--- /dev/null
+From 4feba70a2c1a1a0c96909f657f48b2e11e682370 Mon Sep 17 00:00:00 2001
+From: Peter Gruber <nokos@gmx.net>
+Date: Mon, 27 Oct 2008 23:59:36 -0400
+Subject: ACPI: avoid empty file name in sysfs
+
+From: Peter Gruber <nokos@gmx.net>
+
+commit 4feba70a2c1a1a0c96909f657f48b2e11e682370 upstream.
+
+Since commit bc45b1d39a925b56796bebf8a397a0491489d85c acpi tables are
+allowed to have an empty signature and /sys/firmware/acpi/tables uses the
+signature as filename. Applications using naive recursion through /sys
+loop forever. A possible solution would be: (replacing the zero length
+filename with the string "NULL")
+
+http://bugzilla.kernel.org/show_bug.cgi?id=11539
+
+Acked-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/system.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+--- a/drivers/acpi/system.c
++++ b/drivers/acpi/system.c
+@@ -78,9 +78,15 @@ static ssize_t acpi_table_show(struct ko
+ container_of(bin_attr, struct acpi_table_attr, attr);
+ struct acpi_table_header *table_header = NULL;
+ acpi_status status;
++ char name[ACPI_NAME_SIZE];
++
++ if (strncmp(table_attr->name, "NULL", 4))
++ memcpy(name, table_attr->name, ACPI_NAME_SIZE);
++ else
++ memcpy(name, "\0\0\0\0", 4);
+
+ status =
+- acpi_get_table(table_attr->name, table_attr->instance,
++ acpi_get_table(name, table_attr->instance,
+ &table_header);
+ if (ACPI_FAILURE(status))
+ return -ENODEV;
+@@ -95,21 +101,24 @@ static void acpi_table_attr_init(struct
+ struct acpi_table_header *header = NULL;
+ struct acpi_table_attr *attr = NULL;
+
+- memcpy(table_attr->name, table_header->signature, ACPI_NAME_SIZE);
++ if (table_header->signature[0] != '\0')
++ memcpy(table_attr->name, table_header->signature,
++ ACPI_NAME_SIZE);
++ else
++ memcpy(table_attr->name, "NULL", 4);
+
+ list_for_each_entry(attr, &acpi_table_attr_list, node) {
+- if (!memcmp(table_header->signature, attr->name,
+- ACPI_NAME_SIZE))
++ if (!memcmp(table_attr->name, attr->name, ACPI_NAME_SIZE))
+ if (table_attr->instance < attr->instance)
+ table_attr->instance = attr->instance;
+ }
+ table_attr->instance++;
+
+ if (table_attr->instance > 1 || (table_attr->instance == 1 &&
+- !acpi_get_table(table_header->
+- signature, 2,
+- &header)))
+- sprintf(table_attr->name + 4, "%d", table_attr->instance);
++ !acpi_get_table
++ (table_header->signature, 2, &header)))
++ sprintf(table_attr->name + ACPI_NAME_SIZE, "%d",
++ table_attr->instance);
+
+ table_attr->attr.size = 0;
+ table_attr->attr.read = acpi_table_show;
--- /dev/null
+From f8248434e6a11d7cd314281be3b39bbcf82fc243 Mon Sep 17 00:00:00 2001
+From: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+Date: Sat, 1 Nov 2008 11:05:26 +0000
+Subject: ACPI: EC: make kernel messages more useful when GPE storm is detected
+
+From: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+
+commit f8248434e6a11d7cd314281be3b39bbcf82fc243 upstream.
+
+Make sure we can tell if the GPE storm workaround gets activated,
+and avoid flooding the logs afterwards.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=11841
+"plenty of line "ACPI: EC: non-query interrupt received,
+ switching to interrupt mode" in dmesg"
+
+Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+Acked-by: Alexey Starikovskiy <astarikovskiy@suse.de>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/ec.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -286,7 +286,8 @@ static int acpi_ec_transaction_unlocked(
+ acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
+ } else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
+ t->irq_count > ACPI_EC_STORM_THRESHOLD) {
+- pr_debug(PREFIX "GPE storm detected\n");
++ pr_info(PREFIX "GPE storm detected, "
++ "transactions will use polling mode\n");
+ set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
+ }
+ return ret;
+@@ -566,9 +567,15 @@ static u32 acpi_ec_gpe_handler(void *dat
+ if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
+ !test_bit(EC_FLAGS_NO_GPE, &ec->flags)) {
+ /* this is non-query, must be confirmation */
+- if (printk_ratelimit())
+- pr_info(PREFIX "non-query interrupt received,"
++ if (!test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
++ if (printk_ratelimit())
++ pr_info(PREFIX "non-query interrupt received,"
++ " switching to interrupt mode\n");
++ } else {
++ /* hush, STORM switches the mode every transaction */
++ pr_debug(PREFIX "non-query interrupt received,"
+ " switching to interrupt mode\n");
++ }
+ set_bit(EC_FLAGS_GPE_MODE, &ec->flags);
+ }
+ return ACPI_INTERRUPT_HANDLED;
--- /dev/null
+From 72bc2b1ad62f4d2f0a51b35829093d41f55accce Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nico@cam.org>
+Date: Sat, 8 Nov 2008 21:15:53 +0100
+Subject: ARM: 5329/1: Feroceon: fix feroceon_l2_inv_range
+
+From: Nicolas Pitre <nico@cam.org>
+
+commit 72bc2b1ad62f4d2f0a51b35829093d41f55accce upstream
+
+Same fix as commit c7cf72dcadb: when 'start' and 'end' are less than a
+cacheline apart and 'start' is unaligned we are done after cleaning and
+invalidating the first cacheline.
+
+Signed-off-by: Nicolas Pitre <nico@marvell.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mm/cache-feroceon-l2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mm/cache-feroceon-l2.c
++++ b/arch/arm/mm/cache-feroceon-l2.c
+@@ -148,7 +148,7 @@ static void feroceon_l2_inv_range(unsign
+ /*
+ * Clean and invalidate partial last cache line.
+ */
+- if (end & (CACHE_LINE_SIZE - 1)) {
++ if (start < end && end & (CACHE_LINE_SIZE - 1)) {
+ l2_clean_inv_pa(end & ~(CACHE_LINE_SIZE - 1));
+ end &= ~(CACHE_LINE_SIZE - 1);
+ }
+@@ -156,7 +156,7 @@ static void feroceon_l2_inv_range(unsign
+ /*
+ * Invalidate all full cache lines between 'start' and 'end'.
+ */
+- while (start != end) {
++ while (start < end) {
+ unsigned long range_end = calc_range_end(start, end);
+ l2_inv_pa_range(start, range_end - CACHE_LINE_SIZE);
+ start = range_end;
--- /dev/null
+From eo@nebensachen.de Thu Nov 13 13:21:15 2008
+From: Elias Oltmanns <eo@nebensachen.de>
+Date: Wed, 12 Nov 2008 11:30:10 +0100
+Subject: ath5k: Fix reset sequence for AR5212 in general and RF5111 in particular
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, Bob Copeland <me@bobcopeland.com>, "John W. Linville" <linville@tuxdriver.com>
+Message-ID: <20081112101254.24756.4110.stgit@denkblock.local>
+
+From: Elias Oltmanns <eo@nebensachen.de>
+
+commit 7d19267b8d1e12c0baebf9be96e04cddffe63f67 upstream
+
+Take care to handle register 0xa228 exactly as in the HAL released by
+Atheros. This change is required to make ath5k work again on my system
+since commit 2203d6be (ath5k: Misc hw_reset updates), thus fixing a
+regression in 2.6.27 and therefore hopefully eligible for inclusion into
+a stable release.
