Contents of /trunk/kernel26-magellan-server/patches-2.6.25-r5/0111-2.6.25.12-all-fixes.patch
Parent Directory | Revision Log
Revision 677 -
(show annotations)
(download)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 45066 byte(s)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 45066 byte(s)
2.6.25-magellan-r5: - updated to linux-2.6.25.17
1 | diff --git a/arch/powerpc/kernel/of_platform.c b/arch/powerpc/kernel/of_platform.c |
2 | index fb698d4..3ae33d4 100644 |
3 | --- a/arch/powerpc/kernel/of_platform.c |
4 | +++ b/arch/powerpc/kernel/of_platform.c |
5 | @@ -76,6 +76,8 @@ struct of_device* of_platform_device_create(struct device_node *np, |
6 | return NULL; |
7 | |
8 | dev->dma_mask = 0xffffffffUL; |
9 | + dev->dev.coherent_dma_mask = DMA_32BIT_MASK; |
10 | + |
11 | dev->dev.bus = &of_platform_bus_type; |
12 | |
13 | /* We do not fill the DMA ops for platform devices by default. |
14 | diff --git a/block/as-iosched.c b/block/as-iosched.c |
15 | index 8c39467..743f33a 100644 |
16 | --- a/block/as-iosched.c |
17 | +++ b/block/as-iosched.c |
18 | @@ -831,6 +831,8 @@ static void as_completed_request(struct request_queue *q, struct request *rq) |
19 | } |
20 | |
21 | if (ad->changed_batch && ad->nr_dispatched == 1) { |
22 | + ad->current_batch_expires = jiffies + |
23 | + ad->batch_expire[ad->batch_data_dir]; |
24 | kblockd_schedule_work(&ad->antic_work); |
25 | ad->changed_batch = 0; |
26 | |
27 | diff --git a/crypto/chainiv.c b/crypto/chainiv.c |
28 | index 6da3f57..9affade 100644 |
29 | --- a/crypto/chainiv.c |
30 | +++ b/crypto/chainiv.c |
31 | @@ -117,6 +117,7 @@ static int chainiv_init(struct crypto_tfm *tfm) |
32 | static int async_chainiv_schedule_work(struct async_chainiv_ctx *ctx) |
33 | { |
34 | int queued; |
35 | + int err = ctx->err; |
36 | |
37 | if (!ctx->queue.qlen) { |
38 | smp_mb__before_clear_bit(); |
39 | @@ -131,7 +132,7 @@ static int async_chainiv_schedule_work(struct async_chainiv_ctx *ctx) |
40 | BUG_ON(!queued); |
41 | |
42 | out: |
43 | - return ctx->err; |
44 | + return err; |
45 | } |
46 | |
47 | static int async_chainiv_postpone_request(struct skcipher_givcrypt_request *req) |
48 | @@ -227,6 +228,7 @@ static void async_chainiv_do_postponed(struct work_struct *work) |
49 | postponed); |
50 | struct skcipher_givcrypt_request *req; |
51 | struct ablkcipher_request *subreq; |
52 | + int err; |
53 | |
54 | /* Only handle one request at a time to avoid hogging keventd. */ |
55 | spin_lock_bh(&ctx->lock); |
56 | @@ -241,7 +243,11 @@ static void async_chainiv_do_postponed(struct work_struct *work) |
57 | subreq = skcipher_givcrypt_reqctx(req); |
58 | subreq->base.flags |= CRYPTO_TFM_REQ_MAY_SLEEP; |
59 | |
60 | - async_chainiv_givencrypt_tail(req); |
61 | + err = async_chainiv_givencrypt_tail(req); |
62 | + |
63 | + local_bh_disable(); |
64 | + skcipher_givcrypt_complete(req, err); |
65 | + local_bh_enable(); |
66 | } |
67 | |
68 | static int async_chainiv_init(struct crypto_tfm *tfm) |
69 | diff --git a/drivers/base/node.c b/drivers/base/node.c |
70 | index e59861f..8bbd21d 100644 |
71 | --- a/drivers/base/node.c |
72 | +++ b/drivers/base/node.c |
73 | @@ -70,8 +70,8 @@ static ssize_t node_read_meminfo(struct sys_device * dev, char * buf) |
74 | nid, K(i.totalram), |
75 | nid, K(i.freeram), |
76 | nid, K(i.totalram - i.freeram), |
77 | - nid, node_page_state(nid, NR_ACTIVE), |
78 | - nid, node_page_state(nid, NR_INACTIVE), |
79 | + nid, K(node_page_state(nid, NR_ACTIVE)), |
80 | + nid, K(node_page_state(nid, NR_INACTIVE)), |
81 | #ifdef CONFIG_HIGHMEM |
82 | nid, K(i.totalhigh), |
83 | nid, K(i.freehigh), |
84 | diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c |
85 | index 41636b8..b75a0d9 100644 |
86 | --- a/drivers/block/cciss.c |
87 | +++ b/drivers/block/cciss.c |
88 | @@ -106,35 +106,34 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_device_id); |
89 | /* board_id = Subsystem Device ID & Vendor ID |
90 | * product = Marketing Name for the board |
91 | * access = Address of the struct of function pointers |
92 | - * nr_cmds = Number of commands supported by controller |
93 | */ |
94 | static struct board_type products[] = { |
95 | - {0x40700E11, "Smart Array 5300", &SA5_access, 512}, |
96 | - {0x40800E11, "Smart Array 5i", &SA5B_access, 512}, |
97 | - {0x40820E11, "Smart Array 532", &SA5B_access, 512}, |
98 | - {0x40830E11, "Smart Array 5312", &SA5B_access, 512}, |
99 | - {0x409A0E11, "Smart Array 641", &SA5_access, 512}, |
100 | - {0x409B0E11, "Smart Array 642", &SA5_access, 512}, |
101 | - {0x409C0E11, "Smart Array 6400", &SA5_access, 512}, |
102 | - {0x409D0E11, "Smart Array 6400 EM", &SA5_access, 512}, |
103 | - {0x40910E11, "Smart Array 6i", &SA5_access, 512}, |
104 | - {0x3225103C, "Smart Array P600", &SA5_access, 512}, |
105 | - {0x3223103C, "Smart Array P800", &SA5_access, 512}, |
106 | - {0x3234103C, "Smart Array P400", &SA5_access, 512}, |
107 | - {0x3235103C, "Smart Array P400i", &SA5_access, 512}, |
108 | - {0x3211103C, "Smart Array E200i", &SA5_access, 120}, |
109 | - {0x3212103C, "Smart Array E200", &SA5_access, 120}, |
110 | - {0x3213103C, "Smart Array E200i", &SA5_access, 120}, |
111 | - {0x3214103C, "Smart Array E200i", &SA5_access, 120}, |
112 | - {0x3215103C, "Smart Array E200i", &SA5_access, 120}, |
113 | - {0x3237103C, "Smart Array E500", &SA5_access, 512}, |
114 | - {0x323D103C, "Smart Array P700m", &SA5_access, 512}, |
115 | - {0x3241103C, "Smart Array P212", &SA5_access, 384}, |
116 | - {0x3243103C, "Smart Array P410", &SA5_access, 384}, |
117 | - {0x3245103C, "Smart Array P410i", &SA5_access, 384}, |
118 | - {0x3247103C, "Smart Array P411", &SA5_access, 384}, |
119 | - {0x3249103C, "Smart Array P812", &SA5_access, 384}, |
120 | - {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120}, |
121 | + {0x40700E11, "Smart Array 5300", &SA5_access}, |
122 | + {0x40800E11, "Smart Array 5i", &SA5B_access}, |
123 | + {0x40820E11, "Smart Array 532", &SA5B_access}, |
124 | + {0x40830E11, "Smart Array 5312", &SA5B_access}, |
125 | + {0x409A0E11, "Smart Array 641", &SA5_access}, |
126 | + {0x409B0E11, "Smart Array 642", &SA5_access}, |
127 | + {0x409C0E11, "Smart Array 6400", &SA5_access}, |
128 | + {0x409D0E11, "Smart Array 6400 EM", &SA5_access}, |
129 | + {0x40910E11, "Smart Array 6i", &SA5_access}, |
130 | + {0x3225103C, "Smart Array P600", &SA5_access}, |
131 | + {0x3223103C, "Smart Array P800", &SA5_access}, |
132 | + {0x3234103C, "Smart Array P400", &SA5_access}, |
133 | + {0x3235103C, "Smart Array P400i", &SA5_access}, |
134 | + {0x3211103C, "Smart Array E200i", &SA5_access}, |
135 | + {0x3212103C, "Smart Array E200", &SA5_access}, |
136 | + {0x3213103C, "Smart Array E200i", &SA5_access}, |
