--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 12 05:42:07 2006
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+To: greg@kroah.com
+Date: Thu, 12 Oct 2006 14:41:07 +0200
+Message-Id: <1160656867.15287.11.camel@localhost>
+Mime-Version: 1.0
+Cc: stable@kernel.org
+Subject: [S390] __div64_32 for 31 bit.
+Content-Type: text/plain; charset="us-ascii"
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+The clocksource infrastructure introduced with commit
+ad596171ed635c51a9eef829187af100cbf8dcf7 broke 31 bit s390.
+The reason is that the do_div() primitive for 31 bit always
+had a restriction: it could only divide an unsigned 64 bit
+integer by an unsigned 31 bit integer. The clocksource code
+now uses do_div() with a base value that has the most
+significant bit set. The result is that clock->cycle_interval
+has a funny value which causes the linux time to jump around
+like mad.
+The solution is "obvious": implement a proper __div64_32
+function for 31 bit s390.
+
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/Kconfig | 4 +
+ arch/s390/lib/Makefile | 1
+ arch/s390/lib/div64.c | 151 +++++++++++++++++++++++++++++++++++++++++++++++
+ include/asm-s390/div64.h | 48 --------------
+ 4 files changed, 156 insertions(+), 48 deletions(-)
+
+--- linux-2.6.18.1.orig/arch/s390/Kconfig
++++ linux-2.6.18.1/arch/s390/Kconfig
+@@ -51,6 +51,10 @@ config 64BIT
+ Select this option if you have a 64 bit IBM zSeries machine
+ and want to use the 64 bit addressing mode.
+
++config 32BIT
++ bool
++ default y if !64BIT
++
+ config SMP
+ bool "Symmetric multi-processing support"
+ ---help---
+--- linux-2.6.18.1.orig/arch/s390/lib/Makefile
++++ linux-2.6.18.1/arch/s390/lib/Makefile
+@@ -7,3 +7,4 @@ EXTRA_AFLAGS := -traditional
+ lib-y += delay.o string.o
+ lib-y += $(if $(CONFIG_64BIT),uaccess64.o,uaccess.o)
+ lib-$(CONFIG_SMP) += spinlock.o
++lib-$(CONFIG_32BIT) += div64.o
+--- /dev/null
++++ linux-2.6.18.1/arch/s390/lib/div64.c
+@@ -0,0 +1,151 @@
++/*
++ * arch/s390/lib/div64.c
++ *
++ * __div64_32 implementation for 31 bit.
++ *
++ * Copyright (C) IBM Corp. 2006
++ * Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com),
++ */
++
++#include <linux/types.h>
++#include <linux/module.h>
++
++#ifdef CONFIG_MARCH_G5
++
++/*
++ * Function to divide an unsigned 64 bit integer by an unsigned
++ * 31 bit integer using signed 64/32 bit division.
++ */
++static uint32_t __div64_31(uint64_t *n, uint32_t base)
++{
++ register uint32_t reg2 asm("2");
++ register uint32_t reg3 asm("3");
++ uint32_t *words = (uint32_t *) n;
++ uint32_t tmp;
++
++ /* Special case base==1, remainder = 0, quotient = n */
++ if (base == 1)
++ return 0;
++ /*
++ * Special case base==0 will cause a fixed point divide exception
++ * on the dr instruction and may not happen anyway. For the
++ * following calculation we can assume base > 1. The first
++ * signed 64 / 32 bit division with an upper half of 0 will
++ * give the correct upper half of the 64 bit quotient.
++ */
++ reg2 = 0UL;
++ reg3 = words[0];
++ asm volatile(
++ " dr %0,%2\n"
++ : "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" );
++ words[0] = reg3;
++ reg3 = words[1];
++ /*
++ * To get the lower half of the 64 bit quotient and the 32 bit
++ * remainder we have to use a little trick. Since we only have
++ * a signed division the quotient can get too big. To avoid this
++ * the 64 bit dividend is halved, then the signed division will
++ * work. Afterwards the quotient and the remainder are doubled.
++ * If the last bit of the dividend has been one the remainder
++ * is increased by one then checked against the base. If the
++ * remainder has overflown subtract base and increase the
++ * quotient. Simple, no ?
++ */
++ asm volatile(
++ " nr %2,%1\n"
++ " srdl %0,1\n"
++ " dr %0,%3\n"
++ " alr %0,%0\n"
++ " alr %1,%1\n"
++ " alr %0,%2\n"
++ " clr %0,%3\n"
++ " jl 0f\n"
++ " slr %0,%3\n"
++ " alr %1,%2\n"
++ "0:\n"
++ : "+d" (reg2), "+d" (reg3), "=d" (tmp)
++ : "d" (base), "2" (1UL) : "cc" );
++ words[1] = reg3;
++ return reg2;
++}
++
++/*
++ * Function to divide an unsigned 64 bit integer by an unsigned
++ * 32 bit integer using the unsigned 64/31 bit division.
++ */
++uint32_t __div64_32(uint64_t *n, uint32_t base)
++{
++ uint32_t r;
++
++ /*
++ * If the most significant bit of base is set, divide n by
++ * (base/2). That allows to use 64/31 bit division and gives a
++ * good approximation of the result: n = (base/2)*q + r. The
++ * result needs to be corrected with two simple transformations.
++ * If base is already < 2^31-1 __div64_31 can be used directly.
++ */
++ r = __div64_31(n, ((signed) base < 0) ? (base/2) : base);
++ if ((signed) base < 0) {
++ uint64_t q = *n;
++ /*
++ * First transformation:
++ * n = (base/2)*q + r
++ * = ((base/2)*2)*(q/2) + ((q&1) ? (base/2) : 0) + r
++ * Since r < (base/2), r + (base/2) < base.
++ * With q1 = (q/2) and r1 = r + ((q&1) ? (base/2) : 0)
++ * n = ((base/2)*2)*q1 + r1 with r1 < base.
++ */
++ if (q & 1)
++ r += base/2;
++ q >>= 1;
++ /*
++ * Second transformation. ((base/2)*2) could have lost the
++ * last bit.
++ * n = ((base/2)*2)*q1 + r1
++ * = base*q1 - ((base&1) ? q1 : 0) + r1
++ */
++ if (base & 1) {
++ int64_t rx = r - q;
++ /*
++ * base is >= 2^31. The worst case for the while
++ * loop is n=2^64-1 base=2^31+1. That gives a
++ * maximum for q=(2^64-1)/2^31 = 0x1ffffffff. Since
++ * base >= 2^31 the loop is finished after a maximum
++ * of three iterations.