+
+v2: Only overwrite initial register values on later revisions of AR5212
+ chips.
+v3: Use standard macros to manipulate the register.
+
+Signed-off-by: Elias Oltmanns <eo@nebensachen.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath5k/hw.c | 22 +++++++---------------
+ drivers/net/wireless/ath5k/initvals.c | 2 ++
+ 2 files changed, 9 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/ath5k/hw.c
++++ b/drivers/net/wireless/ath5k/hw.c
+@@ -826,9 +826,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah,
+ mdelay(1);
+
+ /*
+- * Write some more initial register settings
++ * Write some more initial register settings for revised chips
+ */
+- if (ah->ah_version == AR5K_AR5212) {
++ if (ah->ah_version == AR5K_AR5212 &&
++ ah->ah_phy_revision > 0x41) {
+ ath5k_hw_reg_write(ah, 0x0002a002, 0x982c);
+
+ if (channel->hw_value == CHANNEL_G)
+@@ -847,19 +848,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah,
+ else
+ ath5k_hw_reg_write(ah, 0x00000000, 0x994c);
+
+- /* Some bits are disabled here, we know nothing about
+- * register 0xa228 yet, most of the times this ends up
+- * with a value 0x9b5 -haven't seen any dump with
+- * a different value- */
+- /* Got this from decompiling binary HAL */
+- data = ath5k_hw_reg_read(ah, 0xa228);
+- data &= 0xfffffdff;
+- ath5k_hw_reg_write(ah, data, 0xa228);
+-
+- data = ath5k_hw_reg_read(ah, 0xa228);
+- data &= 0xfffe03ff;
+- ath5k_hw_reg_write(ah, data, 0xa228);
+- data = 0;
++ /* Got this from legacy-hal */
++ AR5K_REG_DISABLE_BITS(ah, 0xa228, 0x200);
++
++ AR5K_REG_MASKED_BITS(ah, 0xa228, 2 << 10, ~0x1fc00);
+
+ /* Just write 0x9b5 ? */
+ /* ath5k_hw_reg_write(ah, 0x000009b5, 0xa228); */
+--- a/drivers/net/wireless/ath5k/initvals.c
++++ b/drivers/net/wireless/ath5k/initvals.c
+@@ -810,6 +810,8 @@ static const struct ath5k_ini_mode ar521
+ { 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 } },
+ { AR5K_PHY(642),
+ { 0xd03e6788, 0xd03e6788, 0xd03e6788, 0xd03e6788, 0xd03e6788 } },
++ { 0xa228,
++ { 0x000001b5, 0x000001b5, 0x000001b5, 0x000001b5, 0x000001b5 } },
+ { 0xa23c,
+ { 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af } },
+ };
--- /dev/null
+From eo@nebensachen.de Thu Nov 13 13:19:38 2008
+From: Elias Oltmanns <eo@nebensachen.de>
+Date: Wed, 12 Nov 2008 11:28:39 +0100
+Subject: ath5k: fix suspend-related oops on rmmod
+To: Greg KH <greg@kroah.com>
+Cc: Bob Copeland <me@bobcopeland.com>, stable@kernel.org, "John W. Linville" <linville@tuxdriver.com>
+Message-ID: <20081112101254.24756.4691.stgit@denkblock.local>
+
+From: Elias Oltmanns <eo@nebensachen.de>
+
+Cumulative patch backporting the following two commits from upstream:
+
+commit 8bdd5b9c6bd53add260756b6673a0545fbdbba21 upstream
+Author: Bob Copeland <me@bobcopeland.com>
+
+Based on a patch by Elias Oltmanns, we call ath5k_init in resume even
+if we didn't previously open the device. Besides starting up the
+device unnecessarily, this also causes an oops on rmmod because
+mac80211 will not invoke ath5k_stop and softirqs are left running after
+the module has been unloaded. Add a new state bit, ATH_STAT_STARTED,
+to indicate that we have been started up.
+
+commit bc1b32d6bdd2d6f3fbee9a7c01c9b099f11c579c upstream
+Author: Elias Oltmanns <eo@nebensachen.de>
+
+After a s2ram / resume cycle, resetting the key cache does not work
+unless it is deferred until after the hardware has been reinitialised by
+a call to ath5k_hw_reset(). This fixes a regression introduced by
+"ath5k: fix suspend-related oops on rmmod".
+
+Reported-by: Toralf Förster <toralf.foerster@gmx.de>
+Signed-off-by: Elias Oltmanns <eo@nebensachen.de>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/net/wireless/ath5k/base.c | 67 +++++++++++++++++++-------------------
+ drivers/net/wireless/ath5k/base.h | 3 +
+ 2 files changed, 36 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/wireless/ath5k/base.c
++++ b/drivers/net/wireless/ath5k/base.c
+@@ -294,9 +294,9 @@ static inline u64 ath5k_extend_tsf(struc
+ }
+
+ /* Interrupt handling */
+-static int ath5k_init(struct ath5k_softc *sc);
++static int ath5k_init(struct ath5k_softc *sc, bool is_resume);
+ static int ath5k_stop_locked(struct ath5k_softc *sc);
+-static int ath5k_stop_hw(struct ath5k_softc *sc);
++static int ath5k_stop_hw(struct ath5k_softc *sc, bool is_suspend);
+ static irqreturn_t ath5k_intr(int irq, void *dev_id);
+ static void ath5k_tasklet_reset(unsigned long data);
+
+@@ -584,7 +584,7 @@ ath5k_pci_suspend(struct pci_dev *pdev,
+
+ ath5k_led_off(sc);
+
+- ath5k_stop_hw(sc);
++ ath5k_stop_hw(sc, true);
+
+ free_irq(pdev->irq, sc);
+ pci_save_state(pdev);
+@@ -599,8 +599,7 @@ ath5k_pci_resume(struct pci_dev *pdev)
+ {
+ struct ieee80211_hw *hw = pci_get_drvdata(pdev);
+ struct ath5k_softc *sc = hw->priv;
+- struct ath5k_hw *ah = sc->ah;
+- int i, err;
++ int err;
+
+ pci_restore_state(pdev);
+
+@@ -621,21 +620,11 @@ ath5k_pci_resume(struct pci_dev *pdev)
+ goto err_no_irq;
+ }
+
+- err = ath5k_init(sc);
++ err = ath5k_init(sc, true);
+ if (err)
+ goto err_irq;
+ ath5k_led_enable(sc);
+
+- /*
+- * Reset the key cache since some parts do not
+- * reset the contents on initial power up or resume.
+- *
+- * FIXME: This may need to be revisited when mac80211 becomes
+- * aware of suspend/resume.
