--- /dev/null
+From 0461ec5bc7745b89a8ab67ba0ea497abd58a6301 Mon Sep 17 00:00:00 2001
+From: Paul Larson <pl@linux.vnet.ibm.com>
+Date: Fri, 30 Jan 2009 10:21:49 -0600
+Subject: Add enable_ms to jsm driver
+
+From: Paul Larson <pl@linux.vnet.ibm.com>
+
+commit 0461ec5bc7745b89a8ab67ba0ea497abd58a6301 upstream.
+
+This fixes a crash observed when non-existant enable_ms function is
+called for jsm driver.
+
+Signed-off-by: Scott Kilau <Scott.Kilau@digi.com>
+Signed-off-by: Paul Larson <pl@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/jsm/jsm_tty.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/serial/jsm/jsm_tty.c
++++ b/drivers/serial/jsm/jsm_tty.c
+@@ -161,6 +161,11 @@ static void jsm_tty_stop_rx(struct uart_
+ channel->ch_bd->bd_ops->disable_receiver(channel);
+ }
+
++static void jsm_tty_enable_ms(struct uart_port *port)
++{
++ /* Nothing needed */
++}
++
+ static void jsm_tty_break(struct uart_port *port, int break_state)
+ {
+ unsigned long lock_flags;
+@@ -345,6 +350,7 @@ static struct uart_ops jsm_ops = {
+ .start_tx = jsm_tty_start_tx,
+ .send_xchar = jsm_tty_send_xchar,
+ .stop_rx = jsm_tty_stop_rx,
++ .enable_ms = jsm_tty_enable_ms,
+ .break_ctl = jsm_tty_break,
+ .startup = jsm_tty_open,
+ .shutdown = jsm_tty_close,
--- /dev/null
+From 7fbb7cadd062baf299fd8b26a80ea99da0c3fe01 Mon Sep 17 00:00:00 2001
+From: Risto Suominen <Risto.Suominen@gmail.com>
+Date: Tue, 13 Jan 2009 20:09:30 +0000
+Subject: fbdev/atyfb: Fix DSP config on some PowerMacs & PowerBooks
+
+From: Risto Suominen <Risto.Suominen@gmail.com>
+
+commit 7fbb7cadd062baf299fd8b26a80ea99da0c3fe01 upstream.
+
+Since the complete re-write in 2.6.10, some PowerMacs (At least PowerMac 5500
+and PowerMac G3 Beige rev A) with ATI Mach64 chip have suffered from unstable
+columns in their framebuffer image. This seems to depend on a value (4) read
+from PLL_EXT_CNTL register, which leads to incorrect DSP config parameters to
+be written to the chip. This patch uses a value calculated by aty_init_pll_ct
+instead, as a starting point.
+
+There are questions as to whether this should be extended to other platforms
+or maybe made dependent on specific chip types, but in the meantime, this has
+been tested on various powermacs and works for them so let's commit it.
+
+Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com>
+Tested-by: Michael Pettersson <mike@it.uu.se>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/aty/mach64_ct.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/video/aty/mach64_ct.c
++++ b/drivers/video/aty/mach64_ct.c
+@@ -8,6 +8,9 @@
+ #include <asm/io.h>
+ #include <video/mach64.h>
+ #include "atyfb.h"
++#ifdef CONFIG_PPC
++#include <asm/machdep.h>
++#endif
+
+ #undef DEBUG
+
+@@ -536,6 +539,14 @@ static int __devinit aty_init_pll_ct(con
+ pll->ct.xclk_post_div_real = postdividers[xpost_div];
+ pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8;
+
++#ifdef CONFIG_PPC
++ if (machine_is(powermac)) {
++ /* Override PLL_EXT_CNTL & 0x07. */
++ pll->ct.xclk_post_div = xpost_div;
++ pll->ct.xclk_ref_div = 1;
++ }
++#endif
++
+ #ifdef DEBUG
+ pllmclk = (1000000 * pll->ct.mclk_fb_mult * pll->ct.mclk_fb_div) /
+ (par->ref_clk_per * pll->ct.pll_ref_div);
--- /dev/null
+From 878b8619f711280fd05845e21956434b5e588cc4 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 30 Jan 2009 15:27:14 -0500
+Subject: Fix memory corruption in console selection
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 878b8619f711280fd05845e21956434b5e588cc4 upstream.
+
+Fix an off-by-two memory error in console selection.
+
+The loop below goes from sel_start to sel_end (inclusive), so it writes
+one more character. This one more character was added to the allocated
+size (+1), but it was not multiplied by an UTF-8 multiplier.
+
+This patch fixes a memory corruption when UTF-8 console is used and the
+user selects a few characters, all of them 3-byte in UTF-8 (for example
+a frame line).
+
+When memory redzones are enabled, a redzone corruption is reported.
+When they are not enabled, trashing of random memory occurs.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/selection.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/selection.c
++++ b/drivers/char/selection.c
+@@ -268,7 +268,7 @@ int set_selection(const struct tiocl_sel
+
+ /* Allocate a new buffer before freeing the old one ... */
+ multiplier = use_unicode ? 3 : 1; /* chars can take up to 3 bytes */
+- bp = kmalloc((sel_end-sel_start)/2*multiplier+1, GFP_KERNEL);
++ bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
+ if (!bp) {
+ printk(KERN_WARNING "selection: kmalloc() failed\n");
+ clear_selection();
--- /dev/null
+From 4200844bd9dc511088258437d564a187f0ffc94e Mon Sep 17 00:00:00 2001
+From: Stuart Hopkins <stuart@dodgy-geeza.com>
+Date: Sat, 20 Dec 2008 04:12:33 -0500
+Subject: Input: atkbd - Samsung NC10 key repeat fix
+
+From: Stuart Hopkins <stuart@dodgy-geeza.com>
+
+commit 4200844bd9dc511088258437d564a187f0ffc94e upstream.
