/[linux-patches]/hardened/2.6/trunk/2.6.27/1004_linux-2.6.27.5.patch
Gentoo

Contents of /hardened/2.6/trunk/2.6.27/1004_linux-2.6.27.5.patch

Parent Directory Parent Directory | Revision Log Revision Log

Revision 1397 - (show annotations) (download)
Thu Nov 20 01:00:12 2008 UTC (4 years, 7 months ago) by gengor
File size: 82542 byte(s) 
Import current 2.6.27 release to 2.6/trunk/2.6.27 and tag it as 2.6.27-2
1 diff --git a/Documentation/i2c/busses/i2c-sis96x b/Documentation/i2c/busses/i2c-sis96x
2 index 266481f..70e6a0c 100644
3 --- a/Documentation/i2c/busses/i2c-sis96x
4 +++ b/Documentation/i2c/busses/i2c-sis96x
5 @@ -42,7 +42,7 @@ I suspect that this driver could be made to work for the following SiS
6 chipsets as well: 635, and 635T. If anyone owns a board with those chips
7 AND is willing to risk crashing & burning an otherwise well-behaved kernel
8 in the name of progress... please contact me at <mhoffman@lightlink.com> or
9 -via the project's mailing list: <i2c@lm-sensors.org>. Please send bug
10 +via the linux-i2c mailing list: <linux-i2c@vger.kernel.org>. Please send bug
11 reports and/or success stories as well.
12
13
14 diff --git a/MAINTAINERS b/MAINTAINERS
15 index 8dae455..ff24d01 100644
16 --- a/MAINTAINERS
17 +++ b/MAINTAINERS
18 @@ -360,7 +360,7 @@ S: Maintained
19 ALI1563 I2C DRIVER
20 P: Rudolf Marek
21 M: r.marek@assembler.cz
22 -L: i2c@lm-sensors.org
23 +L: linux-i2c@vger.kernel.org
24 S: Maintained
25
26 ALPHA PORT
27 @@ -1681,7 +1681,7 @@ FREESCALE I2C CPM DRIVER
28 P: Jochen Friedrich
29 M: jochen@scram.de
30 L: linuxppc-dev@ozlabs.org
31 -L: i2c@lm-sensors.org
32 +L: linux-i2c@vger.kernel.org
33 S: Maintained
34
35 FREESCALE SOC FS_ENET DRIVER
36 @@ -1982,7 +1982,7 @@ S: Maintained
37 I2C/SMBUS STUB DRIVER
38 P: Mark M. Hoffman
39 M: mhoffman@lightlink.com
40 -L: i2c@lm-sensors.org
41 +L: linux-i2c@vger.kernel.org
42 S: Maintained
43
44 I2C SUBSYSTEM
45 @@ -1990,14 +1990,14 @@ P: Jean Delvare (PC drivers, core)
46 M: khali@linux-fr.org
47 P: Ben Dooks (embedded platforms)
48 M: ben-linux@fluff.org
49 -L: i2c@lm-sensors.org
50 +L: linux-i2c@vger.kernel.org
51 T: quilt http://khali.linux-fr.org/devel/linux-2.6/jdelvare-i2c/
52 S: Maintained
53
54 I2C-TINY-USB DRIVER
55 P: Till Harbaum
56 M: till@harbaum.org
57 -L: i2c@lm-sensors.org
58 +L: linux-i2c@vger.kernel.org
59 T: http://www.harbaum.org/till/i2c_tiny_usb
60 S: Maintained
61
62 @@ -3070,7 +3070,7 @@ S: Maintained
63 OPENCORES I2C BUS DRIVER
64 P: Peter Korsgaard
65 M: jacmet@sunsite.dk
66 -L: i2c@lm-sensors.org
67 +L: linux-i2c@vger.kernel.org
68 S: Maintained
69
70 ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
71 @@ -3144,7 +3144,7 @@ S: Maintained
72 PA SEMI SMBUS DRIVER
73 P: Olof Johansson
74 M: olof@lixom.net
75 -L: i2c@lm-sensors.org
76 +L: linux-i2c@vger.kernel.org
77 S: Maintained
78
79 PARALLEL PORT SUPPORT
80 @@ -3280,7 +3280,7 @@ S: Maintained
81 PNXxxxx I2C DRIVER
82 P: Vitaly Wool
83 M: vitalywool@gmail.com
84 -L: i2c@lm-sensors.org
85 +L: linux-i2c@vger.kernel.org
86 S: Maintained
87
88 PPP PROTOCOL DRIVERS AND COMPRESSORS
89 @@ -3725,7 +3725,7 @@ S: Maintained
90 SIS 96X I2C/SMBUS DRIVER
91 P: Mark M. Hoffman
92 M: mhoffman@lightlink.com
93 -L: i2c@lm-sensors.org
94 +L: linux-i2c@vger.kernel.org
95 S: Maintained
96
97 SIS FRAMEBUFFER DRIVER
98 @@ -4445,7 +4445,7 @@ S: Maintained
99 VIAPRO SMBUS DRIVER
100 P: Jean Delvare
101 M: khali@linux-fr.org
102 -L: i2c@lm-sensors.org
103 +L: linux-i2c@vger.kernel.org
104 S: Maintained
105
106 VIA VELOCITY NETWORK DRIVER
107 diff --git a/arch/powerpc/configs/linkstation_defconfig b/arch/powerpc/configs/linkstation_defconfig
108 index 6fc4c21..d0846ec 100644
109 --- a/arch/powerpc/configs/linkstation_defconfig
110 +++ b/arch/powerpc/configs/linkstation_defconfig
111 @@ -1,7 +1,7 @@
112 #
113 # Automatically generated make config: don't edit
114 -# Linux kernel version: 2.6.27-rc4
115 -# Thu Aug 21 00:52:05 2008
116 +# Linux kernel version: 2.6.27
117 +# Fri Oct 24 00:42:39 2008
118 #
119 # CONFIG_PPC64 is not set
120
121 @@ -934,7 +934,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
122 CONFIG_SERIAL_CORE=y
123 CONFIG_SERIAL_CORE_CONSOLE=y
124 # CONFIG_SERIAL_JSM is not set
125 -CONFIG_SERIAL_OF_PLATFORM=y
126 +# CONFIG_SERIAL_OF_PLATFORM is not set
127 CONFIG_UNIX98_PTYS=y
128 CONFIG_LEGACY_PTYS=y
129 CONFIG_LEGACY_PTY_COUNT=256
130 @@ -1211,7 +1211,6 @@ CONFIG_USB_STORAGE=m
131 # CONFIG_USB_STORAGE_ALAUDA is not set
132 # CONFIG_USB_STORAGE_ONETOUCH is not set
133 # CONFIG_USB_STORAGE_KARMA is not set
134 -# CONFIG_USB_STORAGE_SIERRA is not set
135 # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
136 # CONFIG_USB_LIBUSUAL is not set
137
138 diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
139 index 8920eea..16319a5 100644
140 --- a/arch/powerpc/mm/hash_utils_64.c
141 +++ b/arch/powerpc/mm/hash_utils_64.c
142 @@ -381,8 +381,10 @@ static int __init htab_dt_scan_hugepage_blocks(unsigned long node,
143 printk(KERN_INFO "Huge page(16GB) memory: "
144 "addr = 0x%lX size = 0x%lX pages = %d\n",
145 phys_addr, block_size, expected_pages);
146 - lmb_reserve(phys_addr, block_size * expected_pages);
147 - add_gpage(phys_addr, block_size, expected_pages);
148 + if (phys_addr + (16 * GB) <= lmb_end_of_DRAM()) {
149 + lmb_reserve(phys_addr, block_size * expected_pages);
150 + add_gpage(phys_addr, block_size, expected_pages);
151 + }
152 return 0;
153 }
154
155 diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
156 index d9a1813..b5ae97e 100644
157 --- a/arch/powerpc/mm/numa.c
158 +++ b/arch/powerpc/mm/numa.c
159 @@ -89,6 +89,48 @@ static int __cpuinit fake_numa_create_new_node(unsigned long end_pfn,
160 return 0;
161 }
162
163 +/*
164 + * get_active_region_work_fn - A helper function for get_node_active_region
165 + * Returns datax set to the start_pfn and end_pfn if they contain
166 + * the initial value of datax->start_pfn between them
167 + * @start_pfn: start page(inclusive) of region to check
168 + * @end_pfn: end page(exclusive) of region to check
169 + * @datax: comes in with ->start_pfn set to value to search for and
170 + * goes out with active range if it contains it
171 + * Returns 1 if search value is in range else 0
172 + */
173 +static int __init get_active_region_work_fn(unsigned long start_pfn,
174 + unsigned long end_pfn, void *datax)
175 +{
176 + struct node_active_region *data;
177 + data = (struct node_active_region *)datax;
178 +
179 + if (start_pfn <= data->start_pfn && end_pfn > data->start_pfn) {
180 + data->start_pfn = start_pfn;
181 + data->end_pfn = end_pfn;
182 + return 1;
183 + }
184 + return 0;
185 +
186 +}
187 +
188 +/*
189 + * get_node_active_region - Return active region containing start_pfn
190 + * Active range returned is empty if none found.
191 + * @start_pfn: The page to return the region for.
192 + * @node_ar: Returned set to the active region containing start_pfn
193 + */
194 +static void __init get_node_active_region(unsigned long start_pfn,
195 + struct node_active_region *node_ar)
196 +{
197 + int nid = early_pfn_to_nid(start_pfn);
198 +
199 + node_ar->nid = nid;
200 + node_ar->start_pfn = start_pfn;
201 + node_ar->end_pfn = start_pfn;
202 + work_with_active_regions(nid, get_active_region_work_fn, node_ar);
203 +}
204 +
205 static void __cpuinit map_cpu_to_node(int cpu, int node)
206 {
207 numa_cpu_lookup_table[cpu] = node;
208 @@ -837,38 +879,53 @@ void __init do_init_bootmem(void)
209 start_pfn, end_pfn);
210
211 free_bootmem_with_active_regions(nid, end_pfn);
212 + }
213
214 - /* Mark reserved regions on this node */
215 - for (i = 0; i < lmb.reserved.cnt; i++) {
216 - unsigned long physbase = lmb.reserved.region[i].base;
217 - unsigned long size = lmb.reserved.region[i].size;
218 - unsigned long start_paddr = start_pfn << PAGE_SHIFT;
219 - unsigned long end_paddr = end_pfn << PAGE_SHIFT;
220 -
221 - if (early_pfn_to_nid(physbase >> PAGE_SHIFT) != nid &&
222 - early_pfn_to_nid((physbase+size-1) >> PAGE_SHIFT) != nid)
223 - continue;
224 -
225 - if (physbase < end_paddr &&
226 - (physbase+size) > start_paddr) {
227 - /* overlaps */
228 - if (physbase < start_paddr) {
229 - size -= start_paddr - physbase;
230 - physbase = start_paddr;
231 - }
232 -
233 - if (size > end_paddr - physbase)
234 - size = end_paddr - physbase;
235 -
236 - dbg("reserve_bootmem %lx %lx\n", physbase,
237 - size);
238 - reserve_bootmem_node(NODE_DATA(nid), physbase,
239 - size, BOOTMEM_DEFAULT);
240 - }
241 + /* Mark reserved regions */
242 + for (i = 0; i < lmb.reserved.cnt; i++) {
243 + unsigned long physbase = lmb.reserved.region[i].base;
244 + unsigned long size = lmb.reserved.region[i].size;
245 + unsigned long start_pfn = physbase >> PAGE_SHIFT;
246 + unsigned long end_pfn = ((physbase + size) >> PAGE_SHIFT);
247 + struct node_active_region node_ar;
248 +
249 + get_node_active_region(start_pfn, &node_ar);
250 + while (start_pfn < end_pfn &&
251 + node_ar.start_pfn < node_ar.end_pfn) {
252 + unsigned long reserve_size = size;
253 + /*
254 + * if reserved region extends past active region
255 + * then trim size to active region
256 + */
257 + if (end_pfn > node_ar.end_pfn)
258 + reserve_size = (node_ar.end_pfn << PAGE_SHIFT)
259 + - (start_pfn << PAGE_SHIFT);
260 + dbg("reserve_bootmem %lx %lx nid=%d\n", physbase,
261 + reserve_size, node_ar.nid);
262 + reserve_bootmem_node(NODE_DATA(node_ar.nid), physbase,
263 + reserve_size, BOOTMEM_DEFAULT);
264 + /*
265 + * if reserved region is contained in the active region
266 + * then done.