+- */
+- for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
+- ath5k_hw_reset_key(ah, i);
+-
+ return 0;
+ err_irq:
+ free_irq(pdev->irq, sc);
+@@ -657,7 +646,6 @@ ath5k_attach(struct pci_dev *pdev, struc
+ struct ath5k_softc *sc = hw->priv;
+ struct ath5k_hw *ah = sc->ah;
+ u8 mac[ETH_ALEN];
+- unsigned int i;
+ int ret;
+
+ ATH5K_DBG(sc, ATH5K_DEBUG_ANY, "devid 0x%x\n", pdev->device);
+@@ -676,13 +664,6 @@ ath5k_attach(struct pci_dev *pdev, struc
+ __set_bit(ATH_STAT_MRRETRY, sc->status);
+
+ /*
+- * Reset the key cache since some parts do not
+- * reset the contents on initial power up.
+- */
+- for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
+- ath5k_hw_reset_key(ah, i);
+-
+- /*
+ * Collect the channel list. The 802.11 layer
+ * is resposible for filtering this list based
+ * on settings like the phy mode and regulatory
+@@ -2197,12 +2178,18 @@ ath5k_beacon_config(struct ath5k_softc *
+ \********************/
+
+ static int
+-ath5k_init(struct ath5k_softc *sc)
++ath5k_init(struct ath5k_softc *sc, bool is_resume)
+ {
+- int ret;
++ struct ath5k_hw *ah = sc->ah;
++ int ret, i;
+
+ mutex_lock(&sc->lock);
+
++ if (is_resume && !test_bit(ATH_STAT_STARTED, sc->status))
++ goto out_ok;
++
++ __clear_bit(ATH_STAT_STARTED, sc->status);
++
+ ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mode %d\n", sc->opmode);
+
+ /*
+@@ -2220,7 +2207,7 @@ ath5k_init(struct ath5k_softc *sc)
+ */
+ sc->curchan = sc->hw->conf.channel;
+ sc->curband = &sc->sbands[sc->curchan->band];
+- ret = ath5k_hw_reset(sc->ah, sc->opmode, sc->curchan, false);
++ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, false);
+ if (ret) {
+ ATH5K_ERR(sc, "unable to reset hardware: %d\n", ret);
+ goto done;
+@@ -2229,7 +2216,14 @@ ath5k_init(struct ath5k_softc *sc)
+ * This is needed only to setup initial state
+ * but it's best done after a reset.
+ */
+- ath5k_hw_set_txpower_limit(sc->ah, 0);
++ ath5k_hw_set_txpower_limit(ah, 0);
++
++ /*
++ * Reset the key cache since some parts do not reset the
++ * contents on initial power up or resume from suspend.
++ */
++ for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
++ ath5k_hw_reset_key(ah, i);
+
+ /*
+ * Setup the hardware after reset: the key cache
+@@ -2249,13 +2243,17 @@ ath5k_init(struct ath5k_softc *sc)
+ AR5K_INT_RXORN | AR5K_INT_FATAL | AR5K_INT_GLOBAL |
+ AR5K_INT_MIB;
+
+- ath5k_hw_set_intr(sc->ah, sc->imask);
++ ath5k_hw_set_intr(ah, sc->imask);
++
++ __set_bit(ATH_STAT_STARTED, sc->status);
++
+ /* Set ack to be sent at low bit-rates */
+- ath5k_hw_set_ack_bitrate_high(sc->ah, false);
++ ath5k_hw_set_ack_bitrate_high(ah, false);
+
+ mod_timer(&sc->calib_tim, round_jiffies(jiffies +
+ msecs_to_jiffies(ath5k_calinterval * 1000)));
+
++out_ok:
+ ret = 0;
+ done:
+ mmiowb();
+@@ -2310,7 +2308,7 @@ ath5k_stop_locked(struct ath5k_softc *sc
+ * stop is preempted).
+ */
+ static int
+-ath5k_stop_hw(struct ath5k_softc *sc)
++ath5k_stop_hw(struct ath5k_softc *sc, bool is_suspend)
+ {
+ int ret;
+
+@@ -2341,6 +2339,9 @@ ath5k_stop_hw(struct ath5k_softc *sc)
+ }
+ }
+ ath5k_txbuf_free(sc, sc->bbuf);
++ if (!is_suspend)
++ __clear_bit(ATH_STAT_STARTED, sc->status);
++
+ mmiowb();
+ mutex_unlock(&sc->lock);
+
+@@ -2719,12 +2720,12 @@ err:
+
+ static int ath5k_start(struct ieee80211_hw *hw)
+ {
+- return ath5k_init(hw->priv);
++ return ath5k_init(hw->priv, false);
+ }
+
+ static void ath5k_stop(struct ieee80211_hw *hw)
+ {
+- ath5k_stop_hw(hw->priv);
++ ath5k_stop_hw(hw->priv, false);
+ }
+
+ static int ath5k_add_interface(struct ieee80211_hw *hw,
+--- a/drivers/net/wireless/ath5k/base.h
++++ b/drivers/net/wireless/ath5k/base.h
+@@ -132,11 +132,12 @@ struct ath5k_softc {
+ size_t desc_len; /* size of TX/RX descriptors */
+ u16 cachelsz; /* cache line size */
+
+- DECLARE_BITMAP(status, 4);
++ DECLARE_BITMAP(status, 5);
+ #define ATH_STAT_INVALID 0 /* disable hardware accesses */
+ #define ATH_STAT_MRRETRY 1 /* multi-rate retry support */
+ #define ATH_STAT_PROMISC 2
+ #define ATH_STAT_LEDSOFT 3 /* enable LED gpio status */
++#define ATH_STAT_STARTED 4 /* opened & irqs enabled */
+
+ unsigned int filter_flags; /* HW flags, AR5K_RX_FILTER_* */
+ unsigned int curmode; /* current phy mode */
--- /dev/null
+From knikanth@suse.de Thu Nov 13 14:07:47 2008
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Date: Wed, 12 Nov 2008 11:33:54 +0530
+Subject: block: fix nr_phys_segments miscalculation bug
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Message-ID: <200811121133.55404.knikanth@suse.de>
+Content-Disposition: inline
+
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+
+commit 8677142710516d986d932d6f1fba7be8382c1fec upstream
+backported by Nikanth Karthikesan <knikanth@suse.de> to the 2.6.27.y tree.
+
+block: fix nr_phys_segments miscalculation bug
+
+This fixes the bug reported by Nikanth Karthikesan <knikanth@suse.de>:
+
+http://lkml.org/lkml/2008/10/2/203
+
+The root cause of the bug is that blk_phys_contig_segment
+miscalculates q->max_segment_size.
+
+blk_phys_contig_segment checks:
+
+req->biotail->bi_size + next_req->bio->bi_size > q->max_segment_size
+
+But blk_recalc_rq_segments might expect that req->biotail and the
+previous bio in the req are supposed be merged into one
+segment. blk_recalc_rq_segments might also expect that next_req->bio
+and the next bio in the next_req are supposed be merged into one
+segment. In such case, we merge two requests that can't be merged
+here. Later, blk_rq_map_sg gives more segments than it should.
