--- /dev/null
+From gregkh@mini.kroah.org Tue Nov 4 15:23:17 2008
+Message-Id: <20081104232317.715134241@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Anholt <eric@anholt.net>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [patch 01/57] agp: Fix stolen memory counting on G4X.
+Content-Disposition: inline; filename=agp-fix-stolen-memory-counting-on-g4x.patch
+Content-Length: 2325
+Lines: 58
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Anholt <eric@anholt.net>
+
+commit 82e14a6215cbc9804ecc35281e973c6c8ce22fe7 upstream
+
+On the GM45, the amount of stolen memory mapped to the GTT was underestimated,
+even though we had 508KB more available since the GTT doesn't take from
+stolen memory. On the non-GM45 G4X, we overestimated how much stolen was
+mapped to the GTT by 4KB, resulting in GPU page faults when that page was
+accessed.
+
+This update requires a corresponding update to xf86-video-intel to work
+correctly.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/agp/intel-agp.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -54,8 +54,7 @@
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965Q_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GM_HB || \
+- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB || \
+- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB)
+
+ #define IS_G33 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G33_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q35_HB || \
+@@ -63,7 +62,8 @@
+
+ #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGD_E_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
+- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB)
++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
+
+ extern int agp_memory_reserved;
+
+@@ -525,8 +525,10 @@ static void intel_i830_init_gtt_entries(
+ size += 4;
+ } else if (IS_G4X) {
+ /* On 4 series hardware, GTT stolen is separate from graphics
+- * stolen, ignore it in stolen gtt entries counting */
+- size = 0;
++ * stolen, ignore it in stolen gtt entries counting. However,
++ * 4KB of the stolen memory doesn't get mapped to the GTT.
++ */
++ size = 4;
+ } else {
+ /* On previous hardware, the GTT size was just what was
+ * required to map the aperture.
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008
+Message-Id: <20081104232317.891267458@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jamie Wellnitz <Jamie.Wellnitz@emulex.com>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 02/57] SCSI: sd: Fix handling of NO_SENSE check condition
+Content-Disposition: inline; filename=scsi-sd-fix-handling-of-no_sense-check-condition.patch
+Content-Length: 1842
+Lines: 51
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jamie Wellnitz <Jamie.Wellnitz@emulex.com>
+
+commit 10dab22664914505dcb804d9ad09cad6bc94d349 upstream
+
+The current handling of NO_SENSE check condition is the same as
+RECOVERED_ERROR, and assumes that in both cases, the I/O was fully
+transferred.
+
+We have seen cases of arrays returning with NO_SENSE (no error), but
+the I/O was not completely transferred, thus residual set. Thus,
+rather than return good_bytes as the entire transfer, set good_bytes
+to 0, so that the midlayer then applies the residual in calculating
+the transfer, and for sd, will fail the I/O and fall into a retry
+path.
+
+Signed-off-by: Jamie Wellnitz <Jamie.Wellnitz@emulex.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sd.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1047,7 +1047,6 @@ static int sd_done(struct scsi_cmnd *SCp
+ good_bytes = sd_completed_bytes(SCpnt);
+ break;
+ case RECOVERED_ERROR:
+- case NO_SENSE:
+ /* Inform the user, but make sure that it's not treated
+ * as a hard error.
+ */
+@@ -1056,6 +1055,15 @@ static int sd_done(struct scsi_cmnd *SCp
+ memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+ good_bytes = scsi_bufflen(SCpnt);
+ break;
++ case NO_SENSE:
++ /* This indicates a false check condition, so ignore it. An
++ * unknown amount of data was transferred so treat it as an
++ * error.
++ */
++ scsi_print_sense("sd", SCpnt);
++ SCpnt->result = 0;
++ memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
++ break;
+ case ABORTED_COMMAND:
+ if (sshdr.asc == 0x10) { /* DIF: Disk detected corruption */
+ scsi_print_result(SCpnt);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008
+Message-Id: <20081104232318.060575154@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Heiko Carstens <heiko.carstens@de.ibm.com>,
+ Martin Schwidefsky <schwidefsky@de.ibm.com>
+Subject: [patch 03/57] S390: Fix sysdev class file creation.