267 + */
268 + if (end_pfn <= node_ar.end_pfn)
269 + break;
270 +
271 + /*
272 + * reserved region extends past the active region
273 + * get next active region that contains this
274 + * reserved region
275 + */
276 + start_pfn = node_ar.end_pfn;
277 + physbase = start_pfn << PAGE_SHIFT;
278 + size = size - reserve_size;
279 + get_node_active_region(start_pfn, &node_ar);
280 }
281
282 - sparse_memory_present_with_active_regions(nid);
283 }
284 +
285 + for_each_online_node(nid)
286 + sparse_memory_present_with_active_regions(nid);
287 }
288
289 void __init paging_init(void)
290 diff --git a/arch/powerpc/platforms/embedded6xx/linkstation.c b/arch/powerpc/platforms/embedded6xx/linkstation.c
291 index eb5d74e..2ca7be6 100644
292 --- a/arch/powerpc/platforms/embedded6xx/linkstation.c
293 +++ b/arch/powerpc/platforms/embedded6xx/linkstation.c
294 @@ -13,6 +13,7 @@
295 #include <linux/kernel.h>
296 #include <linux/initrd.h>
297 #include <linux/mtd/physmap.h>
298 +#include <linux/of_platform.h>
299
300 #include <asm/time.h>
301 #include <asm/prom.h>
302 @@ -54,6 +55,19 @@ static struct mtd_partition linkstation_physmap_partitions[] = {
303 },
304 };
305
306 +static __initdata struct of_device_id of_bus_ids[] = {
307 + { .type = "soc", },
308 + { .compatible = "simple-bus", },
309 + {},
310 +};
311 +
312 +static int __init declare_of_platform_devices(void)
313 +{
314 + of_platform_bus_probe(NULL, of_bus_ids, NULL);
315 + return 0;
316 +}
317 +machine_device_initcall(linkstation, declare_of_platform_devices);
318 +
319 static int __init linkstation_add_bridge(struct device_node *dev)
320 {
321 #ifdef CONFIG_PCI
322 diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
323 index 00b9b4d..fdfca4f 100644
324 --- a/arch/s390/kernel/smp.c
325 +++ b/arch/s390/kernel/smp.c
326 @@ -1117,9 +1117,7 @@ out:
327 return rc;
328 }
329
330 -static ssize_t __ref rescan_store(struct sys_device *dev,
331 - struct sysdev_attribute *attr,
332 - const char *buf,
333 +static ssize_t __ref rescan_store(struct sysdev_class *class, const char *buf,
334 size_t count)
335 {
336 int rc;
337 @@ -1127,12 +1125,10 @@ static ssize_t __ref rescan_store(struct sys_device *dev,
338 rc = smp_rescan_cpus();
339 return rc ? rc : count;
340 }
341 -static SYSDEV_ATTR(rescan, 0200, NULL, rescan_store);
342 +static SYSDEV_CLASS_ATTR(rescan, 0200, NULL, rescan_store);
343 #endif /* CONFIG_HOTPLUG_CPU */
344
345 -static ssize_t dispatching_show(struct sys_device *dev,
346 - struct sysdev_attribute *attr,
347 - char *buf)
348 +static ssize_t dispatching_show(struct sysdev_class *class, char *buf)
349 {
350 ssize_t count;
351
352 @@ -1142,9 +1138,8 @@ static ssize_t dispatching_show(struct sys_device *dev,
353 return count;
354 }
355
356 -static ssize_t dispatching_store(struct sys_device *dev,
357 - struct sysdev_attribute *attr,
358 - const char *buf, size_t count)
359 +static ssize_t dispatching_store(struct sysdev_class *dev, const char *buf,
360 + size_t count)
361 {
362 int val, rc;
363 char delim;
364 @@ -1166,7 +1161,8 @@ out:
365 put_online_cpus();
366 return rc ? rc : count;
367 }
368 -static SYSDEV_ATTR(dispatching, 0644, dispatching_show, dispatching_store);
369 +static SYSDEV_CLASS_ATTR(dispatching, 0644, dispatching_show,
370 + dispatching_store);
371
372 static int __init topology_init(void)
373 {
374 @@ -1176,13 +1172,11 @@ static int __init topology_init(void)
375 register_cpu_notifier(&smp_cpu_nb);
376
377 #ifdef CONFIG_HOTPLUG_CPU
378 - rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
379 - &attr_rescan.attr);
380 + rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_rescan);
381 if (rc)
382 return rc;
383 #endif
384 - rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
385 - &attr_dispatching.attr);
386 + rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_dispatching);
387 if (rc)
388 return rc;
389 for_each_present_cpu(cpu) {
390 diff --git a/arch/sparc64/kernel/trampoline.S b/arch/sparc64/kernel/trampoline.S
391 index 704a3af..83abd5a 100644
392 --- a/arch/sparc64/kernel/trampoline.S
393 +++ b/arch/sparc64/kernel/trampoline.S
394 @@ -328,6 +328,12 @@ after_lock_tlb:
395
396 wrpr %g0, 0, %wstate
397
398 + sethi %hi(prom_entry_lock), %g2
399 +1: ldstub [%g2 + %lo(prom_entry_lock)], %g1
400 + membar #StoreLoad | #StoreStore
401 + brnz,pn %g1, 1b
402 + nop
403 +
404 /* As a hack, put &init_thread_union into %g6.
405 * prom_world() loads from here to restore the %asi
406 * register.
407 @@ -337,7 +343,7 @@ after_lock_tlb:
408
409 sethi %hi(is_sun4v), %o0
410 lduw [%o0 + %lo(is_sun4v)], %o0
411 - brz,pt %o0, 1f
412 + brz,pt %o0, 2f
413 nop
414
415 TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
416 @@ -369,10 +375,10 @@ after_lock_tlb:
417 call %o1
418 add %sp, (2047 + 128), %o0
419
420 - ba,pt %xcc, 2f
421 + ba,pt %xcc, 3f
422 nop
423
424 -1: sethi %hi(sparc64_ttable_tl0), %o0
425 +2: sethi %hi(sparc64_ttable_tl0), %o0
426 set prom_set_trap_table_name, %g2
427 stx %g2, [%sp + 2047 + 128 + 0x00]
428 mov 1, %g2
429 @@ -386,7 +392,11 @@ after_lock_tlb:
430 call %o1
431 add %sp, (2047 + 128), %o0
432
433 -2: ldx [%l0], %g6
434 +3: sethi %hi(prom_entry_lock), %g2
435 + stb %g0, [%g2 + %lo(prom_entry_lock)]
436 + membar #StoreStore | #StoreLoad
437 +
438 + ldx [%l0], %g6
439 ldx [%g6 + TI_TASK], %g4
440
441 mov 1, %g5
442 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
443 index e12e0e4..5a7c539 100644
444 --- a/arch/x86/kernel/process_64.c
445 +++ b/arch/x86/kernel/process_64.c
446 @@ -729,12 +729,12 @@ unsigned long get_wchan(struct task_struct *p)
447 if (!p || p == current || p->state==TASK_RUNNING)
448 return 0;
449 stack = (unsigned long)task_stack_page(p);
450 - if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
451 + if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
452 return 0;
453 fp = *(u64 *)(p->thread.sp);
454 do {
455 if (fp < (unsigned long)stack ||
456 - fp > (unsigned long)stack+THREAD_SIZE)
457 + fp >= (unsigned long)stack+THREAD_SIZE)
458 return 0;
459 ip = *(u64 *)(fp+8);
460 if (!in_sched_functions(ip))
461 diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
462 index 05191bb..0a23b57 100644
463 --- a/arch/x86/kernel/rtc.c
464 +++ b/arch/x86/kernel/rtc.c
465 @@ -223,11 +223,25 @@ static struct platform_device rtc_device = {
466 static __init int add_rtc_cmos(void)
467 {
468 #ifdef CONFIG_PNP
469 - if (!pnp_platform_devices)
470 - platform_device_register(&rtc_device);
471 -#else
472 + static const char *ids[] __initconst =
473 + { "PNP0b00", "PNP0b01", "PNP0b02", };
474 + struct pnp_dev *dev;
475 + struct pnp_id *id;
476 + int i;
477 +
478 + pnp_for_each_dev(dev) {
479 + for (id = dev->id; id; id = id->next) {
480 + for (i = 0; i < ARRAY_SIZE(ids); i++) {
481 + if (compare_pnp_id(id, ids[i]) != 0)
482 + return 0;
483 + }
484 + }
485 + }
486 +#endif
487 +
488 platform_device_register(&rtc_device);
489 -#endif /* CONFIG_PNP */
490 + dev_info(&rtc_device.dev,
491 + "registered platform RTC device (no PNP device found)\n");
492 return 0;
493 }
494 device_initcall(add_rtc_cmos);
495 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
496 index 2a50e0f..ac144c2 100644
497 --- a/arch/x86/mm/pat.c
498 +++ b/arch/x86/mm/pat.c
499 @@ -403,12 +403,16 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
500 return 1;
501 }
502 #else
503 +/* This check is needed to avoid cache aliasing when PAT is enabled */
504 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
505 {
506 u64 from = ((u64)pfn) << PAGE_SHIFT;
507 u64 to = from + size;
508 u64 cursor = from;
509
510 + if (!pat_enabled)
511 + return 1;
512 +
513 while (cursor < to) {
514 if (!devmem_is_allowed(pfn)) {
515 printk(KERN_INFO
516 diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
517 index 1dfec41..59352d9 100644
518 --- a/drivers/acpi/button.c
519 +++ b/drivers/acpi/button.c
520 @@ -262,6 +262,7 @@ static int acpi_lid_send_state(struct acpi_button *button)
521 return -ENODEV;
522 /* input layer checks if event is redundant */
523 input_report_switch(button->input, SW_LID, !state);
524 + input_sync(button->input);
525 return 0;
526 }
527
528 @@ -285,8 +286,8 @@ static void acpi_button_notify(acpi_handle handle, u32 event, void *data)
529 input_report_key(input, keycode, 1);
530 input_sync(input);
531 input_report_key(input, keycode, 0);
532 + input_sync(input);
533 }
534 - input_sync(input);
535
536 acpi_bus_generate_proc_event(button->device, event,
537 ++button->pushed);
538 diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
539 index 13593f9..444cd9e 100644
540 --- a/drivers/acpi/ec.c
541 +++ b/drivers/acpi/ec.c
542 @@ -1,7 +1,7 @@
543 /*
544 - * ec.c - ACPI Embedded Controller Driver (v2.0)
545 + * ec.c - ACPI Embedded Controller Driver (v2.1)
546 *
547 - * Copyright (C) 2006, 2007 Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>
548 + * Copyright (C) 2006-2008 Alexey Starikovskiy <astarikovskiy@suse.de>
549 * Copyright (C) 2006 Denis Sadykov <denis.m.sadykov@intel.com>
550 * Copyright (C) 2004 Luming Yu <luming.yu@intel.com>
551 * Copyright (C) 2001, 2002 Andy Grover <andrew.grover@intel.com>
552 @@ -26,7 +26,7 @@
553 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
554 */
555
556 -/* Uncomment next line to get verbose print outs*/
557 +/* Uncomment next line to get verbose printout */
558 /* #define DEBUG */
559
560 #include <linux/kernel.h>
561 @@ -38,6 +38,7 @@
562 #include <linux/seq_file.h>
563 #include <linux/interrupt.h>
564 #include <linux/list.h>
565 +#include <linux/spinlock.h>
566 #include <asm/io.h>
567 #include <acpi/acpi_bus.h>
568 #include <acpi/acpi_drivers.h>
569 @@ -65,22 +66,21 @@ enum ec_command {
570 ACPI_EC_COMMAND_QUERY = 0x84,
571 };
572
573 -/* EC events */
574 -enum ec_event {
575 - ACPI_EC_EVENT_OBF_1 = 1, /* Output buffer full */
576 - ACPI_EC_EVENT_IBF_0, /* Input buffer empty */
577 -};
578 -
579 #define ACPI_EC_DELAY 500 /* Wait 500ms max. during EC ops */
580 #define ACPI_EC_UDELAY_GLK 1000 /* Wait 1ms max. to get global lock */
581 #define ACPI_EC_UDELAY 100 /* Wait 100us before polling EC again */
582
583 +#define ACPI_EC_STORM_THRESHOLD 20 /* number of false interrupts
584 + per one transaction */
585 +
586 enum {
587 - EC_FLAGS_WAIT_GPE = 0, /* Don't check status until GPE arrives */
588 EC_FLAGS_QUERY_PENDING, /* Query is pending */
589 - EC_FLAGS_GPE_MODE, /* Expect GPE to be sent for status change */
590 + EC_FLAGS_GPE_MODE, /* Expect GPE to be sent
591 + * for status change */
592 EC_FLAGS_NO_GPE, /* Don't use GPE mode */
593 - EC_FLAGS_RESCHEDULE_POLL /* Re-schedule poll */
594 + EC_FLAGS_GPE_STORM, /* GPE storm detected */
595 + EC_FLAGS_HANDLERS_INSTALLED /* Handlers for GPE and
596 + * OpReg are installed */
597 };
598
599 /* If we find an EC via the ECDT, we need to keep a ptr to its context */
600 @@ -95,6 +95,15 @@ struct acpi_ec_query_handler {
601 u8 query_bit;
602 };
603
604 +struct transaction {
605 + const u8 *wdata;
606 + u8 *rdata;
607 + unsigned short irq_count;
608 + u8 command;
609 + u8 wlen;
610 + u8 rlen;
611 +};
612 +
613 static struct acpi_ec {
614 acpi_handle handle;
615 unsigned long gpe;
616 @@ -105,9 +114,8 @@ static struct acpi_ec {
617 struct mutex lock;
618 wait_queue_head_t wait;
619 struct list_head list;
620 - struct delayed_work work;
621 - atomic_t irq_count;
622 - u8 handlers_installed;
623 + struct transaction *curr;
624 + spinlock_t curr_lock;
625 } *boot_ec, *first_ec;
626
627 /*
628 @@ -150,7 +158,7 @@ static inline u8 acpi_ec_read_data(struct acpi_ec *ec)
629 {
630 u8 x = inb(ec->data_addr);
631 pr_debug(PREFIX "---> data = 0x%2.2x\n", x);
632 - return inb(ec->data_addr);
633 + return x;
634 }
635
636 static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command)
637 @@ -165,158 +173,172 @@ static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
638 outb(data, ec->data_addr);
639 }
640
641 -static inline int acpi_ec_check_status(struct acpi_ec *ec, enum ec_event event)
642 +static int ec_transaction_done(struct acpi_ec *ec)