+
+We need to keep track of segment size in blk_recalc_rq_segments and
+use it to see if two requests can be merged. This patch implements it
+in the similar way that we used to do for hw merging (virtual
+merging).
+
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Cc: Nikanth Karthikesan <knikanth@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-merge.c | 19 +++++++++++++++++--
+ include/linux/bio.h | 7 +++++++
+ 2 files changed, 24 insertions(+), 2 deletions(-)
+
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -95,6 +95,9 @@ new_hw_segment:
+ nr_hw_segs++;
+ }
+
++ if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
++ rq->bio->bi_seg_front_size = seg_size;
++
+ nr_phys_segs++;
+ bvprv = bv;
+ seg_size = bv->bv_len;
+@@ -106,6 +109,10 @@ new_hw_segment:
+ rq->bio->bi_hw_front_size = hw_seg_size;
+ if (hw_seg_size > rq->biotail->bi_hw_back_size)
+ rq->biotail->bi_hw_back_size = hw_seg_size;
++ if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
++ rq->bio->bi_seg_front_size = seg_size;
++ if (seg_size > rq->biotail->bi_seg_back_size)
++ rq->biotail->bi_seg_back_size = seg_size;
+ rq->nr_phys_segments = nr_phys_segs;
+ rq->nr_hw_segments = nr_hw_segs;
+ }
+@@ -133,7 +140,8 @@ static int blk_phys_contig_segment(struc
+
+ if (!BIOVEC_PHYS_MERGEABLE(__BVEC_END(bio), __BVEC_START(nxt)))
+ return 0;
+- if (bio->bi_size + nxt->bi_size > q->max_segment_size)
++ if (bio->bi_seg_back_size + nxt->bi_seg_front_size >
++ q->max_segment_size)
+ return 0;
+
+ /*
+@@ -377,6 +385,8 @@ static int ll_merge_requests_fn(struct r
+ {
+ int total_phys_segments;
+ int total_hw_segments;
++ unsigned int seg_size =
++ req->biotail->bi_seg_back_size + next->bio->bi_seg_front_size;
+
+ /*
+ * First check if the either of the requests are re-queued
+@@ -392,8 +402,13 @@ static int ll_merge_requests_fn(struct r
+ return 0;
+
+ total_phys_segments = req->nr_phys_segments + next->nr_phys_segments;
+- if (blk_phys_contig_segment(q, req->biotail, next->bio))
++ if (blk_phys_contig_segment(q, req->biotail, next->bio)) {
++ if (req->nr_phys_segments == 1)
++ req->bio->bi_seg_front_size = seg_size;
++ if (next->nr_phys_segments == 1)
++ next->biotail->bi_seg_back_size = seg_size;
+ total_phys_segments--;
++ }
+
+ if (total_phys_segments > q->max_phys_segments)
+ return 0;
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -98,6 +98,13 @@ struct bio {
+ unsigned int bi_size; /* residual I/O count */
+
+ /*
++ * To keep track of the max segment size, we account for the
++ * sizes of the first and last mergeable segments in this bio.
++ */
++ unsigned int bi_seg_front_size;
++ unsigned int bi_seg_back_size;
++
++ /*
+ * To keep track of the max hw size, we account for the
+ * sizes of the first and last virtually mergeable segments
+ * in this bio
--- /dev/null
+From 12b56ea89e70d4b04f2f5199750310e82894ebbd Mon Sep 17 00:00:00 2001
+From: Eilon Greenstein <eilong@broadcom.com>
+Date: Mon, 3 Nov 2008 16:46:40 -0800
+Subject: bnx2x: Calling netif_carrier_off at the end of the probe
+
+From: Eilon Greenstein <eilong@broadcom.com>
+
+commit 12b56ea89e70d4b04f2f5199750310e82894ebbd upstream.
+
+netif_carrier_off was called too early at the probe. In case of failure
+or simply bad timing, this can cause a fatal error since linkwatch_event
+might run too soon.
+
+Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Alex Chiang <achiang@hp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bnx2x_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bnx2x_main.c
++++ b/drivers/net/bnx2x_main.c
+@@ -10205,8 +10205,6 @@ static int __devinit bnx2x_init_one(stru
+ return -ENOMEM;
+ }
+
+- netif_carrier_off(dev);
+-
+ bp = netdev_priv(dev);
+ bp->msglevel = debug;
+
+@@ -10230,6 +10228,8 @@ static int __devinit bnx2x_init_one(stru
+ goto init_one_exit;
+ }
+
++ netif_carrier_off(dev);
++
+ bp->common.name = board_info[ent->driver_data].name;
+ printk(KERN_INFO "%s: %s (%c%d) PCI-E x%d %s found at mem %lx,"
+ " IRQ %d, ", dev->name, bp->common.name,
--- /dev/null
+From 7d96567ac0527703cf1b80043fc0ebd7f21a10ad Mon Sep 17 00:00:00 2001
+From: Eilon Greenstein <eilong@broadcom.com>
+Date: Mon, 3 Nov 2008 16:46:19 -0800
+Subject: bnx2x: PCI configuration bug on big-endian
+
+From: Eilon Greenstein <eilong@broadcom.com>
+
+commit 7d96567ac0527703cf1b80043fc0ebd7f21a10ad upstream.
+
+The current code read nothing but zeros on big-endian (wrong part of the
+32bits). This caused poor performance on big-endian machines. Though this
+issue did not cause the system to crash, the performance is significantly
+better with the fix so I view it as critical bug fix.
+
+Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Alex Chiang <achiang@hp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bnx2x_init.h | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/bnx2x_init.h
++++ b/drivers/net/bnx2x_init.h
+@@ -564,14 +564,15 @@ static const struct arb_line write_arb_a
+
+ static void bnx2x_init_pxp(struct bnx2x *bp)
+ {
++ u16 devctl;
+ int r_order, w_order;
+ u32 val, i;
+
+ pci_read_config_word(bp->pdev,
+- bp->pcie_cap + PCI_EXP_DEVCTL, (u16 *)&val);
+- DP(NETIF_MSG_HW, "read 0x%x from devctl\n", (u16)val);
+- w_order = ((val & PCI_EXP_DEVCTL_PAYLOAD) >> 5);
+- r_order = ((val & PCI_EXP_DEVCTL_READRQ) >> 12);
++ bp->pcie_cap + PCI_EXP_DEVCTL, &devctl);
++ DP(NETIF_MSG_HW, "read 0x%x from devctl\n", devctl);
++ w_order = ((devctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5);
++ r_order = ((devctl & PCI_EXP_DEVCTL_READRQ) >> 12);
+
+ if (r_order > MAX_RD_ORD) {
+ DP(NETIF_MSG_HW, "read order of %d order adjusted to %d\n",
--- /dev/null
+From 9a0354405feb0f8bd460349a93db05e4cca8d166 Mon Sep 17 00:00:00 2001
+From: Eilon Greenstein <eilong@broadcom.com>
+Date: Mon, 3 Nov 2008 16:45:55 -0800
+Subject: bnx2x: Removing the PMF indication when unloading
+
+From: Eilon Greenstein <eilong@broadcom.com>
+
+commit 9a0354405feb0f8bd460349a93db05e4cca8d166 upstream.