++ */
++ while (rx < 0) {
++ rx += base;
++ q--;
++ }
++ r = rx;
++ }
++ *n = q;
++ }
++ return r;
++}
++
++#else /* MARCH_G5 */
++
++uint32_t __div64_32(uint64_t *n, uint32_t base)
++{
++ register uint32_t reg2 asm("2");
++ register uint32_t reg3 asm("3");
++ uint32_t *words = (uint32_t *) n;
++
++ reg2 = 0UL;
++ reg3 = words[0];
++ asm volatile(
++ " dlr %0,%2\n"
++ : "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" );
++ words[0] = reg3;
++ reg3 = words[1];
++ asm volatile(
++ " dlr %0,%2\n"
++ : "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" );
++ words[1] = reg3;
++ return reg2;
++}
++
++#endif /* MARCH_G5 */
++
++EXPORT_SYMBOL(__div64_32);
+--- linux-2.6.18.1.orig/include/asm-s390/div64.h
++++ linux-2.6.18.1/include/asm-s390/div64.h
+@@ -1,49 +1 @@
+-#ifndef __S390_DIV64
+-#define __S390_DIV64
+-
+-#ifndef __s390x__
+-
+-/* for do_div "base" needs to be smaller than 2^31-1 */
+-#define do_div(n, base) ({ \
+- unsigned long long __n = (n); \
+- unsigned long __r; \
+- \
+- asm (" slr 0,0\n" \
+- " l 1,%1\n" \
+- " srdl 0,1\n" \
+- " dr 0,%2\n" \
+- " alr 1,1\n" \
+- " alr 0,0\n" \
+- " lhi 2,1\n" \
+- " n 2,%1\n" \
+- " alr 0,2\n" \
+- " clr 0,%2\n" \
+- " jl 0f\n" \
+- " slr 0,%2\n" \
+- " ahi 1,1\n" \
+- "0: st 1,%1\n" \
+- " l 1,4+%1\n" \
+- " srdl 0,1\n" \
+- " dr 0,%2\n" \
+- " alr 1,1\n" \
+- " alr 0,0\n" \
+- " lhi 2,1\n" \
+- " n 2,4+%1\n" \
+- " alr 0,2\n" \
+- " clr 0,%2\n" \
+- " jl 1f\n" \
+- " slr 0,%2\n" \
+- " ahi 1,1\n" \
+- "1: st 1,4+%1\n" \
+- " lr %0,0" \
+- : "=d" (__r), "=m" (__n) \
+- : "d" (base), "m" (__n) : "0", "1", "2", "cc" ); \
+- (n) = (__n); \
+- __r; \
+-})
+-
+-#else /* __s390x__ */
+ #include <asm-generic/div64.h>
+-#endif /* __s390x__ */
+-
+-#endif
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 05:44:24 2006
+Date: Mon, 16 Oct 2006 14:43:43 +0200
+Message-ID: <s5hmz7wa0sg.wl%tiwai@suse.de>
+From: Florin Malita <fmalita@gmail.com>
+To: stable@kernel.org
+MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
+Subject: ALSA: Dereference after free in snd_hwdep_release()
+Content-Type: text/plain; charset="us-ascii"
+
+From: Florin Malita <fmalita@gmail.com>
+
+[PATCH] ALSA: Dereference after free in snd_hwdep_release()
+
+snd_card_file_remove() may free hw->card so we can't dereference
+hw->card->module after that.
+
+Coverity ID 1420.
+
+This bug actually causes an Oops at usb-disconnection, especially
+with CONFIG_PREEMPT.
+
+From: Florin Malita <fmalita@gmail.com>
+Signed-off-by: Florin Malita <fmalita@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/hwdep.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/sound/core/hwdep.c
++++ linux-2.6.18.1/sound/core/hwdep.c
+@@ -158,6 +158,7 @@ static int snd_hwdep_release(struct inod
+ {
+ int err = -ENXIO;
+ struct snd_hwdep *hw = file->private_data;
++ struct module *mod = hw->card->module;
+ mutex_lock(&hw->open_mutex);
+ if (hw->ops.release) {
+ err = hw->ops.release(hw, file);
+@@ -167,7 +168,7 @@ static int snd_hwdep_release(struct inod
+ hw->used--;
+ snd_card_file_remove(hw->card, file);
+ mutex_unlock(&hw->open_mutex);
+- module_put(hw->card->module);
++ module_put(mod);
+ return err;
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 05:37:02 2006
+Date: Mon, 16 Oct 2006 14:35:57 +0200
+Message-ID: <s5hr6x8a15e.wl%tiwai@suse.de>
+From: Arnaud Patard <arnaud.patard@rtp-net.org>
+To: stable@kernel.org
+MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
+Subject: ALSA: emu10k1: Fix outl() in snd_emu10k1_resume_regs()
+Content-Type: text/plain; charset="us-ascii"
+
+From: Arnaud Patard <arnaud.patard@rtp-net.org>
+
+[PATCH] ALSA: emu10k1: Fix outl() in snd_emu10k1_resume_regs()
+
+The emu10k1 driver saves the A_IOCFG and HCFG register on suspend and restores
+it on resumes. Unfortunately, this doesn't work as the arguments to outl() are
+reversed.
+
+From: Arnaud Patard <arnaud.patard@rtp-net.org>
+Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/emu10k1/emu10k1_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.1.orig/sound/pci/emu10k1/emu10k1_main.c
++++ linux-2.6.18.1/sound/pci/emu10k1/emu10k1_main.c
+@@ -1460,8 +1460,8 @@ void snd_emu10k1_resume_regs(struct snd_
+
+ /* resore for spdif */
+ if (emu->audigy)
+- outl(emu->port + A_IOCFG, emu->saved_a_iocfg);
+- outl(emu->port + HCFG, emu->saved_hcfg);
++ outl(emu->saved_a_iocfg, emu->port + A_IOCFG);
++ outl(emu->saved_hcfg, emu->port + HCFG);
+
+ val = emu->saved_ptr;
+ for (reg = saved_regs; *reg != 0xff; reg++)
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 05:45:49 2006
+Date: Mon, 16 Oct 2006 14:45:14 +0200
+Message-ID: <s5hlknga0px.wl%tiwai@suse.de>
+From: Karsten Wiese <annabellesgarden@yahoo.de>
+To: stable@kernel.org
+MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
+Subject: ALSA: Fix bug in snd-usb-usx2y's usX2Y_pcms_lock_check()
+Content-Type: text/plain; charset="us-ascii"
+
+From: Karsten Wiese <annabellesgarden@yahoo.de>
+
+[PATCH] ALSA: Fix bug in snd-usb-usx2y's usX2Y_pcms_lock_check()
+
+Fix bug in snd-usb-usx2y's usX2Y_pcms_lock_check()
+
+substream can be NULL......