+Content-Disposition: inline; filename=s390-fix-sysdev-class-file-creation.patch
+Content-Length: 2909
+Lines: 88
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit da5aae7036692fa8d03da1b705c76fd750ed9e38 upstream
+
+Use sysdev_class_create_file() to create create sysdev class attributes
+instead of sysfs_create_file(). Using sysfs_create_file() wasn't a very
+good idea since the show and store functions have a different amount of
+parameters for sysfs files and sysdev class files.
+In particular the pointer to the buffer is the last argument and
+therefore accesses to random memory regions happened.
+Still worked surprisingly well until we got a kernel panic.
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/kernel/smp.c | 24 +++++++++---------------
+ 1 file changed, 9 insertions(+), 15 deletions(-)
+
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -1117,9 +1117,7 @@ out:
+ return rc;
+ }
+
+-static ssize_t __ref rescan_store(struct sys_device *dev,
+- struct sysdev_attribute *attr,
+- const char *buf,
++static ssize_t __ref rescan_store(struct sysdev_class *class, const char *buf,
+ size_t count)
+ {
+ int rc;
+@@ -1127,12 +1125,10 @@ static ssize_t __ref rescan_store(struct
+ rc = smp_rescan_cpus();
+ return rc ? rc : count;
+ }
+-static SYSDEV_ATTR(rescan, 0200, NULL, rescan_store);
++static SYSDEV_CLASS_ATTR(rescan, 0200, NULL, rescan_store);
+ #endif /* CONFIG_HOTPLUG_CPU */
+
+-static ssize_t dispatching_show(struct sys_device *dev,
+- struct sysdev_attribute *attr,
+- char *buf)
++static ssize_t dispatching_show(struct sysdev_class *class, char *buf)
+ {
+ ssize_t count;
+
+@@ -1142,9 +1138,8 @@ static ssize_t dispatching_show(struct s
+ return count;
+ }
+
+-static ssize_t dispatching_store(struct sys_device *dev,
+- struct sysdev_attribute *attr,
+- const char *buf, size_t count)
++static ssize_t dispatching_store(struct sysdev_class *dev, const char *buf,
++ size_t count)
+ {
+ int val, rc;
+ char delim;
+@@ -1166,7 +1161,8 @@ out:
+ put_online_cpus();
+ return rc ? rc : count;
+ }
+-static SYSDEV_ATTR(dispatching, 0644, dispatching_show, dispatching_store);
++static SYSDEV_CLASS_ATTR(dispatching, 0644, dispatching_show,
++ dispatching_store);
+
+ static int __init topology_init(void)
+ {
+@@ -1176,13 +1172,11 @@ static int __init topology_init(void)
+ register_cpu_notifier(&smp_cpu_nb);
+
+ #ifdef CONFIG_HOTPLUG_CPU
+- rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
+- &attr_rescan.attr);
++ rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_rescan);
+ if (rc)
+ return rc;
+ #endif
+- rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
+- &attr_dispatching.attr);
++ rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_dispatching);
+ if (rc)
+ return rc;
+ for_each_present_cpu(cpu) {
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008
+Message-Id: <20081104232318.234852040@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@linux.intel.com>
+Subject: [patch 04/57] sysfs: Fix return values for sysdev_store_{ulong, int}
+Content-Disposition: inline; filename=sysfs-fix-return-values-for-sysdev_store_-ulong-int.patch
+Content-Length: 1234
+Lines: 42
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andi Kleen <andi@firstfloor.org>
+
+commit 4e318d7c6c9dd5cdae48bcf61558bbc0c09b12ac upstream
+
+SYSFS: Fix return values for sysdev_store_{ulong,int}
+
+Always return the full size instead of the consumed
+length of the string in sysdev_store_{ulong,int}
+
+This avoids EINVAL errors in some echo versions.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/sys.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/sys.c
++++ b/drivers/base/sys.c
+@@ -488,7 +488,8 @@ ssize_t sysdev_store_ulong(struct sys_de
+ if (end == buf)
+ return -EINVAL;
+ *(unsigned long *)(ea->var) = new;
+- return end - buf;
++ /* Always return full write size even if we didn't consume all */
++ return size;
+ }
+ EXPORT_SYMBOL_GPL(sysdev_store_ulong);
+
+@@ -511,7 +512,8 @@ ssize_t sysdev_store_int(struct sys_devi
+ if (end == buf || new > INT_MAX || new < INT_MIN)
+ return -EINVAL;
+ *(int *)(ea->var) = new;
+- return end - buf;
++ /* Always return full write size even if we didn't consume all */
++ return size;
+ }
+ EXPORT_SYMBOL_GPL(sysdev_store_int);
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008
+Message-Id: <20081104232318.398108411@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Scott James Remnant <scott@ubuntu.com>,
+ Tim Gardner <tcanonical@tpi.com>,
+ Corey Minyard <minyard@acm.org>
+Subject: [patch 05/57] ipmi: add MODULE_ALIAS to load ipmi_devintf with ipmi_si
+Content-Disposition: inline; filename=ipmi-add-module_alias-to-load-ipmi_devintf-with-ipmi_si.patch
+Content-Length: 1192
+Lines: 31
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Scott James Remnant <scott@canonical.com>
+
+commit 6c89161b10f5771ee0b51ada0fce0e8835e72ade upstream
+
+The ipmi_devintf module contains the userspace interface for IPMI devices,
+yet will not be loaded automatically with a system interface handler
+driver.