+
+When the PMF flag is set, the driver can access the HW freely. When the
+driver is unloaded, it should not access the HW. The problem caused fatal
+errors when "ethtool -i" was called after the calling instance was unloaded
+and another instance was already loaded
+
+Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Alex Chiang <achiang@hp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bnx2x_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/bnx2x_main.c
++++ b/drivers/net/bnx2x_main.c
+@@ -6480,6 +6480,7 @@ load_int_disable:
+ bnx2x_free_irq(bp);
+ load_error:
+ bnx2x_free_mem(bp);
++ bp->port.pmf = 0;
+
+ /* TBD we really need to reset the chip
+ if we want to recover from this */
+@@ -6790,6 +6791,7 @@ unload_error:
+ /* Report UNLOAD_DONE to MCP */
+ if (!BP_NOMCP(bp))
+ bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
++ bp->port.pmf = 0;
+
+ /* Free SKBs, SGEs, TPA pool and driver internals */
+ bnx2x_free_skbs(bp);
--- /dev/null
+From fe2d5ffc74a1de6a31e9fd65b65cce72d881edf7 Mon Sep 17 00:00:00 2001
+From: Darrick J. Wong <djwong@us.ibm.com>
+Date: Wed, 12 Nov 2008 13:25:00 -0800
+Subject: Fix platform drivers that crash on suspend/resume
+
+From: Darrick J. Wong <djwong@us.ibm.com>
+
+commit fe2d5ffc74a1de6a31e9fd65b65cce72d881edf7 upstream.
+
+It turns out that if one registers a struct platform_device, the
+platform device code expects that platform_device.device->driver points
+to a struct driver inside a struct platform_driver.
+
+This is not the case with the ipmi-si, ipmi-msghandler and ibmaem
+drivers, which causes the suspend/resume hook functions to jump off into
+nowhere, causing a crash. Make this assumption hold true for these
+three drivers.
+
+Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
+Acked-by: Corey Minyard <cminyard@mvista.com>
+Cc: Jean Delvare <khali@linux-fr.org>
+Cc: Kay Sievers <kay.sievers@vrfy.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 20 +++++++++++---------
+ drivers/char/ipmi/ipmi_si_intf.c | 16 +++++++++-------
+ drivers/hwmon/ibmaem.c | 18 ++++++++++--------
+ 3 files changed, 30 insertions(+), 24 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -422,9 +422,11 @@ struct ipmi_smi {
+ /**
+ * The driver model view of the IPMI messaging driver.
+ */
+-static struct device_driver ipmidriver = {
+- .name = "ipmi",
+- .bus = &platform_bus_type
++static struct platform_driver ipmidriver = {
++ .driver = {
++ .name = "ipmi",
++ .bus = &platform_bus_type
++ }
+ };
+ static DEFINE_MUTEX(ipmidriver_mutex);
+
+@@ -2384,9 +2386,9 @@ static int ipmi_bmc_register(ipmi_smi_t
+ * representing the interfaced BMC already
+ */
+ if (bmc->guid_set)
+- old_bmc = ipmi_find_bmc_guid(&ipmidriver, bmc->guid);
++ old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
+ else
+- old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver,
++ old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
+ bmc->id.product_id,
+ bmc->id.device_id);
+
+@@ -2416,7 +2418,7 @@ static int ipmi_bmc_register(ipmi_smi_t
+ snprintf(name, sizeof(name),
+ "ipmi_bmc.%4.4x", bmc->id.product_id);
+
+- while (ipmi_find_bmc_prod_dev_id(&ipmidriver,
++ while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
+ bmc->id.product_id,
+ bmc->id.device_id)) {
+ if (!warn_printed) {
+@@ -2446,7 +2448,7 @@ static int ipmi_bmc_register(ipmi_smi_t
+ " Unable to allocate platform device\n");
+ return -ENOMEM;
+ }
+- bmc->dev->dev.driver = &ipmidriver;
++ bmc->dev->dev.driver = &ipmidriver.driver;
+ dev_set_drvdata(&bmc->dev->dev, bmc);
+ kref_init(&bmc->refcount);
+
+@@ -4247,7 +4249,7 @@ static int ipmi_init_msghandler(void)
+ if (initialized)
+ return 0;
+
+- rv = driver_register(&ipmidriver);
++ rv = driver_register(&ipmidriver.driver);
+ if (rv) {
+ printk(KERN_ERR PFX "Could not register IPMI driver\n");
+ return rv;
+@@ -4308,7 +4310,7 @@ static __exit void cleanup_ipmi(void)
+ remove_proc_entry(proc_ipmi_root->name, NULL);
+ #endif /* CONFIG_PROC_FS */
+
+- driver_unregister(&ipmidriver);
++ driver_unregister(&ipmidriver.driver);
+
+ initialized = 0;
+
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -114,9 +114,11 @@ static char *si_to_str[] = { "kcs", "smi
+
+ #define DEVICE_NAME "ipmi_si"
+
+-static struct device_driver ipmi_driver = {
+- .name = DEVICE_NAME,
+- .bus = &platform_bus_type
++static struct platform_driver ipmi_driver = {
++ .driver = {
++ .name = DEVICE_NAME,
++ .bus = &platform_bus_type
++ }
+ };
+
+
+@@ -2868,7 +2870,7 @@ static int try_smi_init(struct smi_info
+ goto out_err;
+ }
+ new_smi->dev = &new_smi->pdev->dev;
+- new_smi->dev->driver = &ipmi_driver;
++ new_smi->dev->driver = &ipmi_driver.driver;
+
+ rv = platform_device_add(new_smi->pdev);
+ if (rv) {
+@@ -2983,7 +2985,7 @@ static __devinit int init_ipmi_si(void)
+ initialized = 1;
+
+ /* Register the device drivers. */
+- rv = driver_register(&ipmi_driver);
++ rv = driver_register(&ipmi_driver.driver);
+ if (rv) {
+ printk(KERN_ERR
+ "init_ipmi_si: Unable to register driver: %d\n",
+@@ -3052,7 +3054,7 @@ static __devinit int init_ipmi_si(void)
+ #ifdef CONFIG_PPC_OF
+ of_unregister_platform_driver(&ipmi_of_platform_driver);
+ #endif
+- driver_unregister(&ipmi_driver);
++ driver_unregister(&ipmi_driver.driver);
+ printk(KERN_WARNING
+ "ipmi_si: Unable to find any System Interface(s)\n");
+ return -ENODEV;
+@@ -3151,7 +3153,7 @@ static __exit void cleanup_ipmi_si(void)
+ cleanup_one_si(e);
+ mutex_unlock(&smi_infos_lock);
+
+- driver_unregister(&ipmi_driver);
++ driver_unregister(&ipmi_driver.driver);
+ }
+ module_exit(cleanup_ipmi_si);
+
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -88,9 +88,11 @@
+ static DEFINE_IDR(aem_idr);
+ static DEFINE_SPINLOCK(aem_idr_lock);