137 | + {0x3214103C, "Smart Array E200i", &SA5_access}, |
138 | + {0x3215103C, "Smart Array E200i", &SA5_access}, |
139 | + {0x3237103C, "Smart Array E500", &SA5_access}, |
140 | + {0x323D103C, "Smart Array P700m", &SA5_access}, |
141 | + {0x3241103C, "Smart Array P212", &SA5_access}, |
142 | + {0x3243103C, "Smart Array P410", &SA5_access}, |
143 | + {0x3245103C, "Smart Array P410i", &SA5_access}, |
144 | + {0x3247103C, "Smart Array P411", &SA5_access}, |
145 | + {0x3249103C, "Smart Array P812", &SA5_access}, |
146 | + {0xFFFF103C, "Unknown Smart Array", &SA5_access}, |
147 | }; |
148 | |
149 | /* How long to wait (in milliseconds) for board to go into simple mode */ |
150 | @@ -3082,11 +3081,20 @@ static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev) |
151 | print_cfg_table(c->cfgtable); |
152 | #endif /* CCISS_DEBUG */ |
153 | |
154 | + /* Some controllers support Zero Memory Raid (ZMR). |
155 | + * When configured in ZMR mode the number of supported |
156 | + * commands drops to 64. So instead of just setting an |
157 | + * arbitrary value we make the driver a little smarter. |
158 | + * We read the config table to tell us how many commands |
159 | + * are supported on the controller then subtract 4 to |
160 | + * leave a little room for ioctl calls. |
161 | + */ |
162 | + c->max_commands = readl(&(c->cfgtable->CmdsOutMax)); |
163 | for (i = 0; i < ARRAY_SIZE(products); i++) { |
164 | if (board_id == products[i].board_id) { |
165 | c->product_name = products[i].product_name; |
166 | c->access = *(products[i].access); |
167 | - c->nr_cmds = products[i].nr_cmds; |
168 | + c->nr_cmds = c->max_commands - 4; |
169 | break; |
170 | } |
171 | } |
172 | @@ -3106,7 +3114,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev) |
173 | if (subsystem_vendor_id == PCI_VENDOR_ID_HP) { |
174 | c->product_name = products[i-1].product_name; |
175 | c->access = *(products[i-1].access); |
176 | - c->nr_cmds = products[i-1].nr_cmds; |
177 | + c->nr_cmds = c->max_commands - 4; |
178 | printk(KERN_WARNING "cciss: This is an unknown " |
179 | "Smart Array controller.\n" |
180 | "cciss: Please update to the latest driver " |
181 | diff --git a/drivers/char/pcmcia/ipwireless/hardware.c b/drivers/char/pcmcia/ipwireless/hardware.c |
182 | index d353866..48c2040 100644 |
183 | --- a/drivers/char/pcmcia/ipwireless/hardware.c |
184 | +++ b/drivers/char/pcmcia/ipwireless/hardware.c |
185 | @@ -616,8 +616,10 @@ static struct ipw_rx_packet *pool_allocate(struct ipw_hardware *hw, |
186 | packet = kmalloc(sizeof(struct ipw_rx_packet) + |
187 | old_packet->length + minimum_free_space, |
188 | GFP_ATOMIC); |
189 | - if (!packet) |
190 | + if (!packet) { |
191 | + kfree(old_packet); |
192 | return NULL; |
193 | + } |
194 | memcpy(packet, old_packet, |
195 | sizeof(struct ipw_rx_packet) |
196 | + old_packet->length); |
197 | diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c |
198 | index 5c3142b..81ecec0 100644 |
199 | --- a/drivers/char/rtc.c |
200 | +++ b/drivers/char/rtc.c |
201 | @@ -677,12 +677,13 @@ static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, int kernel) |
202 | if (arg != (1<<tmp)) |
203 | return -EINVAL; |
204 | |
205 | + rtc_freq = arg; |
206 | + |
207 | spin_lock_irqsave(&rtc_lock, flags); |
208 | if (hpet_set_periodic_freq(arg)) { |
209 | spin_unlock_irqrestore(&rtc_lock, flags); |
210 | return 0; |
211 | } |
212 | - rtc_freq = arg; |
213 | |
214 | val = CMOS_READ(RTC_FREQ_SELECT) & 0xf0; |
215 | val |= (16 - tmp); |
216 | diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c |
217 | index 81503d9..6765649 100644 |
218 | --- a/drivers/char/tpm/tpm_tis.c |
219 | +++ b/drivers/char/tpm/tpm_tis.c |
220 | @@ -623,6 +623,7 @@ static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = { |
221 | {"IFX0102", 0}, /* Infineon */ |
222 | {"BCM0101", 0}, /* Broadcom */ |
223 | {"NSC1200", 0}, /* National */ |
224 | + {"ICO0102", 0}, /* Intel */ |
225 | /* Add new here */ |
226 | {"", 0}, /* User Specified */ |
227 | {"", 0} /* Terminator */ |
228 | diff --git a/drivers/hwmon/hdaps.c b/drivers/hwmon/hdaps.c |
229 | index bab5fd2..50f2269 100644 |
230 | --- a/drivers/hwmon/hdaps.c |
231 | +++ b/drivers/hwmon/hdaps.c |
232 | @@ -515,16 +515,24 @@ static struct dmi_system_id __initdata hdaps_whitelist[] = { |
233 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R50"), |
234 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R51"), |
235 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R52"), |
236 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad R61i"), |
237 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad R61"), |
238 | HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T41p"), |
239 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T41"), |
240 | HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T42p"), |
241 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T42"), |
242 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T43"), |
243 | HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T60"), |
244 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61p"), |
245 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61"), |
246 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad X40"), |
247 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad X41"), |
248 | HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X60"), |
249 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X61s"), |
250 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X61"), |
251 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad Z60m"), |
252 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad Z61m"), |
253 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad Z61p"), |
254 | { .ident = NULL } |
255 | }; |
256 | |
257 | diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c |
258 | index d4ad699..37fcb38 100644 |
259 | --- a/drivers/isdn/i4l/isdn_common.c |
260 | +++ b/drivers/isdn/i4l/isdn_common.c |
261 | @@ -1977,8 +1977,10 @@ isdn_writebuf_stub(int drvidx, int chan, const u_char __user * buf, int len) |
262 | if (!skb) |
263 | return -ENOMEM; |
264 | skb_reserve(skb, hl); |
265 | - if (copy_from_user(skb_put(skb, len), buf, len)) |
266 | + if (copy_from_user(skb_put(skb, len), buf, len)) { |
267 | + dev_kfree_skb(skb); |
268 | return -EFAULT; |
269 | + } |
270 | ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb); |
271 | if (ret <= 0) |
272 | dev_kfree_skb(skb); |
273 | diff --git a/drivers/md/md.c b/drivers/md/md.c |
274 | index ba34990..94e5711 100644 |
275 | --- a/drivers/md/md.c |
276 | +++ b/drivers/md/md.c |
277 | @@ -3804,8 +3804,10 @@ static void autorun_devices(int part) |
278 | |