+in mainline, bug was introduced by:
+2006-06-22 [ALSA] Add O_APPEND flag support to PCM
+
+From: Karsten Wiese <annabellesgarden@yahoo.de>
+Signed-off-by: Karsten Wiese <annabellesgarden@yahoo.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usx2y/usx2yhwdeppcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/sound/usb/usx2y/usx2yhwdeppcm.c
++++ linux-2.6.18.1/sound/usb/usx2y/usx2yhwdeppcm.c
+@@ -632,7 +632,7 @@ static int usX2Y_pcms_lock_check(struct
+ for (s = 0; s < 2; ++s) {
+ struct snd_pcm_substream *substream;
+ substream = pcm->streams[s].substream;
+- if (SUBSTREAM_BUSY(substream))
++ if (substream && SUBSTREAM_BUSY(substream))
+ err = -EBUSY;
+ }
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 05:38:07 2006
+Date: Mon, 16 Oct 2006 14:37:31 +0200
+Message-ID: <s5hpscsa12s.wl%tiwai@suse.de>
+From: Takashi Iwai <tiwai@suse.de>
+To: stable@kernel.org
+MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
+Subject: ALSA: powermac - Fix Oops when conflicting with aoa driver
+Content-Type: text/plain; charset="us-ascii"
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[PATCH] ALSA: powermac - Fix Oops when conflicting with aoa driver
+
+Fixed Oops when conflictin with aoa driver due to lack of
+i2c initialization.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/ppc/keywest.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- linux-2.6.18.1.orig/sound/ppc/keywest.c
++++ linux-2.6.18.1/sound/ppc/keywest.c
+@@ -117,6 +117,9 @@ int __init snd_pmac_tumbler_post_init(vo
+ {
+ int err;
+
++ if (!keywest_ctx || !keywest_ctx->client)
++ return -ENXIO;
++
+ if ((err = keywest_ctx->init_client(keywest_ctx)) < 0) {
+ snd_printk(KERN_ERR "tumbler: %i :cannot initialize the MCS\n", err);
+ return err;
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 05:47:27 2006
+Date: Mon, 16 Oct 2006 14:46:53 +0200
+Message-ID: <s5hk630a0n6.wl%tiwai@suse.de>
+From: Karsten Wiese <annabellesgarden@yahoo.de>
+To: stable@kernel.org
+MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
+Subject: ALSA: Repair snd-usb-usx2y for usb 2.6.18
+Content-Type: text/plain; charset="us-ascii"
+
+From: Karsten Wiese <annabellesgarden@yahoo.de>
+
+ALSA: Repair snd-usb-usx2y for usb 2.6.18
+
+urb->start_frame rolls over beyond MAX_INT now.
+This is for stable kernel and stable alsa.
+
+From: Karsten Wiese <annabellesgarden@yahoo.de>
+Signed-off-by: Karsten Wiese <annabellesgarden@yahoo.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usx2y/usbusx2yaudio.c | 18 ++++++------------
+ sound/usb/usx2y/usx2yhwdeppcm.c | 15 +++++----------
+ 2 files changed, 11 insertions(+), 22 deletions(-)
+
+--- linux-2.6.18.1.orig/sound/usb/usx2y/usbusx2yaudio.c
++++ linux-2.6.18.1/sound/usb/usx2y/usbusx2yaudio.c
+@@ -322,7 +322,7 @@ static void i_usX2Y_urb_complete(struct
+ usX2Y_error_urb_status(usX2Y, subs, urb);
+ return;
+ }
+- if (likely((0xFFFF & urb->start_frame) == usX2Y->wait_iso_frame))
++ if (likely(urb->start_frame == usX2Y->wait_iso_frame))
+ subs->completed_urb = urb;
+ else {
+ usX2Y_error_sequence(usX2Y, subs, urb);
+@@ -335,13 +335,9 @@ static void i_usX2Y_urb_complete(struct
+ atomic_read(&capsubs->state) >= state_PREPARED &&
+ (playbacksubs->completed_urb ||
+ atomic_read(&playbacksubs->state) < state_PREPARED)) {
+- if (!usX2Y_usbframe_complete(capsubs, playbacksubs, urb->start_frame)) {
+- if (nr_of_packs() <= urb->start_frame &&
+- urb->start_frame <= (2 * nr_of_packs() - 1)) // uhci and ohci
+- usX2Y->wait_iso_frame = urb->start_frame - nr_of_packs();
+- else
+- usX2Y->wait_iso_frame += nr_of_packs();
+- } else {
++ if (!usX2Y_usbframe_complete(capsubs, playbacksubs, urb->start_frame))
++ usX2Y->wait_iso_frame += nr_of_packs();
++ else {
+ snd_printdd("\n");
+ usX2Y_clients_stop(usX2Y);
+ }
+@@ -495,7 +491,6 @@ static int usX2Y_urbs_start(struct snd_u
+ if (subs != NULL && atomic_read(&subs->state) >= state_PREPARED)
+ goto start;
+ }
+- usX2Y->wait_iso_frame = -1;
+
+ start:
+ usX2Y_subs_startup(subs);
+@@ -516,10 +511,9 @@ static int usX2Y_urbs_start(struct snd_u
+ snd_printk (KERN_ERR "cannot submit datapipe for urb %d, err = %d\n", i, err);
+ err = -EPIPE;
+ goto cleanup;
+- } else {
+- if (0 > usX2Y->wait_iso_frame)
++ } else
++ if (i == 0)
+ usX2Y->wait_iso_frame = urb->start_frame;
+- }
+ urb->transfer_flags = 0;
+ } else {
+ atomic_set(&subs->state, state_STARTING1);
+--- linux-2.6.18.1.orig/sound/usb/usx2y/usx2yhwdeppcm.c
++++ linux-2.6.18.1/sound/usb/usx2y/usx2yhwdeppcm.c
+@@ -243,7 +243,7 @@ static void i_usX2Y_usbpcm_urb_complete(
+ usX2Y_error_urb_status(usX2Y, subs, urb);
+ return;
+ }
+- if (likely((0xFFFF & urb->start_frame) == usX2Y->wait_iso_frame))
++ if (likely(urb->start_frame == usX2Y->wait_iso_frame))