+
+This patch fixes the key repeat issue with the Fn+F? keys on the new
+Samsung NC10 Netbook, so that the keys can be defined and used within
+ACPID correctly, otherwise the keys repeat indefinately.
+
+This solves part of http://bugzilla.kernel.org/show_bug.cgi?id=12021
+
+Signed-off-by: Stuart Hopkins <stuart@dodgy-geeza.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/keyboard/atkbd.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -884,6 +884,22 @@ static void atkbd_inventec_keymap_fixup(
+ }
+
+ /*
++ * Samsung NC10 with Fn+F? key release not working
++ */
++static void atkbd_samsung_keymap_fixup(struct atkbd *atkbd)
++{
++ const unsigned int forced_release_keys[] = {
++ 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9,
++ };
++ int i;
++
++ if (atkbd->set == 2)
++ for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
++ __set_bit(forced_release_keys[i],
++ atkbd->force_release_mask);
++}
++
++/*
+ * atkbd_set_keycode_table() initializes keyboard's keycode table
+ * according to the selected scancode set
+ */
+@@ -1493,6 +1509,15 @@ static struct dmi_system_id atkbd_dmi_qu
+ .callback = atkbd_setup_fixup,
+ .driver_data = atkbd_inventec_keymap_fixup,
+ },
++ {
++ .ident = "Samsung NC10",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
++ },
++ .callback = atkbd_setup_fixup,
++ .driver_data = atkbd_samsung_keymap_fixup,
++ },
+ { }
+ };
+
--- /dev/null
+From c338ba3ca5bef2df2082d9e8d336ff7b2880c326 Mon Sep 17 00:00:00 2001
+From: Abbas, Mohamed <mohamed.abbas@intel.com>
+Date: Wed, 21 Jan 2009 10:58:02 -0800
+Subject: iwlwifi: fix rs_get_rate WARN_ON()
+
+From: Abbas, Mohamed <mohamed.abbas@intel.com>
+
+commit c338ba3ca5bef2df2082d9e8d336ff7b2880c326 upstream.
+
+In ieee80211_sta structure there is u64 supp_rates[IEEE80211_NUM_BANDS]
+this is filled with all support rate from assoc_resp. If we associate
+with G-band AP only supp_rates of G-band will be set the other band
+supp_rates will be set to 0. If the user type this command
+this will cause mac80211 to set to new channel, mac80211
+does not disassociate in setting new channel, so the active
+band is now A-band. then in handling the new essid mac80211 will
+kick in the assoc steps which involve sending disassociation frame.
+in this mac80211 will WARN_ON sta->supp_rates[A_BAND] == 0.
+
+This fixes:
+http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1822
+http://www.kerneloops.org/searchweek.php?search=rs_get_rate
+
+Signed-off-by: mohamed abbas <mohamed.abbas@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-3945-rs.c | 12 +++++++++---
+ drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 12 ++++++++++--
+ 2 files changed, 19 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+@@ -647,12 +647,16 @@ static void rs_get_rate(void *priv_r, st
+ s8 scale_action = 0;
+ unsigned long flags;
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+- u16 fc, rate_mask;
++ u16 fc;
++ u16 rate_mask = 0;
+ struct iwl3945_priv *priv = (struct iwl3945_priv *)priv_r;
+ DECLARE_MAC_BUF(mac);
+
+ IWL_DEBUG_RATE("enter\n");
+
++ if (sta)
++ rate_mask = sta->supp_rates[sband->band];
++
+ /* Send management frames and broadcast/multicast data using lowest
+ * rate. */
+ fc = le16_to_cpu(hdr->frame_control);
+@@ -660,11 +664,13 @@ static void rs_get_rate(void *priv_r, st
+ is_multicast_ether_addr(hdr->addr1) ||
+ !sta || !priv_sta) {
+ IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
+- sel->rate_idx = rate_lowest_index(sband, sta);
++ if (!rate_mask)
++ sel->rate_idx = rate_lowest_index(sband, NULL);
++ else
++ sel->rate_idx = rate_lowest_index(sband, sta);
+ return;
+ }
+
+- rate_mask = sta->supp_rates[sband->band];
+ index = min(rs_sta->last_txrate_idx & 0xffff, IWL_RATE_COUNT - 1);
+
+ if (sband->band == IEEE80211_BAND_5GHZ)
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+@@ -951,7 +951,8 @@ static void rs_tx_status(void *priv_r, s
+ }
+
+ /* See if there's a better rate or modulation mode to try. */
+- rs_rate_scale_perform(priv, hdr, sta, lq_sta);
++ if (sta && sta->supp_rates[sband->band])
++ rs_rate_scale_perform(priv, hdr, sta, lq_sta);
+ out:
+ return;
+ }
+@@ -2114,15 +2115,22 @@ static void rs_get_rate(void *priv_r, st
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ __le16 fc;
+ struct iwl_lq_sta *lq_sta;
++ u64 mask_bit = 0;
+
+ IWL_DEBUG_RATE_LIMIT("rate scale calculate new rate for skb\n");
+
++ if (sta)
++ mask_bit = sta->supp_rates[sband->band];
++
+ /* Send management frames and broadcast/multicast data using lowest
+ * rate. */
+ fc = hdr->frame_control;
+ if (!ieee80211_is_data(fc) || is_multicast_ether_addr(hdr->addr1) ||
+ !sta || !priv_sta) {
+- sel->rate_idx = rate_lowest_index(sband, sta);
++ if (!mask_bit)
++ sel->rate_idx = rate_lowest_index(sband, NULL);
++ else
++ sel->rate_idx = rate_lowest_index(sband, sta);
+ return;
+ }
+
--- /dev/null
+From 1cf3eb2ff6b0844c678f2f48d0053b9d12b7da67 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Tue, 27 Jan 2009 23:48:59 +0200
+Subject: kmalloc: return NULL instead of link failure
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit 1cf3eb2ff6b0844c678f2f48d0053b9d12b7da67 upstream.