643 {
644 - if (test_bit(EC_FLAGS_WAIT_GPE, &ec->flags))
645 - return 0;
646 - if (event == ACPI_EC_EVENT_OBF_1) {
647 - if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_OBF)
648 - return 1;
649 - } else if (event == ACPI_EC_EVENT_IBF_0) {
650 - if (!(acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF))
651 - return 1;
652 - }
653 -
654 - return 0;
655 + unsigned long flags;
656 + int ret = 0;
657 + spin_lock_irqsave(&ec->curr_lock, flags);
658 + if (!ec->curr || (!ec->curr->wlen && !ec->curr->rlen))
659 + ret = 1;
660 + spin_unlock_irqrestore(&ec->curr_lock, flags);
661 + return ret;
662 }
663
664 -static void ec_schedule_ec_poll(struct acpi_ec *ec)
665 +static void gpe_transaction(struct acpi_ec *ec, u8 status)
666 {
667 - if (test_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags))
668 - schedule_delayed_work(&ec->work,
669 - msecs_to_jiffies(ACPI_EC_DELAY));
670 + unsigned long flags;
671 + spin_lock_irqsave(&ec->curr_lock, flags);
672 + if (!ec->curr)
673 + goto unlock;
674 + if (ec->curr->wlen > 0) {
675 + if ((status & ACPI_EC_FLAG_IBF) == 0) {
676 + acpi_ec_write_data(ec, *(ec->curr->wdata++));
677 + --ec->curr->wlen;
678 + } else
679 + /* false interrupt, state didn't change */
680 + ++ec->curr->irq_count;
681 +
682 + } else if (ec->curr->rlen > 0) {
683 + if ((status & ACPI_EC_FLAG_OBF) == 1) {
684 + *(ec->curr->rdata++) = acpi_ec_read_data(ec);
685 + --ec->curr->rlen;
686 + } else
687 + /* false interrupt, state didn't change */
688 + ++ec->curr->irq_count;
689 + }
690 +unlock:
691 + spin_unlock_irqrestore(&ec->curr_lock, flags);
692 }
693
694 -static void ec_switch_to_poll_mode(struct acpi_ec *ec)
695 +static int acpi_ec_wait(struct acpi_ec *ec)
696 {
697 + if (wait_event_timeout(ec->wait, ec_transaction_done(ec),
698 + msecs_to_jiffies(ACPI_EC_DELAY)))
699 + return 0;
700 + /* missing GPEs, switch back to poll mode */
701 + if (printk_ratelimit())
702 + pr_info(PREFIX "missing confirmations, "
703 + "switch off interrupt mode.\n");
704 set_bit(EC_FLAGS_NO_GPE, &ec->flags);
705 clear_bit(EC_FLAGS_GPE_MODE, &ec->flags);
706 - acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
707 - set_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
708 + return 1;
709 }
710
711 -static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, int force_poll)
712 +static void acpi_ec_gpe_query(void *ec_cxt);
713 +
714 +static int ec_check_sci(struct acpi_ec *ec, u8 state)
715 {
716 - atomic_set(&ec->irq_count, 0);
717 - if (likely(test_bit(EC_FLAGS_GPE_MODE, &ec->flags)) &&
718 - likely(!force_poll)) {
719 - if (wait_event_timeout(ec->wait, acpi_ec_check_status(ec, event),
720 - msecs_to_jiffies(ACPI_EC_DELAY)))
721 - return 0;
722 - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
723 - if (acpi_ec_check_status(ec, event)) {
724 - /* missing GPEs, switch back to poll mode */
725 - if (printk_ratelimit())
726 - pr_info(PREFIX "missing confirmations, "
727 - "switch off interrupt mode.\n");
728 - ec_switch_to_poll_mode(ec);
729 - ec_schedule_ec_poll(ec);
730 - return 0;
731 - }
732 - } else {
733 - unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
734 - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
735 - while (time_before(jiffies, delay)) {
736 - if (acpi_ec_check_status(ec, event))
737 - return 0;
738 - msleep(1);
739 - }
740 - if (acpi_ec_check_status(ec,event))
741 + if (state & ACPI_EC_FLAG_SCI) {
742 + if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
743 + return acpi_os_execute(OSL_EC_BURST_HANDLER,
744 + acpi_ec_gpe_query, ec);
745 + }
746 + return 0;
747 +}
748 +
749 +static int ec_poll(struct acpi_ec *ec)
750 +{
751 + unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
752 + msleep(1);
753 + while (time_before(jiffies, delay)) {
754 + gpe_transaction(ec, acpi_ec_read_status(ec));
755 + msleep(1);
756 + if (ec_transaction_done(ec))
757 return 0;
758 }
759 - pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n",
760 - acpi_ec_read_status(ec),
761 - (event == ACPI_EC_EVENT_OBF_1) ? "\"b0=1\"" : "\"b1=0\"");
762 return -ETIME;
763 }
764
765 -static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command,
766 - const u8 * wdata, unsigned wdata_len,
767 - u8 * rdata, unsigned rdata_len,
768 +static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
769 + struct transaction *t,
770 int force_poll)
771 {
772 - int result = 0;
773 - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
774 + unsigned long tmp;
775 + int ret = 0;
776 pr_debug(PREFIX "transaction start\n");
777 - acpi_ec_write_cmd(ec, command);
778 - for (; wdata_len > 0; --wdata_len) {
779 - result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll);
780 - if (result) {
781 - pr_err(PREFIX
782 - "write_cmd timeout, command = %d\n", command);
783 - goto end;
784 - }
785 - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
786 - acpi_ec_write_data(ec, *(wdata++));
787 + /* disable GPE during transaction if storm is detected */
788 + if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
789 + clear_bit(EC_FLAGS_GPE_MODE, &ec->flags);
790 + acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
791 }
792 -
793 - if (!rdata_len) {
794 - result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll);
795 - if (result) {
796 - pr_err(PREFIX
797 - "finish-write timeout, command = %d\n", command);
798 - goto end;
799 - }
800 - } else if (command == ACPI_EC_COMMAND_QUERY)
801 + /* start transaction */
802 + spin_lock_irqsave(&ec->curr_lock, tmp);
803 + /* following two actions should be kept atomic */
804 + t->irq_count = 0;
805 + ec->curr = t;
806 + acpi_ec_write_cmd(ec, ec->curr->command);
807 + if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
808 clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
809 -
810 - for (; rdata_len > 0; --rdata_len) {
811 - result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1, force_poll);
812 - if (result) {
813 - pr_err(PREFIX "read timeout, command = %d\n", command);
814 - goto end;
815 - }
816 - /* Don't expect GPE after last read */
817 - if (rdata_len > 1)
818 - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
819 - *(rdata++) = acpi_ec_read_data(ec);
820 - }
821 - end:
822 + spin_unlock_irqrestore(&ec->curr_lock, tmp);
823 + /* if we selected poll mode or failed in GPE-mode do a poll loop */
824 + if (force_poll ||
825 + !test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ||
826 + acpi_ec_wait(ec))
827 + ret = ec_poll(ec);
828 pr_debug(PREFIX "transaction end\n");
829 - return result;
830 + spin_lock_irqsave(&ec->curr_lock, tmp);
831 + ec->curr = NULL;
832 + spin_unlock_irqrestore(&ec->curr_lock, tmp);
833 + if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
834 + /* check if we received SCI during transaction */
835 + ec_check_sci(ec, acpi_ec_read_status(ec));
836 + /* it is safe to enable GPE outside of transaction */
837 + acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
838 + } else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
839 + t->irq_count > ACPI_EC_STORM_THRESHOLD) {
840 + pr_debug(PREFIX "GPE storm detected\n");
841 + set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
842 + }
843 + return ret;
844 +}
845 +
846 +static int ec_check_ibf0(struct acpi_ec *ec)
847 +{
848 + u8 status = acpi_ec_read_status(ec);
849 + return (status & ACPI_EC_FLAG_IBF) == 0;
850 }
851
852 -static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
853 - const u8 * wdata, unsigned wdata_len,
854 - u8 * rdata, unsigned rdata_len,
855 +static int ec_wait_ibf0(struct acpi_ec *ec)
856 +{
857 + unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
858 + /* interrupt wait manually if GPE mode is not active */
859 + unsigned long timeout = test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ?
860 + msecs_to_jiffies(ACPI_EC_DELAY) : msecs_to_jiffies(1);
861 + while (time_before(jiffies, delay))
862 + if (wait_event_timeout(ec->wait, ec_check_ibf0(ec), timeout))
863 + return 0;
864 + return -ETIME;
865 +}
866 +
867 +static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t,
868 int force_poll)
869 {
870 int status;
871 u32 glk;
872 -
873 - if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata))
874 + if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))
875 return -EINVAL;
876 -
877 - if (rdata)
878 - memset(rdata, 0, rdata_len);
879 -
880 + if (t->rdata)
881 + memset(t->rdata, 0, t->rlen);
882 mutex_lock(&ec->lock);
883 if (ec->global_lock) {
884 status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
885 if (ACPI_FAILURE(status)) {
886 - mutex_unlock(&ec->lock);
887 - return -ENODEV;
888 + status = -ENODEV;
889 + goto unlock;
890 }
891 }
892 -
893 - status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, 0);
894 - if (status) {
895 + if (ec_wait_ibf0(ec)) {
896 pr_err(PREFIX "input buffer is not empty, "
897 "aborting transaction\n");
898 + status = -ETIME;
899 goto end;
900 }
901 -
902 - status = acpi_ec_transaction_unlocked(ec, command,
903 - wdata, wdata_len,
904 - rdata, rdata_len,
905 - force_poll);
906 -
907 - end:
908 -
909 + status = acpi_ec_transaction_unlocked(ec, t, force_poll);
910 +end:
911 if (ec->global_lock)
912 acpi_release_global_lock(glk);
913 +unlock:
914 mutex_unlock(&ec->lock);
915 -
916 return status;
917 }
918
919 @@ -327,21 +349,32 @@ static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
920 int acpi_ec_burst_enable(struct acpi_ec *ec)
921 {
922 u8 d;
923 - return acpi_ec_transaction(ec, ACPI_EC_BURST_ENABLE, NULL, 0, &d, 1, 0);
924 + struct transaction t = {.command = ACPI_EC_BURST_ENABLE,
925 + .wdata = NULL, .rdata = &d,
926 + .wlen = 0, .rlen = 1};
927 +
928 + return acpi_ec_transaction(ec, &t, 0);
929 }
930
931 int acpi_ec_burst_disable(struct acpi_ec *ec)
932 {
933 - return acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE, NULL, 0, NULL, 0, 0);
934 + struct transaction t = {.command = ACPI_EC_BURST_DISABLE,
935 + .wdata = NULL, .rdata = NULL,
936 + .wlen = 0, .rlen = 0};
937 +
938 + return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ?
939 + acpi_ec_transaction(ec, &t, 0) : 0;
940 }
941
942 static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
943 {
944 int result;
945 u8 d;
946 + struct transaction t = {.command = ACPI_EC_COMMAND_READ,
947 + .wdata = &address, .rdata = &d,
948 + .wlen = 1, .rlen = 1};
949
950 - result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_READ,
951 - &address, 1, &d, 1, 0);
952 + result = acpi_ec_transaction(ec, &t, 0);
953 *data = d;
954 return result;
955 }
956 @@ -349,8 +382,11 @@ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
957 static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
958 {
959 u8 wdata[2] = { address, data };
960 - return acpi_ec_transaction(ec, ACPI_EC_COMMAND_WRITE,
961 - wdata, 2, NULL, 0, 0);
962 + struct transaction t = {.command = ACPI_EC_COMMAND_WRITE,
963 + .wdata = wdata, .rdata = NULL,
964 + .wlen = 2, .rlen = 0};
965 +
966 + return acpi_ec_transaction(ec, &t, 0);
967 }
968
969 /*
970 @@ -412,12 +448,13 @@ int ec_transaction(u8 command,
971 u8 * rdata, unsigned rdata_len,
972 int force_poll)
973 {
974 + struct transaction t = {.command = command,
975 + .wdata = wdata, .rdata = rdata,
976 + .wlen = wdata_len, .rlen = rdata_len};
977 if (!first_ec)
978 return -ENODEV;
979
980 - return acpi_ec_transaction(first_ec, command, wdata,
981 - wdata_len, rdata, rdata_len,
982 - force_poll);
983 + return acpi_ec_transaction(first_ec, &t, force_poll);
984 }
985
986 EXPORT_SYMBOL(ec_transaction);
987 @@ -426,7 +463,9 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 * data)
988 {
989 int result;
990 u8 d;
991 -
992 + struct transaction t = {.command = ACPI_EC_COMMAND_QUERY,
993 + .wdata = NULL, .rdata = &d,
994 + .wlen = 0, .rlen = 1};
995 if (!ec || !data)
996 return -EINVAL;
997
998 @@ -436,7 +475,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 * data)
999 * bit to be cleared (and thus clearing the interrupt source).