279 | md_probe(dev, NULL, NULL); |
280 | mddev = mddev_find(dev); |
281 | - if (!mddev) { |
282 | - printk(KERN_ERR |
283 | + if (!mddev || !mddev->gendisk) { |
284 | + if (mddev) |
285 | + mddev_put(mddev); |
286 | + printk(KERN_ERR |
287 | "md: cannot allocate memory for md drive.\n"); |
288 | break; |
289 | } |
290 | diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c |
291 | index 32389d2..ad98858 100644 |
292 | --- a/drivers/md/raid10.c |
293 | +++ b/drivers/md/raid10.c |
294 | @@ -2102,6 +2102,8 @@ static int run(mddev_t *mddev) |
295 | !test_bit(In_sync, &disk->rdev->flags)) { |
296 | disk->head_position = 0; |
297 | mddev->degraded++; |
298 | + if (disk->rdev) |
299 | + conf->fullsync = 1; |
300 | } |
301 | } |
302 | |
303 | diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c |
304 | index 705fe47..ffcaab6 100644 |
305 | --- a/drivers/md/raid5.c |
306 | +++ b/drivers/md/raid5.c |
307 | @@ -1999,12 +1999,7 @@ static int __handle_issuing_new_read_requests5(struct stripe_head *sh, |
308 | */ |
309 | s->uptodate++; |
310 | return 0; /* uptodate + compute == disks */ |
311 | - } else if ((s->uptodate < disks - 1) && |
312 | - test_bit(R5_Insync, &dev->flags)) { |
313 | - /* Note: we hold off compute operations while checks are |
314 | - * in flight, but we still prefer 'compute' over 'read' |
315 | - * hence we only read if (uptodate < * disks-1) |
316 | - */ |
317 | + } else if (test_bit(R5_Insync, &dev->flags)) { |
318 | set_bit(R5_LOCKED, &dev->flags); |
319 | set_bit(R5_Wantread, &dev->flags); |
320 | if (!test_and_set_bit(STRIPE_OP_IO, &sh->ops.pending)) |
321 | @@ -2861,6 +2856,8 @@ static void handle_stripe5(struct stripe_head *sh) |
322 | |
323 | for (i = conf->raid_disks; i--; ) { |
324 | set_bit(R5_Wantwrite, &sh->dev[i].flags); |
325 | + set_bit(R5_LOCKED, &dev->flags); |
326 | + s.locked++; |
327 | if (!test_and_set_bit(STRIPE_OP_IO, &sh->ops.pending)) |
328 | sh->ops.count++; |
329 | } |
330 | @@ -2874,6 +2871,7 @@ static void handle_stripe5(struct stripe_head *sh) |
331 | conf->raid_disks); |
332 | s.locked += handle_write_operations5(sh, 1, 1); |
333 | } else if (s.expanded && |
334 | + s.locked == 0 && |
335 | !test_bit(STRIPE_OP_POSTXOR, &sh->ops.pending)) { |
336 | clear_bit(STRIPE_EXPAND_READY, &sh->state); |
337 | atomic_dec(&conf->reshape_stripes); |
338 | @@ -4163,7 +4161,9 @@ static int run(mddev_t *mddev) |
339 | " disk %d\n", bdevname(rdev->bdev,b), |
340 | raid_disk); |
341 | working_disks++; |
342 | - } |
343 | + } else |
344 | + /* Cannot rely on bitmap to complete recovery */ |
345 | + conf->fullsync = 1; |
346 | } |
347 | |
348 | /* |
349 | diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c |
350 | index 9fd8399..80c19d8 100644 |
351 | --- a/drivers/media/dvb/dvb-usb/dib0700_devices.c |
352 | +++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c |
353 | @@ -1062,6 +1062,7 @@ struct usb_device_id dib0700_usb_id_table[] = { |
354 | /* 30 */{ USB_DEVICE(USB_VID_PINNACLE, USB_PID_PINNACLE_PCTV73E) }, |
355 | { USB_DEVICE(USB_VID_YUAN, USB_PID_YUAN_EC372S) }, |
356 | { USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_HT_EXPRESS) }, |
357 | + { USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_T_XXS) }, |
358 | { 0 } /* Terminating entry */ |
359 | }; |
360 | MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table); |
361 | @@ -1251,7 +1252,7 @@ struct dvb_usb_device_properties dib0700_devices[] = { |
362 | }, |
363 | }, |
364 | |
365 | - .num_device_descs = 8, |
366 | + .num_device_descs = 9, |
367 | .devices = { |
368 | { "DiBcom STK7070P reference design", |
369 | { &dib0700_usb_id_table[15], NULL }, |
370 | @@ -1285,6 +1286,10 @@ struct dvb_usb_device_properties dib0700_devices[] = { |
371 | { &dib0700_usb_id_table[30], NULL }, |
372 | { NULL }, |
373 | }, |
374 | + { "Terratec Cinergy T USB XXS", |
375 | + { &dib0700_usb_id_table[33], NULL }, |
376 | + { NULL }, |
377 | + }, |
378 | }, |
379 | |
380 | .rc_interval = DEFAULT_RC_INTERVAL, |
381 | diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h |
382 | index 49a44f2..847c008 100644 |
383 | --- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h |
384 | +++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h |
385 | @@ -137,6 +137,7 @@ |
386 | #define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY 0x005a |
387 | #define USB_PID_TERRATEC_CINERGY_HT_USB_XE 0x0058 |
388 | #define USB_PID_TERRATEC_CINERGY_HT_EXPRESS 0x0060 |
389 | +#define USB_PID_TERRATEC_CINERGY_T_XXS 0x0078 |
390 | #define USB_PID_PINNACLE_EXPRESSCARD_320CX 0x022e |
391 | #define USB_PID_PINNACLE_PCTV2000E 0x022c |
392 | #define USB_PID_PINNACLE_PCTV_DVB_T_FLASH 0x0228 |
393 | @@ -191,6 +192,6 @@ |
394 | #define USB_PID_GIGABYTE_U7000 0x7001 |
395 | #define USB_PID_ASUS_U3000 0x171f |
396 | #define USB_PID_ASUS_U3100 0x173f |
397 | -#define USB_PID_YUAN_EC372S 0x1edc |
398 | +#define USB_PID_YUAN_EC372S 0x1edc |
399 | |
400 | #endif |
401 | diff --git a/drivers/media/video/ov7670.c b/drivers/media/video/ov7670.c |
402 | index 2bc6bdc..d7bfd30 100644 |
403 | --- a/drivers/media/video/ov7670.c |
404 | +++ b/drivers/media/video/ov7670.c |
405 | @@ -406,8 +406,10 @@ static int ov7670_read(struct i2c_client *c, unsigned char reg, |
406 | int ret; |
407 | |
408 | ret = i2c_smbus_read_byte_data(c, reg); |
409 | - if (ret >= 0) |
410 | + if (ret >= 0) { |
411 | *value = (unsigned char) ret; |
412 | + ret = 0; |
413 | + } |
414 | return ret; |
415 | } |
416 | |
417 | diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c |
418 | index 25bcfcf..1effca4 100644 |
419 | --- a/drivers/message/fusion/mptspi.c |
420 | +++ b/drivers/message/fusion/mptspi.c |
421 | @@ -1266,13 +1266,18 @@ mptspi_dv_renegotiate(struct _MPT_SCSI_HOST *hd) |
422 | static int |
423 | mptspi_ioc_reset(MPT_ADAPTER *ioc, int reset_phase) |
424 | { |
425 | - struct _MPT_SCSI_HOST *hd = shost_priv(ioc->sh); |
426 | int rc; |
427 | |
428 | rc = mptscsih_ioc_reset(ioc, reset_phase); |
429 | |
430 | - if (reset_phase == MPT_IOC_POST_RESET) |
431 | + /* only try to do a renegotiation if we're properly set up |
432 | + * if we get an ioc fault on bringup, ioc->sh will be NULL */ |
433 | + if (reset_phase == MPT_IOC_POST_RESET && |
434 | + ioc->sh) { |
435 | + struct _MPT_SCSI_HOST *hd = shost_priv(ioc->sh); |
436 | + |
437 | mptspi_dv_renegotiate(hd); |
438 | + } |
439 | |
440 | return rc; |
441 | } |
442 | diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c |
443 | index 65210fc..5c35e63 100644 |
444 | --- a/drivers/mmc/host/pxamci.c |
445 | +++ b/drivers/mmc/host/pxamci.c |
446 | @@ -114,6 +114,7 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) |
447 | unsigned int nob = data->blocks; |
448 | unsigned long long clks; |