+
+Add a MODULE_ALIAS for the "platform:ipmi_si" MODALIAS exported by the
+ipmi_si driver, so that userspace knows of the recommendation.
+
+Signed-off-by: Scott James Remnant <scott@ubuntu.com>
+Cc: Tim Gardner <tcanonical@tpi.com>
+Cc: Corey Minyard <minyard@acm.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/ipmi/ipmi_devintf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/ipmi/ipmi_devintf.c
++++ b/drivers/char/ipmi/ipmi_devintf.c
+@@ -957,3 +957,4 @@ module_exit(cleanup_ipmi);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
+ MODULE_DESCRIPTION("Linux device interface for the IPMI message handler.");
++MODULE_ALIAS("platform:ipmi_si");
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008
+Message-Id: <20081104232318.572456971@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 06/57] USB: fix crash when URBs are unlinked after the device is gone
+Content-Disposition: inline; filename=usb-fix-crash-when-urbs-are-unlinked-after-the-device-is-gone.patch
+Content-Length: 5889
+Lines: 157
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit cde217a556ec552d28ac9e136c5a94684a69ae94 upstream
+
+This patch (as1151) protects usbcore against drivers that try to
+unlink an URB after the URB's device or bus have been removed. The
+core does not currently check for this, and certain drivers can cause
+a crash if they are running while an HCD is unloaded.
+
+Certainly it would be best to fix the guilty drivers. But a little
+defensive programming doesn't hurt, especially since it appears that
+quite a few drivers need to be fixed.
+
+The patch prevents the problem by grabbing a reference to the device
+while an unlink is in progress and using a new spinlock to synchronize
+unlinks with device removal. (There's no need to acquire a reference
+to the bus as well, since the device structure itself keeps a
+reference to the bus.) In addition, the kerneldoc is updated to
+indicate that URBs should not be unlinked after the disconnect method
+returns.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.c | 35 ++++++++++++++++++++++++++++++++---
+ drivers/usb/core/hcd.h | 1 +
+ drivers/usb/core/hub.c | 1 +
+ drivers/usb/core/urb.c | 15 +++++++++++++++
+ 4 files changed, 49 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -106,6 +106,9 @@ static DEFINE_SPINLOCK(hcd_root_hub_lock
+ /* used when updating an endpoint's URB list */
+ static DEFINE_SPINLOCK(hcd_urb_list_lock);
+
++/* used to protect against unlinking URBs after the device is gone */
++static DEFINE_SPINLOCK(hcd_urb_unlink_lock);
++
+ /* wait queue for synchronous unlinks */
+ DECLARE_WAIT_QUEUE_HEAD(usb_kill_urb_queue);
+
+@@ -1377,10 +1380,25 @@ static int unlink1(struct usb_hcd *hcd,
+ int usb_hcd_unlink_urb (struct urb *urb, int status)
+ {
+ struct usb_hcd *hcd;
+- int retval;
++ int retval = -EIDRM;
++ unsigned long flags;
+
+- hcd = bus_to_hcd(urb->dev->bus);
+- retval = unlink1(hcd, urb, status);
++ /* Prevent the device and bus from going away while
++ * the unlink is carried out. If they are already gone
++ * then urb->use_count must be 0, since disconnected
++ * devices can't have any active URBs.