1000 */
1001
1002 - result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_QUERY, NULL, 0, &d, 1, 0);
1003 + result = acpi_ec_transaction(ec, &t, 0);
1004 if (result)
1005 return result;
1006
1007 @@ -513,46 +552,26 @@ static void acpi_ec_gpe_query(void *ec_cxt)
1008
1009 static u32 acpi_ec_gpe_handler(void *data)
1010 {
1011 - acpi_status status = AE_OK;
1012 struct acpi_ec *ec = data;
1013 - u8 state = acpi_ec_read_status(ec);
1014 + u8 status;
1015
1016 pr_debug(PREFIX "~~~> interrupt\n");
1017 - atomic_inc(&ec->irq_count);
1018 - if (atomic_read(&ec->irq_count) > 5) {
1019 - pr_err(PREFIX "GPE storm detected, disabling EC GPE\n");
1020 - ec_switch_to_poll_mode(ec);
1021 - goto end;
1022 - }
1023 - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
1024 - if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags))
1025 + status = acpi_ec_read_status(ec);
1026 +
1027 + gpe_transaction(ec, status);
1028 + if (ec_transaction_done(ec) && (status & ACPI_EC_FLAG_IBF) == 0)
1029 wake_up(&ec->wait);
1030
1031 - if (state & ACPI_EC_FLAG_SCI) {
1032 - if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
1033 - status = acpi_os_execute(OSL_EC_BURST_HANDLER,
1034 - acpi_ec_gpe_query, ec);
1035 - } else if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
1036 - !test_bit(EC_FLAGS_NO_GPE, &ec->flags) &&
1037 - in_interrupt()) {
1038 + ec_check_sci(ec, status);
1039 + if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
1040 + !test_bit(EC_FLAGS_NO_GPE, &ec->flags)) {
1041 /* this is non-query, must be confirmation */
1042 if (printk_ratelimit())
1043 pr_info(PREFIX "non-query interrupt received,"
1044 " switching to interrupt mode\n");
1045 set_bit(EC_FLAGS_GPE_MODE, &ec->flags);
1046 - clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
1047 }
1048 -end:
1049 - ec_schedule_ec_poll(ec);
1050 - return ACPI_SUCCESS(status) ?
1051 - ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED;
1052 -}
1053 -
1054 -static void do_ec_poll(struct work_struct *work)
1055 -{
1056 - struct acpi_ec *ec = container_of(work, struct acpi_ec, work.work);
1057 - atomic_set(&ec->irq_count, 0);
1058 - (void)acpi_ec_gpe_handler(ec);
1059 + return ACPI_INTERRUPT_HANDLED;
1060 }
1061
1062 /* --------------------------------------------------------------------------
1063 @@ -696,8 +715,7 @@ static struct acpi_ec *make_acpi_ec(void)
1064 mutex_init(&ec->lock);
1065 init_waitqueue_head(&ec->wait);
1066 INIT_LIST_HEAD(&ec->list);
1067 - INIT_DELAYED_WORK_DEFERRABLE(&ec->work, do_ec_poll);
1068 - atomic_set(&ec->irq_count, 0);
1069 + spin_lock_init(&ec->curr_lock);
1070 return ec;
1071 }
1072
1073 @@ -736,22 +754,15 @@ ec_parse_device(acpi_handle handle, u32 Level, void *context, void **retval)
1074 return AE_CTRL_TERMINATE;
1075 }
1076
1077 -static void ec_poll_stop(struct acpi_ec *ec)
1078 -{
1079 - clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
1080 - cancel_delayed_work(&ec->work);
1081 -}
1082 -
1083 static void ec_remove_handlers(struct acpi_ec *ec)
1084 {
1085 - ec_poll_stop(ec);
1086 if (ACPI_FAILURE(acpi_remove_address_space_handler(ec->handle,
1087 ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
1088 pr_err(PREFIX "failed to remove space handler\n");
1089 if (ACPI_FAILURE(acpi_remove_gpe_handler(NULL, ec->gpe,
1090 &acpi_ec_gpe_handler)))
1091 pr_err(PREFIX "failed to remove gpe handler\n");
1092 - ec->handlers_installed = 0;
1093 + clear_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
1094 }
1095
1096 static int acpi_ec_add(struct acpi_device *device)
1097 @@ -846,17 +857,15 @@ ec_parse_io_ports(struct acpi_resource *resource, void *context)
1098 static int ec_install_handlers(struct acpi_ec *ec)
1099 {
1100 acpi_status status;
1101 - if (ec->handlers_installed)
1102 + if (test_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags))
1103 return 0;
1104 status = acpi_install_gpe_handler(NULL, ec->gpe,
1105 - ACPI_GPE_EDGE_TRIGGERED,
1106 - &acpi_ec_gpe_handler, ec);
1107 + ACPI_GPE_EDGE_TRIGGERED,
1108 + &acpi_ec_gpe_handler, ec);
1109 if (ACPI_FAILURE(status))
1110 return -ENODEV;
1111 -
1112 acpi_set_gpe_type(NULL, ec->gpe, ACPI_GPE_TYPE_RUNTIME);
1113 acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
1114 -
1115 status = acpi_install_address_space_handler(ec->handle,
1116 ACPI_ADR_SPACE_EC,
1117 &acpi_ec_space_handler,
1118 @@ -866,7 +875,7 @@ static int ec_install_handlers(struct acpi_ec *ec)
1119 return -ENODEV;
1120 }
1121
1122 - ec->handlers_installed = 1;
1123 + set_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
1124 return 0;
1125 }
1126
1127 @@ -887,7 +896,6 @@ static int acpi_ec_start(struct acpi_device *device)
1128
1129 /* EC is fully operational, allow queries */
1130 clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
1131 - ec_schedule_ec_poll(ec);
1132 return ret;
1133 }
1134
1135 @@ -906,7 +914,7 @@ static int acpi_ec_stop(struct acpi_device *device, int type)
1136
1137 int __init acpi_boot_ec_enable(void)
1138 {
1139 - if (!boot_ec || boot_ec->handlers_installed)
1140 + if (!boot_ec || test_bit(EC_FLAGS_HANDLERS_INSTALLED, &boot_ec->flags))
1141 return 0;
1142 if (!ec_install_handlers(boot_ec)) {
1143 first_ec = boot_ec;
1144 diff --git a/drivers/acpi/hardware/hwsleep.c b/drivers/acpi/hardware/hwsleep.c
1145 index ecb6ace..25dccdf 100644
1146 --- a/drivers/acpi/hardware/hwsleep.c
1147 +++ b/drivers/acpi/hardware/hwsleep.c
1148 @@ -612,6 +612,13 @@ acpi_status acpi_leave_sleep_state(u8 sleep_state)
1149 }
1150 /* TBD: _WAK "sometimes" returns stuff - do we want to look at it? */
1151
1152 + /*
1153 + * Some BIOSes assume that WAK_STS will be cleared on resume and use
1154 + * it to determine whether the system is rebooting or resuming. Clear
1155 + * it for compatibility.
1156 + */
1157 + acpi_set_register(ACPI_BITREG_WAKE_STATUS, 1);
1158 +
1159 acpi_gbl_system_awake_and_running = TRUE;
1160
1161 /* Enable power button */
1162 diff --git a/drivers/acpi/reboot.c b/drivers/acpi/reboot.c
1163 index a6b662c..755baf2 100644
1164 --- a/drivers/acpi/reboot.c
1165 +++ b/drivers/acpi/reboot.c
1166 @@ -15,9 +15,28 @@ void acpi_reboot(void)
1167
1168 rr = &acpi_gbl_FADT.reset_register;
1169
1170 - /* Is the reset register supported? */
1171 - if (!(acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER) ||
1172 - rr->bit_width != 8 || rr->bit_offset != 0)
1173 + /*
1174 + * Is the ACPI reset register supported?
1175 + *
1176 + * According to ACPI 3.0, FADT.flags.RESET_REG_SUP indicates
1177 + * whether the ACPI reset mechanism is supported.
1178 + *
1179 + * However, some boxes have this bit clear, yet a valid
1180 + * ACPI_RESET_REG & RESET_VALUE, and ACPI reboot is the only
1181 + * mechanism that works for them after S3.
1182 + *
1183 + * This suggests that other operating systems may not be checking
1184 + * the RESET_REG_SUP bit, and are using other means to decide
1185 + * whether to use the ACPI reboot mechanism or not.
1186 + *
1187 + * So when acpi reboot is requested,
1188 + * only the reset_register is checked. If the following
1189 + * conditions are met, it indicates that the reset register is supported.
1190 + * a. reset_register is not zero
1191 + * b. the access width is eight
1192 + * c. the bit_offset is zero
1193 + */
1194 + if (!(rr->address) || rr->bit_width != 8 || rr->bit_offset != 0)
1195 return;
1196
1197 reset_value = acpi_gbl_FADT.reset_value;
1198 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
1199 index 79e3a8e..8228ae3 100644
1200 --- a/drivers/ata/libata-core.c
1201 +++ b/drivers/ata/libata-core.c
1202 @@ -5259,6 +5259,8 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
1203
1204 #ifdef CONFIG_ATA_SFF
1205 INIT_DELAYED_WORK(&ap->port_task, ata_pio_task);
1206 +#else
1207 + INIT_DELAYED_WORK(&ap->port_task, NULL);
1208 #endif
1209 INIT_DELAYED_WORK(&ap->hotplug_task, ata_scsi_hotplug);
1210 INIT_WORK(&ap->scsi_rescan_task, ata_scsi_dev_rescan);
1211 diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
1212 index 0221c9a..35fd67d 100644
1213 --- a/drivers/ata/pata_it821x.c
1214 +++ b/drivers/ata/pata_it821x.c
1215 @@ -557,9 +557,8 @@ static unsigned int it821x_read_id(struct ata_device *adev,
1216 if (strstr(model_num, "Integrated Technology Express")) {
1217 /* Set feature bits the firmware neglects */
1218 id[49] |= 0x0300; /* LBA, DMA */
1219 - id[82] |= 0x0400; /* LBA48 */
1220 id[83] &= 0x7FFF;
1221 - id[83] |= 0x4000; /* Word 83 is valid */
1222 + id[83] |= 0x4400; /* Word 83 is valid and LBA48 */
1223 id[86] |= 0x0400; /* LBA48 on */
1224 id[ATA_ID_MAJOR_VER] |= 0x1F;
1225 }
1226 diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
1227 index 14601dc..8714c36 100644
1228 --- a/drivers/ata/sata_nv.c
1229 +++ b/drivers/ata/sata_nv.c
1230 @@ -307,10 +307,10 @@ static int nv_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
1231
1232 static void nv_nf2_freeze(struct ata_port *ap);
1233 static void nv_nf2_thaw(struct ata_port *ap);
1234 +static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
1235 + unsigned long deadline);
1236 static void nv_ck804_freeze(struct ata_port *ap);
1237 static void nv_ck804_thaw(struct ata_port *ap);
1238 -static int nv_hardreset(struct ata_link *link, unsigned int *class,
1239 - unsigned long deadline);
1240 static int nv_adma_slave_config(struct scsi_device *sdev);
1241 static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
1242 static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
1243 @@ -405,17 +405,8 @@ static struct scsi_host_template nv_swncq_sht = {
1244 .slave_configure = nv_swncq_slave_config,
1245 };
1246
1247 -/* OSDL bz3352 reports that some nv controllers can't determine device
1248 - * signature reliably and nv_hardreset is implemented to work around
1249 - * the problem. This was reported on nf3 and it's unclear whether any
1250 - * other controllers are affected. However, the workaround has been
1251 - * applied to all variants and there isn't much to gain by trying to
1252 - * find out exactly which ones are affected at this point especially
1253 - * because NV has moved over to ahci for newer controllers.
1254 - */
1255 static struct ata_port_operations nv_common_ops = {
1256 .inherits = &ata_bmdma_port_ops,
1257 - .hardreset = nv_hardreset,
1258 .scr_read = nv_scr_read,
1259 .scr_write = nv_scr_write,
1260 };
1261 @@ -429,12 +420,22 @@ static struct ata_port_operations nv_generic_ops = {
1262 .hardreset = ATA_OP_NULL,
1263 };
1264
1265 +/* OSDL bz3352 reports that nf2/3 controllers can't determine device
1266 + * signature reliably. Also, the following thread reports detection
1267 + * failure on cold boot with the standard debouncing timing.
1268 + *
1269 + * http://thread.gmane.org/gmane.linux.ide/34098
1270 + *
1271 + * Debounce with hotplug timing and request follow-up SRST.