+
+The SLAB kmalloc with a constant value isn't consistent with the other
+implementations because it bails out with __you_cannot_kmalloc_that_much
+rather than returning NULL and properly allowing the caller to fall back
+to vmalloc or take other action. This doesn't happen with a non-constant
+value or with SLOB or SLUB.
+
+Starting with 2.6.28, I've been seeing build failures on s390x. This is
+due to init_section_page_cgroup trying to allocate 2.5MB when the max size
+for a kmalloc on s390x is 2MB.
+
+It's failing because the value is constant. The workarounds at the call
+size are ugly and the caller shouldn't have to change behavior depending
+on what the backend of the API is.
+
+So, this patch eliminates the link failure and returns NULL like the other
+implementations.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Cc: Pekka Enberg <penberg@cs.helsinki.fi>
+Cc: Matt Mackall <mpm@selenic.com>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/slab_def.h | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/include/linux/slab_def.h
++++ b/include/linux/slab_def.h
+@@ -43,10 +43,7 @@ static inline void *kmalloc(size_t size,
+ i++;
+ #include <linux/kmalloc_sizes.h>
+ #undef CACHE
+- {
+- extern void __you_cannot_kmalloc_that_much(void);
+- __you_cannot_kmalloc_that_much();
+- }
++ return NULL;
+ found:
+ #ifdef CONFIG_ZONE_DMA
+ if (flags & GFP_DMA)
+@@ -77,10 +74,7 @@ static inline void *kmalloc_node(size_t
+ i++;
+ #include <linux/kmalloc_sizes.h>
+ #undef CACHE
+- {
+- extern void __you_cannot_kmalloc_that_much(void);
+- __you_cannot_kmalloc_that_much();
+- }
++ return NULL;
+ found:
+ #ifdef CONFIG_ZONE_DMA
+ if (flags & GFP_DMA)
--- /dev/null
+From chunkeey@web.de Tue Feb 3 14:34:41 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Sat, 24 Jan 2009 10:45:10 +0100
+Subject: minstrel: fix warning if lowest supported rate index is not 0
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, Larry.Finger@lwfinger.net, linville@tuxdriver.com, nbd@openwrt.org
+Message-ID: <200901241045.11055.chunkeey@web.de>
+Content-Disposition: inline
+
+From: Christian Lamparter <chunkeey@web.de>
+
+commit d57854bb1d78ba89ffbfdfd1c3e95b52ed7478ff upstream
+
+This patch fixes the following WARNING (caused by rix_to_ndx): "
+>WARNING: at net/mac80211/rc80211_minstrel.c:69 minstrel_rate_init+0xd2/0x33a [mac80211]()
+>[...]
+>Call Trace:
+> warn_on_slowpath+0x51/0x75
+> _format_mac_addr+0x4c/0x88
+> minstrel_rate_init+0xd2/0x33a [mac80211]
+> print_mac+0x16/0x1b
+> schedule_hrtimeout_range+0xdc/0x107
+> ieee80211_add_station+0x158/0x1bd [mac80211]
+> nl80211_new_station+0x1b3/0x20b [cfg80211]
+
+The reason is that I'm experimenting with "g" only mode on a 802.11 b/g card.
+
+Therefore rate_lowest_index returns 4 (= 6Mbit, instead of usual 0 = 1Mbit).
+Since mi->r array is initialized with zeros in minstrel_alloc_sta,
+rix_to_ndx has a hard time to find the 6Mbit entry and will trigged the WARNING.