449 | unsigned int timeout; |
450 | + bool dalgn = 0; |
451 | u32 dcmd; |
452 | int i; |
453 | |
454 | @@ -152,6 +153,9 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) |
455 | host->sg_cpu[i].dcmd = dcmd | length; |
456 | if (length & 31 && !(data->flags & MMC_DATA_READ)) |
457 | host->sg_cpu[i].dcmd |= DCMD_ENDIRQEN; |
458 | + /* Not aligned to 8-byte boundary? */ |
459 | + if (sg_dma_address(&data->sg[i]) & 0x7) |
460 | + dalgn = 1; |
461 | if (data->flags & MMC_DATA_READ) { |
462 | host->sg_cpu[i].dsadr = host->res->start + MMC_RXFIFO; |
463 | host->sg_cpu[i].dtadr = sg_dma_address(&data->sg[i]); |
464 | @@ -165,6 +169,15 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) |
465 | host->sg_cpu[host->dma_len - 1].ddadr = DDADR_STOP; |
466 | wmb(); |
467 | |
468 | + /* |
469 | + * The PXA27x DMA controller encounters overhead when working with |
470 | + * unaligned (to 8-byte boundaries) data, so switch on byte alignment |
471 | + * mode only if we have unaligned data. |
472 | + */ |
473 | + if (dalgn) |
474 | + DALGN |= (1 << host->dma); |
475 | + else |
476 | + DALGN &= ~(1 << host->dma); |
477 | DDADR(host->dma) = host->sg_dma; |
478 | DCSR(host->dma) = DCSR_RUN; |
479 | } |
480 | diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c |
481 | index 4b673aa..e44e2bd 100644 |
482 | --- a/drivers/mmc/host/sdhci.c |
483 | +++ b/drivers/mmc/host/sdhci.c |
484 | @@ -109,7 +109,8 @@ static const struct pci_device_id pci_ids[] __devinitdata = { |
485 | .subvendor = PCI_ANY_ID, |
486 | .subdevice = PCI_ANY_ID, |
487 | .driver_data = SDHCI_QUIRK_SINGLE_POWER_WRITE | |
488 | - SDHCI_QUIRK_RESET_CMD_DATA_ON_IOS, |
489 | + SDHCI_QUIRK_RESET_CMD_DATA_ON_IOS | |
490 | + SDHCI_QUIRK_BROKEN_DMA, |
491 | }, |
492 | |
493 | { |
494 | @@ -118,7 +119,8 @@ static const struct pci_device_id pci_ids[] __devinitdata = { |
495 | .subvendor = PCI_ANY_ID, |
496 | .subdevice = PCI_ANY_ID, |
497 | .driver_data = SDHCI_QUIRK_SINGLE_POWER_WRITE | |
498 | - SDHCI_QUIRK_RESET_CMD_DATA_ON_IOS, |
499 | + SDHCI_QUIRK_RESET_CMD_DATA_ON_IOS | |
500 | + SDHCI_QUIRK_BROKEN_DMA, |
501 | }, |
502 | |
503 | { |
504 | diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c |
505 | index 6f8e7d4..09451ad 100644 |
506 | --- a/drivers/net/3c59x.c |
507 | +++ b/drivers/net/3c59x.c |
508 | @@ -1769,9 +1769,10 @@ vortex_timer(unsigned long data) |
509 | case XCVR_MII: case XCVR_NWAY: |
510 | { |
511 | ok = 1; |
512 | - spin_lock_bh(&vp->lock); |
513 | + /* Interrupts are already disabled */ |
514 | + spin_lock(&vp->lock); |
515 | vortex_check_media(dev, 0); |
516 | - spin_unlock_bh(&vp->lock); |
517 | + spin_unlock(&vp->lock); |
518 | } |
519 | break; |
520 | default: /* Other media types handled by Tx timeouts. */ |
521 | diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c |
522 | index 0aac1ff..23d4c09 100644 |
523 | --- a/drivers/net/wireless/b43/leds.c |
524 | +++ b/drivers/net/wireless/b43/leds.c |
525 | @@ -72,6 +72,9 @@ static void b43_led_brightness_set(struct led_classdev *led_dev, |
526 | struct b43_wldev *dev = led->dev; |
527 | bool radio_enabled; |
528 | |
529 | + if (unlikely(b43_status(dev) < B43_STAT_INITIALIZED)) |
530 | + return; |
531 | + |
532 | /* Checking the radio-enabled status here is slightly racy, |
533 | * but we want to avoid the locking overhead and we don't care |
534 | * whether the LED has the wrong state for a second. */ |
535 | diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c |
536 | index b4a2042..b2cc246 100644 |
537 | --- a/drivers/net/wireless/b43/main.c |
538 | +++ b/drivers/net/wireless/b43/main.c |
539 | @@ -2607,7 +2607,7 @@ static int b43_op_tx(struct ieee80211_hw *hw, |
540 | int err; |
541 | |
542 | if (unlikely(!dev)) |
543 | - return NETDEV_TX_BUSY; |
544 | + goto drop_packet; |
545 | |
546 | /* Transmissions on seperate queues can run concurrently. */ |
547 | read_lock_irqsave(&wl->tx_lock, flags); |
548 | @@ -2619,7 +2619,12 @@ static int b43_op_tx(struct ieee80211_hw *hw, |
549 | read_unlock_irqrestore(&wl->tx_lock, flags); |
550 | |
551 | if (unlikely(err)) |
552 | - return NETDEV_TX_BUSY; |
553 | + goto drop_packet; |
554 | + return NETDEV_TX_OK; |
555 | + |
556 | +drop_packet: |
557 | + /* We can not transmit this packet. Drop it. */ |
558 | + dev_kfree_skb_any(skb); |
559 | return NETDEV_TX_OK; |
560 | } |
561 | |
562 | diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c |
563 | index c990f87..93ddc1c 100644 |
564 | --- a/drivers/net/wireless/b43legacy/dma.c |
565 | +++ b/drivers/net/wireless/b43legacy/dma.c |
566 | @@ -876,6 +876,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, |
567 | if (!ring) |
568 | goto out; |
569 | ring->type = type; |
570 | + ring->dev = dev; |
571 | |
572 | nr_slots = B43legacy_RXRING_SLOTS; |
573 | if (for_tx) |
574 | @@ -922,7 +923,6 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, |
575 | DMA_TO_DEVICE); |
576 | } |
577 | |
578 | - ring->dev = dev; |
579 | ring->nr_slots = nr_slots; |
580 | ring->mmio_base = b43legacy_dmacontroller_base(type, controller_index); |
581 | ring->index = controller_index; |
582 | diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c |
583 | index 0f7a6e7..531aeb2 100644 |
584 | --- a/drivers/net/wireless/b43legacy/main.c |
585 | +++ b/drivers/net/wireless/b43legacy/main.c |
586 | @@ -2350,8 +2350,10 @@ static int b43legacy_op_tx(struct ieee80211_hw *hw, |
587 | } else |
588 | err = b43legacy_dma_tx(dev, skb, ctl); |
589 | out: |
590 | - if (unlikely(err)) |
591 | - return NETDEV_TX_BUSY; |
592 | + if (unlikely(err)) { |
593 | + /* Drop the packet. */ |
594 | + dev_kfree_skb_any(skb); |
595 | + } |
596 | return NETDEV_TX_OK; |
597 | } |
598 | |
599 | diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c |
600 | index 7942b15..17efe4f 100644 |
601 | --- a/drivers/net/wireless/zd1211rw/zd_usb.c |
602 | +++ b/drivers/net/wireless/zd1211rw/zd_usb.c |
603 | @@ -64,6 +64,7 @@ static struct usb_device_id usb_ids[] = { |
604 | { USB_DEVICE(0x079b, 0x0062), .driver_info = DEVICE_ZD1211B }, |
605 | { USB_DEVICE(0x1582, 0x6003), .driver_info = DEVICE_ZD1211B }, |
606 | { USB_DEVICE(0x050d, 0x705c), .driver_info = DEVICE_ZD1211B }, |
607 | + { USB_DEVICE(0x083a, 0xe506), .driver_info = DEVICE_ZD1211B }, |
608 | { USB_DEVICE(0x083a, 0x4505), .driver_info = DEVICE_ZD1211B }, |
609 | { USB_DEVICE(0x0471, 0x1236), .driver_info = DEVICE_ZD1211B }, |
610 | { USB_DEVICE(0x13b1, 0x0024), .driver_info = DEVICE_ZD1211B }, |
611 | diff --git a/drivers/rapidio/rio-driver.c b/drivers/rapidio/rio-driver.c |
612 | index 3ce9f3d..956d3e7 100644 |
613 | --- a/drivers/rapidio/rio-driver.c |
614 | +++ b/drivers/rapidio/rio-driver.c |