1272 + */
1273 static struct ata_port_operations nv_nf2_ops = {
1274 .inherits = &nv_common_ops,
1275 .freeze = nv_nf2_freeze,
1276 .thaw = nv_nf2_thaw,
1277 + .hardreset = nv_nf2_hardreset,
1278 };
1279
1280 +/* CK804 finally gets hardreset right */
1281 static struct ata_port_operations nv_ck804_ops = {
1282 .inherits = &nv_common_ops,
1283 .freeze = nv_ck804_freeze,
1284 @@ -443,7 +444,7 @@ static struct ata_port_operations nv_ck804_ops = {
1285 };
1286
1287 static struct ata_port_operations nv_adma_ops = {
1288 - .inherits = &nv_common_ops,
1289 + .inherits = &nv_ck804_ops,
1290
1291 .check_atapi_dma = nv_adma_check_atapi_dma,
1292 .sff_tf_read = nv_adma_tf_read,
1293 @@ -467,7 +468,7 @@ static struct ata_port_operations nv_adma_ops = {
1294 };
1295
1296 static struct ata_port_operations nv_swncq_ops = {
1297 - .inherits = &nv_common_ops,
1298 + .inherits = &nv_generic_ops,
1299
1300 .qc_defer = ata_std_qc_defer,
1301 .qc_prep = nv_swncq_qc_prep,
1302 @@ -1553,6 +1554,17 @@ static void nv_nf2_thaw(struct ata_port *ap)
1303 iowrite8(mask, scr_addr + NV_INT_ENABLE);
1304 }
1305
1306 +static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
1307 + unsigned long deadline)
1308 +{
1309 + bool online;
1310 + int rc;
1311 +
1312 + rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
1313 + &online, NULL);
1314 + return online ? -EAGAIN : rc;
1315 +}
1316 +
1317 static void nv_ck804_freeze(struct ata_port *ap)
1318 {
1319 void __iomem *mmio_base = ap->host->iomap[NV_MMIO_BAR];
1320 @@ -1605,21 +1617,6 @@ static void nv_mcp55_thaw(struct ata_port *ap)
1321 ata_sff_thaw(ap);
1322 }
1323
1324 -static int nv_hardreset(struct ata_link *link, unsigned int *class,
1325 - unsigned long deadline)
1326 -{
1327 - int rc;
1328 -
1329 - /* SATA hardreset fails to retrieve proper device signature on
1330 - * some controllers. Request follow up SRST. For more info,
1331 - * see http://bugzilla.kernel.org/show_bug.cgi?id=3352
1332 - */
1333 - rc = sata_sff_hardreset(link, class, deadline);
1334 - if (rc)
1335 - return rc;
1336 - return -EAGAIN;
1337 -}
1338 -
1339 static void nv_adma_error_handler(struct ata_port *ap)
1340 {
1341 struct nv_adma_port_priv *pp = ap->private_data;
1342 diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
1343 index 030665b..b26885f 100644
1344 --- a/drivers/ata/sata_promise.c
1345 +++ b/drivers/ata/sata_promise.c
1346 @@ -153,6 +153,10 @@ static void pdc_freeze(struct ata_port *ap);
1347 static void pdc_sata_freeze(struct ata_port *ap);
1348 static void pdc_thaw(struct ata_port *ap);
1349 static void pdc_sata_thaw(struct ata_port *ap);
1350 +static int pdc_pata_softreset(struct ata_link *link, unsigned int *class,
1351 + unsigned long deadline);
1352 +static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class,
1353 + unsigned long deadline);
1354 static void pdc_error_handler(struct ata_port *ap);
1355 static void pdc_post_internal_cmd(struct ata_queued_cmd *qc);
1356 static int pdc_pata_cable_detect(struct ata_port *ap);
1357 @@ -186,6 +190,7 @@ static struct ata_port_operations pdc_sata_ops = {
1358 .scr_read = pdc_sata_scr_read,
1359 .scr_write = pdc_sata_scr_write,
1360 .port_start = pdc_sata_port_start,
1361 + .hardreset = pdc_sata_hardreset,
1362 };
1363
1364 /* First-generation chips need a more restrictive ->check_atapi_dma op */
1365 @@ -200,6 +205,7 @@ static struct ata_port_operations pdc_pata_ops = {
1366 .freeze = pdc_freeze,
1367 .thaw = pdc_thaw,
1368 .port_start = pdc_common_port_start,
1369 + .softreset = pdc_pata_softreset,
1370 };
1371
1372 static const struct ata_port_info pdc_port_info[] = {
1373 @@ -691,6 +697,20 @@ static void pdc_sata_thaw(struct ata_port *ap)
1374 readl(host_mmio + hotplug_offset); /* flush */
1375 }
1376
1377 +static int pdc_pata_softreset(struct ata_link *link, unsigned int *class,
1378 + unsigned long deadline)
1379 +{
1380 + pdc_reset_port(link->ap);
1381 + return ata_sff_softreset(link, class, deadline);
1382 +}
1383 +
1384 +static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class,
1385 + unsigned long deadline)
1386 +{
1387 + pdc_reset_port(link->ap);
1388 + return sata_sff_hardreset(link, class, deadline);
1389 +}
1390 +
1391 static void pdc_error_handler(struct ata_port *ap)
1392 {
1393 if (!(ap->pflags & ATA_PFLAG_FROZEN))
1394 diff --git a/drivers/base/sys.c b/drivers/base/sys.c
1395 index 75dd6e2..70499cb 100644
1396 --- a/drivers/base/sys.c
1397 +++ b/drivers/base/sys.c
1398 @@ -488,7 +488,8 @@ ssize_t sysdev_store_ulong(struct sys_device *sysdev,
1399 if (end == buf)
1400 return -EINVAL;
1401 *(unsigned long *)(ea->var) = new;
1402 - return end - buf;
1403 + /* Always return full write size even if we didn't consume all */
1404 + return size;
1405 }
1406 EXPORT_SYMBOL_GPL(sysdev_store_ulong);
1407
1408 @@ -511,7 +512,8 @@ ssize_t sysdev_store_int(struct sys_device *sysdev,
1409 if (end == buf || new > INT_MAX || new < INT_MIN)
1410 return -EINVAL;
1411 *(int *)(ea->var) = new;
1412 - return end - buf;
1413 + /* Always return full write size even if we didn't consume all */
1414 + return size;
1415 }
1416 EXPORT_SYMBOL_GPL(sysdev_store_int);
1417
1418 diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
1419 index 016fdf0..f1fe749 100644
1420 --- a/drivers/char/agp/intel-agp.c
1421 +++ b/drivers/char/agp/intel-agp.c
1422 @@ -54,8 +54,7 @@
1423 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965Q_HB || \
1424 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB || \
1425 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GM_HB || \
1426 - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB || \
1427 - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
1428 + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB)
1429
1430 #define IS_G33 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G33_HB || \
1431 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q35_HB || \
1432 @@ -63,7 +62,8 @@
1433
1434 #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGD_E_HB || \
1435 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
1436 - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB)
1437 + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
1438 + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
1439
1440 extern int agp_memory_reserved;
1441
1442 @@ -525,8 +525,10 @@ static void intel_i830_init_gtt_entries(void)
1443 size += 4;
1444 } else if (IS_G4X) {
1445 /* On 4 series hardware, GTT stolen is separate from graphics
1446 - * stolen, ignore it in stolen gtt entries counting */
1447 - size = 0;
1448 + * stolen, ignore it in stolen gtt entries counting. However,
1449 + * 4KB of the stolen memory doesn't get mapped to the GTT.
1450 + */
1451 + size = 4;
1452 } else {
1453 /* On previous hardware, the GTT size was just what was
1454 * required to map the aperture.
1455 diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
1456 index 64e1c16..ecaf369 100644
1457 --- a/drivers/char/ipmi/ipmi_devintf.c
1458 +++ b/drivers/char/ipmi/ipmi_devintf.c
1459 @@ -957,3 +957,4 @@ module_exit(cleanup_ipmi);
1460 MODULE_LICENSE("GPL");
1461 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
1462 MODULE_DESCRIPTION("Linux device interface for the IPMI message handler.");
1463 +MODULE_ALIAS("platform:ipmi_si");
1464 diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
1465 index 2e6d584..ed03234 100644
1466 --- a/drivers/firewire/fw-cdev.c
1467 +++ b/drivers/firewire/fw-cdev.c
1468 @@ -720,8 +720,8 @@ static int ioctl_create_iso_context(struct client *client, void *buffer)
1469 #define GET_PAYLOAD_LENGTH(v) ((v) & 0xffff)
1470 #define GET_INTERRUPT(v) (((v) >> 16) & 0x01)
1471 #define GET_SKIP(v) (((v) >> 17) & 0x01)
1472 -#define GET_TAG(v) (((v) >> 18) & 0x02)
1473 -#define GET_SY(v) (((v) >> 20) & 0x04)
1474 +#define GET_TAG(v) (((v) >> 18) & 0x03)
1475 +#define GET_SY(v) (((v) >> 20) & 0x0f)
1476 #define GET_HEADER_LENGTH(v) (((v) >> 24) & 0xff)
1477
1478 static int ioctl_queue_iso(struct client *client, void *buffer)
1479 @@ -913,7 +913,7 @@ dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg)
1480 return -EFAULT;
1481 }
1482
1483 - return 0;
1484 + return retval;
1485 }
1486
1487 static long
1488 diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
1489 index aaff50e..4f73537 100644
1490 --- a/drivers/firewire/fw-sbp2.c
1491 +++ b/drivers/firewire/fw-sbp2.c
1492 @@ -172,6 +172,9 @@ struct sbp2_target {
1493 int blocked; /* ditto */
1494 };
1495
1496 +/* Impossible login_id, to detect logout attempt before successful login */
1497 +#define INVALID_LOGIN_ID 0x10000
1498 +
1499 /*
1500 * Per section 7.4.8 of the SBP-2 spec, a mgt_ORB_timeout value can be
1501 * provided in the config rom. Most devices do provide a value, which
1502 @@ -791,9 +794,20 @@ static void sbp2_release_target(struct kref *kref)
1503 scsi_remove_device(sdev);
1504 scsi_device_put(sdev);
1505 }
1506 - sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
1507 - SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
1508 -
1509 + if (lu->login_id != INVALID_LOGIN_ID) {
1510 + int generation, node_id;
1511 + /*
1512 + * tgt->node_id may be obsolete here if we failed
1513 + * during initial login or after a bus reset where
1514 + * the topology changed.
1515 + */
1516 + generation = device->generation;
1517 + smp_rmb(); /* node_id vs. generation */
1518 + node_id = device->node_id;
1519 + sbp2_send_management_orb(lu, node_id, generation,
1520 + SBP2_LOGOUT_REQUEST,
1521 + lu->login_id, NULL);
1522 + }
1523 fw_core_remove_address_handler(&lu->address_handler);
1524 list_del(&lu->link);
1525 kfree(lu);
1526 @@ -808,19 +822,20 @@ static void sbp2_release_target(struct kref *kref)
1527
1528 static struct workqueue_struct *sbp2_wq;
1529
1530 +static void sbp2_target_put(struct sbp2_target *tgt)
1531 +{
1532 + kref_put(&tgt->kref, sbp2_release_target);
1533 +}
1534 +
1535 /*
1536 * Always get the target's kref when scheduling work on one its units.
1537 * Each workqueue job is responsible to call sbp2_target_put() upon return.
1538 */
1539 static void sbp2_queue_work(struct sbp2_logical_unit *lu, unsigned long delay)
1540 {
1541 - if (queue_delayed_work(sbp2_wq, &lu->work, delay))
1542 - kref_get(&lu->tgt->kref);
1543 -}
1544 -
1545 -static void sbp2_target_put(struct sbp2_target *tgt)
1546 -{
1547 - kref_put(&tgt->kref, sbp2_release_target);
1548 + kref_get(&lu->tgt->kref);
1549 + if (!queue_delayed_work(sbp2_wq, &lu->work, delay))
1550 + sbp2_target_put(lu->tgt);
1551 }
1552
1553 static void
1554 @@ -993,6 +1008,7 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
1555
1556 lu->tgt = tgt;
1557 lu->lun = lun_entry & 0xffff;
1558 + lu->login_id = INVALID_LOGIN_ID;
1559 lu->retries = 0;
1560 lu->has_sdev = false;
1561 lu->blocked = false;
1562 @@ -1158,7 +1174,7 @@ static int sbp2_probe(struct device *dev)
1563
1564 /* Do the login in a workqueue so we can easily reschedule retries. */
1565 list_for_each_entry(lu, &tgt->lu_list, link)
1566 - sbp2_queue_work(lu, 0);
1567 + sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
1568 return 0;
1569
1570 fail_tgt_put:
1571 diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
1572 index c1b8107..5e20471 100644
1573 --- a/drivers/firewire/fw-topology.c
1574 +++ b/drivers/firewire/fw-topology.c
1575 @@ -413,7 +413,7 @@ static void
1576 update_tree(struct fw_card *card, struct fw_node *root)
1577 {
1578 struct list_head list0, list1;
1579 - struct fw_node *node0, *node1;
1580 + struct fw_node *node0, *node1, *next1;
1581 int i, event;
1582
1583 INIT_LIST_HEAD(&list0);
1584 @@ -485,7 +485,9 @@ update_tree(struct fw_card *card, struct fw_node *root)
1585 }
1586
1587 node0 = fw_node(node0->link.next);
1588 - node1 = fw_node(node1->link.next);
1589 + next1 = fw_node(node1->link.next);
1590 + fw_node_put(node1);
1591 + node1 = next1;
1592 }
1593 }
1594
1595 diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
1596 index 2ae1b0d..81b15ba 100644
1597 --- a/drivers/firewire/fw-transaction.h
1598 +++ b/drivers/firewire/fw-transaction.h
1599 @@ -248,7 +248,7 @@ struct fw_card {
1600 struct fw_node *local_node;
1601 struct fw_node *root_node;
1602 struct fw_node *irm_node;
1603 - int color;
1604 + u8 color; /* must be u8 to match the definition in struct fw_node */
1605 int gap_count;
1606 bool beta_repeaters_present;
1607
1608 diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
1609 index b15f882..49144cb 100644
1610 --- a/drivers/hid/usbhid/hid-quirks.c
1611 +++ b/drivers/hid/usbhid/hid-quirks.c
1612 @@ -247,8 +247,6 @@
1613 #define USB_DEVICE_ID_LD_MACHINETEST 0x2040
1614
1615 #define USB_VENDOR_ID_LOGITECH 0x046d
1616 -#define USB_DEVICE_ID_LOGITECH_LX3 0xc044
1617 -#define USB_DEVICE_ID_LOGITECH_V150 0xc047
1618 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
1619 #define USB_DEVICE_ID_LOGITECH_HARMONY 0xc110
1620 #define USB_DEVICE_ID_LOGITECH_HARMONY_2 0xc111
1621 @@ -603,8 +601,6 @@ static const struct hid_blacklist {
1622
1623 { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
1624 { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
1625 - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_LX3, HID_QUIRK_INVERT_HWHEEL },
1626 - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_V150, HID_QUIRK_INVERT_HWHEEL },
1627
1628 { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K, HID_QUIRK_MICROSOFT_KEYS },
1629 { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K, HID_QUIRK_MICROSOFT_KEYS },
1630 diff --git a/drivers/i2c/busses/scx200_i2c.c b/drivers/i2c/busses/scx200_i2c.c
1631 index c3022a0..e4c9853 100644
1632 --- a/drivers/i2c/busses/scx200_i2c.c
1633 +++ b/drivers/i2c/busses/scx200_i2c.c
1634 @@ -81,6 +81,7 @@ static struct i2c_algo_bit_data scx200_i2c_data = {
1635
1636 static struct i2c_adapter scx200_i2c_ops = {
1637 .owner = THIS_MODULE,
1638 + .class = I2C_CLASS_HWMON | I2C_CLASS_SPD,
1639 .id = I2C_HW_B_SCX200,
1640 .algo_data = &scx200_i2c_data,
1641 .name = "NatSemi SCx200 I2C",
1642 diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
1643 index b1ce10f..e32c24d 100644
1644 --- a/drivers/input/keyboard/atkbd.c
1645 +++ b/drivers/input/keyboard/atkbd.c
1646 @@ -834,10 +834,10 @@ static void atkbd_disconnect(struct serio *serio)
1647 }
1648
1649 /*
1650 - * Most special keys (Fn+F?) on Dell Latitudes do not generate release
1651 + * Most special keys (Fn+F?) on Dell laptops do not generate release
1652 * events so we have to do it ourselves.