+
+Signed-off-by: Christian Lamparter <chunkeey@web.de>
+Acked-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/rc80211_minstrel.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -389,13 +389,15 @@ minstrel_rate_init(void *priv, struct ie
+ {
+ struct minstrel_sta_info *mi = priv_sta;
+ struct minstrel_priv *mp = priv;
+- struct minstrel_rate *mr_ctl;
++ struct ieee80211_local *local = hw_to_local(mp->hw);
++ struct ieee80211_rate *ctl_rate;
+ unsigned int i, n = 0;
+ unsigned int t_slot = 9; /* FIXME: get real slot time */
+
+ mi->lowest_rix = rate_lowest_index(sband, sta);
+- mr_ctl = &mi->r[rix_to_ndx(mi, mi->lowest_rix)];
+- mi->sp_ack_dur = mr_ctl->ack_time;
++ ctl_rate = &sband->bitrates[mi->lowest_rix];
++ mi->sp_ack_dur = ieee80211_frame_duration(local, 10, ctl_rate->bitrate,
++ !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
+
+ for (i = 0; i < sband->n_bitrates; i++) {
+ struct minstrel_rate *mr = &mi->r[n];
+@@ -410,7 +412,7 @@ minstrel_rate_init(void *priv, struct ie
+
+ mr->rix = i;
+ mr->bitrate = sband->bitrates[i].bitrate / 5;
+- calc_rate_durations(mi, hw_to_local(mp->hw), mr,
++ calc_rate_durations(mi, local, mr,
+ &sband->bitrates[i]);
+
+ /* calculate maximum number of retransmissions before
--- /dev/null
+From 55ef1274dddd4de387c54d110e354ffbb6cdc706 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Sat, 20 Dec 2008 11:58:38 -0800
+Subject: nfsd: Ensure nfsv4 calls the underlying filesystem on LOCKT
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 55ef1274dddd4de387c54d110e354ffbb6cdc706 upstream.
+
+Since nfsv4 allows LOCKT without an open, but the ->lock() method is a
+file method, we fake up a struct file in the nfsv4 code with just the
+fields we need initialized. But we forgot to initialize the file
+operations, with the result that LOCKT never results in a call to the
+filesystem's ->lock() method (if it exists).
+
+We could just add that one more initialization. But this hack of faking
+up a struct file with only some fields initialized seems the kind of
+thing that might cause more problems in the future. We should either do
+an open and get a real struct file, or make lock-testing an inode (not a
+file) method.
+
+This patch does the former.
+
+Reported-by: Marc Eshel <eshel@almaden.ibm.com>
+Tested-by: Marc Eshel <eshel@almaden.ibm.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4state.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -2769,6 +2769,25 @@ out:
+ }
+
+ /*
++ * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
++ * so we do a temporary open here just to get an open file to pass to
++ * vfs_test_lock. (Arguably perhaps test_lock should be done with an
++ * inode operation.)
++ */
++static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
++{
++ struct file *file;
++ int err;
++
++ err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
++ if (err)
++ return err;
++ err = vfs_test_lock(file, lock);
++ nfsd_close(file);
++ return err;
++}
++
++/*
+ * LOCKT operation
+ */
+ __be32
+@@ -2776,7 +2795,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ struct nfsd4_lockt *lockt)
+ {
+ struct inode *inode;
+- struct file file;
+ struct file_lock file_lock;
+ int error;
+ __be32 status;
+@@ -2833,16 +2851,8 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+
+ nfs4_transform_lock_offset(&file_lock);
+
+- /* vfs_test_lock uses the struct file _only_ to resolve the inode.
+- * since LOCKT doesn't require an OPEN, and therefore a struct
+- * file may not exist, pass vfs_test_lock a struct file with
+- * only the dentry:inode set.
+- */
+- memset(&file, 0, sizeof (struct file));
+- file.f_path.dentry = cstate->current_fh.fh_dentry;
+-
+ status = nfs_ok;
+- error = vfs_test_lock(&file, &file_lock);
++ error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+ if (error) {
+ status = nfserrno(error);
+ goto out;
--- /dev/null
+From fa82a491275a613b15489aab4b99acecb00958d3 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Thu, 22 Jan 2009 14:16:04 -0500
+Subject: nfsd: only set file_lock.fl_lmops in nfsd4_lockt if a stateowner is found
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit fa82a491275a613b15489aab4b99acecb00958d3 upstream.
+
+nfsd4_lockt does a search for a lockstateowner when building the lock
+struct to test. If one is found, it'll set fl_owner to it. Regardless of
+whether that happens, it'll also set fl_lmops. Given that this lock is
+basically a "lightweight" lock that's just used for checking conflicts,
+setting fl_lmops is probably not appropriate for it.
+
+This behavior exposed a bug in DLM's GETLK implementation where it
+wasn't clearing out the fields in the file_lock before filling in
+conflicting lock info. While we were able to fix this in DLM, it
+still seems pointless and dangerous to set the fl_lmops this way