++ */
++ spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
++ if (atomic_read(&urb->use_count) > 0) {
++ retval = 0;
++ usb_get_dev(urb->dev);
++ }
++ spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
++ if (retval == 0) {
++ hcd = bus_to_hcd(urb->dev->bus);
++ retval = unlink1(hcd, urb, status);
++ usb_put_dev(urb->dev);
++ }
+
+ if (retval == 0)
+ retval = -EINPROGRESS;
+@@ -1529,6 +1547,17 @@ void usb_hcd_disable_endpoint(struct usb
+ hcd->driver->endpoint_disable(hcd, ep);
+ }
+
++/* Protect against drivers that try to unlink URBs after the device
++ * is gone, by waiting until all unlinks for @udev are finished.
++ * Since we don't currently track URBs by device, simply wait until
++ * nothing is running in the locked region of usb_hcd_unlink_urb().
++ */
++void usb_hcd_synchronize_unlinks(struct usb_device *udev)
++{
++ spin_lock_irq(&hcd_urb_unlink_lock);
++ spin_unlock_irq(&hcd_urb_unlink_lock);
++}
++
+ /*-------------------------------------------------------------------------*/
+
+ /* called in any context */
+--- a/drivers/usb/core/hcd.h
++++ b/drivers/usb/core/hcd.h
+@@ -232,6 +232,7 @@ extern void usb_hcd_flush_endpoint(struc
+ struct usb_host_endpoint *ep);
+ extern void usb_hcd_disable_endpoint(struct usb_device *udev,
+ struct usb_host_endpoint *ep);
++extern void usb_hcd_synchronize_unlinks(struct usb_device *udev);
+ extern int usb_hcd_get_frame_number(struct usb_device *udev);
+
+ extern struct usb_hcd *usb_create_hcd(const struct hc_driver *driver,
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1349,6 +1349,7 @@ void usb_disconnect(struct usb_device **
+ */
+ dev_dbg (&udev->dev, "unregistering device\n");
+ usb_disable_device(udev, 0);
++ usb_hcd_synchronize_unlinks(udev);
+
+ usb_unlock_device(udev);
+
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -465,6 +465,12 @@ EXPORT_SYMBOL_GPL(usb_submit_urb);
+ * indicating that the request has been canceled (rather than any other
+ * code).
+ *
++ * Drivers should not call this routine or related routines, such as
++ * usb_kill_urb() or usb_unlink_anchored_urbs(), after their disconnect
++ * method has returned. The disconnect function should synchronize with
++ * a driver's I/O routines to insure that all URB-related activity has
++ * completed before it returns.
++ *
+ * This request is always asynchronous. Success is indicated by
+ * returning -EINPROGRESS, at which time the URB will probably not yet
+ * have been given back to the device driver. When it is eventually
+@@ -541,6 +547,9 @@ EXPORT_SYMBOL_GPL(usb_unlink_urb);
+ * This routine may not be used in an interrupt context (such as a bottom
+ * half or a completion handler), or when holding a spinlock, or in other
+ * situations where the caller can't schedule().
++ *
++ * This routine should not be called by a driver after its disconnect
++ * method has returned.
+ */
+ void usb_kill_urb(struct urb *urb)
+ {
+@@ -568,6 +577,9 @@ EXPORT_SYMBOL_GPL(usb_kill_urb);
+ *
+ * this allows all outstanding URBs to be killed starting
+ * from the back of the queue
++ *
++ * This routine should not be called by a driver after its disconnect
++ * method has returned.
+ */
+ void usb_kill_anchored_urbs(struct usb_anchor *anchor)
+ {
+@@ -597,6 +609,9 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs
+ * from the back of the queue. This function is asynchronous.
+ * The unlinking is just tiggered. It may happen after this
+ * function has returned.
++ *
++ * This routine should not be called by a driver after its disconnect
++ * method has returned.