+
+-static struct device_driver aem_driver = {
+- .name = DRVNAME,
+- .bus = &platform_bus_type,
++static struct platform_driver aem_driver = {
++ .driver = {
++ .name = DRVNAME,
++ .bus = &platform_bus_type,
++ }
+ };
+
+ struct aem_ipmi_data {
+@@ -583,7 +585,7 @@ static int aem_init_aem1_inst(struct aem
+ data->pdev = platform_device_alloc(DRVNAME, data->id);
+ if (!data->pdev)
+ goto dev_err;
+- data->pdev->dev.driver = &aem_driver;
++ data->pdev->dev.driver = &aem_driver.driver;
+
+ res = platform_device_add(data->pdev);
+ if (res)
+@@ -716,7 +718,7 @@ static int aem_init_aem2_inst(struct aem
+ data->pdev = platform_device_alloc(DRVNAME, data->id);
+ if (!data->pdev)
+ goto dev_err;
+- data->pdev->dev.driver = &aem_driver;
++ data->pdev->dev.driver = &aem_driver.driver;
+
+ res = platform_device_add(data->pdev);
+ if (res)
+@@ -1085,7 +1087,7 @@ static int __init aem_init(void)
+ {
+ int res;
+
+- res = driver_register(&aem_driver);
++ res = driver_register(&aem_driver.driver);
+ if (res) {
+ printk(KERN_ERR "Can't register aem driver\n");
+ return res;
+@@ -1097,7 +1099,7 @@ static int __init aem_init(void)
+ return 0;
+
+ ipmi_reg_err:
+- driver_unregister(&aem_driver);
++ driver_unregister(&aem_driver.driver);
+ return res;
+
+ }
+@@ -1107,7 +1109,7 @@ static void __exit aem_exit(void)
+ struct aem_data *p1, *next1;
+
+ ipmi_smi_watcher_unregister(&driver_data.bmc_events);
+- driver_unregister(&aem_driver);
++ driver_unregister(&aem_driver.driver);
+ list_for_each_entry_safe(p1, next1, &driver_data.aem_devices, list)
+ aem_delete(p1);
+ }
--- /dev/null
+From f7cd168645dda3e9067f24fabbfa787f9a237488 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes@sipsolutions.net>
+Date: Wed, 12 Nov 2008 16:54:22 -0500
+Subject: hostap: pad the skb->cb usage in lieu of a proper fix
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit f7cd168645dda3e9067f24fabbfa787f9a237488 upstream.
+
+Like mac80211 did, this driver makes 'clever' use of skb->cb to pass
+information along with an skb as it is requeued from the virtual device
+to the physical wireless device. Unfortunately, that trick no longer
+works...
+
+Unlike mac80211, code complexity and driver apathy makes this hack
+the best option we have in the short run. Hopefully someone will
+eventually be motivated to code a proper fix before all the effected
+hardware dies.
+
+(Above text by me. Johannes officially disavows all knowledge of this
+hack. -- JWL)
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/hostap/hostap_wlan.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/hostap/hostap_wlan.h
++++ b/drivers/net/wireless/hostap/hostap_wlan.h
+@@ -918,9 +918,12 @@ struct hostap_interface {
+
+ /*
+ * TX meta data - stored in skb->cb buffer, so this must not be increased over
+- * the 40-byte limit
++ * the 48-byte limit.
++ * THE PADDING THIS STARTS WITH IS A HORRIBLE HACK THAT SHOULD NOT LIVE
++ * TO SEE THE DAY.
+ */
+ struct hostap_skb_tx_data {
++ unsigned int __padding_for_default_qdiscs;
+ u32 magic; /* HOSTAP_SKB_TX_DATA_MAGIC */
+ u8 rate; /* transmit rate */
+ #define HOSTAP_TX_FLAGS_WDS BIT(0)
--- /dev/null
+From 7526674de0c921e7f1e9b6f71a1f9d832557b554 Mon Sep 17 00:00:00 2001
+From: Adam Litke <agl@us.ibm.com>
+Date: Wed, 12 Nov 2008 13:24:56 -0800
+Subject: hugetlb: make unmap_ref_private multi-size-aware
+
+From: Adam Litke <agl@us.ibm.com>
+
+commit 7526674de0c921e7f1e9b6f71a1f9d832557b554 upstream.
+
+Oops. Part of the hugetlb private reservation code was not fully
+converted to use hstates.
+
+When a huge page must be unmapped from VMAs due to a failed COW,
+HPAGE_SIZE is used in the call to unmap_hugepage_range() regardless of
+the page size being used. This works if the VMA is using the default
+huge page size. Otherwise we might unmap too much, too little, or
+trigger a BUG_ON. Rare but serious -- fix it.
+
+Signed-off-by: Adam Litke <agl@us.ibm.com>
+Cc: Jon Tollefson <kniht@linux.vnet.ibm.com>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1797,6 +1797,7 @@ int unmap_ref_private(struct mm_struct *
+ struct page *page,
+ unsigned long address)
+ {
++ struct hstate *h = hstate_vma(vma);
+ struct vm_area_struct *iter_vma;
+ struct address_space *mapping;
+ struct prio_tree_iter iter;
+@@ -1806,7 +1807,7 @@ int unmap_ref_private(struct mm_struct *
+ * vm_pgoff is in PAGE_SIZE units, hence the different calculation
+ * from page cache lookup which is in HPAGE_SIZE units.
+ */
+- address = address & huge_page_mask(hstate_vma(vma));
++ address = address & huge_page_mask(h);
+ pgoff = ((address - vma->vm_start) >> PAGE_SHIFT)
+ + (vma->vm_pgoff >> PAGE_SHIFT);
+ mapping = (struct address_space *)page_private(page);
+@@ -1825,7 +1826,7 @@ int unmap_ref_private(struct mm_struct *
+ */
+ if (!is_vma_resv_set(iter_vma, HPAGE_RESV_OWNER))
+ unmap_hugepage_range(iter_vma,
+- address, address + HPAGE_SIZE,
++ address, address + huge_page_size(h),
+ page);
+ }
+
--- /dev/null
+From 964d2777438bf7687324243d38ade538d9bbfe3c Mon Sep 17 00:00:00 2001
+From: John W. Linville <linville@tuxdriver.com>
+Date: Thu, 30 Oct 2008 14:12:21 -0400
+Subject: iwlagn: avoid sleep in softirq context
+
+From: John W. Linville <linville@tuxdriver.com>
+
+commit 964d2777438bf7687324243d38ade538d9bbfe3c upstream.
+
+__ieee80211_tasklet_handler -> __ieee80211_rx ->
+ __ieee80211_rx_handle_packet -> ieee80211_invoke_rx_handlers ->
+ ieee80211_rx_h_decrypt -> ieee80211_crypto_tkip_decrypt ->
+ ieee80211_tkip_decrypt_data -> iwl4965_mac_update_tkip_key ->
+ iwl_scan_cancel_timeout -> msleep
+
+Ooops!
+
+Avoid the sleep by changing iwl_scan_cancel_timeout with
+iwl_scan_cancel and simply returning on failure if the scan persists.