615 | @@ -101,8 +101,8 @@ static int rio_device_probe(struct device *dev) |
616 | if (error >= 0) { |
617 | rdev->driver = rdrv; |
618 | error = 0; |
619 | + } else |
620 | rio_dev_put(rdev); |
621 | - } |
622 | } |
623 | return error; |
624 | } |
625 | diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c |
626 | index bfdee59..3d8d5d4 100644 |
627 | --- a/drivers/scsi/esp_scsi.c |
628 | +++ b/drivers/scsi/esp_scsi.c |
629 | @@ -2352,6 +2352,24 @@ void scsi_esp_unregister(struct esp *esp) |
630 | } |
631 | EXPORT_SYMBOL(scsi_esp_unregister); |
632 | |
633 | +static int esp_target_alloc(struct scsi_target *starget) |
634 | +{ |
635 | + struct esp *esp = shost_priv(dev_to_shost(&starget->dev)); |
636 | + struct esp_target_data *tp = &esp->target[starget->id]; |
637 | + |
638 | + tp->starget = starget; |
639 | + |
640 | + return 0; |
641 | +} |
642 | + |
643 | +static void esp_target_destroy(struct scsi_target *starget) |
644 | +{ |
645 | + struct esp *esp = shost_priv(dev_to_shost(&starget->dev)); |
646 | + struct esp_target_data *tp = &esp->target[starget->id]; |
647 | + |
648 | + tp->starget = NULL; |
649 | +} |
650 | + |
651 | static int esp_slave_alloc(struct scsi_device *dev) |
652 | { |
653 | struct esp *esp = shost_priv(dev->host); |
654 | @@ -2363,8 +2381,6 @@ static int esp_slave_alloc(struct scsi_device *dev) |
655 | return -ENOMEM; |
656 | dev->hostdata = lp; |
657 | |
658 | - tp->starget = dev->sdev_target; |
659 | - |
660 | spi_min_period(tp->starget) = esp->min_period; |
661 | spi_max_offset(tp->starget) = 15; |
662 | |
663 | @@ -2595,6 +2611,8 @@ struct scsi_host_template scsi_esp_template = { |
664 | .name = "esp", |
665 | .info = esp_info, |
666 | .queuecommand = esp_queuecommand, |
667 | + .target_alloc = esp_target_alloc, |
668 | + .target_destroy = esp_target_destroy, |
669 | .slave_alloc = esp_slave_alloc, |
670 | .slave_configure = esp_slave_configure, |
671 | .slave_destroy = esp_slave_destroy, |
672 | diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c |
673 | index a6d9669..f1f2f65 100644 |
674 | --- a/drivers/scsi/ses.c |
675 | +++ b/drivers/scsi/ses.c |
676 | @@ -61,7 +61,7 @@ static int ses_probe(struct device *dev) |
677 | return err; |
678 | } |
679 | |
680 | -#define SES_TIMEOUT 30 |
681 | +#define SES_TIMEOUT (30 * HZ) |
682 | #define SES_RETRIES 3 |
683 | |
684 | static int ses_recv_diag(struct scsi_device *sdev, int page_code, |
685 | diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c |
686 | index d60705e..fe989c5 100644 |
687 | --- a/drivers/serial/8250.c |
688 | +++ b/drivers/serial/8250.c |
689 | @@ -2564,6 +2564,9 @@ static struct console serial8250_console = { |
690 | |
691 | static int __init serial8250_console_init(void) |
692 | { |
693 | + if (nr_uarts > UART_NR) |
694 | + nr_uarts = UART_NR; |
695 | + |
696 | serial8250_isa_init_ports(); |
697 | register_console(&serial8250_console); |
698 | return 0; |
699 | diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c |
700 | index db9920e..3419a89 100644 |
701 | --- a/drivers/serial/serial_core.c |
702 | +++ b/drivers/serial/serial_core.c |
703 | @@ -1950,7 +1950,9 @@ struct uart_match { |
704 | static int serial_match_port(struct device *dev, void *data) |
705 | { |
706 | struct uart_match *match = data; |
707 | - dev_t devt = MKDEV(match->driver->major, match->driver->minor) + match->port->line; |
708 | + struct tty_driver *tty_drv = match->driver->tty_driver; |
709 | + dev_t devt = MKDEV(tty_drv->major, tty_drv->minor_start) + |
710 | + match->port->line; |
711 | |
712 | return dev->devt == devt; /* Actually, only one tty per port */ |
713 | } |
714 | diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c |
715 | index e52ed16..27533b3 100644 |
716 | --- a/drivers/usb/core/hcd.c |
717 | +++ b/drivers/usb/core/hcd.c |
718 | @@ -1685,19 +1685,30 @@ EXPORT_SYMBOL_GPL(usb_bus_start_enum); |
719 | irqreturn_t usb_hcd_irq (int irq, void *__hcd) |
720 | { |
721 | struct usb_hcd *hcd = __hcd; |
722 | - int start = hcd->state; |
723 | + unsigned long flags; |
724 | + irqreturn_t rc; |
725 | |
726 | - if (unlikely(start == HC_STATE_HALT || |
727 | - !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) |
728 | - return IRQ_NONE; |
729 | - if (hcd->driver->irq (hcd) == IRQ_NONE) |
730 | - return IRQ_NONE; |
731 | + /* IRQF_DISABLED doesn't work correctly with shared IRQs |
732 | + * when the first handler doesn't use it. So let's just |
733 | + * assume it's never used. |
734 | + */ |
735 | + local_irq_save(flags); |
736 | |
737 | - set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags); |
738 | + if (unlikely(hcd->state == HC_STATE_HALT || |
739 | + !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) { |
740 | + rc = IRQ_NONE; |
741 | + } else if (hcd->driver->irq(hcd) == IRQ_NONE) { |
742 | + rc = IRQ_NONE; |
743 | + } else { |
744 | + set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags); |
745 | |
746 | - if (unlikely(hcd->state == HC_STATE_HALT)) |
747 | - usb_hc_died (hcd); |
748 | - return IRQ_HANDLED; |
749 | + if (unlikely(hcd->state == HC_STATE_HALT)) |
750 | + usb_hc_died(hcd); |
751 | + rc = IRQ_HANDLED; |
752 | + } |
753 | + |
754 | + local_irq_restore(flags); |
755 | + return rc; |
756 | } |
757 | |
758 | /*-------------------------------------------------------------------------*/ |
759 | @@ -1861,6 +1872,13 @@ int usb_add_hcd(struct usb_hcd *hcd, |
760 | |
761 | /* enable irqs just before we start the controller */ |
762 | if (hcd->driver->irq) { |
763 | + |
764 | + /* IRQF_DISABLED doesn't work as advertised when used together |
765 | + * with IRQF_SHARED. As usb_hcd_irq() will always disable |
766 | + * interrupts we can remove it here. |
767 | + */ |
768 | + irqflags &= ~IRQF_DISABLED; |
769 | + |
770 | snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d", |
771 | hcd->driver->description, hcd->self.busnum); |
772 | if ((retval = request_irq(irqnum, &usb_hcd_irq, irqflags, |
773 | diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h |
774 | index bf92d20..888e81e 100644 |
775 | --- a/drivers/usb/host/ehci.h |
776 | +++ b/drivers/usb/host/ehci.h |
777 | @@ -176,6 +176,15 @@ timer_action_done (struct ehci_hcd *ehci, enum ehci_timer_action action) |
778 | static inline void |
779 | timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action) |
780 | { |
781 | + /* Don't override timeouts which shrink or (later) disable |
782 | + * the async ring; just the I/O watchdog. Note that if a |
783 | + * SHRINK were pending, OFF would never be requested. |
784 | + */ |
785 | + if (timer_pending(&ehci->watchdog) |
786 | + && ((BIT(TIMER_ASYNC_SHRINK) | BIT(TIMER_ASYNC_OFF)) |
787 | + & ehci->actions)) |
788 | + return; |
789 | + |