1653 */
1654 -static void atkbd_latitude_keymap_fixup(struct atkbd *atkbd)
1655 +static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
1656 {
1657 const unsigned int forced_release_keys[] = {
1658 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93,
1659 @@ -1461,13 +1461,13 @@ static int __init atkbd_setup_fixup(const struct dmi_system_id *id)
1660
1661 static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
1662 {
1663 - .ident = "Dell Latitude series",
1664 + .ident = "Dell Laptop",
1665 .matches = {
1666 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
1667 - DMI_MATCH(DMI_PRODUCT_NAME, "Latitude"),
1668 + DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
1669 },
1670 .callback = atkbd_setup_fixup,
1671 - .driver_data = atkbd_latitude_keymap_fixup,
1672 + .driver_data = atkbd_dell_laptop_keymap_fixup,
1673 },
1674 {
1675 .ident = "HP 2133",
1676 diff --git a/drivers/media/dvb/frontends/s5h1411.c b/drivers/media/dvb/frontends/s5h1411.c
1677 index 2da1a37..a92ee16 100644
1678 --- a/drivers/media/dvb/frontends/s5h1411.c
1679 +++ b/drivers/media/dvb/frontends/s5h1411.c
1680 @@ -471,6 +471,20 @@ static int s5h1411_set_spectralinversion(struct dvb_frontend *fe, int inversion)
1681 return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0x24, val);
1682 }
1683
1684 +static int s5h1411_set_serialmode(struct dvb_frontend *fe, int serial)
1685 +{
1686 + struct s5h1411_state *state = fe->demodulator_priv;
1687 + u16 val;
1688 +
1689 + dprintk("%s(%d)\n", __func__, serial);
1690 + val = s5h1411_readreg(state, S5H1411_I2C_TOP_ADDR, 0xbd) & ~0x100;
1691 +
1692 + if (serial == 1)
1693 + val |= 0x100;
1694 +
1695 + return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, val);
1696 +}
1697 +
1698 static int s5h1411_enable_modulation(struct dvb_frontend *fe,
1699 fe_modulation_t m)
1700 {
1701 @@ -535,7 +549,7 @@ static int s5h1411_set_gpio(struct dvb_frontend *fe, int enable)
1702 return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xe0, val);
1703 }
1704
1705 -static int s5h1411_sleep(struct dvb_frontend *fe, int enable)
1706 +static int s5h1411_set_powerstate(struct dvb_frontend *fe, int enable)
1707 {
1708 struct s5h1411_state *state = fe->demodulator_priv;
1709
1710 @@ -551,6 +565,11 @@ static int s5h1411_sleep(struct dvb_frontend *fe, int enable)
1711 return 0;
1712 }
1713
1714 +static int s5h1411_sleep(struct dvb_frontend *fe)
1715 +{
1716 + return s5h1411_set_powerstate(fe, 1);
1717 +}
1718 +
1719 static int s5h1411_register_reset(struct dvb_frontend *fe)
1720 {
1721 struct s5h1411_state *state = fe->demodulator_priv;
1722 @@ -574,9 +593,6 @@ static int s5h1411_set_frontend(struct dvb_frontend *fe,
1723
1724 s5h1411_enable_modulation(fe, p->u.vsb.modulation);
1725
1726 - /* Allow the demod to settle */
1727 - msleep(100);
1728 -
1729 if (fe->ops.tuner_ops.set_params) {
1730 if (fe->ops.i2c_gate_ctrl)
1731 fe->ops.i2c_gate_ctrl(fe, 1);
1732 @@ -587,6 +603,10 @@ static int s5h1411_set_frontend(struct dvb_frontend *fe,
1733 fe->ops.i2c_gate_ctrl(fe, 0);
1734 }
1735
1736 + /* Issue a reset to the demod so it knows to resync against the
1737 + newly tuned frequency */
1738 + s5h1411_softreset(fe);
1739 +
1740 return 0;
1741 }
1742
1743 @@ -599,7 +619,7 @@ static int s5h1411_init(struct dvb_frontend *fe)
1744
1745 dprintk("%s()\n", __func__);
1746
1747 - s5h1411_sleep(fe, 0);
1748 + s5h1411_set_powerstate(fe, 0);
1749 s5h1411_register_reset(fe);
1750
1751 for (i = 0; i < ARRAY_SIZE(init_tab); i++)
1752 @@ -612,10 +632,10 @@ static int s5h1411_init(struct dvb_frontend *fe)
1753
1754 if (state->config->output_mode == S5H1411_SERIAL_OUTPUT)
1755 /* Serial */
1756 - s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1101);
1757 + s5h1411_set_serialmode(fe, 1);
1758 else
1759 /* Parallel */
1760 - s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1001);
1761 + s5h1411_set_serialmode(fe, 0);
1762
1763 s5h1411_set_spectralinversion(fe, state->config->inversion);
1764 s5h1411_set_if_freq(fe, state->config->vsb_if);
1765 @@ -863,6 +883,7 @@ static struct dvb_frontend_ops s5h1411_ops = {
1766 },
1767
1768 .init = s5h1411_init,
1769 + .sleep = s5h1411_sleep,
1770 .i2c_gate_ctrl = s5h1411_i2c_gate_ctrl,
1771 .set_frontend = s5h1411_set_frontend,
1772 .get_frontend = s5h1411_get_frontend,
1773 diff --git a/drivers/media/video/pvrusb2/pvrusb2-encoder.c b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
1774 index a1252d6..273d2a1 100644
1775 --- a/drivers/media/video/pvrusb2/pvrusb2-encoder.c
1776 +++ b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
1777 @@ -402,6 +402,10 @@ static int pvr2_encoder_prep_config(struct pvr2_hdw *hdw)
1778 ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 0,3,0,0);
1779 ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4,15,0,0,0);
1780
1781 + /* prevent the PTSs from slowly drifting away in the generated
1782 + MPEG stream */
1783 + ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC, 2, 4, 1);
1784 +
1785 return ret;
1786 }
1787
1788 diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
1789 index e23ce77..b46e599 100644
1790 --- a/drivers/net/atlx/atl1.c
1791 +++ b/drivers/net/atlx/atl1.c
1792 @@ -2317,7 +2317,8 @@ static void atl1_tx_queue(struct atl1_adapter *adapter, u16 count,
1793 if (tpd != ptpd)
1794 memcpy(tpd, ptpd, sizeof(struct tx_packet_desc));
1795 tpd->buffer_addr = cpu_to_le64(buffer_info->dma);
1796 - tpd->word2 = (cpu_to_le16(buffer_info->length) &
1797 + tpd->word2 &= ~(TPD_BUFLEN_MASK << TPD_BUFLEN_SHIFT);
1798 + tpd->word2 |= (cpu_to_le16(buffer_info->length) &
1799 TPD_BUFLEN_MASK) << TPD_BUFLEN_SHIFT;
1800
1801 /*
1802 @@ -2426,8 +2427,8 @@ static int atl1_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
1803 vlan_tag = (vlan_tag << 4) | (vlan_tag >> 13) |
1804 ((vlan_tag >> 9) & 0x8);
1805 ptpd->word3 |= 1 << TPD_INS_VL_TAG_SHIFT;
1806 - ptpd->word3 |= (vlan_tag & TPD_VL_TAGGED_MASK) <<
1807 - TPD_VL_TAGGED_SHIFT;
1808 + ptpd->word2 |= (vlan_tag & TPD_VLANTAG_MASK) <<
1809 + TPD_VLANTAG_SHIFT;
1810 }
1811
1812 tso = atl1_tso(adapter, skb, ptpd);
1813 diff --git a/drivers/net/atlx/atl1.h b/drivers/net/atlx/atl1.h
1814 index a5015b1..ffa73fc 100644
1815 --- a/drivers/net/atlx/atl1.h
1816 +++ b/drivers/net/atlx/atl1.h
1817 @@ -504,7 +504,7 @@ struct rx_free_desc {
1818 #define TPD_PKTNT_MASK 0x0001
1819 #define TPD_PKTINT_SHIFT 15
1820 #define TPD_VLANTAG_MASK 0xFFFF
1821 -#define TPD_VLAN_SHIFT 16
1822 +#define TPD_VLANTAG_SHIFT 16
1823
1824 /* tpd word 3 bits 0:13 */
1825 #define TPD_EOP_MASK 0x0001
1826 diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
1827 index b211486..4489e58 100644
1828 --- a/drivers/net/bonding/bond_alb.c
1829 +++ b/drivers/net/bonding/bond_alb.c
1830 @@ -167,11 +167,14 @@ static void tlb_clear_slave(struct bonding *bond, struct slave *slave, int save_
1831 /* clear slave from tx_hashtbl */
1832 tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl;
1833
1834 - index = SLAVE_TLB_INFO(slave).head;
1835 - while (index != TLB_NULL_INDEX) {
1836 - u32 next_index = tx_hash_table[index].next;
1837 - tlb_init_table_entry(&tx_hash_table[index], save_load);
1838 - index = next_index;
1839 + /* skip this if we've already freed the tx hash table */
1840 + if (tx_hash_table) {
1841 + index = SLAVE_TLB_INFO(slave).head;
1842 + while (index != TLB_NULL_INDEX) {
1843 + u32 next_index = tx_hash_table[index].next;
1844 + tlb_init_table_entry(&tx_hash_table[index], save_load);
1845 + index = next_index;
1846 + }
1847 }
1848
1849 tlb_init_slave(slave);
1850 diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
1851 index 4b27456..50927ea 100644
1852 --- a/drivers/net/wireless/libertas/scan.c
1853 +++ b/drivers/net/wireless/libertas/scan.c
1854 @@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_descriptor *bss,
1855
1856 switch (elem->id) {
1857 case MFIE_TYPE_SSID:
1858 - bss->ssid_len = elem->len;
1859 - memcpy(bss->ssid, elem->data, elem->len);
1860 + bss->ssid_len = min_t(int, 32, elem->len);
1861 + memcpy(bss->ssid, elem->data, bss->ssid_len);
1862 lbs_deb_scan("got SSID IE: '%s', len %u\n",
1863 escape_essid(bss->ssid, bss->ssid_len),
1864 bss->ssid_len);
1865 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
1866 index 36698e5..bcafbd6 100644
1867 --- a/drivers/pci/probe.c
1868 +++ b/drivers/pci/probe.c
1869 @@ -219,7 +219,7 @@ static inline enum pci_bar_type decode_bar(struct resource *res, u32 bar)
1870
1871 res->flags = bar & ~PCI_BASE_ADDRESS_MEM_MASK;
1872
1873 - if (res->flags == PCI_BASE_ADDRESS_MEM_TYPE_64)
1874 + if (res->flags & PCI_BASE_ADDRESS_MEM_TYPE_64)
1875 return pci_bar_mem64;
1876 return pci_bar_mem32;
1877 }
1878 diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
1879 index b184367..6ad46d7 100644
1880 --- a/drivers/rtc/rtc-cmos.c
1881 +++ b/drivers/rtc/rtc-cmos.c
1882 @@ -1030,29 +1030,32 @@ static struct platform_driver cmos_platform_driver = {
1883
1884 static int __init cmos_init(void)
1885 {
1886 + int retval = 0;
1887 +
1888 #ifdef CONFIG_PNP
1889 - if (pnp_platform_devices)
1890 - return pnp_register_driver(&cmos_pnp_driver);
1891 - else
1892 - return platform_driver_probe(&cmos_platform_driver,
1893 - cmos_platform_probe);
1894 -#else
1895 - return platform_driver_probe(&cmos_platform_driver,
1896 - cmos_platform_probe);
1897 -#endif /* CONFIG_PNP */
1898 + pnp_register_driver(&cmos_pnp_driver);
1899 +#endif
1900 +
1901 + if (!cmos_rtc.dev)
1902 + retval = platform_driver_probe(&cmos_platform_driver,
1903 + cmos_platform_probe);
1904 +
1905 + if (retval == 0)
1906 + return 0;
1907 +
1908 +#ifdef CONFIG_PNP
1909 + pnp_unregister_driver(&cmos_pnp_driver);
1910 +#endif
1911 + return retval;
1912 }
1913 module_init(cmos_init);
1914
1915 static void __exit cmos_exit(void)
1916 {
1917 #ifdef CONFIG_PNP
1918 - if (pnp_platform_devices)
1919 - pnp_unregister_driver(&cmos_pnp_driver);
1920 - else
1921 - platform_driver_unregister(&cmos_platform_driver);
1922 -#else
1923 + pnp_unregister_driver(&cmos_pnp_driver);
1924 +#endif
1925 platform_driver_unregister(&cmos_platform_driver);
1926 -#endif /* CONFIG_PNP */
1927 }
1928 module_exit(cmos_exit);
1929
1930 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
1931 index e5e7d78..b7ea69c 100644
1932 --- a/drivers/scsi/sd.c
1933 +++ b/drivers/scsi/sd.c
1934 @@ -1047,7 +1047,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
1935 good_bytes = sd_completed_bytes(SCpnt);
1936 break;
1937 case RECOVERED_ERROR:
1938 - case NO_SENSE:
1939 /* Inform the user, but make sure that it's not treated
1940 * as a hard error.