+This will cause hardware decryption to fail and we'll handle a few more
+frames with software decryption.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: Holger Macht <hmacht@novell.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-agn.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3275,7 +3275,11 @@ static void iwl4965_mac_update_tkip_key(
+ return;
+ }
+
+- iwl_scan_cancel_timeout(priv, 100);
++ if (iwl_scan_cancel(priv)) {
++ /* cancel scan failed, just live w/ bad key and rely
++ briefly on SW decryption */
++ return;
++ }
+
+ key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
+ key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
--- /dev/null
+From bf1b36445dc868cbbde194aa1dd87e38fe24cf16 Mon Sep 17 00:00:00 2001
+From: Jonathan McDowell <noodles@earth.li>
+Date: Sat, 13 Sep 2008 17:08:31 +0100
+Subject: kbuild: Fixup deb-pkg target to generate separate firmware deb
+
+From: Jonathan McDowell <noodles@earth.li>
+
+commit bf1b36445dc868cbbde194aa1dd87e38fe24cf16 upstream.
+
+The below is a simplistic fix for "make deb-pkg"; it splits the
+firmware out to a linux-firmware-image package and adds an
+(unversioned) Suggests to the linux package for this firmware.
+
+Signed-Off-By: Jonathan McDowell <noodles@earth.li>
+Acked-by: Frans Pop <elendil@planet.nl>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/package/builddeb | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+--- a/scripts/package/builddeb
++++ b/scripts/package/builddeb
+@@ -15,15 +15,18 @@ set -e
+ version=$KERNELRELEASE
+ revision=`cat .version`
+ tmpdir="$objtree/debian/tmp"
++fwdir="$objtree/debian/fwtmp"
+ packagename=linux-$version
++fwpackagename=linux-firmware-image
+
+ if [ "$ARCH" == "um" ] ; then
+ packagename=user-mode-linux-$version
+ fi
+
+ # Setup the directory structure
+-rm -rf "$tmpdir"
++rm -rf "$tmpdir" "$fwdir"
+ mkdir -p "$tmpdir/DEBIAN" "$tmpdir/lib" "$tmpdir/boot"
++mkdir -p "$fwdir/DEBIAN" "$fwdir/lib"
+ if [ "$ARCH" == "um" ] ; then
+ mkdir -p "$tmpdir/usr/lib/uml/modules/$version" "$tmpdir/usr/share/doc/$packagename" "$tmpdir/usr/bin"
+ fi
+@@ -107,6 +110,7 @@ Standards-Version: 3.6.1
+
+ Package: $packagename
+ Provides: kernel-image-$version, linux-image-$version
++Suggests: $fwpackagename
+ Architecture: any
+ Description: Linux kernel, version $version
+ This package contains the Linux kernel, modules and corresponding other
+@@ -118,8 +122,24 @@ fi
+ chown -R root:root "$tmpdir"
+ chmod -R go-w "$tmpdir"
+
++# Do we have firmware? Move it out of the way and build it into a package.
++if [ -e "$tmpdir/lib/firmware" ]; then
++ mv "$tmpdir/lib/firmware" "$fwdir/lib/"
++
++ cat <<EOF >> debian/control
++
++Package: $fwpackagename
++Architecture: all
++Description: Linux kernel firmware, version $version
++ This package contains firmware from the Linux kernel, version $version
++EOF
++
++ dpkg-gencontrol -isp -p$fwpackagename -P"$fwdir"
++ dpkg --build "$fwdir" ..
++fi
++
+ # Perform the final magic
+-dpkg-gencontrol -isp
++dpkg-gencontrol -isp -p$packagename
+ dpkg --build "$tmpdir" ..
+
+ exit 0
--- /dev/null
+From 3c10c9c45e290022ca7d2aa1ad33a0b6ed767520 Mon Sep 17 00:00:00 2001
+From: Kumar Gala <galak@kernel.crashing.org>
+Date: Tue, 28 Oct 2008 18:01:39 +0000
+Subject: powerpc/mpic: Fix regression caused by change of default IRQ affinity
+
+From: Kumar Gala <galak@kernel.crashing.org>
+
+commit 3c10c9c45e290022ca7d2aa1ad33a0b6ed767520 upstream.
+
+The Freescale implementation of MPIC only allows a single CPU destination
+for non-IPI interrupts. We add a flag to the mpic_init to distinquish
+these variants of MPIC. We pull in the irq_choose_cpu from sparc64 to
+select a single CPU as the destination of the interrupt.
+
+This is to deal with the fact that the default smp affinity was
+changed by commit 18404756765c713a0be4eb1082920c04822ce588 ("genirq
+Expose default irq affinity mask (take 3)") to be all CPUs.
+
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/include/asm/mpic.h | 2 +
+ arch/powerpc/platforms/85xx/mpc85xx_ds.c | 3 +
+ arch/powerpc/platforms/86xx/pic.c | 3 +
+ arch/powerpc/sysdev/mpic.c | 59 ++++++++++++++++++++++++++++---
+ 4 files changed, 61 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/include/asm/mpic.h
++++ b/arch/powerpc/include/asm/mpic.h
+@@ -355,6 +355,8 @@ struct mpic
+ #define MPIC_NO_BIAS 0x00000400
+ /* Ignore NIRQS as reported by FRR */
+ #define MPIC_BROKEN_FRR_NIRQS 0x00000800
++/* Destination only supports a single CPU at a time */
++#define MPIC_SINGLE_DEST_CPU 0x00001000
+
+ /* MPIC HW modification ID */
+ #define MPIC_REGSET_MASK 0xf0000000
+--- a/arch/powerpc/platforms/85xx/mpc85xx_ds.c
++++ b/arch/powerpc/platforms/85xx/mpc85xx_ds.c
+@@ -78,7 +78,8 @@ void __init mpc85xx_ds_pic_init(void)
+
+ mpic = mpic_alloc(np, r.start,
+ MPIC_PRIMARY | MPIC_WANTS_RESET |
+- MPIC_BIG_ENDIAN | MPIC_BROKEN_FRR_NIRQS,
++ MPIC_BIG_ENDIAN | MPIC_BROKEN_FRR_NIRQS |
++ MPIC_SINGLE_DEST_CPU,
+ 0, 256, " OpenPIC ");
+ BUG_ON(mpic == NULL);
+ of_node_put(np);
+--- a/arch/powerpc/platforms/86xx/pic.c
++++ b/arch/powerpc/platforms/86xx/pic.c
+@@ -44,7 +44,8 @@ void __init mpc86xx_init_irq(void)
+
+ mpic = mpic_alloc(np, res.start,
+ MPIC_PRIMARY | MPIC_WANTS_RESET |
+- MPIC_BIG_ENDIAN | MPIC_BROKEN_FRR_NIRQS,
++ MPIC_BIG_ENDIAN | MPIC_BROKEN_FRR_NIRQS |
++ MPIC_SINGLE_DEST_CPU,
+ 0, 256, " MPIC ");
+ of_node_put(np);
+ BUG_ON(mpic == NULL);
+--- a/arch/powerpc/sysdev/mpic.c
++++ b/arch/powerpc/sysdev/mpic.c
+@@ -563,6 +563,51 @@ static void __init mpic_scan_ht_pics(str
+
+ #endif /* CONFIG_MPIC_U3_HT_IRQS */