+ subs->completed_urb = urb;
+ else {
+ usX2Y_error_sequence(usX2Y, subs, urb);
+@@ -256,13 +256,9 @@ static void i_usX2Y_usbpcm_urb_complete(
+ if (capsubs->completed_urb && atomic_read(&capsubs->state) >= state_PREPARED &&
+ (NULL == capsubs2 || capsubs2->completed_urb) &&
+ (playbacksubs->completed_urb || atomic_read(&playbacksubs->state) < state_PREPARED)) {
+- if (!usX2Y_usbpcm_usbframe_complete(capsubs, capsubs2, playbacksubs, urb->start_frame)) {
+- if (nr_of_packs() <= urb->start_frame &&
+- urb->start_frame <= (2 * nr_of_packs() - 1)) // uhci and ohci
+- usX2Y->wait_iso_frame = urb->start_frame - nr_of_packs();
+- else
+- usX2Y->wait_iso_frame += nr_of_packs();
+- } else {
++ if (!usX2Y_usbpcm_usbframe_complete(capsubs, capsubs2, playbacksubs, urb->start_frame))
++ usX2Y->wait_iso_frame += nr_of_packs();
++ else {
+ snd_printdd("\n");
+ usX2Y_clients_stop(usX2Y);
+ }
+@@ -433,7 +429,6 @@ static int usX2Y_usbpcm_urbs_start(struc
+ if (subs != NULL && atomic_read(&subs->state) >= state_PREPARED)
+ goto start;
+ }
+- usX2Y->wait_iso_frame = -1;
+
+ start:
+ usX2Y_usbpcm_subs_startup(subs);
+@@ -459,7 +454,7 @@ static int usX2Y_usbpcm_urbs_start(struc
+ goto cleanup;
+ } else {
+ snd_printdd("%i\n", urb->start_frame);
+- if (0 > usX2Y->wait_iso_frame)
++ if (u == 0)
+ usX2Y->wait_iso_frame = urb->start_frame;
+ }
+ urb->transfer_flags = 0;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 04:50:35 2006
+Date: Mon, 16 Oct 2006 15:59:28 GMT
+Message-Id: <200610161559.k9GFxSnJ005249@hera.kernel.org>
+From: Marcel Holtmann <marcel@holtmann.org>
+MIME-Version: 1.0
+Subject: Bluetooth: Check if DLC is still attached to the TTY
+Content-Type: text/plain; charset="us-ascii"
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+[Bluetooth] Check if DLC is still attached to the TTY
+
+If the DLC device is no longer attached to the TTY device, then it
+makes no sense to go through with changing the termios settings.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bluetooth/rfcomm/tty.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- linux-2.6.18.1.orig/net/bluetooth/rfcomm/tty.c
++++ linux-2.6.18.1/net/bluetooth/rfcomm/tty.c
+@@ -748,6 +748,9 @@ static void rfcomm_tty_set_termios(struc
+
+ BT_DBG("tty %p termios %p", tty, old);
+
++ if (!dev)
++ return;
++
+ /* Handle turning off CRTSCTS */
+ if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
+ BT_DBG("Turning off CRTSCTS unsupported");
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 12 01:50:48 2006
+Date: Thu, 12 Oct 2006 01:49:38 -0700 (PDT)
+Message-Id: <20061012.014938.71090955.davem@davemloft.net>
+To: stable@kernel.org
+From: Patrick McHardy <kaber@trash.net>
+Mime-Version: 1.0
+Subject: [DECNET]: Fix sfuzz hanging on 2.6.18
+Content-Type: text/plain; charset="us-ascii"
+
+From: Patrick McHardy <kaber@trash.net>
+
+Dave Jones wrote:
+> sfuzz D 724EF62A 2828 28717 28691 (NOTLB)
+> cd69fe98 00000082 0000012d 724ef62a 0001971a 00000010 00000007 df6d22b0
+> dfd81080 725bbc5e 0001971a 000cc634 00000001 df6d23bc c140e260 00000202
+> de1d5ba0 cd69fea0 de1d5ba0 00000000 00000000 de1d5b60 de1d5b8c de1d5ba0
+> Call Trace:
+> [<c05b1708>] lock_sock+0x75/0xa6
+> [<e0b0b604>] dn_getname+0x18/0x5f [decnet]
+> [<c05b083b>] sys_getsockname+0x5c/0xb0
+> [<c05b0b46>] sys_socketcall+0xef/0x261
+> [<c0403f97>] syscall_call+0x7/0xb
+> DWARF2 unwinder stuck at syscall_call+0x7/0xb
+>
+> I wonder if the plethora of lockdep related changes inadvertantly broke something?
+
+Looks like unbalanced locking.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/decnet/af_decnet.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/net/decnet/af_decnet.c
++++ linux-2.6.18.1/net/decnet/af_decnet.c
+@@ -1177,8 +1177,10 @@ static int dn_getname(struct socket *soc
+ if (peer) {
+ if ((sock->state != SS_CONNECTED &&
+ sock->state != SS_CONNECTING) &&
+- scp->accept_mode == ACC_IMMED)
++ scp->accept_mode == ACC_IMMED) {
++ release_sock(sk);
+ return -ENOTCONN;
++ }
+
+ memcpy(sa, &scp->peer, sizeof(struct sockaddr_dn));
+ } else {
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 04:11:12 2006
+Date: Fri, 29 Sep 2006 17:01:11 GMT
+Message-Id: <200609291701.k8TH1BPN029946@hera.kernel.org>
+From: David Woodhouse <dwmw2@infradead.org>
+MIME-Version: 1.0
+Subject: Fix uninitialised spinlock in via-pmu-backlight code.
+Content-Type: text/plain; charset="us-ascii"
+
+From: David Woodhouse <dwmw2@infradead.org>
+
+[PATCH] Fix uninitialised spinlock in via-pmu-backlight code.
+
+The uninitialised pmu_backlight_lock causes the current Fedora test kernel
+(which has spinlock debugging enabled) to panic on suspend.
+
+This is suboptimal, so I fixed it.