+when we may have a NULL lockstateowner.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@pig.fieldses.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4state.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -2824,7 +2824,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ file_lock.fl_owner = (fl_owner_t)lockt->lt_stateowner;
+ file_lock.fl_pid = current->tgid;
+ file_lock.fl_flags = FL_POSIX;
+- file_lock.fl_lmops = &nfsd_posix_mng_ops;
+
+ file_lock.fl_start = lockt->lt_offset;
+ if ((lockt->lt_length == ~(u64)0) || LOFF_OVERFLOW(lockt->lt_offset, lockt->lt_length))
--- /dev/null
+From chunkeey@web.de Tue Feb 3 14:30:26 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Sat, 24 Jan 2009 10:44:26 +0100
+Subject: p54: fix lm87 checksum endianness
+To: Greg KH <greg@kroah.com>
+Cc: Johannes Berg <johannes@sipsolutions.net>, stable@kernel.org, linville@tuxdriver.com, Larry.Finger@lwfinger.net
+Message-ID: <200901241044.26478.chunkeey@web.de>
+Content-Disposition: inline
+
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit c91276592695e13d1b52eab572551017cbf96ee7 upstream
+
+This fixes the checksum calculation for lm87 firmwares
+on big endian platforms, the device treats the data as
+an array of 32-bit little endian values so the driver
+needs to do that as well.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Acked-by: Christian Lamparter <chunkeey@web.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -222,13 +222,13 @@ static void p54u_tx_3887(struct ieee8021
+ usb_submit_urb(data_urb, GFP_ATOMIC);
+ }
+
+-static __le32 p54u_lm87_chksum(const u32 *data, size_t length)
++static __le32 p54u_lm87_chksum(const __le32 *data, size_t length)
+ {
+ u32 chk = 0;
+
+ length >>= 2;
+ while (length--) {
+- chk ^= *data++;
++ chk ^= le32_to_cpu(*data++);
+ chk = (chk >> 5) ^ (chk << 3);
+ }
+
+@@ -247,7 +247,7 @@ static void p54u_tx_lm87(struct ieee8021
+ if (!data_urb)
+ return;
+
+- hdr->chksum = p54u_lm87_chksum((u32 *)data, len);
++ hdr->chksum = p54u_lm87_chksum((__le32 *) data, len);
+ hdr->device_addr = data->req_id;
+
+ usb_fill_bulk_urb(data_urb, priv->udev,
--- /dev/null
+From chunkeey@web.de Tue Feb 3 14:31:42 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Sat, 24 Jan 2009 10:44:40 +0100
+Subject: p54: fix p54_read_eeprom to cope with tx_hdr_len
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, Larry.Finger@lwfinger.net, linville@tuxdriver.com
+Message-ID: <200901241044.40580.chunkeey@web.de>
+Content-Disposition: inline
+
+From: Christian Lamparter <chunkeey@web.de>
+
+commit b92f30d65aeb0502e2ed8beb80c8465578b40002 upstream
+
+This patch fixes a regression in "p54: move eeprom code into common library"
+7cb770729ba895f73253dfcd46c3fcba45d896f9
+
+Some of p54usb's devices need a little headroom for the transportation and
+this was forgotten in the eeprom change.
+
+Signed-off-by: Christian Lamparter <chunkeey@web.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54common.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54common.c
++++ b/drivers/net/wireless/p54/p54common.c
+@@ -741,17 +741,19 @@ static void p54_assign_address(struct ie
+ int p54_read_eeprom(struct ieee80211_hw *dev)
+ {
+ struct p54_common *priv = dev->priv;
+- struct p54_control_hdr *hdr = NULL;
++ struct p54_control_hdr *hdr = NULL, *org_hdr;
+ struct p54_eeprom_lm86 *eeprom_hdr;
+ size_t eeprom_size = 0x2020, offset = 0, blocksize;
+ int ret = -ENOMEM;
+ void *eeprom = NULL;
+
+- hdr = (struct p54_control_hdr *)kzalloc(sizeof(*hdr) +
+- sizeof(*eeprom_hdr) + EEPROM_READBACK_LEN, GFP_KERNEL);
+- if (!hdr)
++ org_hdr = kzalloc(priv->tx_hdr_len + sizeof(*hdr) +
++ sizeof(*eeprom_hdr) + EEPROM_READBACK_LEN,
++ GFP_KERNEL);
++ if (!org_hdr)
+ goto free;
+
++ hdr = (void *) org_hdr + priv->tx_hdr_len;
+ priv->eeprom = kzalloc(EEPROM_READBACK_LEN, GFP_KERNEL);
+ if (!priv->eeprom)
+ goto free;
+@@ -790,7 +792,7 @@ int p54_read_eeprom(struct ieee80211_hw
+ free:
+ kfree(priv->eeprom);
+ priv->eeprom = NULL;
+- kfree(hdr);
++ kfree(org_hdr);
+ kfree(eeprom);
+
+ return ret;
--- /dev/null
+From chunkeey@web.de Tue Feb 3 14:33:39 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Sat, 24 Jan 2009 10:44:53 +0100
+Subject: p54usb: rewriting rx/tx routines to make use of usb_anchor's facilities
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, linville@tuxdriver.com, Larry.Finger@lwfinger.net
+Message-ID: <200901241044.54196.chunkeey@web.de>
+Content-Disposition: inline
+
+From: Christian Lamparter <chunkeey@web.de>
+
+commit dd397dc9dddfa2149a1bbc9e52ac7d5630737cec upstream
+
+Alan Stern found several flaws in p54usb's implementation and annotated:
+"usb_kill_urb() and similar routines do not expect an URB's completion
+routine to deallocate it. This is almost obvious -- if the URB is deallocated
+before the completion routine returns then there's no way for usb_kill_urb
+to detect when the URB actually is complete."
+
+This patch addresses all known limitations in the old implementation and fixes
+khub's "use-after-freed" hang, when SLUB debug's poisoning option is enabled.
