m + # CONFIG_USB_STORAGE_ALAUDA is not set + # CONFIG_USB_STORAGE_ONETOUCH is not set + # CONFIG_USB_STORAGE_KARMA is not set +-# CONFIG_USB_STORAGE_SIERRA is not set + # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set + # CONFIG_USB_LIBUSUAL is not set + +--- a/arch/powerpc/platforms/embedded6xx/linkstation.c ++++ b/arch/powerpc/platforms/embedded6xx/linkstation.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -54,6 +55,19 @@ static struct mtd_partition linkstation_ + }, + }; + ++static __initdata struct of_device_id of_bus_ids[] = { ++ { .type = "soc", }, ++ { .compatible = "simple-bus", }, ++ {}, ++}; ++ ++static int __init declare_of_platform_devices(void) ++{ ++ of_platform_bus_probe(NULL, of_bus_ids, NULL); ++ return 0; ++} ++machine_device_initcall(linkstation, declare_of_platform_devices); ++ + static int __init linkstation_add_bridge(struct device_node *dev) + { + #ifdef CONFIG_PCI + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008 +Message-Id: <20081104232322.364422911@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jon Tollefson , + Benjamin Herrenschmidt +Subject: [patch 28/57] powerpc: Reserve in bootmem lmb reserved regions that cross NUMA nodes +Content-Disposition: inline; filename=powerpc-reserve-in-bootmem-lmb-reserved-regions-that-cross-numa-nodes.patch +Content-Length: 6658 +Lines: 186 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jon Tollefson + +commit 8f64e1f2d1e09267ac926e15090fd505c1c0cbcb upstream + +If there are multiple reserved memory blocks via lmb_reserve() that are +contiguous addresses and on different NUMA nodes we are losing track of which +address ranges to reserve in bootmem on which node. I discovered this +when I recently got to try 16GB huge pages on a system with more then 2 nodes. + +When scanning the device tree in early boot we call lmb_reserve() with +the addresses of the 16G pages that we find so that the memory doesn't +get used for something else. For example the addresses for the pages +could be 4000000000, 4400000000, 4800000000, 4C00000000, etc - 8 pages, +one on each of eight nodes. In the lmb after all the pages have been +reserved it will look something like the following: + +lmb_dump_all: + memory.cnt = 0x2 + memory.size = 0x3e80000000 + memory.region[0x0].base = 0x0 + .size = 0x1e80000000 + memory.region[0x1].base = 0x4000000000 + .size = 0x2000000000 + reserved.cnt = 0x5 + reserved.size = 0x3e80000000 + reserved.region[0x0].base = 0x0 + .size = 0x7b5000 + reserved.region[0x1].base = 0x2a00000 + .size = 0x78c000 + reserved.region[0x2].base = 0x328c000 + .size = 0x43000 + reserved.region[0x3].base = 0xf4e8000 + .size = 0xb18000 + reserved.region[0x4].base = 0x4000000000 + .size = 0x2000000000 + +The reserved.region[0x4] contains the 16G pages. In +arch/powerpc/mm/num.c: do_init_bootmem() we loop through each of the +node numbers looking for the reserved regions that belong to the +particular node. It is not able to identify region 0x4 as being a part +of each of the 8 nodes. It is assuming that a reserved region is only +on a single node. + +This patch takes out the reserved region loop from inside +the loop that goes over each node. It looks up the active region containing +the start of the reserved region. If it extends past that active region then +it adjusts the size and gets the next active region containing it. + +Signed-off-by: Jon Tollefson +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/mm/numa.c | 108 ++++++++++++++++++++++++++++++++++++------------- + 1 file changed, 80 insertions(+), 28 deletions(-) + +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -89,6 +89,46 @@ static int __cpuinit fake_numa_create_ne + return 0; + } + ++/* ++ * get_active_region_work_fn - A helper function for get_node_active_region ++ * Returns datax set to the start_pfn and end_pfn if they contain ++ * the initial value of datax->start_pfn between them ++ * @start_pfn: start page(inclusive) of region to check ++ * @end_pfn: end page(exclusive) of region to check ++ * @datax: comes in with ->start_pfn set to value to search for and ++ * goes out with active range if it contains it ++ * Returns 1 if search value is in range else 0 ++ */ ++static int __init get_active_region_work_fn(unsigned long start_pfn, ++ unsigned long end_pfn, void *datax) ++{ ++ struct node_active_region *data; ++ data = (struct node_active_region *)datax; ++ ++ if (start_pfn <= data->start_pfn && end_pfn > data->start_pfn) { ++ data->start_pfn = start_pfn; ++ data->end_pfn = end_pfn; ++ return 1; ++ } ++ return 0; ++ ++} ++ ++/* ++ * get_node_active_region - Return active region containing start_pfn ++ * @start_pfn: The page to return the region for. ++ * @node_ar: Returned set to the active region containing start_pfn ++ */ ++static void __init get_node_active_region(unsigned long start_pfn, ++ struct node_active_region *node_ar) ++{ ++ int nid = early_pfn_to_nid(start_pfn); ++ ++ node_ar->nid = nid; ++ node_ar->start_pfn = start_pfn; ++ work_with_active_regions(nid, get_active_region_work_fn, node_ar); ++} ++ + static void __cpuinit map_cpu_to_node(int cpu, int node) + { + numa_cpu_lookup_table[cpu] = node; +@@ -837,38 +877,50 @@ void __init do_init_bootmem(void) + start_pfn, end_pfn); + + free_bootmem_with_active_regions(nid, end_pfn); ++ } + +- /* Mark reserved regions on this node */ +- for (i = 0; i < lmb.reserved.cnt; i++) { +- unsigned long physbase = lmb.reserved.region[i].base; +- unsigned long size = lmb.reserved.region[i].size; +- unsigned long start_paddr = start_pfn << PAGE_SHIFT; +- unsigned long end_paddr = end_pfn << PAGE_SHIFT; +- +- if (early_pfn_to_nid(physbase >> PAGE_SHIFT) != nid && +- early_pfn_to_nid((physbase+size-1) >> PAGE_SHIFT) != nid) +- continue; +- +- if (physbase < end_paddr && +- (physbase+size) > start_paddr) { +- /* overlaps */ +- if (physbase < start_paddr) { +- size -= start_paddr - physbase; +- physbase = start_paddr; +- } +- +- if (size > end_paddr - physbase) +- size = end_paddr - physbase; +- +- dbg("reserve_bootmem %lx %lx\n", physbase, +- size); +- reserve_bootmem_node(NODE_DATA(nid), physbase, +- size, BOOTMEM_DEFAULT); +- } ++ /* Mark reserved regions */ ++ for (i = 0; i < lmb.reserved.cnt; i++) { ++ unsigned long physbase = lmb.reserved.region[i].base; ++ unsigned long size = lmb.reserved.region[i].size; ++ unsigned long start_pfn = physbase >> PAGE_SHIFT; ++ unsigned long end_pfn = ((physbase + size) >> PAGE_SHIFT); ++ struct node_active_region node_ar; ++ ++ get_node_active_region(start_pfn, &node_ar); ++ while (start_pfn < end_pfn) { ++ /* ++ * if reserved region extends past active region ++ * then trim size to active region ++ */ ++ if (end_pfn > node_ar.end_pfn) ++ size = (node_ar.end_pfn << PAGE_SHIFT) ++ - (start_pfn << PAGE_SHIFT); ++ dbg("reserve_bootmem %lx %lx nid=%d\n", physbase, size, ++ node_ar.nid); ++ reserve_bootmem_node(NODE_DATA(node_ar.nid), physbase, ++ size, BOOTMEM_DEFAULT); ++ /* ++ * if reserved region is contained in the active region ++ * then done. ++ */ ++ if (end_pfn <= node_ar.end_pfn) ++ break; ++ ++ /* ++ * reserved region extends past the active region ++ * get next active region that contains this ++ * reserved region ++ */ ++ start_pfn = node_ar.end_pfn; ++ physbase = start_pfn << PAGE_SHIFT; ++ get_node_active_region(start_pfn, &node_ar); + } + +- sparse_memory_present_with_active_regions(nid); + } ++ ++ for_each_online_node(nid) ++ sparse_memory_present_with_active_regions(nid); + } + + void __init paging_init(void) + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008 +Message-Id: <20081104232322.481201031@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jon Tollefson , + Benjamin Herrenschmidt +Subject: [patch 29/57] powerpc/numa: Make memory reserve code more robust +Content-Disposition: inline; filename=powerpc-numa-make-memory-reserve-code-more-robust.patch +Content-Length: 2488 +Lines: 71 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jon Tollefson + +commit e81703724a966120ace6504c993bda9e084cbf3e upstream. + +Adjust amount to reserve based on previous nodes for reserves spanning +multiple nodes. Check if the node active range is empty before attempting +to pass the reserve to bootmem. In practice the range shouldn't be empty, +but to be sure we check. + +Signed-off-by: Jon Tollefson +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/mm/numa.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -116,6 +116,7 @@ static int __init get_active_region_work + + /* + * get_node_active_region - Return active region containing start_pfn ++ * Active range returned is empty if none found. + * @start_pfn: The page to return the region for. + * @node_ar: Returned set to the active region containing start_pfn + */ +@@ -126,6 +127,7 @@ static void __init get_node_active_regio + + node_ar->nid = nid; + node_ar->start_pfn = start_pfn; ++ node_ar->end_pfn = start_pfn; + work_with_active_regions(nid, get_active_region_work_fn, node_ar); + } + +@@ -888,18 +890,20 @@ void __init do_init_bootmem(void) + struct node_active_region node_ar; + + get_node_active_region(start_pfn, &node_ar); +- while (start_pfn < end_pfn) { ++ while (start_pfn < end_pfn && ++ node_ar.start_pfn < node_ar.end_pfn) { ++ unsigned long reserve_size = size; + /* + * if reserved region extends past active region + * then trim size to active region + */ + if (end_pfn > node_ar.end_pfn) +- size = (node_ar.end_pfn << PAGE_SHIFT) ++ reserve_size = (node_ar.end_pfn << PAGE_SHIFT) + - (start_pfn << PAGE_SHIFT); +- dbg("reserve_bootmem %lx %lx nid=%d\n", physbase, size, +- node_ar.nid); ++ dbg("reserve_bootmem %lx %lx nid=%d\n", physbase, ++ reserve_size, node_ar.nid); + reserve_bootmem_node(NODE_DATA(node_ar.nid), physbase, +- size, BOOTMEM_DEFAULT); ++ reserve_size, BOOTMEM_DEFAULT); + /* + * if reserved region is contained in the active region + * then done. +@@ -914,6 +918,7 @@ void __init do_init_bootmem(void) + */ + start_pfn = node_ar.end_pfn; + physbase = start_pfn << PAGE_SHIFT; ++ size = size - reserve_size; + get_node_active_region(start_pfn, &node_ar); + } + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008 +Message-Id: <20081104232322.681989038@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jon Tollefson , + Benjamin Herrenschmidt +Subject: [patch 30/57] powerpc: Dont use a 16G page if beyond mem= limits +Content-Disposition: inline; filename=powerpc-don-t-use-a-16g-page-if-beyond-mem-limits.patch +Content-Length: 1219 +Lines: 33 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jon Tollefson + +commit 4792adbac9eb41cea77a45ab76258ea10d411173 upstream + +If mem= is used on the boot command line to limit memory then the memory block where a 16G page resides may not be available. + +Thanks to Michael Ellerman for finding the problem. + +Signed-off-by: Jon Tollefson +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/mm/hash_utils_64.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/mm/hash_utils_64.c ++++ b/arch/powerpc/mm/hash_utils_64.c +@@ -381,8 +381,10 @@ static int __init htab_dt_scan_hugepage_ + printk(KERN_INFO "Huge page(16GB) memory: " + "addr = 0x%lX size = 0x%lX pages = %d\n", + phys_addr, block_size, expected_pages); +- lmb_reserve(phys_addr, block_size * expected_pages); +- add_gpage(phys_addr, block_size, expected_pages); ++ if (phys_addr + (16 * GB) <= lmb_end_of_DRAM()) { ++ lmb_reserve(phys_addr, block_size * expected_pages); ++ add_gpage(phys_addr, block_size, expected_pages); ++ } + return 0; + } + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008 +Message-Id: <20081104232322.819327166@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare +Subject: [patch 31/57] i2c: The i2c mailing list is moving +Content-Disposition: inline; filename=i2c-the-i2c-mailing-list-is-moving.patch +Content-Length: 3273 +Lines: 121 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit 846557d3ceb6c7493e090921db5d6158ec237228 upstream + +Replace all references to the old i2c mailing list. + +This isn't a bug fix, but I would hate to miss bug reports because +they're sent to a dead mailing list. + +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/i2c/busses/i2c-sis96x | 2 +- + MAINTAINERS | 20 ++++++++++---------- + 2 files changed, 11 insertions(+), 11 deletions(-) + +--- a/Documentation/i2c/busses/i2c-sis96x ++++ b/Documentation/i2c/busses/i2c-sis96x +@@ -42,7 +42,7 @@ I suspect that this driver could be made + chipsets as well: 635, and 635T. If anyone owns a board with those chips + AND is willing to risk crashing & burning an otherwise well-behaved kernel + in the name of progress... please contact me at or +-via the project's mailing list: . Please send bug ++via the linux-i2c mailing list: . Please send bug + reports and/or success stories as well. + + +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -360,7 +360,7 @@ S: Maintained + ALI1563 I2C DRIVER + P: Rudolf Marek + M: r.marek@assembler.cz +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + S: Maintained + + ALPHA PORT +@@ -1681,7 +1681,7 @@ FREESCALE I2C CPM DRIVER + P: Jochen Friedrich + M: jochen@scram.de + L: linuxppc-dev@ozlabs.org +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + S: Maintained + + FREESCALE SOC FS_ENET DRIVER +@@ -1982,7 +1982,7 @@ S: Maintained + I2C/SMBUS STUB DRIVER + P: Mark M. Hoffman + M: mhoffman@lightlink.com +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + S: Maintained + + I2C SUBSYSTEM +@@ -1990,14 +1990,14 @@ P: Jean Delvare (PC drivers, core) + M: khali@linux-fr.org + P: Ben Dooks (embedded platforms) + M: ben-linux@fluff.org +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + T: quilt http://khali.linux-fr.org/devel/linux-2.6/jdelvare-i2c/ + S: Maintained + + I2C-TINY-USB DRIVER + P: Till Harbaum + M: till@harbaum.org +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + T: http://www.harbaum.org/till/i2c_tiny_usb + S: Maintained + +@@ -3070,7 +3070,7 @@ S: Maintained + OPENCORES I2C BUS DRIVER + P: Peter Korsgaard + M: jacmet@sunsite.dk +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + S: Maintained + + ORACLE CLUSTER FILESYSTEM 2 (OCFS2) +@@ -3144,7 +3144,7 @@ S: Maintained + PA SEMI SMBUS DRIVER + P: Olof Johansson + M: olof@lixom.net +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + S: Maintained + + PARALLEL PORT SUPPORT +@@ -3280,7 +3280,7 @@ S: Maintained + PNXxxxx I2C DRIVER + P: Vitaly Wool + M: vitalywool@gmail.com +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + S: Maintained + + PPP PROTOCOL DRIVERS AND COMPRESSORS +@@ -3725,7 +3725,7 @@ S: Maintained + SIS 96X I2C/SMBUS DRIVER + P: Mark M. Hoffman + M: mhoffman@lightlink.com +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + S: Maintained + + SIS FRAMEBUFFER DRIVER +@@ -4445,7 +4445,7 @@ S: Maintained + VIAPRO SMBUS DRIVER + P: Jean Delvare + M: khali@linux-fr.org +-L: i2c@lm-sensors.org ++L: linux-i2c@vger.kernel.org + S: Maintained + + VIA VELOCITY NETWORK DRIVER + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008 +Message-Id: <20081104232322.982918778@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Len Sorensen , + Jean Delvare +Subject: [patch 32/57] scx200_i2c: Add missing class parameter +Content-Disposition: inline; filename=scx200_i2c-add-missing-class-parameter.patch +Content-Length: 969 +Lines: 30 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Lennart Sorensen + +commit 4a029abee0f1d69cb0445657d6fa5a38597bd17d upstream + +The scx200_i2c driver is missing the .class parameter, which means no +i2c drivers are willing to probe for devices on the bus and attach to +them. + +Signed-off-by: Len Sorensen +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/i2c/busses/scx200_i2c.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i2c/busses/scx200_i2c.c ++++ b/drivers/i2c/busses/scx200_i2c.c +@@ -81,6 +81,7 @@ static struct i2c_algo_bit_data scx200_i + + static struct i2c_adapter scx200_i2c_ops = { + .owner = THIS_MODULE, ++ .class = I2C_CLASS_HWMON | I2C_CLASS_SPD, + .id = I2C_HW_B_SCX200, + .algo_data = &scx200_i2c_data, + .name = "NatSemi SCx200 I2C", + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008 +Message-Id: <20081104232323.155870147@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai , + Jaroslav Kysela , + Chris Wedgwood +Subject: [patch 33/57] ALSA: use correct lock in snd_ctl_dev_disconnect() +Content-Disposition: inline; filename=alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch +Content-Length: 1254 +Lines: 36 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Takashi Iwai + +commit d8009882e9f5e1a76986c741f071edd2ad760c97 upstream + +The lock used in snd_ctl_dev_disconnect() should be card->ctl_files_rwlock +for protection of card->ctl_files entries, instead of card->controls_rwsem. + +Reported-by: Vegard Nossum +Signed-off-by: Takashi Iwai +Signed-off-by: Jaroslav Kysela +Cc: Chris Wedgwood +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/control.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -1427,12 +1427,12 @@ static int snd_ctl_dev_disconnect(struct + cardnum = card->number; + snd_assert(cardnum >= 0 && cardnum < SNDRV_CARDS, return -ENXIO); + +- down_read(&card->controls_rwsem); ++ read_lock(&card->ctl_files_rwlock); + list_for_each_entry(ctl, &card->ctl_files, list) { + wake_up(&ctl->change_sleep); + kill_fasync(&ctl->fasync, SIGIO, POLL_ERR); + } +- up_read(&card->controls_rwsem); ++ read_unlock(&card->ctl_files_rwlock); + + if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL, + card, -1)) < 0) + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008 +Message-Id: <20081104232323.311316441@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Boris Dores , + v4l-dvb maintainer list , + Mike Isely , + Mauro Carvalho Chehab +Subject: [patch 34/57] V4L: pvrusb2: Keep MPEG PTSs from drifting away +Content-Disposition: inline; filename=v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch +Content-Length: 1145 +Lines: 34 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Boris Dores + +cherry picked from commit 3f93d1adca658201c64251c43a147cc79d468c3f + +V4L: pvrusb2: Keep MPEG PTSs from drifting away + +This change was empirically figured out by Boris Dores after +empirically comparing against behavior in the Windows driver. + +Signed-off-by: Mike Isely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/pvrusb2/pvrusb2-encoder.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/video/pvrusb2/pvrusb2-encoder.c ++++ b/drivers/media/video/pvrusb2/pvrusb2-encoder.c +@@ -402,6 +402,10 @@ static int pvr2_encoder_prep_config(stru + ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 0,3,0,0); + ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4,15,0,0,0); + ++ /* prevent the PTSs from slowly drifting away in the generated ++ MPEG stream */ ++ ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC, 2, 4, 1); ++ + return ret; + } + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008 +Message-Id: <20081104232323.474028821@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + v4l-dvb maintainer list , + Steven Toth , + Mauro Carvalho Chehab +Subject: [patch 35/57] DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits +Content-Disposition: inline; filename=dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch +Content-Length: 1847 +Lines: 55 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Steven Toth + +cherry picked from commit 1af46b450fa49c57d73764d66f267335ccd807e2 + +DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits + +Adding a serialmode function to read/and/or/write the register for safety. + +Signed-off-by: Steven Toth +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/s5h1411.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb/frontends/s5h1411.c ++++ b/drivers/media/dvb/frontends/s5h1411.c +@@ -471,6 +471,20 @@ static int s5h1411_set_spectralinversion + return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0x24, val); + } + ++static int s5h1411_set_serialmode(struct dvb_frontend *fe, int serial) ++{ ++ struct s5h1411_state *state = fe->demodulator_priv; ++ u16 val; ++ ++ dprintk("%s(%d)\n", __func__, serial); ++ val = s5h1411_readreg(state, S5H1411_I2C_TOP_ADDR, 0xbd) & ~0x100; ++ ++ if (serial == 1) ++ val |= 0x100; ++ ++ return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, val); ++} ++ + static int s5h1411_enable_modulation(struct dvb_frontend *fe, + fe_modulation_t m) + { +@@ -612,10 +626,10 @@ static int s5h1411_init(struct dvb_front + + if (state->config->output_mode == S5H1411_SERIAL_OUTPUT) + /* Serial */ +- s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1101); ++ s5h1411_set_serialmode(fe, 1); + else + /* Parallel */ +- s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1001); ++ s5h1411_set_serialmode(fe, 0); + + s5h1411_set_spectralinversion(fe, state->config->inversion); + s5h1411_set_if_freq(fe, state->config->vsb_if); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008 +Message-Id: <20081104232323.644532814@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + v4l-dvb maintainer list , + Steven Toth , + Devin Heitmueller , + Mauro Carvalho Chehab +Subject: [patch 36/57] DVB: s5h1411: Perform s5h1411 soft reset after tuning +Content-Disposition: inline; filename=dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch +Content-Length: 1516 +Lines: 47 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Devin Heitmueller + +cherry picked from commit f0d041e50bc6c8a677922d72b010f80af9b23b18 + +DVB: s5h1411: Perform s5h1411 soft reset after tuning + +If you instruct the tuner to change frequencies, it can take up to 2500ms to +get a demod lock. By performing a soft reset after the tuning call (which +is consistent with how the Pinnacle 801e Windows driver behaves), you get +a demod lock inside of 300ms + +Signed-off-by: Devin Heitmueller +Signed-off-by: Michael Krufky +Acked-by: Steven Toth +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/s5h1411.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/dvb/frontends/s5h1411.c ++++ b/drivers/media/dvb/frontends/s5h1411.c +@@ -588,9 +588,6 @@ static int s5h1411_set_frontend(struct d + + s5h1411_enable_modulation(fe, p->u.vsb.modulation); + +- /* Allow the demod to settle */ +- msleep(100); +- + if (fe->ops.tuner_ops.set_params) { + if (fe->ops.i2c_gate_ctrl) + fe->ops.i2c_gate_ctrl(fe, 1); +@@ -601,6 +598,10 @@ static int s5h1411_set_frontend(struct d + fe->ops.i2c_gate_ctrl(fe, 0); + } + ++ /* Issue a reset to the demod so it knows to resync against the ++ newly tuned frequency */ ++ s5h1411_softreset(fe); ++ + return 0; + } + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008 +Message-Id: <20081104232323.814985552@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + v4l-dvb maintainer list , + Steven Toth , + Devin Heitmueller , + Mauro Carvalho Chehab +Subject: [patch 37/57] DVB: s5h1411: Power down s5h1411 when not in use +Content-Disposition: inline; filename=dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch +Content-Length: 2015 +Lines: 63 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Devin Heitmueller + +cherry picked from commit 11fc9a4a440112b5afc1a99d86ba92d70205a688 + +DVB: s5h1411: Power down s5h1411 when not in use + +Power down the s5h1411 demodulator when not in use +(on the Pinnacle 801e, this brings idle power from +123ma down to 84ma). + +Signed-off-by: Devin Heitmueller +Acked-by: Steven Toth +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/s5h1411.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb/frontends/s5h1411.c ++++ b/drivers/media/dvb/frontends/s5h1411.c +@@ -549,7 +549,7 @@ static int s5h1411_set_gpio(struct dvb_f + return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xe0, val); + } + +-static int s5h1411_sleep(struct dvb_frontend *fe, int enable) ++static int s5h1411_set_powerstate(struct dvb_frontend *fe, int enable) + { + struct s5h1411_state *state = fe->demodulator_priv; + +@@ -565,6 +565,11 @@ static int s5h1411_sleep(struct dvb_fron + return 0; + } + ++static int s5h1411_sleep(struct dvb_frontend *fe) ++{ ++ return s5h1411_set_powerstate(fe, 1); ++} ++ + static int s5h1411_register_reset(struct dvb_frontend *fe) + { + struct s5h1411_state *state = fe->demodulator_priv; +@@ -614,7 +619,7 @@ static int s5h1411_init(struct dvb_front + + dprintk("%s()\n", __func__); + +- s5h1411_sleep(fe, 0); ++ s5h1411_set_powerstate(fe, 0); + s5h1411_register_reset(fe); + + for (i = 0; i < ARRAY_SIZE(init_tab); i++) +@@ -878,6 +883,7 @@ static struct dvb_frontend_ops s5h1411_o + }, + + .init = s5h1411_init, ++ .sleep = s5h1411_sleep, + .i2c_gate_ctrl = s5h1411_i2c_gate_ctrl, + .set_frontend = s5h1411_set_frontend, + .get_frontend = s5h1411_get_frontend, + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008 +Message-Id: <20081104232323.976542478@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Chubb , + Jesse Barnes , + Bjorn Helgaas +Subject: [patch 38/57] PCI: fix 64-vbit prefetchable memory resource BARs +Content-Disposition: inline; filename=pci-fix-64-vbit-prefetchable-memory-resource-bars.patch +Content-Length: 1310 +Lines: 37 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Peter Chubb + +commit e354597cce8d219d135d65e585dc4f30323486b9 upstream. + +Since patch 6ac665c63dcac8fcec534a1d224ecbb8b867ad59 my infiniband +controller hasn't worked. This is because it has 64-bit prefetchable +memory, which was mistakenly being taken to be 32-bit memory. The +resource flags in this case are PCI_BASE_ADDRESS_MEM_TYPE_64 | +PCI_BASE_ADDRESS_MEM_PREFETCH. + +This patch checks only for the PCI_BASE_ADDRESS_MEM_TYPE_64 bit; thus +whether the region is prefetchable or not is ignored. This fixes my +Infiniband. + +Reviewed-by: Matthew Wilcox +Signed-off-by: Peter Chubb +Signed-off-by: Jesse Barnes +Cc: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -219,7 +219,7 @@ static inline enum pci_bar_type decode_b + + res->flags = bar & ~PCI_BASE_ADDRESS_MEM_MASK; + +- if (res->flags == PCI_BASE_ADDRESS_MEM_TYPE_64) ++ if (res->flags & PCI_BASE_ADDRESS_MEM_TYPE_64) + return pci_bar_mem64; + return pci_bar_mem32; + } + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008 +Message-Id: <20081104232324.144651614@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Zijlstra , + Ingo Molnar +Subject: [patch 39/57] sched: disable the hrtick for now +Content-Disposition: inline; filename=sched-disable-the-hrtick-for-now.patch +Content-Length: 1070 +Lines: 36 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ingo Molnar + +commit 0c4b83da58ec2e96ce9c44c211d6eac5f9dae478 upstream + +sched: disable the hrtick for now + +David Miller reported that hrtick update overhead has tripled the +wakeup overhead on Sparc64. + +That is too much - disable the HRTICK feature for now by default, +until a faster implementation is found. + +Reported-by: David Miller +Acked-by: Peter Zijlstra +Signed-off-by: Ingo Molnar +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched_features.