+
+Signed-off-by: David Woodhouse <dwmw2@infradead.org>
+Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Michael Hanselmann <linux-kernel@hansmi.ch>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/macintosh/via-pmu-backlight.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/drivers/macintosh/via-pmu-backlight.c
++++ linux-2.6.18.1/drivers/macintosh/via-pmu-backlight.c
+@@ -16,7 +16,7 @@
+ #define MAX_PMU_LEVEL 0xFF
+
+ static struct backlight_properties pmu_backlight_data;
+-static spinlock_t pmu_backlight_lock;
++static DEFINE_SPINLOCK(pmu_backlight_lock);
+ static int sleeping;
+ static u8 bl_curve[FB_BACKLIGHT_LEVELS];
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 12 09:14:50 2006
+Date: Thu, 12 Oct 2006 09:14:05 -0700
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+To: stable@kernel.org
+Message-Id: <20061012091405.e4bb1f55.akpm@osdl.org>
+Mime-Version: 1.0
+Subject: mm: fix a race condition under SMC + COW
+Content-Type: text/plain; charset="us-ascii"
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+Failing context is a multi threaded process context and the failing
+sequence is as follows.
+
+One thread T0 doing self modifying code on page X on processor P0 and
+another thread T1 doing COW (breaking the COW setup as part of just
+happened fork() in another thread T2) on the same page X on processor P1.
+T0 doing SMC can endup modifying the new page Y (allocated by the T1 doing
+COW on P1) but because of different I/D TLB's, P0 ITLB will not see the new
+mapping till the flush TLB IPI from P1 is received. During this interval,
+if T0 executes the code created by SMC it can result in an app error (as
+ITLB still points to old page X and endup executing the content in page X
+rather than using the content in page Y).
+
+Fix this issue by first clearing the PTE and flushing it, before updating
+it with new entry.
+
+Hugh sayeth:
+
+ I was a bit sceptical, in the habit of thinking that Self Modifying Code
+ must look such issues itself: but I guess there's nothing it can do to avoid
+ this one.
+
+ Fair enough, what you're changing it to is pretty much what powerpc and
+ s390 were already doing, and is a more robust way of proceeding, consistent
+ with how ptes are set everywhere else.
+
+ The ptep_clear_flush is a bit heavy-handed (it's anxious to return the pte
+ that was atomically cleared), but we'd have to wander through lots of arches
+ to get the right minimal behaviour. It'd also be nice to eliminate
+ ptep_establish completely, now only used to define other macros/inlines: it
+ always seemed obfuscation to me, what you've got there now is clearer.
+ Let's put those cleanups on a TODO list.
+
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Acked-by: "David S. Miller" <davem@davemloft.net>
+Acked-by: Hugh Dickins <hugh@veritas.com>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memory.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/mm/memory.c
++++ linux-2.6.18.1/mm/memory.c
+@@ -1551,7 +1551,14 @@ gotten:
+ entry = mk_pte(new_page, vma->vm_page_prot);
+ entry = maybe_mkwrite(pte_mkdirty(entry), vma);
+ lazy_mmu_prot_update(entry);
+- ptep_establish(vma, address, page_table, entry);
++ /*
++ * Clear the pte entry and flush it first, before updating the
++ * pte with the new entry. This will avoid a race condition
++ * seen in the presence of one thread doing SMC and another
++ * thread doing COW.
++ */
++ ptep_clear_flush(vma, address, page_table);
++ set_pte_at(mm, address, page_table, entry);
+ update_mmu_cache(vma, address, entry);
+ lru_cache_add_active(new_page);
+ page_add_new_anon_rmap(new_page, vma, address);
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 04:10:47 2006
+Date: Sun, 24 Sep 2006 03:59:49 GMT
+Message-Id: <200609240359.k8O3xnOl023638@hera.kernel.org>
+From: Brian King <brking@us.ibm.com>
+MIME-Version: 1.0
+Subject: SCSI: DAC960: PCI id table fixup
+Content-Type: text/plain; charset="us-ascii"
+
+From: Brian King <brking@us.ibm.com>
+
+[SCSI] DAC960: PCI id table fixup
+
+The PCI ID table in the DAC960 driver conflicts with some devices
+that use the ipr driver. All ipr adapters that use this chip
+have an IBM subvendor ID and all DAC960 adapters that use this
+chip have a Mylex subvendor id.
+
+Signed-off-by: Brian King <brking@us.ibm.com>
+Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/DAC960.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/drivers/block/DAC960.c
++++ linux-2.6.18.1/drivers/block/DAC960.c
+@@ -7115,7 +7115,7 @@ static struct pci_device_id DAC960_id_ta
+ {
+ .vendor = PCI_VENDOR_ID_MYLEX,
+ .device = PCI_DEVICE_ID_MYLEX_DAC960_GEM,
+- .subvendor = PCI_ANY_ID,
++ .subvendor = PCI_VENDOR_ID_MYLEX,
+ .subdevice = PCI_ANY_ID,
+ .driver_data = (unsigned long) &DAC960_GEM_privdata,
+ },
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 04:27:39 2006
+Date: Tue, 17 Oct 2006 13:26:34 +0200
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+To: stable@kernel.org
+Message-ID: <20061017112634.GD24505@nancy>
+MIME-Version: 1.0
+Content-Disposition: inline
+Subject: SERIAL: Fix oops when removing suspended serial port
+Content-Type: text/plain; charset="us-ascii"
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+[SERIAL] Fix oops when removing suspended serial port
+
+A serial card might have been removed when the system is resumed.
+This results in a suspended port being shut down, which results in
+the ports shutdown method being called twice in a row. This causes
+BUGs. Avoid this by tracking the suspended state separately from
+the initialised state.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: maximilian attems <maks@sternwelten.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/serial_core.c | 9 +++++++--
+ include/linux/serial_core.h | 1 +
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/serial/serial_core.c
++++ linux-2.6.18.1/drivers/serial/serial_core.c
+@@ -1932,6 +1932,9 @@ int uart_suspend_port(struct uart_driver
+ if (state->info && state->info->flags & UIF_INITIALIZED) {
+ const struct uart_ops *ops = port->ops;
+
++ state->info->flags = (state->info->flags & ~UIF_INITIALIZED)
++ | UIF_SUSPENDED;
++
+ spin_lock_irq(&port->lock);
+ ops->stop_tx(port);
+ ops->set_mctrl(port, 0);
+@@ -1991,7 +1994,7 @@ int uart_resume_port(struct uart_driver
+ console_start(port->cons);
+ }
+
+- if (state->info && state->info->flags & UIF_INITIALIZED) {
++ if (state->info && state->info->flags & UIF_SUSPENDED) {
+ const struct uart_ops *ops = port->ops;
+ int ret;
+
+@@ -2003,15 +2006,17 @@ int uart_resume_port(struct uart_driver
+ ops->set_mctrl(port, port->mctrl);
+ ops->start_tx(port);
+ spin_unlock_irq(&port->lock);
++ state->info->flags |= UIF_INITIALIZED;
+ } else {
+ /*
+ * Failed to resume - maybe hardware went away?