790 | if (!test_and_set_bit (action, &ehci->actions)) { |
791 | unsigned long t; |
792 | |
793 | @@ -191,15 +200,7 @@ timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action) |
794 | t = EHCI_SHRINK_JIFFIES; |
795 | break; |
796 | } |
797 | - t += jiffies; |
798 | - // all timings except IAA watchdog can be overridden. |
799 | - // async queue SHRINK often precedes IAA. while it's ready |
800 | - // to go OFF neither can matter, and afterwards the IO |
801 | - // watchdog stops unless there's still periodic traffic. |
802 | - if (time_before_eq(t, ehci->watchdog.expires) |
803 | - && timer_pending (&ehci->watchdog)) |
804 | - return; |
805 | - mod_timer (&ehci->watchdog, t); |
806 | + mod_timer(&ehci->watchdog, t + jiffies); |
807 | } |
808 | } |
809 | |
810 | diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c |
811 | index 33f1c1c..a8160d6 100644 |
812 | --- a/drivers/usb/host/ohci-hcd.c |
813 | +++ b/drivers/usb/host/ohci-hcd.c |
814 | @@ -1054,7 +1054,7 @@ MODULE_LICENSE ("GPL"); |
815 | |
816 | #ifdef CONFIG_MFD_SM501 |
817 | #include "ohci-sm501.c" |
818 | -#define PLATFORM_DRIVER ohci_hcd_sm501_driver |
819 | +#define SM501_OHCI_DRIVER ohci_hcd_sm501_driver |
820 | #endif |
821 | |
822 | #if !defined(PCI_DRIVER) && \ |
823 | @@ -1062,6 +1062,7 @@ MODULE_LICENSE ("GPL"); |
824 | !defined(OF_PLATFORM_DRIVER) && \ |
825 | !defined(SA1111_DRIVER) && \ |
826 | !defined(PS3_SYSTEM_BUS_DRIVER) && \ |
827 | + !defined(SM501_OHCI_DRIVER) && \ |
828 | !defined(SSB_OHCI_DRIVER) |
829 | #error "missing bus glue for ohci-hcd" |
830 | #endif |
831 | @@ -1121,9 +1122,18 @@ static int __init ohci_hcd_mod_init(void) |
832 | goto error_ssb; |
833 | #endif |
834 | |
835 | +#ifdef SM501_OHCI_DRIVER |
836 | + retval = platform_driver_register(&SM501_OHCI_DRIVER); |
837 | + if (retval < 0) |
838 | + goto error_sm501; |
839 | +#endif |
840 | + |
841 | return retval; |
842 | |
843 | /* Error path */ |
844 | +#ifdef SM501_OHCI_DRIVER |
845 | + error_sm501: |
846 | +#endif |
847 | #ifdef SSB_OHCI_DRIVER |
848 | error_ssb: |
849 | #endif |
850 | @@ -1159,6 +1169,9 @@ module_init(ohci_hcd_mod_init); |
851 | |
852 | static void __exit ohci_hcd_mod_exit(void) |
853 | { |
854 | +#ifdef SM501_OHCI_DRIVER |
855 | + platform_driver_unregister(&SM501_OHCI_DRIVER); |
856 | +#endif |
857 | #ifdef SSB_OHCI_DRIVER |
858 | ssb_driver_unregister(&SSB_OHCI_DRIVER); |
859 | #endif |
860 | diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c |
861 | index 9c9f3b5..9b54740 100644 |
862 | --- a/drivers/usb/host/ohci-q.c |
863 | +++ b/drivers/usb/host/ohci-q.c |
864 | @@ -952,6 +952,7 @@ rescan_this: |
865 | struct urb *urb; |
866 | urb_priv_t *urb_priv; |
867 | __hc32 savebits; |
868 | + u32 tdINFO; |
869 | |
870 | td = list_entry (entry, struct td, td_list); |
871 | urb = td->urb; |
872 | @@ -966,6 +967,17 @@ rescan_this: |
873 | savebits = *prev & ~cpu_to_hc32 (ohci, TD_MASK); |
874 | *prev = td->hwNextTD | savebits; |
875 | |
876 | + /* If this was unlinked, the TD may not have been |
877 | + * retired ... so manually save the data toggle. |
878 | + * The controller ignores the value we save for |
879 | + * control and ISO endpoints. |
880 | + */ |
881 | + tdINFO = hc32_to_cpup(ohci, &td->hwINFO); |
882 | + if ((tdINFO & TD_T) == TD_T_DATA0) |
883 | + ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_C); |
884 | + else if ((tdINFO & TD_T) == TD_T_DATA1) |
885 | + ed->hwHeadP |= cpu_to_hc32(ohci, ED_C); |
886 | + |
887 | /* HC may have partly processed this TD */ |
888 | td_done (ohci, urb, td); |
889 | urb_priv->td_cnt++; |
890 | diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c |
891 | index cb7fa0e..33182f4 100644 |
892 | --- a/drivers/usb/misc/sisusbvga/sisusb.c |
893 | +++ b/drivers/usb/misc/sisusbvga/sisusb.c |
894 | @@ -3264,8 +3264,6 @@ static void sisusb_disconnect(struct usb_interface *intf) |
895 | |
896 | /* decrement our usage count */ |
897 | kref_put(&sisusb->kref, sisusb_delete); |
898 | - |
899 | - dev_info(&sisusb->sisusb_dev->dev, "Disconnected\n"); |
900 | } |
901 | |
902 | static struct usb_device_id sisusb_table [] = { |
903 | diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c |
904 | index 24843fd..59df132 100644 |
905 | --- a/drivers/video/fb_defio.c |
906 | +++ b/drivers/video/fb_defio.c |
907 | @@ -74,6 +74,7 @@ static int fb_deferred_io_mkwrite(struct vm_area_struct *vma, |
908 | { |
909 | struct fb_info *info = vma->vm_private_data; |
910 | struct fb_deferred_io *fbdefio = info->fbdefio; |
911 | + struct page *cur; |
912 | |
913 | /* this is a callback we get when userspace first tries to |
914 | write to the page. we schedule a workqueue. that workqueue |
915 | @@ -83,7 +84,24 @@ static int fb_deferred_io_mkwrite(struct vm_area_struct *vma, |
916 | |
917 | /* protect against the workqueue changing the page list */ |
918 | mutex_lock(&fbdefio->lock); |
919 | - list_add(&page->lru, &fbdefio->pagelist); |
920 | + |
921 | + /* we loop through the pagelist before adding in order |
922 | + to keep the pagelist sorted */ |
923 | + list_for_each_entry(cur, &fbdefio->pagelist, lru) { |
924 | + /* this check is to catch the case where a new |
925 | + process could start writing to the same page |
926 | + through a new pte. this new access can cause the |
927 | + mkwrite even when the original ps's pte is marked |
928 | + writable */ |
929 | + if (unlikely(cur == page)) |
930 | + goto page_already_added; |
931 | + else if (cur->index > page->index) |
932 | + break; |
933 | + } |
934 | + |
935 | + list_add_tail(&page->lru, &cur->lru); |
936 | + |
937 | +page_already_added: |
938 | mutex_unlock(&fbdefio->lock); |
939 | |
940 | /* come back after delay to process the deferred IO */ |
941 | diff --git a/fs/buffer.c b/fs/buffer.c |
942 | index 39ff144..c55d485 100644 |
943 | --- a/fs/buffer.c |
944 | +++ b/fs/buffer.c |
945 | @@ -818,7 +818,7 @@ static int fsync_buffers_list(spinlock_t *lock, struct list_head *list) |
946 | * contents - it is a noop if I/O is still in |
947 | * flight on potentially older contents. |
948 | */ |
949 | - ll_rw_block(SWRITE, 1, &bh); |
950 | + ll_rw_block(SWRITE_SYNC, 1, &bh); |
951 | brelse(bh); |
952 | spin_lock(lock); |
953 | } |
954 | @@ -2952,16 +2952,19 @@ void ll_rw_block(int rw, int nr, struct buffer_head *bhs[]) |
955 | for (i = 0; i < nr; i++) { |
956 | struct buffer_head *bh = bhs[i]; |
957 | |
958 | - if (rw == SWRITE) |
959 | + if (rw == SWRITE || rw == SWRITE_SYNC) |
960 | lock_buffer(bh); |
961 | else if (test_set_buffer_locked(bh)) |
962 | continue; |
963 | |
964 | - if (rw == WRITE || rw == SWRITE) { |
965 | + if (rw == WRITE || rw == SWRITE || rw == SWRITE_SYNC) { |
966 | if (test_clear_buffer_dirty(bh)) { |