+
+Signed-off-by: Christian Lamparter <chunkeey@web.de>
+Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 143 +++++++++++++++++++++++---------------
+ drivers/net/wireless/p54/p54usb.h | 1
+ 2 files changed, 89 insertions(+), 55 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -85,13 +85,13 @@ static void p54u_rx_cb(struct urb *urb)
+ struct ieee80211_hw *dev = info->dev;
+ struct p54u_priv *priv = dev->priv;
+
++ skb_unlink(skb, &priv->rx_queue);
++
+ if (unlikely(urb->status)) {
+- info->urb = NULL;
+- usb_free_urb(urb);
++ dev_kfree_skb_irq(skb);
+ return;
+ }
+
+- skb_unlink(skb, &priv->rx_queue);
+ skb_put(skb, urb->actual_length);
+
+ if (priv->hw_type == P54U_NET2280)
+@@ -104,7 +104,6 @@ static void p54u_rx_cb(struct urb *urb)
+ if (p54_rx(dev, skb)) {
+ skb = dev_alloc_skb(priv->common.rx_mtu + 32);
+ if (unlikely(!skb)) {
+- usb_free_urb(urb);
+ /* TODO check rx queue length and refill *somewhere* */
+ return;
+ }
+@@ -114,7 +113,6 @@ static void p54u_rx_cb(struct urb *urb)
+ info->dev = dev;
+ urb->transfer_buffer = skb_tail_pointer(skb);
+ urb->context = skb;
+- skb_queue_tail(&priv->rx_queue, skb);
+ } else {
+ if (priv->hw_type == P54U_NET2280)
+ skb_push(skb, priv->common.tx_hdr_len);
+@@ -129,22 +127,23 @@ static void p54u_rx_cb(struct urb *urb)
+ WARN_ON(1);
+ urb->transfer_buffer = skb_tail_pointer(skb);
+ }
+-
+- skb_queue_tail(&priv->rx_queue, skb);
+ }
+
+- usb_submit_urb(urb, GFP_ATOMIC);
++ usb_anchor_urb(urb, &priv->submitted);
++ if (usb_submit_urb(urb, GFP_ATOMIC)) {
++ usb_unanchor_urb(urb);
++ dev_kfree_skb_irq(skb);
++ } else
++ skb_queue_tail(&priv->rx_queue, skb);
+ }
+
+-static void p54u_tx_cb(struct urb *urb)
+-{
+- usb_free_urb(urb);
+-}
++static void p54u_tx_cb(struct urb *urb) { }
+
+-static void p54u_tx_free_cb(struct urb *urb)
++static void p54u_free_urbs(struct ieee80211_hw *dev)
+ {
+- kfree(urb->transfer_buffer);
+- usb_free_urb(urb);
++ struct p54u_priv *priv = dev->priv;
++
++ usb_kill_anchored_urbs(&priv->submitted);
+ }
+
+ static int p54u_init_urbs(struct ieee80211_hw *dev)
+@@ -153,15 +152,18 @@ static int p54u_init_urbs(struct ieee802
+ struct urb *entry;
+ struct sk_buff *skb;
+ struct p54u_rx_info *info;
++ int ret = 0;
+
+ while (skb_queue_len(&priv->rx_queue) < 32) {
+ skb = __dev_alloc_skb(priv->common.rx_mtu + 32, GFP_KERNEL);
+- if (!skb)
+- break;
++ if (!skb) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ entry = usb_alloc_urb(0, GFP_KERNEL);
+ if (!entry) {
+- kfree_skb(skb);
+- break;
++ ret = -ENOMEM;
++ goto err;
+ }
+ usb_fill_bulk_urb(entry, priv->udev,
+ usb_rcvbulkpipe(priv->udev, P54U_PIPE_DATA),
+@@ -171,26 +173,25 @@ static int p54u_init_urbs(struct ieee802
+ info->urb = entry;
+ info->dev = dev;
+ skb_queue_tail(&priv->rx_queue, skb);
+- usb_submit_urb(entry, GFP_KERNEL);
++
++ usb_anchor_urb(entry, &priv->submitted);
++ ret = usb_submit_urb(entry, GFP_KERNEL);
++ if (ret) {
++ skb_unlink(skb, &priv->rx_queue);
++ usb_unanchor_urb(entry);
++ goto err;
++ }
++ usb_free_urb(entry);
++ entry = NULL;
+ }
+
+ return 0;
+-}
+-
+-static void p54u_free_urbs(struct ieee80211_hw *dev)
+-{
+- struct p54u_priv *priv = dev->priv;
+- struct p54u_rx_info *info;
+- struct sk_buff *skb;
+
+- while ((skb = skb_dequeue(&priv->rx_queue))) {
+- info = (struct p54u_rx_info *) skb->cb;
+- if (!info->urb)
+- continue;
+-
+- usb_kill_urb(info->urb);
+- kfree_skb(skb);
+- }
++err:
++ usb_free_urb(entry);
++ kfree_skb(skb);
++ p54u_free_urbs(dev);
++ return ret;
+ }
+
+ static void p54u_tx_3887(struct ieee80211_hw *dev, struct p54_control_hdr *data,
+@@ -210,16 +211,29 @@ static void p54u_tx_3887(struct ieee8021
+ }
+
+ usb_fill_bulk_urb(addr_urb, priv->udev,
+- usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), &data->req_id,
+- sizeof(data->req_id), p54u_tx_cb, dev);
++ usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
++ &data->req_id, sizeof(data->req_id), p54u_tx_cb,
++ dev);