1941 */
1942 @@ -1056,6 +1055,15 @@ static int sd_done(struct scsi_cmnd *SCpnt)
1943 memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
1944 good_bytes = scsi_bufflen(SCpnt);
1945 break;
1946 + case NO_SENSE:
1947 + /* This indicates a false check condition, so ignore it. An
1948 + * unknown amount of data was transferred so treat it as an
1949 + * error.
1950 + */
1951 + scsi_print_sense("sd", SCpnt);
1952 + SCpnt->result = 0;
1953 + memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
1954 + break;
1955 case ABORTED_COMMAND:
1956 if (sshdr.asc == 0x10) { /* DIF: Disk detected corruption */
1957 scsi_print_result(SCpnt);
1958 diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
1959 index 706f3e6..7a4ccf5 100644
1960 --- a/drivers/usb/core/hcd.c
1961 +++ b/drivers/usb/core/hcd.c
1962 @@ -106,6 +106,9 @@ static DEFINE_SPINLOCK(hcd_root_hub_lock);
1963 /* used when updating an endpoint's URB list */
1964 static DEFINE_SPINLOCK(hcd_urb_list_lock);
1965
1966 +/* used to protect against unlinking URBs after the device is gone */
1967 +static DEFINE_SPINLOCK(hcd_urb_unlink_lock);
1968 +
1969 /* wait queue for synchronous unlinks */
1970 DECLARE_WAIT_QUEUE_HEAD(usb_kill_urb_queue);
1971
1972 @@ -1377,10 +1380,25 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status)
1973 int usb_hcd_unlink_urb (struct urb *urb, int status)
1974 {
1975 struct usb_hcd *hcd;
1976 - int retval;
1977 + int retval = -EIDRM;
1978 + unsigned long flags;
1979
1980 - hcd = bus_to_hcd(urb->dev->bus);
1981 - retval = unlink1(hcd, urb, status);
1982 + /* Prevent the device and bus from going away while
1983 + * the unlink is carried out. If they are already gone
1984 + * then urb->use_count must be 0, since disconnected
1985 + * devices can't have any active URBs.
1986 + */
1987 + spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
1988 + if (atomic_read(&urb->use_count) > 0) {
1989 + retval = 0;
1990 + usb_get_dev(urb->dev);
1991 + }
1992 + spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
1993 + if (retval == 0) {
1994 + hcd = bus_to_hcd(urb->dev->bus);
1995 + retval = unlink1(hcd, urb, status);
1996 + usb_put_dev(urb->dev);
1997 + }
1998
1999 if (retval == 0)
2000 retval = -EINPROGRESS;
2001 @@ -1529,6 +1547,17 @@ void usb_hcd_disable_endpoint(struct usb_device *udev,
2002 hcd->driver->endpoint_disable(hcd, ep);
2003 }
2004
2005 +/* Protect against drivers that try to unlink URBs after the device
2006 + * is gone, by waiting until all unlinks for @udev are finished.
2007 + * Since we don't currently track URBs by device, simply wait until
2008 + * nothing is running in the locked region of usb_hcd_unlink_urb().
2009 + */
2010 +void usb_hcd_synchronize_unlinks(struct usb_device *udev)
2011 +{
2012 + spin_lock_irq(&hcd_urb_unlink_lock);
2013 + spin_unlock_irq(&hcd_urb_unlink_lock);
2014 +}
2015 +
2016 /*-------------------------------------------------------------------------*/
2017
2018 /* called in any context */
2019 diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
2020 index 2dcde61..9465e70 100644
2021 --- a/drivers/usb/core/hcd.h
2022 +++ b/drivers/usb/core/hcd.h
2023 @@ -232,6 +232,7 @@ extern void usb_hcd_flush_endpoint(struct usb_device *udev,
2024 struct usb_host_endpoint *ep);
2025 extern void usb_hcd_disable_endpoint(struct usb_device *udev,
2026 struct usb_host_endpoint *ep);
2027 +extern void usb_hcd_synchronize_unlinks(struct usb_device *udev);
2028 extern int usb_hcd_get_frame_number(struct usb_device *udev);
2029
2030 extern struct usb_hcd *usb_create_hcd(const struct hc_driver *driver,
2031 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
2032 index 875de9a..769f80f 100644
2033 --- a/drivers/usb/core/hub.c
2034 +++ b/drivers/usb/core/hub.c
2035 @@ -1349,6 +1349,7 @@ void usb_disconnect(struct usb_device **pdev)
2036 */
2037 dev_dbg (&udev->dev, "unregistering device\n");
2038 usb_disable_device(udev, 0);
2039 + usb_hcd_synchronize_unlinks(udev);
2040
2041 usb_unlock_device(udev);
2042
2043 diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
2044 index 47111e8..db72269 100644
2045 --- a/drivers/usb/core/urb.c
2046 +++ b/drivers/usb/core/urb.c
2047 @@ -465,6 +465,12 @@ EXPORT_SYMBOL_GPL(usb_submit_urb);
2048 * indicating that the request has been canceled (rather than any other
2049 * code).
2050 *
2051 + * Drivers should not call this routine or related routines, such as
2052 + * usb_kill_urb() or usb_unlink_anchored_urbs(), after their disconnect
2053 + * method has returned. The disconnect function should synchronize with
2054 + * a driver's I/O routines to insure that all URB-related activity has
2055 + * completed before it returns.
2056 + *
2057 * This request is always asynchronous. Success is indicated by
2058 * returning -EINPROGRESS, at which time the URB will probably not yet
2059 * have been given back to the device driver. When it is eventually
2060 @@ -541,6 +547,9 @@ EXPORT_SYMBOL_GPL(usb_unlink_urb);
2061 * This routine may not be used in an interrupt context (such as a bottom
2062 * half or a completion handler), or when holding a spinlock, or in other
2063 * situations where the caller can't schedule().
2064 + *
2065 + * This routine should not be called by a driver after its disconnect
2066 + * method has returned.
2067 */
2068 void usb_kill_urb(struct urb *urb)
2069 {
2070 @@ -568,6 +577,9 @@ EXPORT_SYMBOL_GPL(usb_kill_urb);
2071 *
2072 * this allows all outstanding URBs to be killed starting
2073 * from the back of the queue
2074 + *
2075 + * This routine should not be called by a driver after its disconnect
2076 + * method has returned.
2077 */
2078 void usb_kill_anchored_urbs(struct usb_anchor *anchor)
2079 {
2080 @@ -597,6 +609,9 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
2081 * from the back of the queue. This function is asynchronous.
2082 * The unlinking is just tiggered. It may happen after this
2083 * function has returned.
2084 + *
2085 + * This routine should not be called by a driver after its disconnect
2086 + * method has returned.
2087 */
2088 void usb_unlink_anchored_urbs(struct usb_anchor *anchor)
2089 {
2090 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
2091 index cd15547..061df9b 100644
2092 --- a/drivers/usb/storage/unusual_devs.h
2093 +++ b/drivers/usb/storage/unusual_devs.h
2094 @@ -1745,6 +1745,15 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
2095 US_SC_DEVICE, US_PR_DEVICE, NULL,
2096 US_FL_IGNORE_RESIDUE ),
2097
2098 +/* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
2099 + * JMicron responds to USN and several other SCSI ioctls with a
2100 + * residue that causes subsequent I/O requests to fail. */
2101 +UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
2102 + "JMicron",
2103 + "USB to ATA/ATAPI Bridge",
2104 + US_SC_DEVICE, US_PR_DEVICE, NULL,
2105 + US_FL_IGNORE_RESIDUE ),
2106 +
2107 /* Reported by Robert Schedel <r.schedel@yahoo.de>
2108 * Note: this is a 'super top' device like the above 14cd/6600 device */
2109 UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
2110 diff --git a/fs/hfsplus/bitmap.c b/fs/hfsplus/bitmap.c
2111 index d128a25..ea30afc 100644
2112 --- a/fs/hfsplus/bitmap.c
2113 +++ b/fs/hfsplus/bitmap.c
2114 @@ -32,6 +32,10 @@ int hfsplus_block_allocate(struct super_block *sb, u32 size, u32 offset, u32 *ma
2115 mutex_lock(&HFSPLUS_SB(sb).alloc_file->i_mutex);
2116 mapping = HFSPLUS_SB(sb).alloc_file->i_mapping;
2117 page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, NULL);
2118 + if (IS_ERR(page)) {
2119 + start = size;
2120 + goto out;
2121 + }
2122 pptr = kmap(page);
2123 curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32;
2124 i = offset % 32;
2125 @@ -73,6 +77,10 @@ int hfsplus_block_allocate(struct super_block *sb, u32 size, u32 offset, u32 *ma
2126 break;
2127 page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
2128 NULL);
2129 + if (IS_ERR(page)) {
2130 + start = size;
2131 + goto out;
2132 + }
2133 curr = pptr = kmap(page);
2134 if ((size ^ offset) / PAGE_CACHE_BITS)
2135 end = pptr + PAGE_CACHE_BITS / 32;
2136 @@ -120,6 +128,10 @@ found:
2137 offset += PAGE_CACHE_BITS;
2138 page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
2139 NULL);
2140 + if (IS_ERR(page)) {
2141 + start = size;
2142 + goto out;
2143 + }
2144 pptr = kmap(page);
2145 curr = pptr;
2146 end = pptr + PAGE_CACHE_BITS / 32;
2147 diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
2148 index ba117c4..f6874ac 100644
2149 --- a/fs/hfsplus/catalog.c
2150 +++ b/fs/hfsplus/catalog.c
2151 @@ -168,6 +168,11 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
2152 return -EIO;
2153 }
2154
2155 + if (be16_to_cpu(tmp.thread.nodeName.length) > 255) {
2156 + printk(KERN_ERR "hfs: catalog name length corrupted\n");
2157 + return -EIO;
2158 + }
2159 +
2160 hfsplus_cat_build_key_uni(fd->search_key, be32_to_cpu(tmp.thread.parentID),
2161 &tmp.thread.nodeName);
2162 return hfs_brec_find(fd);
2163 diff --git a/include/linux/sched.h b/include/linux/sched.h
2164 index 3d9120c..6bfb849 100644
2165 --- a/include/linux/sched.h
2166 +++ b/include/linux/sched.h
2167 @@ -1286,7 +1286,9 @@ struct task_struct {
2168 atomic_t fs_excl; /* holding fs exclusive resources */
2169 struct rcu_head rcu;
2170
2171 - /*
2172 + struct list_head *scm_work_list;
2173 +
2174 +/*
2175 * cache last used pipe for splice
2176 */
2177 struct pipe_inode_info *splice_pipe;
2178 diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
2179 index bb46e76..408f743 100644
2180 --- a/include/math-emu/op-common.h
2181 +++ b/include/math-emu/op-common.h
2182 @@ -139,18 +139,27 @@ do { \
2183 if (X##_e <= _FP_WFRACBITS_##fs) \
2184 { \
2185 _FP_FRAC_SRS_##wc(X, X##_e, _FP_WFRACBITS_##fs); \
2186 - _FP_ROUND(wc, X); \
2187 if (_FP_FRAC_HIGH_##fs(X) \
2188 & (_FP_OVERFLOW_##fs >> 1)) \
2189 { \
2190 X##_e = 1; \
2191 _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
2192 - FP_SET_EXCEPTION(FP_EX_INEXACT); \
2193 } \
2194 else \
2195 { \
2196 - X##_e = 0; \
2197 - _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
2198 + _FP_ROUND(wc, X); \
2199 + if (_FP_FRAC_HIGH_##fs(X) \
2200 + & (_FP_OVERFLOW_##fs >> 1)) \
2201 + { \
2202 + X##_e = 1; \
2203 + _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
2204 + FP_SET_EXCEPTION(FP_EX_INEXACT); \
2205 + } \
2206 + else \
2207 + { \
2208 + X##_e = 0; \
2209 + _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
2210 + } \
2211 } \
2212 if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
2213 (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \
2214 diff --git a/include/net/scm.h b/include/net/scm.h
2215 index 06df126..33e9986 100644
2216 --- a/include/net/scm.h
2217 +++ b/include/net/scm.h
2218 @@ -14,8 +14,9 @@
2219
2220 struct scm_fp_list
2221 {
2222 - int count;
2223 - struct file *fp[SCM_MAX_FD];
2224 + struct list_head list;
2225 + int count;
2226 + struct file *fp[SCM_MAX_FD];
2227 };
2228
2229 struct scm_cookie
2230 diff --git a/kernel/sched_clock.c b/kernel/sched_clock.c