967 | bh->b_end_io = end_buffer_write_sync; |
968 | get_bh(bh); |
969 | - submit_bh(WRITE, bh); |
970 | + if (rw == SWRITE_SYNC) |
971 | + submit_bh(WRITE_SYNC, bh); |
972 | + else |
973 | + submit_bh(WRITE, bh); |
974 | continue; |
975 | } |
976 | } else { |
977 | @@ -2990,7 +2993,7 @@ int sync_dirty_buffer(struct buffer_head *bh) |
978 | if (test_clear_buffer_dirty(bh)) { |
979 | get_bh(bh); |
980 | bh->b_end_io = end_buffer_write_sync; |
981 | - ret = submit_bh(WRITE, bh); |
982 | + ret = submit_bh(WRITE_SYNC, bh); |
983 | wait_on_buffer(bh); |
984 | if (buffer_eopnotsupp(bh)) { |
985 | clear_buffer_eopnotsupp(bh); |
986 | diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c |
987 | index 1cb5b0a..f454f71 100644 |
988 | --- a/fs/cifs/cifsacl.c |
989 | +++ b/fs/cifs/cifsacl.c |
990 | @@ -34,11 +34,11 @@ |
991 | static struct cifs_wksid wksidarr[NUM_WK_SIDS] = { |
992 | {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"}, |
993 | {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"}, |
994 | - {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"}, |
995 | - {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(18), 0, 0, 0, 0} }, "sys"}, |
996 | - {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(544), 0, 0, 0} }, "root"}, |
997 | - {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(545), 0, 0, 0} }, "users"}, |
998 | - {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(546), 0, 0, 0} }, "guest"} } |
999 | + {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"}, |
1000 | + {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(18), 0, 0, 0, 0} }, "sys"}, |
1001 | + {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(544), 0, 0, 0} }, "root"}, |
1002 | + {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(545), 0, 0, 0} }, "users"}, |
1003 | + {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(546), 0, 0, 0} }, "guest"} } |
1004 | ; |
1005 | |
1006 | |
1007 | diff --git a/fs/exec.c b/fs/exec.c |
1008 | index 54a0a55..3080915 100644 |
1009 | --- a/fs/exec.c |
1010 | +++ b/fs/exec.c |
1011 | @@ -605,7 +605,7 @@ int setup_arg_pages(struct linux_binprm *bprm, |
1012 | bprm->exec -= stack_shift; |
1013 | |
1014 | down_write(&mm->mmap_sem); |
1015 | - vm_flags = vma->vm_flags; |
1016 | + vm_flags = VM_STACK_FLAGS; |
1017 | |
1018 | /* |
1019 | * Adjust stack execute permissions; explicitly enable for |
1020 | diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c |
1021 | index 5791793..1922696 100644 |
1022 | --- a/fs/reiserfs/inode.c |
1023 | +++ b/fs/reiserfs/inode.c |
1024 | @@ -45,6 +45,8 @@ void reiserfs_delete_inode(struct inode *inode) |
1025 | goto out; |
1026 | reiserfs_update_inode_transaction(inode); |
1027 | |
1028 | + reiserfs_discard_prealloc(&th, inode); |
1029 | + |
1030 | err = reiserfs_delete_object(&th, inode); |
1031 | |
1032 | /* Do quota update inside a transaction for journaled quotas. We must do that |
1033 | diff --git a/include/linux/fs.h b/include/linux/fs.h |
1034 | index b84b848..212ad96 100644 |
1035 | --- a/include/linux/fs.h |
1036 | +++ b/include/linux/fs.h |
1037 | @@ -83,6 +83,7 @@ extern int dir_notify_enable; |
1038 | #define READ_SYNC (READ | (1 << BIO_RW_SYNC)) |
1039 | #define READ_META (READ | (1 << BIO_RW_META)) |
1040 | #define WRITE_SYNC (WRITE | (1 << BIO_RW_SYNC)) |
1041 | +#define SWRITE_SYNC (SWRITE | (1 << BIO_RW_SYNC)) |
1042 | #define WRITE_BARRIER ((1 << BIO_RW) | (1 << BIO_RW_BARRIER)) |
1043 | |
1044 | #define SEL_IN 1 |
1045 | diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c |
1046 | index c15a359..3d31d65 100644 |
1047 | --- a/kernel/hrtimer.c |
1048 | +++ b/kernel/hrtimer.c |
1049 | @@ -896,10 +896,18 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode) |
1050 | */ |
1051 | raise = timer->state == HRTIMER_STATE_PENDING; |
1052 | |
1053 | + /* |
1054 | + * We use preempt_disable to prevent this task from migrating after |
1055 | + * setting up the softirq and raising it. Otherwise, if me migrate |
1056 | + * we will raise the softirq on the wrong CPU. |
1057 | + */ |
1058 | + preempt_disable(); |
1059 | + |
1060 | unlock_hrtimer_base(timer, &flags); |
1061 | |
1062 | if (raise) |
1063 | hrtimer_raise_softirq(); |
1064 | + preempt_enable(); |
1065 | |
1066 | return ret; |
1067 | } |
1068 | diff --git a/lib/ts_bm.c b/lib/ts_bm.c |
1069 | index d90822c..4a7fce7 100644 |
1070 | --- a/lib/ts_bm.c |
1071 | +++ b/lib/ts_bm.c |
1072 | @@ -63,7 +63,7 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state) |
1073 | struct ts_bm *bm = ts_config_priv(conf); |
1074 | unsigned int i, text_len, consumed = state->offset; |
1075 | const u8 *text; |
1076 | - int shift = bm->patlen, bs; |
1077 | + int shift = bm->patlen - 1, bs; |
1078 | |
1079 | for (;;) { |
1080 | text_len = conf->get_next_block(consumed, &text, conf, state); |
1081 | diff --git a/mm/slub.c b/mm/slub.c |
1082 | index acc975f..8927f29 100644 |
1083 | --- a/mm/slub.c |
1084 | +++ b/mm/slub.c |
1085 | @@ -1575,9 +1575,11 @@ static __always_inline void *slab_alloc(struct kmem_cache *s, |
1086 | void **object; |
1087 | struct kmem_cache_cpu *c; |
1088 | unsigned long flags; |
1089 | + unsigned int objsize; |
1090 | |
1091 | local_irq_save(flags); |
1092 | c = get_cpu_slab(s, smp_processor_id()); |
1093 | + objsize = c->objsize; |
1094 | if (unlikely(!c->freelist || !node_match(c, node))) |
1095 | |
1096 | object = __slab_alloc(s, gfpflags, node, addr, c); |
1097 | @@ -1590,7 +1592,7 @@ static __always_inline void *slab_alloc(struct kmem_cache *s, |
1098 | local_irq_restore(flags); |
1099 | |
1100 | if (unlikely((gfpflags & __GFP_ZERO) && object)) |
1101 | - memset(object, 0, c->objsize); |
1102 | + memset(object, 0, objsize); |
1103 | |
1104 | return object; |
1105 | } |
1106 | diff --git a/net/can/af_can.c b/net/can/af_can.c |
1107 | index 6b956f5..57594b9 100644 |
1108 | --- a/net/can/af_can.c |
1109 | +++ b/net/can/af_can.c |
1110 | @@ -205,12 +205,19 @@ static int can_create(struct net *net, struct socket *sock, int protocol) |
1111 | * -ENOBUFS on full driver queue (see net_xmit_errno()) |
1112 | * -ENOMEM when local loopback failed at calling skb_clone() |
1113 | * -EPERM when trying to send on a non-CAN interface |
1114 | + * -EINVAL when the skb->data does not contain a valid CAN frame |
1115 | */ |
1116 | int can_send(struct sk_buff *skb, int loop) |
1117 | { |
1118 | struct sk_buff *newskb = NULL; |
1119 | + struct can_frame *cf = (struct can_frame *)skb->data; |
1120 | int err; |
1121 | |
1122 | + if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) { |
1123 | + kfree_skb(skb); |
1124 | + return -EINVAL; |
1125 | + } |
1126 | + |
1127 | if (skb->dev->type != ARPHRD_CAN) { |
1128 | kfree_skb(skb); |