+ * Clear the "initialized" flag so we won't try
+ * to call the low level drivers shutdown method.
+ */
+- state->info->flags &= ~UIF_INITIALIZED;
+ uart_shutdown(state);
+ }
++
++ state->info->flags &= ~UIF_SUSPENDED;
+ }
+
+ mutex_unlock(&state->mutex);
+--- linux-2.6.18.1.orig/include/linux/serial_core.h
++++ linux-2.6.18.1/include/linux/serial_core.h
+@@ -319,6 +319,7 @@ struct uart_info {
+ #define UIF_CTS_FLOW ((__force uif_t) (1 << 26))
+ #define UIF_NORMAL_ACTIVE ((__force uif_t) (1 << 29))
+ #define UIF_INITIALIZED ((__force uif_t) (1 << 31))
++#define UIF_SUSPENDED ((__force uif_t) (1 << 30))
+
+ int blocked_open;
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 04:20:54 2006
+Date: Tue, 17 Oct 2006 13:19:40 +0200
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+To: stable@kernel.org
+Message-ID: <20061017111940.GC24505@nancy>
+MIME-Version: 1.0
+Content-Disposition: inline
+Cc: Russell King <rmk@dyn-67.arm.linux.org.uk>, David Woodhouse <dwmw2@infradead.org>
+Subject: SERIAL: Fix resume handling bug
+Content-Type: text/plain; charset="us-ascii"
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+Unfortunately, pcmcia_dev_present() returns false when a device is
+suspended, so checking this on resume does not work too well. Omit
+this test.
+
+the backported patch below is already in fedora tree. -maks
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: maximilian attems <maks@sternwelten.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/serial_cs.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/serial/serial_cs.c
++++ linux-2.6.18.1/drivers/serial/serial_cs.c
+@@ -185,14 +185,12 @@ static int serial_suspend(struct pcmcia_
+
+ static int serial_resume(struct pcmcia_device *link)
+ {
+- if (pcmcia_dev_present(link)) {
+- struct serial_info *info = link->priv;
+- int i;
++ struct serial_info *info = link->priv;
++ int i;
+
+- for (i = 0; i < info->ndev; i++)
+- serial8250_resume_port(info->line[i]);
+- wakeup_card(info);
+- }
++ for (i = 0; i < info->ndev; i++)
++ serial8250_resume_port(info->line[i]);
++ wakeup_card(info);
+
+ return 0;
+ }
--- /dev/null
+fix-sfuzz-hanging-on-2.6.18.patch
+splice-fix-pipe_to_file-prepare_write-error-path.patch
+__div64_32-for-31-bit.patch
+mm-fix-a-race-condition-under-smc-cow.patch
+sky2-msi-test-race-and-message.patch
+sky2-pause-parameter-adjustment.patch
+sky2-turn-off-phy-irq-on-shutdown.patch
+alsa-emu10k1-fix-outl-in-snd_emu10k1_resume_regs.patch
+alsa-powermac-fix-oops-when-conflicting-with-aoa-driver.patch
+sound-pci-au88x0-au88x0.c-ioremap-balanced-with-iounmap.patch
+alsa-dereference-after-free-in-snd_hwdep_release.patch
+alsa-fix-bug-in-snd-usb-usx2y-s-usx2y_pcms_lock_check.patch
+alsa-repair-snd-usb-usx2y-for-usb-2.6.18.patch
+sky2-accept-multicast-pause-frames.patch
+sky2-gmac-pause-frame.patch
+uml-fix-processor-selection-to-exclude-unsupported-processors-and-features.patch
+scsi-dac960-pci-id-table-fixup.patch
+fix-uninitialised-spinlock-in-via-pmu-backlight-code.patch
+serial-fix-resume-handling-bug.patch
+serial-fix-oops-when-removing-suspended-serial-port.patch
+bluetooth-check-if-dlc-is-still-attached-to-the-tty.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 15:29:40 2006
+Date: Mon, 16 Oct 2006 14:08:56 -0700
+From: Stephen Hemminger <shemminger@osdl.org>
+To: stable@kernel.org
+Message-ID: <20061016140856.2f8b3907@freekitty>
+Mime-Version: 1.0
+Subject: sky2: accept multicast pause frames
+Content-Type: text/plain; charset="us-ascii"
+
+From: Stephen Hemminger <shemminger@osdl.org>
+
+When using flow control, the PHY needs to accept multicast pause frames.
+Without this fix, these frames were getting discarded by the PHY before
+doing any flow control.