+
++#ifdef CONFIG_SMP
++static int irq_choose_cpu(unsigned int virt_irq)
++{
++ cpumask_t mask = irq_desc[virt_irq].affinity;
++ int cpuid;
++
++ if (cpus_equal(mask, CPU_MASK_ALL)) {
++ static int irq_rover;
++ static DEFINE_SPINLOCK(irq_rover_lock);
++ unsigned long flags;
++
++ /* Round-robin distribution... */
++ do_round_robin
++ spin_lock_irqsave(&irq_rover_lock, flags);
++
++ while (!cpu_online(irq_rover)) {
++ if (++irq_rover >= NR_CPUS)
++ irq_rover = 0;
++ }
++ cpuid = irq_rover;
++ do {
++ if (++irq_rover >= NR_CPUS)
++ irq_rover = 0;
++ } while (!cpu_online(irq_rover));
++
++ spin_unlock_irqrestore(&irq_rover_lock, flags);
++ } else {
++ cpumask_t tmp;
++
++ cpus_and(tmp, cpu_online_map, mask);
++
++ if (cpus_empty(tmp))
++ goto do_round_robin;
++
++ cpuid = first_cpu(tmp);
++ }
++
++ return cpuid;
++}
++#else
++static int irq_choose_cpu(unsigned int virt_irq)
++{
++ return hard_smp_processor_id();
++}
++#endif
+
+ #define mpic_irq_to_hw(virq) ((unsigned int)irq_map[virq].hwirq)
+
+@@ -777,12 +822,18 @@ void mpic_set_affinity(unsigned int irq,
+ struct mpic *mpic = mpic_from_irq(irq);
+ unsigned int src = mpic_irq_to_hw(irq);
+
+- cpumask_t tmp;
++ if (mpic->flags & MPIC_SINGLE_DEST_CPU) {
++ int cpuid = irq_choose_cpu(irq);
++
++ mpic_irq_write(src, MPIC_INFO(IRQ_DESTINATION), 1 << cpuid);
++ } else {
++ cpumask_t tmp;
+
+- cpus_and(tmp, cpumask, cpu_online_map);
++ cpus_and(tmp, cpumask, cpu_online_map);
+
+- mpic_irq_write(src, MPIC_INFO(IRQ_DESTINATION),
+- mpic_physmask(cpus_addr(tmp)[0]));
++ mpic_irq_write(src, MPIC_INFO(IRQ_DESTINATION),
++ mpic_physmask(cpus_addr(tmp)[0]));
++ }
+ }
+
+ static unsigned int mpic_type_to_vecpri(struct mpic *mpic, unsigned int type)
--- /dev/null
+From 8f7c41d4cec91cdbfa89b4a77d5a628938875366 Mon Sep 17 00:00:00 2001
+From: Ivan Kuten <ivan.kuten@promwad.com>
+Date: Mon, 10 Nov 2008 19:39:25 -0600
+Subject: rtl8187: Add Abocom USB ID
+
+From: Ivan Kuten <ivan.kuten@promwad.com>
+
+commit 8f7c41d4cec91cdbfa89b4a77d5a628938875366 upstream.
+
+Signed-off-by: Ivan Kuten <ivan.kuten@promwad.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtl8187_dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/rtl8187_dev.c
++++ b/drivers/net/wireless/rtl8187_dev.c
+@@ -45,6 +45,8 @@ static struct usb_device_id rtl8187_tabl
+ {USB_DEVICE(0x03f0, 0xca02), .driver_info = DEVICE_RTL8187},
+ /* Sitecom */
+ {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
++ /* Abocom */
++ {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
+ {}
+ };
+
--- /dev/null
+From f3c769185a28b7947d97b3552a977102c1fac3f2 Mon Sep 17 00:00:00 2001
+From: Bob Jolliffe <bobjolliffe@gmail.com>
+Date: Wed, 12 Nov 2008 20:16:59 +0000
+Subject: rtl8187 : support for Sitecom WL-168 0001 v4
+
+From: Bob Jolliffe <bobjolliffe@gmail.com>
+
+commit f3c769185a28b7947d97b3552a977102c1fac3f2 upstream.
+
+the Sitecom 0001 v4 with product id 0x0df6:0028, uses Realtek's
+RTL8187B and work fine with new 2.6.27 driver.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtl8187_dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtl8187_dev.c
++++ b/drivers/net/wireless/rtl8187_dev.c
+@@ -45,6 +45,7 @@ static struct usb_device_id rtl8187_tabl
+ {USB_DEVICE(0x03f0, 0xca02), .driver_info = DEVICE_RTL8187},
+ /* Sitecom */
+ {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
++ {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+ /* Abocom */
+ {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
+ {}
--- /dev/null
+touch_mnt_namespace-when-the-mount-flags-change.patch
+iwlagn-avoid-sleep-in-softirq-context.patch
+ath5k-fix-suspend-related-oops-on-rmmod.patch
+ath5k-fix-reset-sequence-for-ar5212-in-general-and-rf5111-in-particular.patch
+bnx2x-removing-the-pmf-indication-when-unloading.patch
+bnx2x-pci-configuration-bug-on-big-endian.patch
+bnx2x-calling-netif_carrier_off-at-the-end-of-the-probe.patch
+arm-5329-1-feroceon-fix-feroceon_l2_inv_range.patch
+fix-platform-drivers-that-crash-on-suspend-resume.patch
+hostap-pad-the-skb-cb-usage-in-lieu-of-a-proper-fix.patch
+acpi-avoid-empty-file-name-in-sysfs.patch
+acpi-ec-make-kernel-messages-more-useful-when-gpe-storm-is-detected.patch
+hugetlb-make-unmap_ref_private-multi-size-aware.patch
+rtl8187-add-abocom-usb-id.patch
+rtl8187-support-for-sitecom-wl-168-0001-v4.patch
+kbuild-fixup-deb-pkg-target-to-generate-separate-firmware-deb.patch
+block-fix-nr_phys_segments-miscalculation-bug.patch
+powerpc-mpic-fix-regression-caused-by-change-of-default-irq-affinity.patch
--- /dev/null
+From 0e55a7cca4b66f625d67b292f80b6a976e77c51b Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 26 Sep 2008 19:01:20 -0700
+Subject: touch_mnt_namespace when the mount flags change
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 0e55a7cca4b66f625d67b292f80b6a976e77c51b upstream
+
+Daemons that need to be launched while the rootfs is read-only can now
+poll /proc/mounts to be notified when their O_RDWR requests may no
+longer end in EROFS.
+
+Cc: Kay Sievers <kay.sievers@vrfy.org>
+Cc: Neil Brown <neilb@suse.de>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/namespace.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1553,8 +1553,13 @@ static noinline int do_remount(struct na
+ if (!err)
+ nd->path.mnt->mnt_flags = mnt_flags;
+ up_write(&sb->s_umount);
+- if (!err)
++ if (!err) {
+ security_sb_post_remount(nd->path.mnt, flags, data);
++
++ spin_lock(&vfsmount_lock);
++ touch_mnt_namespace(nd->path.mnt->mnt_ns);
++ spin_unlock(&vfsmount_lock);
++ }
+ return err;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