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/sched_features.h ++++ b/kernel/sched_features.h +@@ -5,7 +5,7 @@ SCHED_FEAT(START_DEBIT, 1) + SCHED_FEAT(AFFINE_WAKEUPS, 1) + SCHED_FEAT(CACHE_HOT_BUDDY, 1) + SCHED_FEAT(SYNC_WAKEUPS, 1) +-SCHED_FEAT(HRTICK, 1) ++SCHED_FEAT(HRTICK, 0) + SCHED_FEAT(DOUBLE_TICK, 0) + SCHED_FEAT(ASYM_GRAN, 1) + SCHED_FEAT(LB_BIAS, 1) + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008 +Message-Id: <20081104232324.301439138@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Zijlstra , + Molnar , + Ingo@hera.kernel.org, + Dave Kleikamp , + Peter Zijlstra +Subject: [patch 40/57] sched_clock: prevent scd->clock from moving backwards +Content-Disposition: inline; filename=sched_clock-prevent-scd-clock-from-moving-backwards.patch +Content-Length: 1606 +Lines: 45 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Dave Kleikamp + +commit 5b7dba4ff834259a5623e03a565748704a8fe449 upstream + +sched_clock: prevent scd->clock from moving backwards + +When sched_clock_cpu() couples the clocks between two cpus, it may +increment scd->clock beyond the GTOD tick window that __update_sched_clock() +uses to clamp the clock. A later call to __update_sched_clock() may move +the clock back to scd->tick_gtod + TICK_NSEC, violating the clock's +monotonic property. + +This patch ensures that scd->clock will not be set backward. + +Signed-off-by: Dave Kleikamp +Acked-by: Peter Zijlstra +Signed-off-by: Ingo Molnar +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched_clock.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/sched_clock.c ++++ b/kernel/sched_clock.c +@@ -118,13 +118,13 @@ static u64 __update_sched_clock(struct s + + /* + * scd->clock = clamp(scd->tick_gtod + delta, +- * max(scd->tick_gtod, scd->clock), +- * scd->tick_gtod + TICK_NSEC); ++ * max(scd->tick_gtod, scd->clock), ++ * max(scd->clock, scd->tick_gtod + TICK_NSEC)); + */ + + clock = scd->tick_gtod + delta; + min_clock = wrap_max(scd->tick_gtod, scd->clock); +- max_clock = scd->tick_gtod + TICK_NSEC; ++ max_clock = wrap_max(scd->clock, scd->tick_gtod + TICK_NSEC); + + clock = wrap_max(clock, min_clock); + clock = wrap_min(clock, max_clock); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008 +Message-Id: <20081104232324.459449593@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar , + David Rientjes +Subject: [patch 41/57] x86: avoid dereferencing beyond stack + THREAD_SIZE +Content-Disposition: inline; filename=x86-avoid-dereferencing-beyond-stack-thread_size.patch +Content-Length: 1345 +Lines: 39 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Rientjes + +commit e1e23bb0513520035ec934fa3483507cb6648b7c upstream + +x86: avoid dereferencing beyond stack + THREAD_SIZE + +It's possible for get_wchan() to dereference past task->stack + THREAD_SIZE +while iterating through instruction pointers if fp equals the upper boundary, +causing a kernel panic. + +Signed-off-by: David Rientjes +Signed-off-by: Ingo Molnar +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/process_64.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -729,12 +729,12 @@ unsigned long get_wchan(struct task_stru + if (!p || p == current || p->state==TASK_RUNNING) + return 0; + stack = (unsigned long)task_stack_page(p); +- if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE) ++ if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE) + return 0; + fp = *(u64 *)(p->thread.sp); + do { + if (fp < (unsigned long)stack || +- fp > (unsigned long)stack+THREAD_SIZE) ++ fp >= (unsigned long)stack+THREAD_SIZE) + return 0; + ip = *(u64 *)(fp+8); + if (!in_sched_functions(ip)) + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008 +Message-Id: <20081104232324.618853017@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Brownell , + Bjorn Helgaas , + "Rafael J. Wysocki" +Subject: [patch 42/57] rtc-cmos: look for PNP RTC first, then for platform RTC +Content-Disposition: inline; filename=rtc-cmos-look-for-pnp-rtc-first-then-for-platform-rtc.patch +Content-Length: 2704 +Lines: 91 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bjorn Helgaas + +commit 72f22b1eb6ca5e4676a632a04d40d46cb61d4562 upstream + +rtc-cmos: look for PNP RTC first, then for platform RTC + +We shouldn't rely on "pnp_platform_devices" to tell us whether there +is a PNP RTC device. + +I introduced "pnp_platform_devices", but I think it was a mistake. +All it tells us is whether we found any PNPBIOS or PNPACPI devices. +Many machines have some PNP devices, but do not describe the RTC +via PNP. On those machines, we need to do the platform driver probe +to find the RTC. + +We should just register the PNP driver and see whether it claims anything. +If we don't find a PNP RTC, fall back to the platform driver probe. + +This (in conjunction with the arch/x86/kernel/rtc.c patch to add +a platform RTC device when PNP doesn't have one) should resolve +these issues: + + http://bugzilla.kernel.org/show_bug.cgi?id=11580 + https://bugzilla.redhat.com/show_bug.cgi?id=451188 + +Signed-off-by: Bjorn Helgaas +Acked-by: Rafael J. Wysocki +Acked-by: David Brownell +Reported-by: Rik Theys +Reported-by: shr_msn@yahoo.com.tw +Signed-off-by: Linus Torvalds +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-cmos.c | 33 ++++++++++++++++++--------------- + 1 file changed, 18 insertions(+), 15 deletions(-) + +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -1030,29 +1030,32 @@ static struct platform_driver cmos_platf + + static int __init cmos_init(void) + { ++ int retval = 0; ++ ++#ifdef CONFIG_PNP ++ pnp_register_driver(&cmos_pnp_driver); ++#endif ++ ++ if (!cmos_rtc.dev) ++ retval = platform_driver_probe(&cmos_platform_driver, ++ cmos_platform_probe); ++ ++ if (retval == 0) ++ return 0; ++ + #ifdef CONFIG_PNP +- if (pnp_platform_devices) +- return pnp_register_driver(&cmos_pnp_driver); +- else +- return platform_driver_probe(&cmos_platform_driver, +- cmos_platform_probe); +-#else +- return platform_driver_probe(&cmos_platform_driver, +- cmos_platform_probe); +-#endif /* CONFIG_PNP */ ++ pnp_unregister_driver(&cmos_pnp_driver); ++#endif ++ return retval; + } + module_init(cmos_init); + + static void __exit cmos_exit(void) + { + #ifdef CONFIG_PNP +- if (pnp_platform_devices) +- pnp_unregister_driver(&cmos_pnp_driver); +- else +- platform_driver_unregister(&cmos_platform_driver); +-#else ++ pnp_unregister_driver(&cmos_pnp_driver); ++#endif + platform_driver_unregister(&cmos_platform_driver); +-#endif /* CONFIG_PNP */ + } + module_exit(cmos_exit); + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008 +Message-Id: <20081104232324.778794289@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Phil Dibowitz , + Alexandre Oliva +Subject: [patch 43/57] USB: storage: Avoid I/O errors when issuing SCSI ioctls to JMicron USB/ATA bridge +Content-Disposition: inline; filename=usb-storage-avoid-i-o-errors-when-issuing-scsi-ioctls-to-jmicron-usb-ata-bridge.patch +Content-Length: 2149 +Lines: 56 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Phil Dibowitz + +commit 3030ca4cf4abbdd2dd850a14d20e9fca5937ffb5 upstream + +USB: storage: Avoid I/O errors when issuing SCSI ioctls to JMicron USB/ATA bridge + +Here's the patch that implements the fix you suggested to avoid the +I/O errors that I was running into with my new USB enclosure with a +JMicron USB/ATA bridge, while issuing scsi-io USN or other such +queries used by Fedora's mkinitrd. +http://bugzilla.kernel.org/show_bug.cgi?id=9638#c85 + + +/proc/bus/usb/devices: +T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=04 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=152d ProdID=2329 Rev= 1.00 +S: Manufacturer=JMicron +S: Product=USB to ATA/ATAPI Bridge +S: SerialNumber=DE5088854FFF +C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr= 2mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +(patch applied and retested on a modified 2.6.27.2-libre.24.rc1.fc10) + +Signed-off-by: Phil Dibowitz +Cc: Alexandre Oliva +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1745,6 +1745,15 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE ), + ++/* Reported by Alexandre Oliva ++ * JMicron responds to USN and several other SCSI ioctls with a ++ * residue that causes subsequent I/O requests to fail. */ ++UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100, ++ "JMicron", ++ "USB to ATA/ATAPI Bridge", ++ US_SC_DEVICE, US_PR_DEVICE, NULL, ++ US_FL_IGNORE_RESIDUE ), ++ + /* Reported by Robert Schedel + * Note: this is a 'super top' device like the above 14cd/6600 device */ + UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201, + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008 +Message-Id: <20081104232324.943633265@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Brownell , + Bjorn Helgaas , + "Rafael J. Wysocki" +Subject: [patch 44/57] x86: register a platform RTC device if PNP doesnt describe it +Content-Disposition: inline; filename=x86-register-a-platform-rtc-device-if-pnp-doesn-t-describe-it.patch +Content-Length: 2071 +Lines: 65 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bjorn Helgaas + +commit 758a7f7bb86b520aadc484f23da85e547b3bf3d8 upstream + +x86: register a platform RTC device if PNP doesn't describe it + +Most if not all x86 platforms have an RTC device, but sometimes the RTC +is not exposed as a PNP0b00/PNP0b01/PNP0b02 device in PNPBIOS or ACPI: + + http://bugzilla.kernel.org/show_bug.cgi?id=11580 + https://bugzilla.redhat.com/show_bug.cgi?id=451188 + +It's best if we can discover the RTC via PNP because then we know +which flavor of device it is, where it lives, and which IRQ it uses. + +But if we can't, we should register a platform device using the +compiled-in RTC_PORT/RTC_IRQ resource assumptions. + +Signed-off-by: Bjorn Helgaas +Acked-by: Rafael J. Wysocki +Acked-by: David Brownell +Reported-by: Rik Theys +Reported-by: shr_msn@yahoo.com.tw +Cc: Chuck Ebbert +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/rtc.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/arch/x86/kernel/rtc.c ++++ b/arch/x86/kernel/rtc.c +@@ -223,11 +223,25 @@ static struct platform_device rtc_device + static __init int add_rtc_cmos(void) + { + #ifdef CONFIG_PNP +- if (!pnp_platform_devices) +- platform_device_register(&rtc_device); +-#else ++ static const char *ids[] __initconst = ++ { "PNP0b00", "PNP0b01", "PNP0b02", }; ++ struct pnp_dev *dev; ++ struct pnp_id *id; ++ int i; ++ ++ pnp_for_each_dev(dev) { ++ for (id = dev->id; id; id = id->next) { ++ for (i = 0; i < ARRAY_SIZE(ids); i++) { ++ if (compare_pnp_id(id, ids[i]) != 0) ++ return 0; ++ } ++ } ++ } ++#endif ++ + platform_device_register(&rtc_device); +-#endif /* CONFIG_PNP */ ++ dev_info(&rtc_device.dev, ++ "registered platform RTC device (no PNP device found)\n"); + return 0; + } + device_initcall(add_rtc_cmos); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008 +Message-Id: <20081104232325.109638649@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikael Pettersson , + Jeff Garzik +Subject: [patch 45/57] sata_promise: add ATA engine reset to reset ops +Content-Disposition: inline; filename=sata_promise-add-ata-engine-reset-to-reset-ops.patch +Content-Length: 2945 +Lines: 79 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mikael Pettersson + +commit cadef677e4a9b9c1d069675043767df486782986 upstream + +Promise ATA engines need to be reset when errors occur. +That's currently done for errors detected by sata_promise itself, +but it's not done for errors like timeouts detected outside of +the low-level driver. + +The effect of this omission is that a timeout tends to result +in a sequence of failed COMRESETs after which libata EH gives +up and disables the port. At that point the port's ATA engine +hangs and even reloading the driver will not resume it. + +To fix this, make sata_promise override ->hardreset on SATA +ports with code which calls pdc_reset_port() on the port in +question before calling libata's hardreset. PATA ports don't +use ->hardreset, so for those we override ->softreset instead. + +Signed-off-by: Mikael Pettersson +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_promise.