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/net/sky2.c
++++ linux-2.6.18.1/drivers/net/sky2.c
+@@ -2745,6 +2745,14 @@ static int sky2_set_mac_address(struct n
+ return 0;
+ }
+
++static void inline sky2_add_filter(u8 filter[8], const u8 *addr)
++{
++ u32 bit;
++
++ bit = ether_crc(ETH_ALEN, addr) & 63;
++ filter[bit >> 3] |= 1 << (bit & 7);
++}
++
+ static void sky2_set_multicast(struct net_device *dev)
+ {
+ struct sky2_port *sky2 = netdev_priv(dev);
+@@ -2753,6 +2761,7 @@ static void sky2_set_multicast(struct ne
+ struct dev_mc_list *list = dev->mc_list;
+ u16 reg;
+ u8 filter[8];
++ static const u8 pause_mc_addr[ETH_ALEN] = { 0x1, 0x80, 0xc2, 0x0, 0x0, 0x1 };
+
+ memset(filter, 0, sizeof(filter));
+
+@@ -2763,16 +2772,17 @@ static void sky2_set_multicast(struct ne
+ reg &= ~(GM_RXCR_UCF_ENA | GM_RXCR_MCF_ENA);
+ else if ((dev->flags & IFF_ALLMULTI) || dev->mc_count > 16) /* all multicast */
+ memset(filter, 0xff, sizeof(filter));
+- else if (dev->mc_count == 0) /* no multicast */
++ else if (dev->mc_count == 0 && !sky2->rx_pause)
+ reg &= ~GM_RXCR_MCF_ENA;
+ else {
+ int i;
+ reg |= GM_RXCR_MCF_ENA;
+
+- for (i = 0; list && i < dev->mc_count; i++, list = list->next) {
+- u32 bit = ether_crc(ETH_ALEN, list->dmi_addr) & 0x3f;
+- filter[bit / 8] |= 1 << (bit % 8);
+- }
++ if (sky2->rx_pause)
++ sky2_add_filter(filter, pause_mc_addr);
++
++ for (i = 0; list && i < dev->mc_count; i++, list = list->next)
++ sky2_add_filter(filter, list->dmi_addr);
+ }
+
+ gma_write16(hw, port, GM_MC_ADDR_H1,
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 15:29:40 2006
+Date: Mon, 16 Oct 2006 14:10:16 -0700
+From: Stephen Hemminger <shemminger@osdl.org>
+To: stable@kernel.org
+Message-ID: <20061016141016.62d39650@freekitty>
+Mime-Version: 1.0
+Subject: sky2: GMAC pause frame
+Content-Type: text/plain; charset="us-ascii"
+
+From: Stephen Hemminger <shemminger@osdl.org>
+
+This reverts earlier change that attempted to fix flow control.
+Device needs to discard pause frames, otherwise it passes pause frames up
+the stack.
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/net/sky2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/drivers/net/sky2.h
++++ linux-2.6.18.1/drivers/net/sky2.h
+@@ -1566,7 +1566,7 @@ enum {
+
+ GMR_FS_ANY_ERR = GMR_FS_RX_FF_OV | GMR_FS_CRC_ERR |
+ GMR_FS_FRAGMENT | GMR_FS_LONG_ERR |
+- GMR_FS_MII_ERR | GMR_FS_BAD_FC |
++ GMR_FS_MII_ERR | GMR_FS_GOOD_FC | GMR_FS_BAD_FC |
+ GMR_FS_UN_SIZE | GMR_FS_JABBER,
+ };
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 12 15:38:46 2006
+Date: Thu, 12 Oct 2006 15:38:11 -0700
+From: Stephen Hemminger <shemminger@osdl.org>
+To: stable@kernel.org
+Message-ID: <20061012153811.09790730@freekitty>
+Mime-Version: 1.0
+Subject: sky2: MSI test race and message
+Content-Type: text/plain; charset="us-ascii"
+
+From: Stephen Hemminger <shemminger@osdl.org>
+
+Make sure and do PCI reads after writes in the MSI test setup code.
+
+Some motherboards don't implement MSI correctly. The driver handles this
+but the warning is too verbose and overly cautious.
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/net/sky2.c
++++ linux-2.6.18.1/drivers/net/sky2.c
+@@ -3208,6 +3208,8 @@ static int __devinit sky2_test_msi(struc
+ struct pci_dev *pdev = hw->pdev;
+ int err;
+
++ init_waitqueue_head (&hw->msi_wait);
++
+ sky2_write32(hw, B0_IMSK, Y2_IS_IRQ_SW);
+
+ err = request_irq(pdev->irq, sky2_test_intr, IRQF_SHARED, DRV_NAME, hw);
+@@ -3217,18 +3219,15 @@ static int __devinit sky2_test_msi(struc
+ return err;
+ }
+
+- init_waitqueue_head (&hw->msi_wait);
+-
+ sky2_write8(hw, B0_CTST, CS_ST_SW_IRQ);
+- wmb();
++ sky2_read8(hw, B0_CTST);
+
+ wait_event_timeout(hw->msi_wait, hw->msi_detected, HZ/10);
+
+ if (!hw->msi_detected) {
+ /* MSI test failed, go back to INTx mode */
+- printk(KERN_WARNING PFX "%s: No interrupt was generated using MSI, "
+- "switching to INTx mode. Please report this failure to "
+- "the PCI maintainer and include system chipset information.\n",
++ printk(KERN_INFO PFX "%s: No interrupt generated using MSI, "
++ "switching to INTx mode.\n",
+ pci_name(pdev));
+
+ err = -EOPNOTSUPP;
+@@ -3236,6 +3235,7 @@ static int __devinit sky2_test_msi(struc
+ }
+
+ sky2_write32(hw, B0_IMSK, 0);
++ sky2_read32(hw, B0_IMSK);
+
+ free_irq(pdev->irq, hw);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 12 15:38:57 2006
+Date: Thu, 12 Oct 2006 15:34:24 -0700
+From: Stephen Hemminger <shemminger@osdl.org>
+To: stable@kernel.org
+Message-ID: <20061012153424.1271db55@freekitty>
+Mime-Version: 1.0
+Subject: sky2: pause parameter adjustment
+Content-Type: text/plain; charset="us-ascii"
+
+From: Stephen Hemminger <shemminger@osdl.org>
+
+The lower pause threshold set by the driver is too large and causes FIFO overruns.
+Especially on laptops running at slower clock rates.
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/net/sky2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/drivers/net/sky2.c
++++ linux-2.6.18.1/drivers/net/sky2.c
+@@ -678,7 +678,7 @@ static void sky2_mac_init(struct sky2_hw
+ sky2_write16(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_OPER_ON);
+
+ if (hw->chip_id == CHIP_ID_YUKON_EC_U) {
+- sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 768/8);
++ sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 512/8);
+ sky2_write8(hw, SK_REG(port, RX_GMF_UP_THR), 1024/8);
+ if (hw->dev[port]->mtu > ETH_DATA_LEN) {
+ /* set Tx GMAC FIFO Almost Empty Threshold */
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 12 15:38:57 2006
+Date: Thu, 12 Oct 2006 15:32:42 -0700
+From: Stephen Hemminger <shemminger@osdl.org>
+To: stable@kernel.org
+Message-ID: <20061012153242.43fb9c38@freekitty>
+Mime-Version: 1.0
+Subject: sky2: turn off PHY IRQ on shutdown
+Content-Type: text/plain; charset="us-ascii"
+
+From: Stephen Hemminger <shemminger@osdl.org>
+
+When PHY is turned off on shutdown, it can causes the IRQ to get stuck on.