2231 index e8ab096..8178724 100644
2232 --- a/kernel/sched_clock.c
2233 +++ b/kernel/sched_clock.c
2234 @@ -118,13 +118,13 @@ static u64 __update_sched_clock(struct sched_clock_data *scd, u64 now)
2235
2236 /*
2237 * scd->clock = clamp(scd->tick_gtod + delta,
2238 - * max(scd->tick_gtod, scd->clock),
2239 - * scd->tick_gtod + TICK_NSEC);
2240 + * max(scd->tick_gtod, scd->clock),
2241 + * max(scd->clock, scd->tick_gtod + TICK_NSEC));
2242 */
2243
2244 clock = scd->tick_gtod + delta;
2245 min_clock = wrap_max(scd->tick_gtod, scd->clock);
2246 - max_clock = scd->tick_gtod + TICK_NSEC;
2247 + max_clock = wrap_max(scd->clock, scd->tick_gtod + TICK_NSEC);
2248
2249 clock = wrap_max(clock, min_clock);
2250 clock = wrap_min(clock, max_clock);
2251 diff --git a/kernel/sched_features.h b/kernel/sched_features.h
2252 index 9353ca7..c4c88ae 100644
2253 --- a/kernel/sched_features.h
2254 +++ b/kernel/sched_features.h
2255 @@ -5,7 +5,7 @@ SCHED_FEAT(START_DEBIT, 1)
2256 SCHED_FEAT(AFFINE_WAKEUPS, 1)
2257 SCHED_FEAT(CACHE_HOT_BUDDY, 1)
2258 SCHED_FEAT(SYNC_WAKEUPS, 1)
2259 -SCHED_FEAT(HRTICK, 1)
2260 +SCHED_FEAT(HRTICK, 0)
2261 SCHED_FEAT(DOUBLE_TICK, 0)
2262 SCHED_FEAT(ASYM_GRAN, 1)
2263 SCHED_FEAT(LB_BIAS, 1)
2264 diff --git a/net/core/scm.c b/net/core/scm.c
2265 index 10f5c65..ab242cc 100644
2266 --- a/net/core/scm.c
2267 +++ b/net/core/scm.c
2268 @@ -75,6 +75,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
2269 if (!fpl)
2270 return -ENOMEM;
2271 *fplp = fpl;
2272 + INIT_LIST_HEAD(&fpl->list);
2273 fpl->count = 0;
2274 }
2275 fpp = &fpl->fp[fpl->count];
2276 @@ -106,9 +107,25 @@ void __scm_destroy(struct scm_cookie *scm)
2277
2278 if (fpl) {
2279 scm->fp = NULL;
2280 - for (i=fpl->count-1; i>=0; i--)
2281 - fput(fpl->fp[i]);
2282 - kfree(fpl);
2283 + if (current->scm_work_list) {
2284 + list_add_tail(&fpl->list, current->scm_work_list);
2285 + } else {
2286 + LIST_HEAD(work_list);
2287 +
2288 + current->scm_work_list = &work_list;
2289 +
2290 + list_add(&fpl->list, &work_list);
2291 + while (!list_empty(&work_list)) {
2292 + fpl = list_first_entry(&work_list, struct scm_fp_list, list);
2293 +
2294 + list_del(&fpl->list);
2295 + for (i=fpl->count-1; i>=0; i--)
2296 + fput(fpl->fp[i]);
2297 + kfree(fpl);
2298 + }
2299 +
2300 + current->scm_work_list = NULL;
2301 + }
2302 }
2303 }
2304
2305 @@ -284,6 +301,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
2306
2307 new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
2308 if (new_fpl) {
2309 + INIT_LIST_HEAD(&new_fpl->list);
2310 for (i=fpl->count-1; i>=0; i--)
2311 get_file(fpl->fp[i]);
2312 memcpy(new_fpl, fpl, sizeof(*fpl));
2313 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
2314 index 8165f5a..d083f9a 100644
2315 --- a/net/ipv4/tcp_output.c
2316 +++ b/net/ipv4/tcp_output.c
2317 @@ -357,6 +357,17 @@ struct tcp_out_options {
2318 __u32 tsval, tsecr; /* need to include OPTION_TS */
2319 };
2320
2321 +/* Beware: Something in the Internet is very sensitive to the ordering of
2322 + * TCP options, we learned this through the hard way, so be careful here.
2323 + * Luckily we can at least blame others for their non-compliance but from
2324 + * inter-operatibility perspective it seems that we're somewhat stuck with
2325 + * the ordering which we have been using if we want to keep working with
2326 + * those broken things (not that it currently hurts anybody as there isn't
2327 + * particular reason why the ordering would need to be changed).
2328 + *
2329 + * At least SACK_PERM as the first option is known to lead to a disaster
2330 + * (but it may well be that other scenarios fail similarly).
2331 + */
2332 static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
2333 const struct tcp_out_options *opts,
2334 __u8 **md5_hash) {
2335 @@ -371,6 +382,12 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
2336 *md5_hash = NULL;
2337 }
2338
2339 + if (unlikely(opts->mss)) {
2340 + *ptr++ = htonl((TCPOPT_MSS << 24) |
2341 + (TCPOLEN_MSS << 16) |
2342 + opts->mss);
2343 + }
2344 +
2345 if (likely(OPTION_TS & opts->options)) {
2346 if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) {
2347 *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
2348 @@ -387,12 +404,6 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
2349 *ptr++ = htonl(opts->tsecr);
2350 }
2351
2352 - if (unlikely(opts->mss)) {
2353 - *ptr++ = htonl((TCPOPT_MSS << 24) |
2354 - (TCPOLEN_MSS << 16) |
2355 - opts->mss);
2356 - }
2357 -
2358 if (unlikely(OPTION_SACK_ADVERTISE & opts->options &&
2359 !(OPTION_TS & opts->options))) {
2360 *ptr++ = htonl((TCPOPT_NOP << 24) |
2361 @@ -2266,6 +2277,11 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
2362 }
2363
2364 memset(&opts, 0, sizeof(opts));
2365 +#ifdef CONFIG_SYN_COOKIES
2366 + if (unlikely(req->cookie_ts))
2367 + TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
2368 + else
2369 +#endif
2370 TCP_SKB_CB(skb)->when = tcp_time_stamp;
2371 tcp_header_size = tcp_synack_options(sk, req,
2372 dst_metric(dst, RTAX_ADVMSS),
2373 @@ -2292,11 +2308,6 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
2374
2375 /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
2376 th->window = htons(min(req->rcv_wnd, 65535U));
2377 -#ifdef CONFIG_SYN_COOKIES
2378 - if (unlikely(req->cookie_ts))
2379 - TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
2380 - else
2381 -#endif
2382 tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
2383 th->doff = (tcp_header_size >> 2);
2384 TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
2385 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
2386 index 10e22fd..245cbc5 100644
2387 --- a/net/ipv6/tcp_ipv6.c
2388 +++ b/net/ipv6/tcp_ipv6.c
2389 @@ -1087,7 +1087,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
2390 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
2391 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
2392 *topt++ = htonl(tcp_time_stamp);
2393 - *topt = htonl(ts);
2394 + *topt++ = htonl(ts);
2395 }
2396
2397 #ifdef CONFIG_TCP_MD5SIG
2398 diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
2399 index ec0a083..700ae9e 100644
2400 --- a/net/sched/sch_generic.c
2401 +++ b/net/sched/sch_generic.c
2402 @@ -319,6 +319,7 @@ struct Qdisc_ops noop_qdisc_ops __read_mostly = {
2403
2404 static struct netdev_queue noop_netdev_queue = {
2405 .qdisc = &noop_qdisc,
2406 + .qdisc_sleeping = &noop_qdisc,
2407 };
2408
2409 struct Qdisc noop_qdisc = {
2410 @@ -344,6 +345,7 @@ static struct Qdisc_ops noqueue_qdisc_ops __read_mostly = {
2411 static struct Qdisc noqueue_qdisc;
2412 static struct netdev_queue noqueue_netdev_queue = {
2413 .qdisc = &noqueue_qdisc,
2414 + .qdisc_sleeping = &noqueue_qdisc,
2415 };
2416
2417 static struct Qdisc noqueue_qdisc = {
2418 diff --git a/scripts/package/mkspec b/scripts/package/mkspec
2419 index ffd61fe..62c5ffd 100755
2420 --- a/scripts/package/mkspec
2421 +++ b/scripts/package/mkspec
2422 @@ -64,8 +64,10 @@ fi
2423 echo "%install"
2424 echo "%ifarch ia64"
2425 echo 'mkdir -p $RPM_BUILD_ROOT/boot/efi $RPM_BUILD_ROOT/lib/modules'
2426 +echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
2427 echo "%else"
2428 echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules'
2429 +echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
2430 echo "%endif"
2431
2432 echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} modules_install'
2433 @@ -92,5 +94,6 @@ echo "%files"
2434 echo '%defattr (-, root, root)'
2435 echo "%dir /lib/modules"
2436 echo "/lib/modules/$KERNELRELEASE"
2437 +echo "/lib/firmware"
2438 echo "/boot/*"
2439 echo ""
2440 diff --git a/security/commoncap.c b/security/commoncap.c
2441 index e4c4b3f..378172b 100644
2442 --- a/security/commoncap.c
2443 +++ b/security/commoncap.c
2444 @@ -279,10 +279,10 @@ static int get_file_caps(struct linux_binprm *bprm)
2445 struct vfs_cap_data vcaps;
2446 struct inode *inode;
2447
2448 - if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
2449 - bprm_clear_caps(bprm);
2450 + bprm_clear_caps(bprm);
2451 +
2452 + if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
2453 return 0;
2454 - }
2455
2456 dentry = dget(bprm->file->f_dentry);
2457 inode = dentry->d_inode;
2458 diff --git a/sound/core/control.c b/sound/core/control.c
2459 index 281b2e2..236bbb1 100644
2460 --- a/sound/core/control.c
2461 +++ b/sound/core/control.c
2462 @@ -1427,12 +1427,12 @@ static int snd_ctl_dev_disconnect(struct snd_device *device)
2463 cardnum = card->number;
2464 snd_assert(cardnum >= 0 && cardnum < SNDRV_CARDS, return -ENXIO);
2465
2466 - down_read(&card->controls_rwsem);
2467 + read_lock(&card->ctl_files_rwlock);
2468 list_for_each_entry(ctl, &card->ctl_files, list) {
2469 wake_up(&ctl->change_sleep);
2470 kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
2471 }
2472 - up_read(&card->controls_rwsem);
2473 + read_unlock(&card->ctl_files_rwlock);
2474
2475 if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL,
2476 card, -1)) < 0)
2477 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
2478 index 1c53e33..0f014b1 100644
2479 --- a/sound/pci/hda/hda_intel.c
2480 +++ b/sound/pci/hda/hda_intel.c
2481 @@ -45,6 +45,7 @@
2482 #include <linux/slab.h>
2483 #include <linux/pci.h>
2484 #include <linux/mutex.h>
2485 +#include <linux/reboot.h>
2486 #include <sound/core.h>
2487 #include <sound/initval.h>
2488 #include "hda_codec.h"
2489 @@ -385,6 +386,9 @@ struct azx {
2490
2491 /* for pending irqs */
2492 struct work_struct irq_pending_work;
2493 +
2494 + /* reboot notifier (for mysterious hangup problem at power-down) */
2495 + struct notifier_block reboot_notifier;
2496 };
2497
2498 /* driver types */
2499 @@ -1890,12 +1894,36 @@ static int azx_resume(struct pci_dev *pci)
2500
2501
2502 /*
2503 + * reboot notifier for hang-up problem at power-down
2504 + */
2505 +static int azx_halt(struct notifier_block *nb, unsigned long event, void *buf)
2506 +{
2507 + struct azx *chip = container_of(nb, struct azx, reboot_notifier);
2508 + azx_stop_chip(chip);
2509 + return NOTIFY_OK;
2510 +}
2511 +
2512 +static void azx_notifier_register(struct azx *chip)
2513 +{
2514 + chip->reboot_notifier.notifier_call = azx_halt;
2515 + register_reboot_notifier(&chip->reboot_notifier);
2516 +}
2517 +
2518 +static void azx_notifier_unregister(struct azx *chip)
2519 +{
2520 + if (chip->reboot_notifier.notifier_call)
2521 + unregister_reboot_notifier(&chip->reboot_notifier);
2522 +}
2523 +
2524 +/*
2525 * destructor
2526 */
2527 static int azx_free(struct azx *chip)
2528 {
2529 int i;
2530
2531 + azx_notifier_unregister(chip);
2532 +
2533 if (chip->initialized) {
2534 azx_clear_irq_pending(chip);
2535 for (i = 0; i < chip->num_streams; i++)
2536 @@ -2250,6 +2278,7 @@ static int __devinit azx_probe(struct pci_dev *pci,
2537 pci_set_drvdata(pci, card);
2538 chip->running = 1;
2539 power_down_all_codecs(chip);
2540 + azx_notifier_register(chip);
2541
2542 dev++;
2543 return err;
  ViewVC Help
Powered by ViewVC 1.1.20