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/ata/sata_promise.c ++++ b/drivers/ata/sata_promise.c +@@ -153,6 +153,10 @@ static void pdc_freeze(struct ata_port * + static void pdc_sata_freeze(struct ata_port *ap); + static void pdc_thaw(struct ata_port *ap); + static void pdc_sata_thaw(struct ata_port *ap); ++static int pdc_pata_softreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline); ++static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline); + static void pdc_error_handler(struct ata_port *ap); + static void pdc_post_internal_cmd(struct ata_queued_cmd *qc); + static int pdc_pata_cable_detect(struct ata_port *ap); +@@ -186,6 +190,7 @@ static struct ata_port_operations pdc_sa + .scr_read = pdc_sata_scr_read, + .scr_write = pdc_sata_scr_write, + .port_start = pdc_sata_port_start, ++ .hardreset = pdc_sata_hardreset, + }; + + /* First-generation chips need a more restrictive ->check_atapi_dma op */ +@@ -200,6 +205,7 @@ static struct ata_port_operations pdc_pa + .freeze = pdc_freeze, + .thaw = pdc_thaw, + .port_start = pdc_common_port_start, ++ .softreset = pdc_pata_softreset, + }; + + static const struct ata_port_info pdc_port_info[] = { +@@ -691,6 +697,20 @@ static void pdc_sata_thaw(struct ata_por + readl(host_mmio + hotplug_offset); /* flush */ + } + ++static int pdc_pata_softreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline) ++{ ++ pdc_reset_port(link->ap); ++ return ata_sff_softreset(link, class, deadline); ++} ++ ++static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline) ++{ ++ pdc_reset_port(link->ap); ++ return sata_sff_hardreset(link, class, deadline); ++} ++ + static void pdc_error_handler(struct ata_port *ap) + { + if (!(ap->pflags & ATA_PFLAG_FROZEN)) + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008 +Message-Id: <20081104232325.303788739@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik +Subject: [patch 46/57] sata_nv: fix generic, nf2/3 detection regression +Content-Disposition: inline; filename=sata_nv-fix-generic-nf2-3-detection-regression.patch +Content-Length: 5029 +Lines: 146 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +commit 3c324283e6cdb79210cf7975c3e40d3ba3e672b2 upstream + +All three flavors of sata_nv's are different in how their hardreset +behaves. + +* generic: Hardreset is not reliable. Link often doesn't come online + after hardreset. + +* nf2/3: A little bit better - link comes online with longer debounce + timing. However, nf2/3 can't reliable wait for the first D2H + Register FIS, so it can't wait for device readiness or classify the + device after hardreset. Follow-up SRST required. + +* ck804: Hardreset finally works. + +The core layer change to prefer hardreset and follow up changes +exposed the above issues and caused various detection regressions for +all three flavors. This patch, hopefully, fixes all the known issues +and should make sata_nv error handling more reliable. + +Signed-off-by: Tejun Heo +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_nv.c | 53 +++++++++++++++++++++++--------------------------- + 1 file changed, 25 insertions(+), 28 deletions(-) + +--- a/drivers/ata/sata_nv.c ++++ b/drivers/ata/sata_nv.c +@@ -307,10 +307,10 @@ static int nv_scr_write(struct ata_port + + static void nv_nf2_freeze(struct ata_port *ap); + static void nv_nf2_thaw(struct ata_port *ap); ++static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline); + static void nv_ck804_freeze(struct ata_port *ap); + static void nv_ck804_thaw(struct ata_port *ap); +-static int nv_hardreset(struct ata_link *link, unsigned int *class, +- unsigned long deadline); + static int nv_adma_slave_config(struct scsi_device *sdev); + static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc); + static void nv_adma_qc_prep(struct ata_queued_cmd *qc); +@@ -405,17 +405,8 @@ static struct scsi_host_template nv_swnc + .slave_configure = nv_swncq_slave_config, + }; + +-/* OSDL bz3352 reports that some nv controllers can't determine device +- * signature reliably and nv_hardreset is implemented to work around +- * the problem. This was reported on nf3 and it's unclear whether any +- * other controllers are affected. However, the workaround has been +- * applied to all variants and there isn't much to gain by trying to +- * find out exactly which ones are affected at this point especially +- * because NV has moved over to ahci for newer controllers. +- */ + static struct ata_port_operations nv_common_ops = { + .inherits = &ata_bmdma_port_ops, +- .hardreset = nv_hardreset, + .scr_read = nv_scr_read, + .scr_write = nv_scr_write, + }; +@@ -429,12 +420,22 @@ static struct ata_port_operations nv_gen + .hardreset = ATA_OP_NULL, + }; + ++/* OSDL bz3352 reports that nf2/3 controllers can't determine device ++ * signature reliably. Also, the following thread reports detection ++ * failure on cold boot with the standard debouncing timing. ++ * ++ * http://thread.gmane.org/gmane.linux.ide/34098 ++ * ++ * Debounce with hotplug timing and request follow-up SRST. ++ */ + static struct ata_port_operations nv_nf2_ops = { + .inherits = &nv_common_ops, + .freeze = nv_nf2_freeze, + .thaw = nv_nf2_thaw, ++ .hardreset = nv_nf2_hardreset, + }; + ++/* CK804 finally gets hardreset right */ + static struct ata_port_operations nv_ck804_ops = { + .inherits = &nv_common_ops, + .freeze = nv_ck804_freeze, +@@ -443,7 +444,7 @@ static struct ata_port_operations nv_ck8 + }; + + static struct ata_port_operations nv_adma_ops = { +- .inherits = &nv_common_ops, ++ .inherits = &nv_ck804_ops, + + .check_atapi_dma = nv_adma_check_atapi_dma, + .sff_tf_read = nv_adma_tf_read, +@@ -467,7 +468,7 @@ static struct ata_port_operations nv_adm + }; + + static struct ata_port_operations nv_swncq_ops = { +- .inherits = &nv_common_ops, ++ .inherits = &nv_generic_ops, + + .qc_defer = ata_std_qc_defer, + .qc_prep = nv_swncq_qc_prep, +@@ -1553,6 +1554,17 @@ static void nv_nf2_thaw(struct ata_port + iowrite8(mask, scr_addr + NV_INT_ENABLE); + } + ++static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline) ++{ ++ bool online; ++ int rc; ++ ++ rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline, ++ &online, NULL); ++ return online ? -EAGAIN : rc; ++} ++ + static void nv_ck804_freeze(struct ata_port *ap) + { + void __iomem *mmio_base = ap->host->iomap[NV_MMIO_BAR]; +@@ -1605,21 +1617,6 @@ static void nv_mcp55_thaw(struct ata_por + ata_sff_thaw(ap); + } + +-static int nv_hardreset(struct ata_link *link, unsigned int *class, +- unsigned long deadline) +-{ +- int rc; +- +- /* SATA hardreset fails to retrieve proper device signature on +- * some controllers. Request follow up SRST. For more info, +- * see http://bugzilla.kernel.org/show_bug.cgi?id=3352 +- */ +- rc = sata_sff_hardreset(link, class, deadline); +- if (rc) +- return rc; +- return -EAGAIN; +-} +- + static void nv_adma_error_handler(struct ata_port *ap) + { + struct nv_adma_port_priv *pp = ap->private_data; + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008 +Message-Id: <20081104232325.485611718@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexey Starikovskiy , + Len Brown , + "Rafael J. Wysocki" +Subject: [patch 47/57] ACPI: EC: do transaction from interrupt context +Content-Disposition: inline; filename=acpi-ec-do-transaction-from-interrupt-context.patch +Content-Length: 16282 +Lines: 532 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alexey Starikovskiy + +commit 7c6db4e050601f359081fde418ca6dc4fc2d0011 upstream. + +It is easier and faster to do transaction directly from interrupt context +rather than waking control thread. +Also, cleaner GPE storm avoidance is implemented. +References: http://bugzilla.kernel.org/show_bug.cgi?id=9998 + http://bugzilla.kernel.org/show_bug.cgi?id=10724 + http://bugzilla.kernel.org/show_bug.cgi?id=10919 + http://bugzilla.kernel.org/show_bug.cgi?id=11309 + http://bugzilla.kernel.org/show_bug.cgi?id=11549 + +Signed-off-by: Alexey Starikovskiy +Tested-by: Sitsofe Wheeler +Signed-off-by: Len Brown +Cc: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 309 ++++++++++++++++++++++++++---------------------------- + 1 file changed, 149 insertions(+), 160 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1,7 +1,7 @@ + /* +- * ec.c - ACPI Embedded Controller Driver (v2.0) ++ * ec.c - ACPI Embedded Controller Driver (v2.1) + * +- * Copyright (C) 2006, 2007 Alexey Starikovskiy ++ * Copyright (C) 2006-2008 Alexey Starikovskiy + * Copyright (C) 2006 Denis Sadykov + * Copyright (C) 2004 Luming Yu + * Copyright (C) 2001, 2002 Andy Grover +@@ -26,7 +26,7 @@ + * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + */ + +-/* Uncomment next line to get verbose print outs*/ ++/* Uncomment next line to get verbose printout */ + /* #define DEBUG */ + + #include +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -65,22 +66,21 @@ enum ec_command { + ACPI_EC_COMMAND_QUERY = 0x84, + }; + +-/* EC events */ +-enum ec_event { +- ACPI_EC_EVENT_OBF_1 = 1, /* Output buffer full */ +- ACPI_EC_EVENT_IBF_0, /* Input buffer empty */ +-}; +- + #define ACPI_EC_DELAY 500 /* Wait 500ms max. during EC ops */ + #define ACPI_EC_UDELAY_GLK 1000 /* Wait 1ms max. to get global lock */ + #define ACPI_EC_UDELAY 100 /* Wait 100us before polling EC again */ + ++#define ACPI_EC_STORM_THRESHOLD 20 /* number of false interrupts ++ per one transaction */ ++ + enum { +- EC_FLAGS_WAIT_GPE = 0, /* Don't check status until GPE arrives */ + EC_FLAGS_QUERY_PENDING, /* Query is pending */ +- EC_FLAGS_GPE_MODE, /* Expect GPE to be sent for status change */ ++ EC_FLAGS_GPE_MODE, /* Expect GPE to be sent ++ * for status change */ + EC_FLAGS_NO_GPE, /* Don't use GPE mode */ +- EC_FLAGS_RESCHEDULE_POLL /* Re-schedule poll */ ++ EC_FLAGS_GPE_STORM, /* GPE storm detected */ ++ EC_FLAGS_HANDLERS_INSTALLED /* Handlers for GPE and ++ * OpReg are installed */ + }; + + /* If we find an EC via the ECDT, we need to keep a ptr to its context */ +@@ -95,6 +95,14 @@ struct acpi_ec_query_handler { + u8 query_bit; + }; + ++struct transaction_data { ++ const u8 *wdata; ++ u8 *rdata; ++ unsigned short irq_count; ++ u8 wlen; ++ u8 rlen; ++}; ++ + static struct acpi_ec { + acpi_handle handle; + unsigned long gpe; +@@ -105,9 +113,8 @@ static struct acpi_ec { + struct mutex lock; + wait_queue_head_t wait; + struct list_head list; +- struct delayed_work work; +- atomic_t irq_count; +- u8 handlers_installed; ++ struct transaction_data *t; ++ spinlock_t t_lock; + } *boot_ec, *first_ec; + + /* +@@ -150,7 +157,7 @@ static inline u8 acpi_ec_read_data(struc + { + u8 x = inb(ec->data_addr); + pr_debug(PREFIX "---> data = 0x%2.2x\n", x); +- return inb(ec->data_addr); ++ return x; + } + + static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command) +@@ -165,68 +172,79 @@ static inline void acpi_ec_write_data(st + outb(data, ec->data_addr); + } + +-static inline int acpi_ec_check_status(struct acpi_ec *ec, enum ec_event event) ++static int ec_transaction_done(struct acpi_ec *ec) + { +- if (test_bit(EC_FLAGS_WAIT_GPE, &ec->flags)) +- return 0; +- if (event == ACPI_EC_EVENT_OBF_1) { +- if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_OBF) +- return 1; +- } else if (event == ACPI_EC_EVENT_IBF_0) { +- if (!(acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)) +- return 1; +- } +- +- return 0; ++ unsigned long flags; ++ int ret = 0; ++ spin_lock_irqsave(&ec->t_lock, flags); ++ if (!ec->t || (!ec->t->wlen && !ec->t->rlen)) ++ ret = 1; ++ spin_unlock_irqrestore(&ec->t_lock, flags); ++ return ret; + } + +-static void ec_schedule_ec_poll(struct acpi_ec *ec) ++static void gpe_transaction(struct acpi_ec *ec, u8 status) + { +- if (test_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags)) +- schedule_delayed_work(&ec->work, +- msecs_to_jiffies(ACPI_EC_DELAY)); ++ unsigned long flags; ++ spin_lock_irqsave(&ec->t_lock, flags); ++ if (!ec->t) ++ goto unlock; ++ if (ec->t->wlen > 0) { ++ if ((status & ACPI_EC_FLAG_IBF) == 0) { ++ acpi_ec_write_data(ec, *(ec->t->wdata++)); ++ --ec->t->wlen; ++ } else ++ /* false interrupt, state didn't change */ ++ ++ec->t->irq_count; ++ ++ } else if (ec->t->rlen > 0) { ++ if ((status & ACPI_EC_FLAG_OBF) == 1) { ++ *(ec->t->rdata++) = acpi_ec_read_data(ec); ++ --ec->t->rlen; ++ } else ++ /* false interrupt, state didn't change */ ++ ++ec->t->irq_count; ++ } ++unlock: ++ spin_unlock_irqrestore(&ec->t_lock, flags); + } + +-static void ec_switch_to_poll_mode(struct acpi_ec *ec) ++static int acpi_ec_wait(struct acpi_ec *ec) + { ++ if (wait_event_timeout(ec->wait, ec_transaction_done(ec), ++ msecs_to_jiffies(ACPI_EC_DELAY))) ++ return 0; ++ /* missing GPEs, switch back to poll mode */ ++ if (printk_ratelimit()) ++ pr_info(PREFIX "missing confirmations, " ++ "switch off interrupt mode.\n"); + set_bit(EC_FLAGS_NO_GPE, &ec->flags); + clear_bit(EC_FLAGS_GPE_MODE, &ec->flags); +- acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR); +- set_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags); ++ return 1; + } + +-static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, int force_poll) ++static void acpi_ec_gpe_query(void *ec_cxt); ++ ++static int ec_check_sci(struct acpi_ec *ec, u8 state) + { +- atomic_set(&ec->irq_count, 0); +- if (likely(test_bit(EC_FLAGS_GPE_MODE, &ec->flags)) && +- likely(!force_poll)) { +- if (wait_event_timeout(ec->wait, acpi_ec_check_status(ec, event), +- msecs_to_jiffies(ACPI_EC_DELAY))) +- return 0; +- clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags); +- if (acpi_ec_check_status(ec, event)) { +- /* missing GPEs, switch back to poll mode */ +- if (printk_ratelimit()) +- pr_info(PREFIX "missing confirmations, " +- "switch off interrupt mode.