+ usb_fill_bulk_urb(data_urb, priv->udev,
+- usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), data, len,
+- free_on_tx ? p54u_tx_free_cb : p54u_tx_cb, dev);
++ usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
++ data, len, p54u_tx_cb, dev);
+ addr_urb->transfer_flags |= URB_ZERO_PACKET;
+- data_urb->transfer_flags |= URB_ZERO_PACKET;
++ data_urb->transfer_flags |= URB_ZERO_PACKET |
++ (free_on_tx ? URB_FREE_BUFFER : 0);
+
+- usb_submit_urb(addr_urb, GFP_ATOMIC);
+- usb_submit_urb(data_urb, GFP_ATOMIC);
++ usb_anchor_urb(addr_urb, &priv->submitted);
++ if (usb_submit_urb(addr_urb, GFP_ATOMIC)) {
++ usb_unanchor_urb(addr_urb);
++ goto out;
++ }
++
++ usb_anchor_urb(data_urb, &priv->submitted);
++ if (usb_submit_urb(data_urb, GFP_ATOMIC))
++ usb_unanchor_urb(data_urb);
++
++out:
++ usb_free_urb(addr_urb);
++ usb_free_urb(data_urb);
+ }
+
+ static __le32 p54u_lm87_chksum(const __le32 *data, size_t length)
+@@ -251,12 +265,16 @@ static void p54u_tx_lm87(struct ieee8021
+ hdr->device_addr = data->req_id;
+
+ usb_fill_bulk_urb(data_urb, priv->udev,
+- usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
+- len + sizeof(*hdr), free_on_tx ? p54u_tx_free_cb : p54u_tx_cb,
+- dev);
+- data_urb->transfer_flags |= URB_ZERO_PACKET;
++ usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
++ len + sizeof(*hdr), p54u_tx_cb, dev);
++ data_urb->transfer_flags |= URB_ZERO_PACKET |
++ (free_on_tx ? URB_FREE_BUFFER : 0);
++
++ usb_anchor_urb(data_urb, &priv->submitted);
++ if (usb_submit_urb(data_urb, GFP_ATOMIC))
++ usb_unanchor_urb(data_urb);
+
+- usb_submit_urb(data_urb, GFP_ATOMIC);
++ usb_free_urb(data_urb);
+ }
+
+ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct p54_control_hdr *data,
+@@ -295,16 +313,30 @@ static void p54u_tx_net2280(struct ieee8
+ hdr->len = cpu_to_le16(len);
+
+ usb_fill_bulk_urb(int_urb, priv->udev,
+- usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV), reg, sizeof(*reg),
+- p54u_tx_free_cb, dev);
+- int_urb->transfer_flags |= URB_ZERO_PACKET;
+- usb_submit_urb(int_urb, GFP_ATOMIC);
++ usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV),
++ reg, sizeof(*reg), p54u_tx_cb, dev);
++ int_urb->transfer_flags |= URB_ZERO_PACKET | URB_FREE_BUFFER;
++ usb_anchor_urb(int_urb, &priv->submitted);
++ if (usb_submit_urb(int_urb, GFP_ATOMIC)) {
++ usb_unanchor_urb(int_urb);
++ goto out;
++ }
+
+ usb_fill_bulk_urb(data_urb, priv->udev,
+- usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr, len + sizeof(*hdr),
+- free_on_tx ? p54u_tx_free_cb : p54u_tx_cb, dev);
+- data_urb->transfer_flags |= URB_ZERO_PACKET;
+- usb_submit_urb(data_urb, GFP_ATOMIC);
++ usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
++ len + sizeof(*hdr), p54u_tx_cb, dev);
++ data_urb->transfer_flags |= URB_ZERO_PACKET |
++ (free_on_tx ? URB_FREE_BUFFER : 0);
++
++ usb_anchor_urb(int_urb, &priv->submitted);
++ if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
++ usb_unanchor_urb(data_urb);
++ goto out;
++ }
++
++out:
++ usb_free_urb(int_urb);
++ usb_free_urb(data_urb);
+ }
+
+ static int p54u_write(struct p54u_priv *priv,
+@@ -805,6 +837,7 @@ static int __devinit p54u_probe(struct u
+ SET_IEEE80211_DEV(dev, &intf->dev);
+ usb_set_intfdata(intf, dev);
+ priv->udev = udev;
++ init_usb_anchor(&priv->submitted);
+
+ usb_get_dev(udev);
+
+--- a/drivers/net/wireless/p54/p54usb.h
++++ b/drivers/net/wireless/p54/p54usb.h
+@@ -133,6 +133,7 @@ struct p54u_priv {
+
+ spinlock_t lock;
+ struct sk_buff_head rx_queue;
++ struct usb_anchor submitted;
+ };
+
+ #endif /* P54USB_H */
--- /dev/null
+From 57064d213d2e44654d4f13c66df135b5e7389a26 Mon Sep 17 00:00:00 2001
+From: Seth Heasley <seth.heasley@intel.com>
+Date: Fri, 23 Jan 2009 12:43:38 -0800
+Subject: PCI: irq and pci_ids patch for Intel Tigerpoint DeviceIDs
+
+From: Seth Heasley <seth.heasley@intel.com>
+
+commit 57064d213d2e44654d4f13c66df135b5e7389a26 upstream.
+
+This patch adds the Intel Tigerpoint LPC Controller DeviceIDs.