+Make sure and disable the IRQ first, and if IRQ occurs when device
+is not running, don't access PHY because that can hang.
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/net/sky2.c
++++ linux-2.6.18.1/drivers/net/sky2.c
+@@ -1429,6 +1429,11 @@ static int sky2_down(struct net_device *
+ /* Stop more packets from being queued */
+ netif_stop_queue(dev);
+
++ /* Disable port IRQ */
++ imask = sky2_read32(hw, B0_IMSK);
++ imask &= ~portirq_msk[port];
++ sky2_write32(hw, B0_IMSK, imask);
++
+ sky2_phy_reset(hw, port);
+
+ /* Stop transmitter */
+@@ -1472,11 +1477,6 @@ static int sky2_down(struct net_device *
+ sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_SET);
+ sky2_write8(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_RST_SET);
+
+- /* Disable port IRQ */
+- imask = sky2_read32(hw, B0_IMSK);
+- imask &= ~portirq_msk[port];
+- sky2_write32(hw, B0_IMSK, imask);
+-
+ /* turn off LED's */
+ sky2_write16(hw, B0_Y2LED, LED_STAT_OFF);
+
+@@ -1687,13 +1687,13 @@ static void sky2_phy_intr(struct sky2_hw
+ struct sky2_port *sky2 = netdev_priv(dev);
+ u16 istatus, phystat;
+
++ if (!netif_running(dev))
++ return;
++
+ spin_lock(&sky2->phy_lock);
+ istatus = gm_phy_read(hw, port, PHY_MARV_INT_STAT);
+ phystat = gm_phy_read(hw, port, PHY_MARV_PHY_STAT);
+
+- if (!netif_running(dev))
+- goto out;
+-
+ if (netif_msg_intr(sky2))
+ printk(KERN_INFO PFX "%s: phy interrupt status 0x%x 0x%x\n",
+ sky2->netdev->name, istatus, phystat);
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 05:39:43 2006
+Date: Mon, 16 Oct 2006 14:39:03 +0200
+Message-ID: <s5hodsca108.wl%tiwai@suse.de>
+From: Amol Lad <amol@verismonetworks.com>
+To: stable@kernel.org
+MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
+Subject: sound/pci/au88x0/au88x0.c: ioremap balanced with iounmap
+Content-Type: text/plain; charset="us-ascii"
+
+From: Amol Lad <amol@verismonetworks.com>
+
+[PATCH] sound/pci/au88x0/au88x0.c: ioremap balanced with iounmap
+
+From: Amol Lad <amol@verismonetworks.com>
+Signed-off-by: Amol Lad <amol@verismonetworks.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/au88x0/au88x0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.18.1.orig/sound/pci/au88x0/au88x0.c
++++ linux-2.6.18.1/sound/pci/au88x0/au88x0.c
+@@ -128,6 +128,7 @@ static int snd_vortex_dev_free(struct sn
+ // Take down PCI interface.
+ synchronize_irq(vortex->irq);
+ free_irq(vortex->irq, vortex);
++ iounmap(vortex->mmio);
+ pci_release_regions(vortex->pci_dev);
+ pci_disable_device(vortex->pci_dev);
+ kfree(vortex);
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Oct 11 23:00:27 2006
+Date: Thu, 12 Oct 2006 07:59:47 +0200
+From: Jens Axboe <jens.axboe@oracle.com>
+To: stable@kernel.org
+Message-ID: <20061012055946.GU6515@kernel.dk>
+Mime-Version: 1.0
+Content-Disposition: inline
+Subject: splice: fix pipe_to_file() ->prepare_write() error path
+Content-Type: text/plain; charset="us-ascii"
+
+From: Jens Axboe <jens.axboe@oracle.com>
+
+Don't jump to the unlock+release path, we already did that.
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/splice.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- linux-2.6.18.1.orig/fs/splice.c
++++ linux-2.6.18.1/fs/splice.c
+@@ -607,7 +607,7 @@ find_page:
+ ret = -ENOMEM;
+ page = page_cache_alloc_cold(mapping);
+ if (unlikely(!page))
+- goto out_nomem;
++ goto out_ret;
+
+ /*
+ * This will also lock the page
+@@ -666,7 +666,7 @@ find_page:
+ if (sd->pos + this_len > isize)
+ vmtruncate(mapping->host, isize);
+
+- goto out;
++ goto out_ret;
+ }
+
+ if (buf->page != page) {
+@@ -698,7 +698,7 @@ find_page:
+ out:
+ page_cache_release(page);
+ unlock_page(page);
+-out_nomem:
++out_ret:
+ return ret;
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 16 14:10:02 2006
+From: "Paolo 'Blaisorblade' Giarrusso" <blaisorblade@yahoo.it>
+To: stable@kernel.org
+Date: Sun, 15 Oct 2006 21:43:29 +0200
+Message-Id: <11609414093462-git-send-email-blaisorblade@yahoo.it>
+Cc: Jeff Dike <jdike@addtoit.com>, "Paolo 'Blaisorblade' Giarrusso" <blaisorblade@yahoo.it>
+Subject: uml: fix processor selection to exclude unsupported processors and features
+MIME-Version: 1.0
+Content-Type: text/plain; charset="us-ascii"
+
+From: "Paolo 'Blaisorblade' Giarrusso" <blaisorblade@yahoo.it>
+
+Makes UML compile on any possible processor choice. The two problems were:
+
+*) x86 code, when 386 is selected, checks at runtime boot_cpuflags, which we do
+ not have.
+*) 3Dnow support for memcpy() et al. does not compile currently and fixing this
+ is not trivial, so simply disable it; with this change, if one selects MK7
+ UML compiles (while it did not).
+Merged upstream.
+
+Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/Kconfig.cpu | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/arch/i386/Kconfig.cpu
++++ linux-2.6.18.1/arch/i386/Kconfig.cpu
+@@ -7,6 +7,7 @@ choice
+
+ config M386
+ bool "386"
++ depends on !UML
+ ---help---
+ This is the processor type of your CPU. This information is used for
+ optimizing purposes. In order to compile a kernel that can run on
+@@ -301,7 +302,7 @@ config X86_USE_PPRO_CHECKSUM
+
+ config X86_USE_3DNOW
+ bool
+- depends on MCYRIXIII || MK7 || MGEODE_LX
++ depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
+ default y
+
+ config X86_OOSTORE
projects / thirdparty / kernel / stable-queue.git / commitdiff