\n"); +- ec_switch_to_poll_mode(ec); +- ec_schedule_ec_poll(ec); +- return 0; +- } +- } else { +- unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY); +- clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags); +- while (time_before(jiffies, delay)) { +- if (acpi_ec_check_status(ec, event)) +- return 0; +- msleep(1); +- } +- if (acpi_ec_check_status(ec,event)) ++ if (state & ACPI_EC_FLAG_SCI) { ++ if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags)) ++ return acpi_os_execute(OSL_EC_BURST_HANDLER, ++ acpi_ec_gpe_query, ec); ++ } ++ return 0; ++} ++ ++static int ec_poll(struct acpi_ec *ec) ++{ ++ unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY); ++ msleep(1); ++ while (time_before(jiffies, delay)) { ++ gpe_transaction(ec, acpi_ec_read_status(ec)); ++ msleep(1); ++ if (ec_transaction_done(ec)) + return 0; + } +- pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n", +- acpi_ec_read_status(ec), +- (event == ACPI_EC_EVENT_OBF_1) ? "\"b0=1\"" : "\"b1=0\""); + return -ETIME; + } + +@@ -235,45 +253,51 @@ static int acpi_ec_transaction_unlocked( + u8 * rdata, unsigned rdata_len, + int force_poll) + { +- int result = 0; +- set_bit(EC_FLAGS_WAIT_GPE, &ec->flags); ++ unsigned long tmp; ++ struct transaction_data t = {.wdata = wdata, .rdata = rdata, ++ .wlen = wdata_len, .rlen = rdata_len, ++ .irq_count = 0}; ++ int ret = 0; + pr_debug(PREFIX "transaction start\n"); ++ /* disable GPE during transaction if storm is detected */ ++ if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) { ++ clear_bit(EC_FLAGS_GPE_MODE, &ec->flags); ++ acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR); ++ } ++ /* start transaction */ ++ spin_lock_irqsave(&ec->t_lock, tmp); ++ /* following two actions should be kept atomic */ ++ ec->t = &t; + acpi_ec_write_cmd(ec, command); +- for (; wdata_len > 0; --wdata_len) { +- result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll); +- if (result) { +- pr_err(PREFIX +- "write_cmd timeout, command = %d\n", command); +- goto end; +- } +- set_bit(EC_FLAGS_WAIT_GPE, &ec->flags); +- acpi_ec_write_data(ec, *(wdata++)); +- } +- +- if (!rdata_len) { +- result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll); +- if (result) { +- pr_err(PREFIX +- "finish-write timeout, command = %d\n", command); +- goto end; +- } +- } else if (command == ACPI_EC_COMMAND_QUERY) ++ if (command == ACPI_EC_COMMAND_QUERY) + clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); +- +- for (; rdata_len > 0; --rdata_len) { +- result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1, force_poll); +- if (result) { +- pr_err(PREFIX "read timeout, command = %d\n", command); +- goto end; +- } +- /* Don't expect GPE after last read */ +- if (rdata_len > 1) +- set_bit(EC_FLAGS_WAIT_GPE, &ec->flags); +- *(rdata++) = acpi_ec_read_data(ec); +- } +- end: ++ spin_unlock_irqrestore(&ec->t_lock, tmp); ++ /* if we selected poll mode or failed in GPE-mode do a poll loop */ ++ if (force_poll || ++ !test_bit(EC_FLAGS_GPE_MODE, &ec->flags) || ++ acpi_ec_wait(ec)) ++ ret = ec_poll(ec); + pr_debug(PREFIX "transaction end\n"); +- return result; ++ spin_lock_irqsave(&ec->t_lock, tmp); ++ ec->t = NULL; ++ spin_unlock_irqrestore(&ec->t_lock, tmp); ++ if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) { ++ /* check if we received SCI during transaction */ ++ ec_check_sci(ec, acpi_ec_read_status(ec)); ++ /* it is safe to enable GPE outside of transaction */ ++ acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR); ++ } else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) && ++ t.irq_count > ACPI_EC_STORM_THRESHOLD) { ++ pr_debug(PREFIX "GPE storm detected\n"); ++ set_bit(EC_FLAGS_GPE_STORM, &ec->flags); ++ } ++ return ret; ++} ++ ++static int ec_check_ibf0(struct acpi_ec *ec) ++{ ++ u8 status = acpi_ec_read_status(ec); ++ return (status & ACPI_EC_FLAG_IBF) == 0; + } + + static int acpi_ec_transaction(struct acpi_ec *ec, u8 command, +@@ -283,40 +307,34 @@ static int acpi_ec_transaction(struct ac + { + int status; + u32 glk; +- + if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata)) + return -EINVAL; +- + if (rdata) + memset(rdata, 0, rdata_len); +- + mutex_lock(&ec->lock); + if (ec->global_lock) { + status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk); + if (ACPI_FAILURE(status)) { +- mutex_unlock(&ec->lock); +- return -ENODEV; ++ status = -ENODEV; ++ goto unlock; + } + } +- +- status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, 0); +- if (status) { ++ if (!wait_event_timeout(ec->wait, ec_check_ibf0(ec), ++ msecs_to_jiffies(ACPI_EC_DELAY))) { + pr_err(PREFIX "input buffer is not empty, " + "aborting transaction\n"); ++ status = -ETIME; + goto end; + } +- + status = acpi_ec_transaction_unlocked(ec, command, + wdata, wdata_len, + rdata, rdata_len, + force_poll); +- +- end: +- ++end: + if (ec->global_lock) + acpi_release_global_lock(glk); ++unlock: + mutex_unlock(&ec->lock); +- + return status; + } + +@@ -332,7 +350,9 @@ int acpi_ec_burst_enable(struct acpi_ec + + int acpi_ec_burst_disable(struct acpi_ec *ec) + { +- return acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE, NULL, 0, NULL, 0, 0); ++ return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ? ++ acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE, ++ NULL, 0, NULL, 0, 0) : 0; + } + + static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data) +@@ -513,46 +533,26 @@ static void acpi_ec_gpe_query(void *ec_c + + static u32 acpi_ec_gpe_handler(void *data) + { +- acpi_status status = AE_OK; + struct acpi_ec *ec = data; +- u8 state = acpi_ec_read_status(ec); ++ u8 status; + + pr_debug(PREFIX "~~~> interrupt\n"); +- atomic_inc(&ec->irq_count); +- if (atomic_read(&ec->irq_count) > 5) { +- pr_err(PREFIX "GPE storm detected, disabling EC GPE\n"); +- ec_switch_to_poll_mode(ec); +- goto end; +- } +- clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags); +- if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags)) ++ status = acpi_ec_read_status(ec); ++ ++ gpe_transaction(ec, status); ++ if (ec_transaction_done(ec) && (status & ACPI_EC_FLAG_IBF) == 0) + wake_up(&ec->wait); + +- if (state & ACPI_EC_FLAG_SCI) { +- if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags)) +- status = acpi_os_execute(OSL_EC_BURST_HANDLER, +- acpi_ec_gpe_query, ec); +- } else if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) && +- !test_bit(EC_FLAGS_NO_GPE, &ec->flags) && +- in_interrupt()) { ++ ec_check_sci(ec, status); ++ if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) && ++ !test_bit(EC_FLAGS_NO_GPE, &ec->flags)) { + /* this is non-query, must be confirmation */ + if (printk_ratelimit()) + pr_info(PREFIX "non-query interrupt received," + " switching to interrupt mode\n"); + set_bit(EC_FLAGS_GPE_MODE, &ec->flags); +- clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags); + } +-end: +- ec_schedule_ec_poll(ec); +- return ACPI_SUCCESS(status) ? +- ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED; +-} +- +-static void do_ec_poll(struct work_struct *work) +-{ +- struct acpi_ec *ec = container_of(work, struct acpi_ec, work.work); +- atomic_set(&ec->irq_count, 0); +- (void)acpi_ec_gpe_handler(ec); ++ return ACPI_INTERRUPT_HANDLED; + } + + /* -------------------------------------------------------------------------- +@@ -696,8 +696,7 @@ static struct acpi_ec *make_acpi_ec(void + mutex_init(&ec->lock); + init_waitqueue_head(&ec->wait); + INIT_LIST_HEAD(&ec->list); +- INIT_DELAYED_WORK_DEFERRABLE(&ec->work, do_ec_poll); +- atomic_set(&ec->irq_count, 0); ++ spin_lock_init(&ec->t_lock); + return ec; + } + +@@ -736,22 +735,15 @@ ec_parse_device(acpi_handle handle, u32 + return AE_CTRL_TERMINATE; + } + +-static void ec_poll_stop(struct acpi_ec *ec) +-{ +- clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags); +- cancel_delayed_work(&ec->work); +-} +- + static void ec_remove_handlers(struct acpi_ec *ec) + { +- ec_poll_stop(ec); + if (ACPI_FAILURE(acpi_remove_address_space_handler(ec->handle, + ACPI_ADR_SPACE_EC, &acpi_ec_space_handler))) + pr_err(PREFIX "failed to remove space handler\n"); + if (ACPI_FAILURE(acpi_remove_gpe_handler(NULL, ec->gpe, + &acpi_ec_gpe_handler))) + pr_err(PREFIX "failed to remove gpe handler\n"); +- ec->handlers_installed = 0; ++ clear_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags); + } + + static int acpi_ec_add(struct acpi_device *device) +@@ -846,17 +838,15 @@ ec_parse_io_ports(struct acpi_resource * + static int ec_install_handlers(struct acpi_ec *ec) + { + acpi_status status; +- if (ec->handlers_installed) ++ if (test_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags)) + return 0; + status = acpi_install_gpe_handler(NULL, ec->gpe, +- ACPI_GPE_EDGE_TRIGGERED, +- &acpi_ec_gpe_handler, ec); ++ ACPI_GPE_EDGE_TRIGGERED, ++ &acpi_ec_gpe_handler, ec); + if (ACPI_FAILURE(status)) + return -ENODEV; +- + acpi_set_gpe_type(NULL, ec->gpe, ACPI_GPE_TYPE_RUNTIME); + acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR); +- + status = acpi_install_address_space_handler(ec->handle, + ACPI_ADR_SPACE_EC, + &acpi_ec_space_handler, +@@ -866,7 +856,7 @@ static int ec_install_handlers(struct ac + return -ENODEV; + } + +- ec->handlers_installed = 1; ++ set_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags); + return 0; + } + +@@ -887,7 +877,6 @@ static int acpi_ec_start(struct acpi_dev + + /* EC is fully operational, allow queries */ + clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); +- ec_schedule_ec_poll(ec); + return ret; + } + +@@ -906,7 +895,7 @@ static int acpi_ec_stop(struct acpi_devi + + int __init acpi_boot_ec_enable(void) + { +- if (!boot_ec || boot_ec->handlers_installed) ++ if (!boot_ec || test_bit(EC_FLAGS_HANDLERS_INSTALLED, &boot_ec->flags)) + return 0; + if (!ec_install_handlers(boot_ec)) { + first_ec = boot_ec; + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008 +Message-Id: <20081104232325.708594095@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexey Starikovskiy , + "Rafael J. Wysocki" , + Len Brown +Subject: [patch 48/57] ACPI: EC: Rename some variables +Content-Disposition: inline; filename=acpi-ec-rename-some-variables.patch +Content-Length: 8692 +Lines: 286 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alexey Starikovskiy + +commit 8463200a00fe2aea938b40173198a0983f2929ef upstream +(needed by the next patch) + +No functional changes. + +Signed-off-by: Alexey Starikovskiy +Acked-by: Rafael J. Wysocki +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 118 ++++++++++++++++++++++++++++-------------------------- + 1 file changed, 63 insertions(+), 55 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -95,10 +95,11 @@ struct acpi_ec_query_handler { + u8 query_bit; + }; + +-struct transaction_data { ++struct transaction { + const u8 *wdata; + u8 *rdata; + unsigned short irq_count; ++ u8 command; + u8 wlen; + u8 rlen; + }; +@@ -113,8 +114,8 @@ static struct acpi_ec { + struct mutex lock; + wait_queue_head_t wait; + struct list_head list; +- struct transaction_data *t; +- spinlock_t t_lock; ++ struct transaction *curr; ++ spinlock_t curr_lock; + } *boot_ec, *first_ec; + + /* +@@ -176,37 +177,37 @@ static int ec_transaction_done(struct ac + { + unsigned long flags; + int ret = 0; +- spin_lock_irqsave(&ec->t_lock, flags); +- if (!ec->t || (!ec->t->wlen && !ec->t->rlen)) ++ spin_lock_irqsave(&ec->curr_lock, flags); ++ if (!ec->curr || (!ec->curr->wlen && !ec->curr->rlen)) + ret = 1; +- spin_unlock_irqrestore(&ec->t_lock, flags); ++ spin_unlock_irqrestore(&ec->curr_lock, flags); + return ret; + } + + static void gpe_transaction(struct acpi_ec *ec, u8 status) + { + unsigned long flags; +- spin_lock_irqsave(&ec->t_lock, flags); +- if (!ec->t) ++ spin_lock_irqsave(&ec->curr_lock, flags); ++ if (!ec->curr) + goto unlock; +- if (ec->t->wlen > 0) { ++ if (ec->curr->wlen > 0) { + if ((status & ACPI_EC_FLAG_IBF) == 0) { +- acpi_ec_write_data(ec, *(ec->t->wdata++)); +- --ec->t->wlen; ++ acpi_ec_write_data(ec, *(ec->curr->wdata++)); ++ --ec->curr->wlen; + } else + /* false interrupt, state didn't change */ +- ++ec->t->irq_count; ++ ++ec->curr->irq_count; + +- } else if (ec->t->rlen > 0) { ++ } else if (ec->curr->rlen > 0) { + if ((status & ACPI_EC_FLAG_OBF) == 1) { +- *(ec->t->rdata++) = acpi_ec_read_data(ec); +- --ec->t->rlen; ++ *(ec->curr->rdata++) = acpi_ec_read_data(ec); ++ --ec->curr->rlen; + } else + /* false interrupt, state didn't change */ +- ++ec->t->irq_count; ++ ++ec->curr->irq_count; + } + unlock: +- spin_unlock_irqrestore(&ec->t_lock, flags); ++ spin_unlock_irqrestore(&ec->curr_lock, flags); + } + + static int acpi_ec_wait(struct acpi_ec *ec) +@@ -248,15 +249,11 @@ static int ec_poll(struct acpi_ec *ec) + return -ETIME; + } + +-static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command, +- const u8 * wdata, unsigned wdata_len, +- u8 * rdata, unsigned rdata_len, ++static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, ++ struct transaction *t, + int force_poll) + { + unsigned long tmp; +- struct transaction_data t = {.wdata = wdata, .rdata = rdata, +- .wlen = wdata_len, .rlen = rdata_len, +- .irq_count = 0}; + int ret = 0; + pr_debug(PREFIX "transaction start\n"); + /* disable GPE during transaction if storm is detected */ +@@ -265,29 +262,30 @@ static int acpi_ec_transaction_unlocked( + acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR); + } + /* start transaction */ +- spin_lock_irqsave(&ec->t_lock, tmp); ++ spin_lock_irqsave(&ec->curr_lock, tmp); + /* following two actions should be kept atomic */ +- ec->t = &t; +- acpi_ec_write_cmd(ec, command); +- if (command == ACPI_EC_COMMAND_QUERY) ++ t->irq_count = 0; ++ ec->curr = t; ++ acpi_ec_write_cmd(ec, ec->curr->command); ++ if (ec->curr->command == ACPI_EC_COMMAND_QUERY) + clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); +- spin_unlock_irqrestore(&ec->t_lock, tmp); ++ spin_unlock_irqrestore(&ec->curr_lock, tmp); + /* if we selected poll mode or failed in GPE-mode do a poll loop */ + if (force_poll || + !test_bit(EC_FLAGS_GPE_MODE, &ec->flags) || + acpi_ec_wait(ec)) + ret = ec_poll(ec); + pr_debug(PREFIX "transaction end\n"); +- spin_lock_irqsave(&ec->t_lock, tmp); +- ec->t = NULL; +- spin_unlock_irqrestore(&ec->t_lock, tmp); ++ spin_lock_irqsave(&ec->curr_lock, tmp); ++ ec->curr = NULL; ++ spin_unlock_irqrestore(&ec->curr_lock, tmp); + if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) { + /* check if we received SCI during transaction */ + ec_check_sci(ec, acpi_ec_read_status(ec)); + /* it is safe to enable GPE outside of transaction */ + acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR); + } else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) && +- t.irq_count > ACPI_EC_STORM_THRESHOLD) { ++ t->irq_count > ACPI_EC_STORM_THRESHOLD) { + pr_debug(PREFIX "GPE storm detected\n"); + set_bit(EC_FLAGS_GPE_STORM, &ec->flags); + } +@@ -300,17 +298,15 @@ static int ec_check_ibf0(struct acpi_ec + return (status & ACPI_EC_FLAG_IBF) == 0; + } + +-static int acpi_ec_transaction(struct acpi_ec *ec, u8 command, +- const u8 * wdata, unsigned wdata_len, +- u8 * rdata, unsigned rdata_len, ++static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t, + int force_poll) + { + int status; + u32 glk; +- if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata)) ++ if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata)) + return -EINVAL; +- if (rdata) +- memset(rdata, 0, rdata_len); ++ if (t->rdata) ++ memset(t->rdata, 0, t->rlen); + mutex_lock(&ec->lock); + if (ec->global_lock) { + status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk); +@@ -326,10 +322,7 @@ static int acpi_ec_transaction(struct ac + status = -ETIME; + goto end; + } +- status = acpi_ec_transaction_unlocked(ec, command, +- wdata, wdata_len, +- rdata, rdata_len, +- force_poll); ++ status = acpi_ec_transaction_unlocked(ec, t, force_poll); + end: + if (ec->global_lock) + acpi_release_global_lock(glk); +@@ -345,23 +338,32 @@ unlock: + int acpi_ec_burst_enable(struct acpi_ec *ec) + { + u8 d; +- return acpi_ec_transaction(ec, ACPI_EC_BURST_ENABLE, NULL, 0, &d, 1, 0); ++ struct transaction t = {.command = ACPI_EC_BURST_ENABLE, ++ .wdata = NULL, .rdata = &d, ++ .wlen = 0, .rlen = 1}; ++ ++ return acpi_ec_transaction(ec, &t, 0); + } + + int acpi_ec_burst_disable(struct acpi_ec *ec) + { ++ struct transaction t = {.command = ACPI_EC_BURST_DISABLE, ++ .wdata = NULL, .rdata = NULL, ++ .wlen = 0, .rlen = 0}; ++ + return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ? +- acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE, +- NULL, 0, NULL, 0, 0) : 0; ++ acpi_ec_transaction(ec, &t, 0) : 0; + } + + static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data) + { + int result; + u8 d; ++ struct transaction t = {.command = ACPI_EC_COMMAND_READ, ++ .wdata = &address, .rdata = &d, ++ .wlen = 1, .rlen = 1}; + +- result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_READ, +- &address, 1, &d, 1, 0); ++ result = acpi_ec_transaction(ec, &t, 0); + *data = d; + return result; + } +@@ -369,8 +371,11 @@ static int acpi_ec_read(struct acpi_ec * + static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data) + { + u8 wdata[2] = { address, data }; +- return acpi_ec_transaction(ec, ACPI_EC_COMMAND_WRITE, +- wdata, 2, NULL, 0, 0); ++ struct transaction t = {.command = ACPI_EC_COMMAND_WRITE, ++ .wdata = wdata, .rdata = NULL, ++ .wlen = 2, .rlen = 0}; ++ ++ return acpi_ec_transaction(ec, &t, 0); + } + + /* +@@ -432,12 +437,13 @@ int ec_transaction(u8 command, + u8 * rdata, unsigned rdata_len, + int force_poll) + { ++ struct transaction t = {.command = command, ++ .wdata = wdata, .rdata = rdata, ++ .wlen = wdata_len, .rlen = rdata_len}; + if (!first_ec) + return -ENODEV; + +- return acpi_ec_transaction(first_ec, command, wdata, +- wdata_len, rdata, rdata_len, +- force_poll); ++ return acpi_ec_transaction(first_ec, &t, force_poll); + } + + EXPORT_SYMBOL(ec_transaction); +@@ -446,7 +452,9 @@ static int acpi_ec_query(struct acpi_ec + { + int result; + u8 d; +- ++ struct transaction t = {.command = ACPI_EC_COMMAND_QUERY, ++ .wdata = NULL, .rdata = &d, ++ .wlen = 0, .rlen = 1}; + if (!ec || !data) + return -EINVAL; + +@@ -456,7 +464,7 @@ static int acpi_ec_query(struct acpi_ec + * bit to be cleared (and thus clearing the interrupt source). + */ + +- result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_QUERY, NULL, 0, &d, 1, 0); ++ result = acpi_ec_transaction(ec, &t, 0); + if (result) + return result; + +@@ -696,7 +704,7 @@ static struct acpi_ec *make_acpi_ec(void + mutex_init(&ec->lock); + init_waitqueue_head(&ec->wait); + INIT_LIST_HEAD(&ec->list); +- spin_lock_init(&ec->t_lock); ++ spin_lock_init(&ec->curr_lock); + return ec; + } + + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008 +Message-Id: <20081104232325.819662055@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexey Starikovskiy , + Len Brown +Subject: [patch 49/57] ACPI: EC: Check for IBF=0 periodically if not in GPE mode +Content-Disposition: inline; filename=acpi-ec-check-for-ibf-0-periodically-if-not-in-gpe-mode.patch +Content-Length: 1532 +Lines: 46 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alexey Starikovskiy + +commit c0ff17720ec5f42205b3d2ca03a18da0a8272976 upstream. + +Signed-off-by: Alexey Starikovskiy +Tested-by: Alan Jenkins +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -298,6 +298,18 @@ static int ec_check_ibf0(struct acpi_ec + return (status & ACPI_EC_FLAG_IBF) == 0; + } + ++static int ec_wait_ibf0(struct acpi_ec *ec) ++{ ++ unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY); ++ /* interrupt wait manually if GPE mode is not active */ ++ unsigned long timeout = test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ? ++ msecs_to_jiffies(ACPI_EC_DELAY) : msecs_to_jiffies(1); ++ while (time_before(jiffies, delay)) ++ if (wait_event_timeout(ec->wait, ec_check_ibf0(ec), timeout)) ++ return 0; ++ return -ETIME; ++} ++ + static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t, + int force_poll) + { +@@ -315,8 +327,7 @@ static int acpi_ec_transaction(struct ac + goto unlock; + } + } +- if (!wait_event_timeout(ec->wait, ec_check_ibf0(ec), +- msecs_to_jiffies(ACPI_EC_DELAY))) { ++ if (ec_wait_ibf0(ec)) { + pr_err(PREFIX "input buffer is not empty, " + "aborting transaction\n"); + status = -ETIME; + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008 +Message-Id: <20081104232325.968509404@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox , + Ondrej Zary , + Jeff Garzik +Subject: [patch 50/57] libata: Fix LBA48 on pata_it821x RAID volumes. +Content-Disposition: inline; filename=libata-fix-lba48-on-pata_it821x-raid-volumes.patch +Content-Length: 1183 +Lines: 35 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ondrej Zary + +Subject: [patch 50/57] libata: Fix LBA48 on pata_it821x RAID volumes. + +commit 054e5f616b5becdc096b793407dc33fe379749ac upstream + +libata: Fix LBA48 on pata_it821x RAID volumes. + +[http://lkml.org/lkml/2008/10/18/82] + +Signed-off-by: Ondrej Zary +Acked-by: Alan Cox +Signed-off-by: Jeff Garzik +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_it821x.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/ata/pata_it821x.c ++++ b/drivers/ata/pata_it821x.c +@@ -557,9 +557,8 @@ static unsigned int it821x_read_id(struc + if (strstr(model_num, "Integrated Technology Express")) { + /* Set feature bits the firmware neglects */ + id[49] |= 0x0300; /* LBA, DMA */ +- id[82] |= 0x0400; /* LBA48 */ + id[83] &= 0x7FFF; +- id[83] |= 0x4000; /* Word 83 is valid */ ++ id[83] |= 0x4400; /* Word 83 is valid and LBA48 */ + id[86] |= 0x0400; /* LBA48 on */ + id[ATA_ID_MAJOR_VER] |= 0x1F; + } + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008 +Message-Id: <20081104232326.140638815@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Len Brown , + Zhao Yakui +Subject: [patch 51/57] ACPI: Ingore the RESET_REG_SUP bit when using ACPI reset mechanism +Content-Disposition: inline; filename=acpi-ingore-the-reset_reg_sup-bit-when-using-acpi-reset-mechanism.patch +Content-Length: 2707 +Lines: 75 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zhao Yakui + +Subject: [patch 51/57] ACPI: Ingore the RESET_REG_SUP bit when using ACPI reset mechanism + +commit 8fd145917fb62368a9b80db59562c20576238f5a upstream + +ACPI: Ingore the RESET_REG_SUP bit when using ACPI reset mechanism + +According to ACPI 3.0, FADT.flags.RESET_REG_SUP indicates +whether the ACPI reboot mechanism is supported. + +However, some boxes have this bit clear, have a valid +ACPI_RESET_REG & RESET_VALUE, and ACPI reboot is the only +mechanism that works for them after S3. + +This suggests that other operating systems may not be checking +the RESET_REG_SUP bit, and are using other means to decide +whether to use the ACPI reboot mechanism or not. + +Here we stop checking RESET_REG_SUP. +Instead, When acpi reboot is requested, +only the reset_register is checked. If the following +conditions are met, it indicates that the reset register is supported. + a. reset_register is not zero + b. the access width is eight + c. the bit_offset is zero + +http://bugzilla.kernel.org/show_bug.cgi?id=7299 +http://bugzilla.kernel.org/show_bug.cgi?id=1148 + +Signed-off-by: Zhao Yakui +Signed-off-by: Len Brown +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/reboot.c | 25 ++++++++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/reboot.c ++++ b/drivers/acpi/reboot.c +@@ -15,9 +15,28 @@ void acpi_reboot(void) + + rr = &acpi_gbl_FADT.reset_register; + +- /* Is the reset register supported? */ +- if (!(acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER) || +- rr->bit_width != 8 || rr->bit_offset != 0) ++ /* ++ * Is the ACPI reset register supported? ++ * ++ * According to ACPI 3.0, FADT.flags.RESET_REG_SUP indicates ++ * whether the ACPI reset mechanism is supported. ++ * ++ * However, some boxes have this bit clear, yet a valid ++ * ACPI_RESET_REG & RESET_VALUE, and ACPI reboot is the only ++ * mechanism that works for them after S3. ++ * ++ * This suggests that other operating systems may not be checking ++ * the RESET_REG_SUP bit, and are using other means to decide ++ * whether to use the ACPI reboot mechanism or not. ++ * ++ * So when acpi reboot is requested, ++ * only the reset_register is checked. If the following ++ * conditions are met, it indicates that the reset register is supported. ++ * a. reset_register is not zero ++ * b. the access width is eight ++ * c. the bit_offset is zero ++ */ ++ if (!(rr->address) || rr->bit_width != 8 || rr->bit_offset != 0) + return; + + reset_value = acpi_gbl_FADT.reset_value; + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008 +Message-Id: <20081104232326.314265769@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Len Brown , + Matthew Garrett , + Andi Kleen +Subject: [patch 52/57] ACPI: Clear WAK_STS on resume +Content-Disposition: inline; filename=acpi-clear-wak_sts-on-resume.patch +Content-Length: 1585 +Lines: 47 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Matthew Garrett + +Subject: [patch 52/57] ACPI: Clear WAK_STS on resume + +commit a68823ee5285e65b51ceb96f8b13a5b4f99a6888 upstream. + +ACPI: Clear WAK_STS on resume + +The leading other brand OS appears to clear the WAK_STS flag on resume. +When rebooted, certain BIOSes assume that the system is actually +resuming if it's still set and so fail to reboot correctly. Make sure +that it's cleared at resume time. + +Comment clarified as suggested by Bob Moore + +http://bugzilla.kernel.org/show_bug.cgi?id=11634 + +Signed-off-by: Matthew Garrett +Signed-off-by: Andi Kleen +Tested-by: Christian Borntraeger +Tested-by: Romano Giannetti +Signed-off-by: Len Brown +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/hardware/hwsleep.