+
+Signed-off-by: Seth Heasley <seth.heasley@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/irq.c | 1 +
+ include/linux/pci_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/x86/pci/irq.c
++++ b/arch/x86/pci/irq.c
+@@ -573,6 +573,7 @@ static __init int intel_router_probe(str
+ case PCI_DEVICE_ID_INTEL_ICH7_1:
+ case PCI_DEVICE_ID_INTEL_ICH7_30:
+ case PCI_DEVICE_ID_INTEL_ICH7_31:
++ case PCI_DEVICE_ID_INTEL_TGP_LPC:
+ case PCI_DEVICE_ID_INTEL_ESB2_0:
+ case PCI_DEVICE_ID_INTEL_ICH8_0:
+ case PCI_DEVICE_ID_INTEL_ICH8_1:
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2418,6 +2418,7 @@
+ #define PCI_DEVICE_ID_INTEL_ICH7_0 0x27b8
+ #define PCI_DEVICE_ID_INTEL_ICH7_1 0x27b9
+ #define PCI_DEVICE_ID_INTEL_ICH7_30 0x27b0
++#define PCI_DEVICE_ID_INTEL_TGP_LPC 0x27bc
+ #define PCI_DEVICE_ID_INTEL_ICH7_31 0x27bd
+ #define PCI_DEVICE_ID_INTEL_ICH7_17 0x27da
+ #define PCI_DEVICE_ID_INTEL_ICH7_19 0x27dd
--- /dev/null
+From 2d775708bc6613f1be47f1e720781343341ecc94 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Sun, 25 Jan 2009 11:29:38 +0900
+Subject: sata_nv: fix MCP5x reset
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 2d775708bc6613f1be47f1e720781343341ecc94 upstream.
+
+MCP5x family of controllers seem to share much more with nf2's as far
+as reset protocol is concerned. It requires heardreset to get the PHY
+going and classfication code report after hardreset is unreliable.
+Create a new board type MCP5x and use noclassify hardreset. SWNCQ is
+modified to inherit from this new type.
+
+This fixes hotplug regression reported in kernel bz#12351.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_nv.c | 42 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 29 insertions(+), 13 deletions(-)
+
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -352,6 +352,7 @@ enum nv_host_type
+ NFORCE3 = NFORCE2, /* NF2 == NF3 as far as sata_nv is concerned */
+ CK804,
+ ADMA,
++ MCP5x,
+ SWNCQ,
+ };
+
+@@ -363,10 +364,10 @@ static const struct pci_device_id nv_pci
+ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA2), CK804 },
+ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA), CK804 },
+ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA2), CK804 },
+- { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), SWNCQ },
+- { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), SWNCQ },
+- { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), SWNCQ },
+- { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), SWNCQ },
++ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), MCP5x },
++ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), MCP5x },
++ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), MCP5x },
++ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), MCP5x },
+ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), GENERIC },
+ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), GENERIC },
+ { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), GENERIC },
+@@ -467,8 +468,19 @@ static struct ata_port_operations nv_adm
+ .host_stop = nv_adma_host_stop,
+ };
+
++/* Kernel bz#12351 reports that when SWNCQ is enabled, for hotplug to
++ * work, hardreset should be used and hardreset can't report proper
++ * signature, which suggests that mcp5x is closer to nf2 as long as
++ * reset quirkiness is concerned. Define separate ops for mcp5x with
++ * nv_noclassify_hardreset().
++ */
++static struct ata_port_operations nv_mcp5x_ops = {
++ .inherits = &nv_common_ops,
++ .hardreset = nv_noclassify_hardreset,
++};
++
+ static struct ata_port_operations nv_swncq_ops = {
+- .inherits = &nv_generic_ops,
++ .inherits = &nv_mcp5x_ops,
+
+ .qc_defer = ata_std_qc_defer,
+ .qc_prep = nv_swncq_qc_prep,
+@@ -531,6 +543,15 @@ static const struct ata_port_info nv_por
+ .port_ops = &nv_adma_ops,
+ .private_data = NV_PI_PRIV(nv_adma_interrupt, &nv_adma_sht),
+ },
++ /* MCP5x */
++ {
++ .flags = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY,
++ .pio_mask = NV_PIO_MASK,
++ .mwdma_mask = NV_MWDMA_MASK,
++ .udma_mask = NV_UDMA_MASK,
++ .port_ops = &nv_mcp5x_ops,
++ .private_data = NV_PI_PRIV(nv_generic_interrupt, &nv_sht),
++ },
+ /* SWNCQ */
+ {
+ .flags = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+@@ -2355,14 +2376,9 @@ static int nv_init_one(struct pci_dev *p
+ if (type == CK804 && adma_enabled) {
+ dev_printk(KERN_NOTICE, &pdev->dev, "Using ADMA mode\n");
+ type = ADMA;
+- }
+-
+- if (type == SWNCQ) {
+- if (swncq_enabled)
+- dev_printk(KERN_NOTICE, &pdev->dev,
+- "Using SWNCQ mode\n");
+- else
+- type = GENERIC;
++ } else if (type == MCP5x && swncq_enabled) {
++ dev_printk(KERN_NOTICE, &pdev->dev, "Using SWNCQ mode\n");
++ type = SWNCQ;
+ }
+
+ ppi[0] = &nv_port_info[type];
cifs-make-sure-we-allocate-enough-storage-for-socket-address.patch
netfilter-ctnetlink-fix-scheduling-while-atomic.patch
orinoco-move-kmalloc-outside-spinlock-in-orinoco_ioctl_set_genie.patch
+fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
+kmalloc-return-null-instead-of-link-failure.patch
+sata_nv-fix-mcp5x-reset.patch
+fix-memory-corruption-in-console-selection.patch
+add-enable_ms-to-jsm-driver.patch
+input-atkbd-samsung-nc10-key-repeat-fix.patch
+nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
+nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
+iwlwifi-fix-rs_get_rate-warn_on.patch
+p54-fix-lm87-checksum-endianness.patch
+p54-fix-p54_read_eeprom-to-cope-with-tx_hdr_len.patch
+p54usb-rewriting-rx-tx-routines-to-make-use-of-usb_anchor-s-facilities.patch
+minstrel-fix-warning-if-lowest-supported-rate-index-is-not-0.patch
+pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