1129 | return -EPERM; |
1130 | @@ -605,6 +612,7 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, |
1131 | struct packet_type *pt, struct net_device *orig_dev) |
1132 | { |
1133 | struct dev_rcv_lists *d; |
1134 | + struct can_frame *cf = (struct can_frame *)skb->data; |
1135 | int matches; |
1136 | |
1137 | if (dev->type != ARPHRD_CAN || dev->nd_net != &init_net) { |
1138 | @@ -612,6 +620,8 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, |
1139 | return 0; |
1140 | } |
1141 | |
1142 | + BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8); |
1143 | + |
1144 | /* update statistics */ |
1145 | can_stats.rx_frames++; |
1146 | can_stats.rx_frames_delta++; |
1147 | diff --git a/net/can/bcm.c b/net/can/bcm.c |
1148 | index bd4282d..2709292 100644 |
1149 | --- a/net/can/bcm.c |
1150 | +++ b/net/can/bcm.c |
1151 | @@ -326,7 +326,7 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head, |
1152 | |
1153 | if (head->nframes) { |
1154 | /* can_frames starting here */ |
1155 | - firstframe = (struct can_frame *) skb_tail_pointer(skb); |
1156 | + firstframe = (struct can_frame *)skb_tail_pointer(skb); |
1157 | |
1158 | memcpy(skb_put(skb, datalen), frames, datalen); |
1159 | |
1160 | @@ -818,6 +818,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, |
1161 | for (i = 0; i < msg_head->nframes; i++) { |
1162 | err = memcpy_fromiovec((u8 *)&op->frames[i], |
1163 | msg->msg_iov, CFSIZ); |
1164 | + |
1165 | + if (op->frames[i].can_dlc > 8) |
1166 | + err = -EINVAL; |
1167 | + |
1168 | if (err < 0) |
1169 | return err; |
1170 | |
1171 | @@ -850,6 +854,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, |
1172 | for (i = 0; i < msg_head->nframes; i++) { |
1173 | err = memcpy_fromiovec((u8 *)&op->frames[i], |
1174 | msg->msg_iov, CFSIZ); |
1175 | + |
1176 | + if (op->frames[i].can_dlc > 8) |
1177 | + err = -EINVAL; |
1178 | + |
1179 | if (err < 0) { |
1180 | if (op->frames != &op->sframe) |
1181 | kfree(op->frames); |
1182 | @@ -1161,9 +1169,12 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk) |
1183 | |
1184 | skb->dev = dev; |
1185 | skb->sk = sk; |
1186 | - can_send(skb, 1); /* send with loopback */ |
1187 | + err = can_send(skb, 1); /* send with loopback */ |
1188 | dev_put(dev); |
1189 | |
1190 | + if (err) |
1191 | + return err; |
1192 | + |
1193 | return CFSIZ + MHSIZ; |
1194 | } |
1195 | |
1196 | @@ -1182,6 +1193,10 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock, |
1197 | if (!bo->bound) |
1198 | return -ENOTCONN; |
1199 | |
1200 | + /* check for valid message length from userspace */ |
1201 | + if (size < MHSIZ || (size - MHSIZ) % CFSIZ) |
1202 | + return -EINVAL; |
1203 | + |
1204 | /* check for alternative ifindex for this bcm_op */ |
1205 | |
1206 | if (!ifindex && msg->msg_name) { |
1207 | @@ -1256,8 +1271,8 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock, |
1208 | break; |
1209 | |
1210 | case TX_SEND: |
1211 | - /* we need at least one can_frame */ |
1212 | - if (msg_head.nframes < 1) |
1213 | + /* we need exactly one can_frame behind the msg head */ |
1214 | + if ((msg_head.nframes != 1) || (size != CFSIZ + MHSIZ)) |
1215 | ret = -EINVAL; |
1216 | else |
1217 | ret = bcm_tx_send(msg, ifindex, sk); |
1218 | diff --git a/net/can/raw.c b/net/can/raw.c |
1219 | index da26bbb..ba33944 100644 |
1220 | --- a/net/can/raw.c |
1221 | +++ b/net/can/raw.c |
1222 | @@ -632,6 +632,9 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock, |
1223 | } else |
1224 | ifindex = ro->ifindex; |
1225 | |
1226 | + if (size != sizeof(struct can_frame)) |
1227 | + return -EINVAL; |
1228 | + |
1229 | dev = dev_get_by_index(&init_net, ifindex); |
1230 | if (!dev) |
1231 | return -ENXIO; |
1232 | diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c |
1233 | index 67b509e..9bdaed8 100644 |
1234 | --- a/net/mac80211/tx.c |
1235 | +++ b/net/mac80211/tx.c |
1236 | @@ -1090,7 +1090,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb, |
1237 | ieee80211_tx_handler *handler; |
1238 | struct ieee80211_txrx_data tx; |
1239 | ieee80211_txrx_result res = TXRX_DROP, res_prepare; |
1240 | - int ret, i; |
1241 | + int ret, i, retries = 0; |
1242 | |
1243 | WARN_ON(__ieee80211_queue_pending(local, control->queue)); |
1244 | |
1245 | @@ -1181,6 +1181,13 @@ retry: |
1246 | if (!__ieee80211_queue_stopped(local, control->queue)) { |
1247 | clear_bit(IEEE80211_LINK_STATE_PENDING, |
1248 | &local->state[control->queue]); |
1249 | + retries++; |
1250 | + /* |
1251 | + * Driver bug, it's rejecting packets but |
1252 | + * not stopping queues. |
1253 | + */ |
1254 | + if (WARN_ON_ONCE(retries > 5)) |
1255 | + goto drop; |
1256 | goto retry; |
1257 | } |
1258 | memcpy(&store->control, control, |
1259 | diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c |
1260 | index 6256795..fc43e22 100644 |
1261 | --- a/net/netfilter/nf_conntrack_proto_tcp.c |
1262 | +++ b/net/netfilter/nf_conntrack_proto_tcp.c |
1263 | @@ -332,12 +332,13 @@ static unsigned int get_conntrack_index(const struct tcphdr *tcph) |
1264 | |
1265 | I. Upper bound for valid data: seq <= sender.td_maxend |
1266 | II. Lower bound for valid data: seq + len >= sender.td_end - receiver.td_maxwin |
1267 | - III. Upper bound for valid ack: sack <= receiver.td_end |
1268 | - IV. Lower bound for valid ack: ack >= receiver.td_end - MAXACKWINDOW |
1269 | + III. Upper bound for valid (s)ack: sack <= receiver.td_end |
1270 | + IV. Lower bound for valid (s)ack: sack >= receiver.td_end - MAXACKWINDOW |
1271 | |
1272 | - where sack is the highest right edge of sack block found in the packet. |
1273 | + where sack is the highest right edge of sack block found in the packet |
1274 | + or ack in the case of packet without SACK option. |
1275 | |
1276 | - The upper bound limit for a valid ack is not ignored - |
1277 | + The upper bound limit for a valid (s)ack is not ignored - |
1278 | we doesn't have to deal with fragments. |
1279 | */ |
1280 | |
1281 | @@ -607,12 +608,12 @@ static int tcp_in_window(const struct nf_conn *ct, |
1282 | before(seq, sender->td_maxend + 1), |
1283 | after(end, sender->td_end - receiver->td_maxwin - 1), |
1284 | before(sack, receiver->td_end + 1), |
1285 | - after(ack, receiver->td_end - MAXACKWINDOW(sender))); |
1286 | + after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)); |
1287 | |
1288 | if (before(seq, sender->td_maxend + 1) && |
1289 | after(end, sender->td_end - receiver->td_maxwin - 1) && |
1290 | before(sack, receiver->td_end + 1) && |
1291 | - after(ack, receiver->td_end - MAXACKWINDOW(sender))) { |
1292 | + after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) { |
1293 | /* |
1294 | * Take into account window scaling (RFC 1323). |
1295 | */ |