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/acpi/hardware/hwsleep.c ++++ b/drivers/acpi/hardware/hwsleep.c +@@ -612,6 +612,13 @@ acpi_status acpi_leave_sleep_state(u8 sl + } + /* TBD: _WAK "sometimes" returns stuff - do we want to look at it? */ + ++ /* ++ * Some BIOSes assume that WAK_STS will be cleared on resume and use ++ * it to determine whether the system is rebooting or resuming. Clear ++ * it for compatibility. ++ */ ++ acpi_set_register(ACPI_BITREG_WAKE_STATUS, 1); ++ + acpi_gbl_system_awake_and_running = TRUE; + + /* Enable power button */ + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008 +Message-Id: <20081104232326.481451483@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dmitry Torokhov , + Matthew Garrett +Subject: [patch 53/57] Input: atkbd - expand Latitudes force release quirk to other Dells +Content-Disposition: inline; filename=input-atkbd-expand-latitude-s-force-release-quirk-to-other-dells.patch +Content-Length: 1887 +Lines: 55 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Matthew Garrett + +commit 61579ba83934d397a4fa2bb7372de9ae112587d5 upstream. + +Input: atkbd - expand Latitude's force release quirk to other Dells + +Dell laptops fail to send key up events for several of their special +keys. There's an existing quirk in the kernel to handle this, but it's +limited to the Latitude range. This patch extends it to cover all +portable Dells. + +Signed-off-by: Matthew Garrett +Signed-off-by: Dmitry Torokhov +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/atkbd.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -834,10 +834,10 @@ static void atkbd_disconnect(struct seri + } + + /* +- * Most special keys (Fn+F?) on Dell Latitudes do not generate release ++ * Most special keys (Fn+F?) on Dell laptops do not generate release + * events so we have to do it ourselves. + */ +-static void atkbd_latitude_keymap_fixup(struct atkbd *atkbd) ++static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd) + { + const unsigned int forced_release_keys[] = { + 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93, +@@ -1461,13 +1461,13 @@ static int __init atkbd_setup_fixup(cons + + static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = { + { +- .ident = "Dell Latitude series", ++ .ident = "Dell Laptop", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "Latitude"), ++ DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */ + }, + .callback = atkbd_setup_fixup, +- .driver_data = atkbd_latitude_keymap_fixup, ++ .driver_data = atkbd_dell_laptop_keymap_fixup, + }, + { + .ident = "HP 2133", + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008 +Message-Id: <20081104232326.652815710@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sesterhenn , + Roman Zippel +Subject: [patch 54/57] hfsplus: fix Buffer overflow with a corrupted image +Content-Disposition: inline; filename=hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch +Content-Length: 6366 +Lines: 122 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Sesterhenn + +commit efc7ffcb4237f8cb9938909041c4ed38f6e1bf40 upstream + +When an hfsplus image gets corrupted it might happen that the catalog +namelength field gets b0rked. If we mount such an image the memcpy() in +hfsplus_cat_build_key_uni() writes more than the 255 that fit in the name +field. Depending on the size of the overwritten data, we either only get +memory corruption or also trigger an oops like this: + +[ 221.628020] BUG: unable to handle kernel paging request at c82b0000 +[ 221.629066] IP: [] hfsplus_find_cat+0x10d/0x151 +[ 221.629066] *pde = 0ea29163 *pte = 082b0160 +[ 221.629066] Oops: 0002 [#1] PREEMPT DEBUG_PAGEALLOC +[ 221.629066] Modules linked in: +[ 221.629066] +[ 221.629066] Pid: 4845, comm: mount Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #28) +[ 221.629066] EIP: 0060:[] EFLAGS: 00010206 CPU: 0 +[ 221.629066] EIP is at hfsplus_find_cat+0x10d/0x151 +[ 221.629066] EAX: 00000029 EBX: 00016210 ECX: 000042c2 EDX: 00000002 +[ 221.629066] ESI: c82d70ca EDI: c82b0000 EBP: c82d1bcc ESP: c82d199c +[ 221.629066] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 +[ 221.629066] Process mount (pid: 4845, ti=c82d1000 task=c8224060 task.ti=c82d1000) +[ 221.629066] Stack: c080b3c4 c82aa8f8 c82d19c2 00016210 c080b3be c82d1bd4 c82aa8f0 00000300 +[ 221.629066] 01000000 750008b1 74006e00 74006900 65006c00 c82d6400 c013bd35 c8224060 +[ 221.629066] 00000036 00000046 c82d19f0 00000082 c8224548 c8224060 00000036 c0d653cc +[ 221.629066] Call Trace: +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? native_sched_clock+0x82/0x96 +[ 221.629066] [] ? __kernel_text_address+0x1b/0x27 +[ 221.629066] [] ? dump_trace+0xca/0xd6 +[ 221.629066] [] ? save_stack_address+0x0/0x2c +[ 221.629066] [] ? save_stack_trace+0x1c/0x3a +[ 221.629066] [] ? save_trace+0x37/0x8d +[ 221.629066] [] ? add_lock_to_list+0x67/0x8d +[ 221.629066] [] ? validate_chain+0x8a4/0x9f4 +[ 221.629066] [] ? down+0xc/0x2f +[ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? native_sched_clock+0x82/0x96 +[ 221.629066] [] ? mark_held_locks+0x43/0x5a +[ 221.629066] [] ? trace_hardirqs_on+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_on_caller+0xf4/0x12f +[ 221.629066] [] ? _spin_unlock_irqrestore+0x42/0x58 +[ 221.629066] [] ? down+0x2b/0x2f +[ 221.629066] [] ? hfsplus_iget+0xa0/0x154 +[ 221.629066] [] ? hfsplus_fill_super+0x280/0x447 +[ 221.629066] [] ? native_sched_clock+0x82/0x96 +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 +[ 221.629066] [] ? string+0x2b/0x74 +[ 221.629066] [] ? vsnprintf+0x2e9/0x512 +[ 221.629066] [] ? dump_trace+0xca/0xd6 +[ 221.629066] [] ? save_stack_trace+0x1c/0x3a +[ 221.629066] [] ? save_stack_trace+0x1c/0x3a +[ 221.629066] [] ? save_trace+0x37/0x8d +[ 221.629066] [] ? add_lock_to_list+0x67/0x8d +[ 221.629066] [] ? validate_chain+0x8a4/0x9f4 +[ 221.629066] [] ? up+0xc/0x2f +[ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? native_sched_clock+0x82/0x96 +[ 221.629066] [] ? snprintf+0x1b/0x1d +[ 221.629066] [] ? disk_name+0x25/0x67 +[ 221.629066] [] ? get_sb_bdev+0xcd/0x10b +[ 221.629066] [] ? kstrdup+0x2a/0x4c +[ 221.629066] [] ? hfsplus_get_sb+0x13/0x15 +[ 221.629066] [] ? hfsplus_fill_super+0x0/0x447 +[ 221.629066] [] ? vfs_kern_mount+0x3b/0x76 +[ 221.629066] [] ? do_kern_mount+0x32/0xba +[ 221.629066] [] ? do_new_mount+0x46/0x74 +[ 221.629066] [] ? do_mount+0x175/0x193 +[ 221.629066] [] ? trace_hardirqs_on_caller+0xf4/0x12f +[ 221.629066] [] ? __get_free_pages+0x1e/0x24 +[ 221.629066] [] ? lock_kernel+0x19/0x8c +[ 221.629066] [] ? sys_mount+0x51/0x9b +[ 221.629066] [] ? sys_mount+0x64/0x9b +[ 221.629066] [] ? sysenter_do_call+0x12/0x31 +[ 221.629066] ======================= +[ 221.629066] Code: 89 c2 c1 e2 08 c1 e8 08 09 c2 8b 85 e8 fd ff ff 66 89 50 06 89 c7 53 83 c7 08 56 57 68 c4 b3 80 c0 e8 8c 5c ef ff 89 d9 c1 e9 02 a5 89 d9 83 e1 03 74 02 f3 a4 83 c3 06 8b 95 e8 fd ff ff 0f +[ 221.629066] EIP: [] hfsplus_find_cat+0x10d/0x151 SS:ESP 0068:c82d199c +[ 221.629066] ---[ end trace e417a1d67f0d0066 ]--- + +Since hfsplus_cat_build_key_uni() returns void and only has one callsite, +the check is performed at the callsite. + +Signed-off-by: Eric Sesterhenn +Reviewed-by: Pekka Enberg +Cc: Roman Zippel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfsplus/catalog.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/hfsplus/catalog.c ++++ b/fs/hfsplus/catalog.c +@@ -168,6 +168,11 @@ int hfsplus_find_cat(struct super_block + return -EIO; + } + ++ if (be16_to_cpu(tmp.thread.nodeName.length) > 255) { ++ printk(KERN_ERR "hfs: catalog name length corrupted\n"); ++ return -EIO; ++ } ++ + hfsplus_cat_build_key_uni(fd->search_key, be32_to_cpu(tmp.thread.parentID), + &tmp.thread.nodeName); + return hfs_brec_find(fd); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008 +Message-Id: <20081104232326.823379916@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sesterhenn , + Roman Zippel +Subject: [patch 55/57] hfsplus: check read_mapping_page() return value +Content-Disposition: inline; filename=hfsplus-check-read_mapping_page-return-value.patch +Content-Length: 4690 +Lines: 103 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Sesterhenn + +While testing more corrupted images with hfsplus, i came across +one which triggered the following bug: + +[15840.675016] BUG: unable to handle kernel paging request at fffffffb +[15840.675016] IP: [] kmap+0x15/0x56 +[15840.675016] *pde = 00008067 *pte = 00000000 +[15840.675016] Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC +[15840.675016] Modules linked in: +[15840.675016] +[15840.675016] Pid: 11575, comm: ln Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #29) +[15840.675016] EIP: 0060:[] EFLAGS: 00010202 CPU: 0 +[15840.675016] EIP is at kmap+0x15/0x56 +[15840.675016] EAX: 00000246 EBX: fffffffb ECX: 00000000 EDX: cab919c0 +[15840.675016] ESI: 000007dd EDI: cab0bcf4 EBP: cab0bc98 ESP: cab0bc94 +[15840.675016] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 +[15840.675016] Process ln (pid: 11575, ti=cab0b000 task=cab919c0 task.ti=cab0b000) +[15840.675016] Stack: 00000000 cab0bcdc c0231cfb 00000000 cab0bce0 00000800 ca9290c0 fffffffb +[15840.675016] cab145d0 cab919c0 cab15998 22222222 22222222 22222222 00000001 cab15960 +[15840.675016] 000007dd cab0bcf4 cab0bd04 c022cb3a cab0bcf4 cab15a6c ca9290c0 00000000 +[15840.675016] Call Trace: +[15840.675016] [] ? hfsplus_block_allocate+0x6f/0x2d3 +[15840.675016] [] ? hfsplus_file_extend+0xc4/0x1db +[15840.675016] [] ? hfsplus_get_block+0x8c/0x19d +[15840.675016] [] ? sub_preempt_count+0x9d/0xab +[15840.675016] [] ? __block_prepare_write+0x147/0x311 +[15840.675016] [] ? __grab_cache_page+0x52/0x73 +[15840.675016] [] ? block_write_begin+0x79/0xd5 +[15840.675016] [] ? hfsplus_get_block+0x0/0x19d +[15840.675016] [] ? cont_write_begin+0x27f/0x2af +[15840.675016] [] ? hfsplus_get_block+0x0/0x19d +[15840.675016] [] ? tick_program_event+0x28/0x4c +[15840.675016] [] ? trace_hardirqs_off+0xb/0xd +[15840.675016] [] ? hfsplus_write_begin+0x2d/0x32 +[15840.675016] [] ? hfsplus_get_block+0x0/0x19d +[15840.675016] [] ? pagecache_write_begin+0x33/0x107 +[15840.675016] [] ? __page_symlink+0x3c/0xae +[15840.675016] [] ? __mark_inode_dirty+0x12f/0x137 +[15840.675016] [] ? page_symlink+0x19/0x1e +[15840.675016] [] ? hfsplus_symlink+0x41/0xa6 +[15840.675016] [] ? vfs_symlink+0x99/0x101 +[15840.675016] [] ? sys_symlinkat+0x6b/0xad +[15840.675016] [] ? sys_symlink+0x10/0x12 +[15840.675016] [] ? sysenter_do_call+0x12/0x31 +[15840.675016] ======================= +[15840.675016] Code: 00 00 75 10 83 3d 88 2f ec c0 02 75 07 89 d0 e8 12 56 05 00 5d c3 55 ba 06 00 00 00 89 e5 53 89 c3 b8 3d eb 7e c0 e8 16 74 00 00 <8b> 03 c1 e8 1e 69 c0 d8 02 00 00 05 b8 69 8e c0 2b 80 c4 02 00 +[15840.675016] EIP: [] kmap+0x15/0x56 SS:ESP 0068:cab0bc94 +[15840.675016] ---[ end trace 4fea40dad6b70e5f ]--- + +This happens because the return value of read_mapping_page() is passed on +to kmap unchecked. The bug is triggered after the first +read_mapping_page() in hfsplus_block_allocate(), this patch fixes all +three usages in this functions but leaves the ones further down in the +file unchanged. + +Signed-off-by: Eric Sesterhenn +Cc: Roman Zippel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfsplus/bitmap.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/fs/hfsplus/bitmap.c ++++ b/fs/hfsplus/bitmap.c +@@ -32,6 +32,10 @@ int hfsplus_block_allocate(struct super_ + mutex_lock(&HFSPLUS_SB(sb).alloc_file->i_mutex); + mapping = HFSPLUS_SB(sb).alloc_file->i_mapping; + page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, NULL); ++ if (IS_ERR(page)) { ++ start = size; ++ goto out; ++ } + pptr = kmap(page); + curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32; + i = offset % 32; +@@ -73,6 +77,10 @@ int hfsplus_block_allocate(struct super_ + break; + page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, + NULL); ++ if (IS_ERR(page)) { ++ start = size; ++ goto out; ++ } + curr = pptr = kmap(page); + if ((size ^ offset) / PAGE_CACHE_BITS) + end = pptr + PAGE_CACHE_BITS / 32; +@@ -120,6 +128,10 @@ found: + offset += PAGE_CACHE_BITS; + page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, + NULL); ++ if (IS_ERR(page)) { ++ start = size; ++ goto out; ++ } + pptr = kmap(page); + curr = pptr; + end = pptr + PAGE_CACHE_BITS / 32; + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:27 2008 +Message-Id: <20081104232326.998473618@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andy Gospodarek , + Jay Vosburgh , + Jeff Garzik +Subject: [patch 56/57] bonding: fix panic when taking bond interface down before removing module +Content-Disposition: inline; filename=bonding-fix-panic-when-taking-bond-interface-down-before-removing-module.patch +Content-Length: 2575 +Lines: 69 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andy Gospodarek + +commit ce39a800ea87c655de49af021c8b20ee323cb40d upstream. + +A panic was discovered with bonding when using mode 5 or 6 and trying to +remove the slaves from the bond after the interface was taken down. +When calling 'ifconfig bond0 down' the following happens: + + bond_close() + bond_alb_deinitialize() + tlb_deinitialize() + kfree(bond_info->tx_hashtbl) + bond_info->tx_hashtbl = NULL + +Unfortunately if there are still slaves in the bond, when removing the +module the following happens: + + bonding_exit() + bond_free_all() + bond_release_all() + bond_alb_deinit_slave() + tlb_clear_slave() + tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl + u32 next_index = tx_hash_table[index].next + +As you might guess we panic when trying to access a few entries into the +table that no longer exists. + +I experimented with several options (like moving the calls to +tlb_deinitialize somewhere else), but it really makes the most sense to +be part of the bond_close routine. It also didn't seem logical move +tlb_clear_slave around too much, so the simplest option seems to add a +check in tlb_clear_slave to make sure we haven't already wiped the +tx_hashtbl away before searching for all the non-existent hash-table +entries that used to point to the slave as the output interface. + +Signed-off-by: Andy Gospodarek +Signed-off-by: Jay Vosburgh +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bonding/bond_alb.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/net/bonding/bond_alb.c ++++ b/drivers/net/bonding/bond_alb.c +@@ -167,11 +167,14 @@ static void tlb_clear_slave(struct bondi + /* clear slave from tx_hashtbl */ + tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl; + +- index = SLAVE_TLB_INFO(slave).head; +- while (index != TLB_NULL_INDEX) { +- u32 next_index = tx_hash_table[index].next; +- tlb_init_table_entry(&tx_hash_table[index], save_load); +- index = next_index; ++ /* skip this if we've already freed the tx hash table */ ++ if (tx_hash_table) { ++ index = SLAVE_TLB_INFO(slave).head; ++ while (index != TLB_NULL_INDEX) { ++ u32 next_index = tx_hash_table[index].next; ++ tlb_init_table_entry(&tx_hash_table[index], save_load); ++ index = next_index; ++ } + } + + tlb_init_slave(slave); + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:27 2008 +Message-Id: <20081104232327.167153494@mini.kroah.org> +References: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:22:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Serge Hallyn , + David Howells , + "Andrew G. Morgan" +Subject: [patch 57/57] file caps: always start with clear bprm->caps_* +Content-Disposition: inline; filename=file-caps-always-start-with-clear-bprm-caps_.patch +Content-Length: 1400 +Lines: 41 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Serge Hallyn + +commit 3318a386e4ca68c76e0294363d29bdc46fcad670 upstream + +While Linux doesn't honor setuid on scripts. However, it mistakenly +behaves differently for file capabilities. + +This patch fixes that behavior by making sure that get_file_caps() +begins with empty bprm->caps_*. That way when a script is loaded, +its bprm->caps_* may be filled when binfmt_misc calls prepare_binprm(), +but they will be cleared again when binfmt_elf calls prepare_binprm() +next to read the interpreter's file capabilities. + +Signed-off-by: Serge Hallyn +Acked-by: David Howells +Acked-by: Andrew G. Morgan +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + security/commoncap.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -279,10 +279,10 @@ static int get_file_caps(struct linux_bi + struct vfs_cap_data vcaps; + struct inode *inode; + +- if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) { +- bprm_clear_caps(bprm); ++ bprm_clear_caps(bprm); ++ ++ if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) + return 0; +- } + + dentry = dget(bprm->file->f_dentry); + inode = dentry->d_inode; + +-- + +From gregkh@mini.kroah.org Tue Nov 4 15:23:17 2008 +Message-Id: <20081104232144.186593464@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 04 Nov 2008 15:21:44 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/57] 2.6.27-stable review +Status: RO +Content-Length: 4250 +Lines: 81 + +This is the start of the stable review cycle for the 2.6.27.5 release. +There are 57 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Thursday, November 6, 23:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.5-rc1.gz +and the diffstat can be found below. + +thanks, + +greg k-h + +------------- + + Documentation/i2c/busses/i2c-sis96x | 2 + MAINTAINERS | 20 - + Makefile | 2 + arch/powerpc/configs/linkstation_defconfig | 7 + arch/powerpc/mm/hash_utils_64.c | 6 + arch/powerpc/mm/numa.c | 113 +++++- + arch/powerpc/platforms/embedded6xx/linkstation.c | 14 + arch/s390/kernel/smp.c | 24 - + arch/sparc64/kernel/trampoline.S | 18 - + arch/x86/kernel/process_64.c | 4 + arch/x86/kernel/rtc.c | 22 + + arch/x86/mm/pat.c | 4 + drivers/acpi/button.c | 3 + drivers/acpi/ec.c | 374 +++++++++++------------ + drivers/acpi/hardware/hwsleep.c | 7 + drivers/acpi/reboot.c | 25 + + drivers/ata/libata-core.c | 2 + drivers/ata/pata_it821x.c | 3 + drivers/ata/sata_nv.c | 53 +-- + drivers/ata/sata_promise.c | 20 + + drivers/base/sys.c | 6 + drivers/char/agp/intel-agp.c | 12 + drivers/char/ipmi/ipmi_devintf.c | 1 + drivers/firewire/fw-cdev.c | 6 + drivers/firewire/fw-sbp2.c | 38 +- + drivers/firewire/fw-topology.c | 6 + drivers/firewire/fw-transaction.h | 2 + drivers/hid/usbhid/hid-quirks.c | 4 + drivers/i2c/busses/scx200_i2c.c | 1 + drivers/input/keyboard/atkbd.c | 10 + drivers/media/dvb/frontends/s5h1411.c | 35 +- + drivers/media/video/pvrusb2/pvrusb2-encoder.c | 4 + drivers/net/atlx/atl1.c | 7 + drivers/net/atlx/atl1.h | 2 + drivers/net/bonding/bond_alb.c | 13 + drivers/net/wireless/libertas/scan.c | 4 + drivers/pci/probe.c | 2 + drivers/rtc/rtc-cmos.c | 33 +- + drivers/scsi/sd.c | 10 + drivers/usb/core/hcd.c | 35 +- + drivers/usb/core/hcd.h | 1 + drivers/usb/core/hub.c | 1 + drivers/usb/core/urb.c | 15 + drivers/usb/storage/unusual_devs.h | 9 + fs/hfsplus/bitmap.c | 12 + fs/hfsplus/catalog.c | 5 + include/math-emu/op-common.h | 17 - + kernel/sched_clock.c | 6 + kernel/sched_features.h | 2 + net/ipv4/tcp_output.c | 33 +- + net/ipv6/tcp_ipv6.c | 2 + net/sched/sch_generic.c | 2 + scripts/package/mkspec | 3 + security/commoncap.c | 6 + sound/core/control.c | 4 + sound/pci/hda/hda_intel.c | 29 + + 56 files changed, 717 insertions(+), 384 deletions(-) + diff --git a/queue-2.6.27/pci-fix-64-vbit-prefetchable-memory-resource-bars.patch b/review-2.6.27/pci-fix-64-vbit-prefetchable-memory-resource-bars.patch similarity index 100% rename from queue-2.6.27/pci-fix-64-vbit-prefetchable-memory-resource-bars.patch rename to review-2.6.27/pci-fix-64-vbit-prefetchable-memory-resource-bars.patch diff --git a/queue-2.6.27/powerpc-don-t-use-a-16g-page-if-beyond-mem-limits.patch b/review-2.6.27/powerpc-don-t-use-a-16g-page-if-beyond-mem-limits.patch similarity index 100% rename from queue-2.6.27/powerpc-don-t-use-a-16g-page-if-beyond-mem-limits.patch rename to review-2.6.27/powerpc-don-t-use-a-16g-page-if-beyond-mem-limits.patch diff --git a/queue-2.6.27/powerpc-fix-i2c-on-ppc-linkstation-kurobox-machines.patch b/review-2.6.27/powerpc-fix-i2c-on-ppc-linkstation-kurobox-machines.patch similarity index 100% rename from queue-2.6.27/powerpc-fix-i2c-on-ppc-linkstation-kurobox-machines.patch rename to review-2.6.27/powerpc-fix-i2c-on-ppc-linkstation-kurobox-machines.patch diff --git a/queue-2.6.27/powerpc-numa-make-memory-reserve-code-more-robust.patch b/review-2.6.27/powerpc-numa-make-memory-reserve-code-more-robust.patch similarity index 100% rename from queue-2.6.27/powerpc-numa-make-memory-reserve-code-more-robust.patch rename to review-2.6.27/powerpc-numa-make-memory-reserve-code-more-robust.patch diff --git a/queue-2.6.27/powerpc-reserve-in-bootmem-lmb-reserved-regions-that-cross-numa-nodes.patch b/review-2.6.27/powerpc-reserve-in-bootmem-lmb-reserved-regions-that-cross-numa-nodes.patch similarity index 100% rename from queue-2.6.27/powerpc-reserve-in-bootmem-lmb-reserved-regions-that-cross-numa-nodes.patch rename to review-2.6.27/powerpc-reserve-in-bootmem-lmb-reserved-regions-that-cross-numa-nodes.patch diff --git a/queue-2.6.27/revert-hid-invert-hwheel-mappings-for-some-logitech-mice.patch b/review-2.6.27/revert-hid-invert-hwheel-mappings-for-some-logitech-mice.patch similarity index 100% rename from queue-2.6.27/revert-hid-invert-hwheel-mappings-for-some-logitech-mice.patch rename to review-2.6.27/revert-hid-invert-hwheel-mappings-for-some-logitech-mice.patch diff --git a/queue-2.6.27/rtc-cmos-look-for-pnp-rtc-first-then-for-platform-rtc.patch b/review-2.6.27/rtc-cmos-look-for-pnp-rtc-first-then-for-platform-rtc.patch similarity index 100% rename from queue-2.6.27/rtc-cmos-look-for-pnp-rtc-first-then-for-platform-rtc.patch rename to review-2.6.27/rtc-cmos-look-for-pnp-rtc-first-then-for-platform-rtc.patch diff --git a/queue-2.6.27/s390-fix-sysdev-class-file-creation.patch b/review-2.6.27/s390-fix-sysdev-class-file-creation.patch similarity index 100% rename from queue-2.6.27/s390-fix-sysdev-class-file-creation.patch rename to review-2.6.27/s390-fix-sysdev-class-file-creation.patch diff --git a/queue-2.6.27/sata_nv-fix-generic-nf2-3-detection-regression.patch b/review-2.6.27/sata_nv-fix-generic-nf2-3-detection-regression.patch similarity index 100% rename from queue-2.6.27/sata_nv-fix-generic-nf2-3-detection-regression.patch rename to review-2.6.27/sata_nv-fix-generic-nf2-3-detection-regression.patch diff --git a/queue-2.6.27/sata_promise-add-ata-engine-reset-to-reset-ops.patch b/review-2.6.27/sata_promise-add-ata-engine-reset-to-reset-ops.patch similarity index 100% rename from queue-2.6.27/sata_promise-add-ata-engine-reset-to-reset-ops.patch rename to review-2.6.27/sata_promise-add-ata-engine-reset-to-reset-ops.patch diff --git a/queue-2.6.27/sched-disable-the-hrtick-for-now.patch b/review-2.6.27/sched-disable-the-hrtick-for-now.patch similarity index 100% rename from queue-2.6.27/sched-disable-the-hrtick-for-now.patch rename to review-2.6.27/sched-disable-the-hrtick-for-now.patch diff --git a/queue-2.6.27/sched_clock-prevent-scd-clock-from-moving-backwards.patch b/review-2.6.27/sched_clock-prevent-scd-clock-from-moving-backwards.patch similarity index 100% rename from queue-2.6.27/sched_clock-prevent-scd-clock-from-moving-backwards.patch rename to review-2.6.27/sched_clock-prevent-scd-clock-from-moving-backwards.patch diff --git a/queue-2.6.27/scsi-sd-fix-handling-of-no_sense-check-condition.patch b/review-2.6.27/scsi-sd-fix-handling-of-no_sense-check-condition.patch similarity index 100% rename from queue-2.6.27/scsi-sd-fix-handling-of-no_sense-check-condition.patch rename to review-2.6.27/scsi-sd-fix-handling-of-no_sense-check-condition.patch diff --git a/queue-2.6.27/scx200_i2c-add-missing-class-parameter.patch b/review-2.6.27/scx200_i2c-add-missing-class-parameter.patch similarity index 100% rename from queue-2.6.27/scx200_i2c-add-missing-class-parameter.patch rename to review-2.6.27/scx200_i2c-add-missing-class-parameter.patch diff --git a/queue-2.6.27/series b/review-2.6.27/series similarity index 100% rename from queue-2.6.27/series rename to review-2.6.27/series diff --git a/queue-2.6.27/sysfs-fix-return-values-for-sysdev_store_-ulong-int.patch b/review-2.6.27/sysfs-fix-return-values-for-sysdev_store_-ulong-int.patch similarity index 100% rename from queue-2.6.27/sysfs-fix-return-values-for-sysdev_store_-ulong-int.patch rename to review-2.6.27/sysfs-fix-return-values-for-sysdev_store_-ulong-int.patch diff --git a/queue-2.6.27/usb-fix-crash-when-urbs-are-unlinked-after-the-device-is-gone.patch b/review-2.6.27/usb-fix-crash-when-urbs-are-unlinked-after-the-device-is-gone.patch similarity index 100% rename from queue-2.6.27/usb-fix-crash-when-urbs-are-unlinked-after-the-device-is-gone.patch rename to review-2.6.27/usb-fix-crash-when-urbs-are-unlinked-after-the-device-is-gone.patch diff --git a/queue-2.6.27/usb-storage-avoid-i-o-errors-when-issuing-scsi-ioctls-to-jmicron-usb-ata-bridge.patch b/review-2.6.27/usb-storage-avoid-i-o-errors-when-issuing-scsi-ioctls-to-jmicron-usb-ata-bridge.patch similarity index 100% rename from queue-2.6.27/usb-storage-avoid-i-o-errors-when-issuing-scsi-ioctls-to-jmicron-usb-ata-bridge.patch rename to review-2.6.27/usb-storage-avoid-i-o-errors-when-issuing-scsi-ioctls-to-jmicron-usb-ata-bridge.patch diff --git a/queue-2.6.27/v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch b/review-2.6.27/v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch similarity index 100% rename from queue-2.6.27/v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch rename to review-2.6.27/v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch diff --git a/queue-2.6.27/x86-avoid-dereferencing-beyond-stack-thread_size.patch b/review-2.6.27/x86-avoid-dereferencing-beyond-stack-thread_size.patch similarity index 100% rename from queue-2.6.27/x86-avoid-dereferencing-beyond-stack-thread_size.patch rename to review-2.6.27/x86-avoid-dereferencing-beyond-stack-thread_size.patch diff --git a/queue-2.6.27/x86-fix-dev-mem-mmap-breakage-when-pat-is-disabled.patch b/review-2.6.27/x86-fix-dev-mem-mmap-breakage-when-pat-is-disabled.patch similarity index 100% rename from queue-2.6.27/x86-fix-dev-mem-mmap-breakage-when-pat-is-disabled.patch rename to review-2.6.27/x86-fix-dev-mem-mmap-breakage-when-pat-is-disabled.patch diff --git a/queue-2.6.27/x86-register-a-platform-rtc-device-if-pnp-doesn-t-describe-it.patch b/review-2.6.27/x86-register-a-platform-rtc-device-if-pnp-doesn-t-describe-it.patch similarity index 100% rename from queue-2.6.27/x86-register-a-platform-rtc-device-if-pnp-doesn-t-describe-it.patch rename to review-2.6.27/x86-register-a-platform-rtc-device-if-pnp-doesn-t-describe-it.patch -- 2.47.3