+ */
+ void usb_unlink_anchored_urbs(struct usb_anchor *anchor)
+ {
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:18 2008
+Message-Id: <20081104232318.757214800@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 07/57] ALSA: hda - Add reboot notifier
+Content-Disposition: inline; filename=alsa-hda-add-reboot-notifier.patch
+Content-Length: 2410
+Lines: 87
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0cbf00980f0fc4cc064a15ab3dfce19b5fae9130 upstream
+
+The current snd-hda-intel driver seems blocking the power-off on some
+devices like eeepc. Although this is likely a BIOS problem, we can add
+a workaround by disabling IRQ lines before power-off operation.
+This patch adds the reboot notifier to achieve it.
+
+The detailed problem description is found in bug#11889:
+ http://bugme.linux-foundation.org/show_bug.cgi?id=11889
+
+Tested-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -45,6 +45,7 @@
+ #include <linux/slab.h>
+ #include <linux/pci.h>
+ #include <linux/mutex.h>
++#include <linux/reboot.h>
+ #include <sound/core.h>
+ #include <sound/initval.h>
+ #include "hda_codec.h"
+@@ -385,6 +386,9 @@ struct azx {
+
+ /* for pending irqs */
+ struct work_struct irq_pending_work;
++
++ /* reboot notifier (for mysterious hangup problem at power-down) */
++ struct notifier_block reboot_notifier;
+ };
+
+ /* driver types */
+@@ -1890,12 +1894,36 @@ static int azx_resume(struct pci_dev *pc
+
+
+ /*
++ * reboot notifier for hang-up problem at power-down
++ */
++static int azx_halt(struct notifier_block *nb, unsigned long event, void *buf)
++{
++ struct azx *chip = container_of(nb, struct azx, reboot_notifier);
++ azx_stop_chip(chip);
++ return NOTIFY_OK;
++}
++
++static void azx_notifier_register(struct azx *chip)
++{
++ chip->reboot_notifier.notifier_call = azx_halt;
++ register_reboot_notifier(&chip->reboot_notifier);
++}
++
++static void azx_notifier_unregister(struct azx *chip)
++{
++ if (chip->reboot_notifier.notifier_call)
++ unregister_reboot_notifier(&chip->reboot_notifier);
++}
++
++/*
+ * destructor
+ */
+ static int azx_free(struct azx *chip)
+ {
+ int i;
+
++ azx_notifier_unregister(chip);
++
+ if (chip->initialized) {
+ azx_clear_irq_pending(chip);
+ for (i = 0; i < chip->num_streams; i++)
+@@ -2250,6 +2278,7 @@ static int __devinit azx_probe(struct pc
+ pci_set_drvdata(pci, card);
+ chip->running = 1;
+ power_down_all_codecs(chip);
++ azx_notifier_register(chip);
+
+ dev++;
+ return err;
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008
+Message-Id: <20081104232318.926549738@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Evgeniy Manachkin <sfstudio@mail.ru>,
+ Alan Cox <alan@redhat.com>,
+ Sam Ravnborg <sam@ravnborg.org>
+Subject: [patch 08/57] kbuild: mkspec - fix build rpm
+Content-Disposition: inline; filename=kbuild-mkspec-fix-build-rpm.patch
+Content-Length: 1413
+Lines: 41
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Evgeniy Manachkin <sfstudio@mail.ru>
+
+commit 46dca86cb93db80992a45e4b55737ff2b2f61cd0 upstream
+Date: Wed, 15 Oct 2008 23:37:26 +0600
+Subject: [patch 08/57] kbuild: mkspec - fix build rpm
+
+This is patch to fix incorrect mkspec script to make rpm correctly at 2.6.27 vanilla kernel.
+This is regression in 2.6.27. 2.6.26 make rpm work good.
+In 2.6.27 'make rpm' say error from rpmbuild "Many unpacked files (*.fw)."
+
+Signed-off-by: Evgeniy Manachkin <sfstudio@mail.ru>
+Acked-by: Alan Cox <alan@redhat.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/package/mkspec | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/scripts/package/mkspec
++++ b/scripts/package/mkspec
+@@ -64,8 +64,10 @@ fi
+ echo "%install"
+ echo "%ifarch ia64"
+ echo 'mkdir -p $RPM_BUILD_ROOT/boot/efi $RPM_BUILD_ROOT/lib/modules'
++echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
+ echo "%else"
+ echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules'
++echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
+ echo "%endif"
+
+ echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} modules_install'
+@@ -92,5 +94,6 @@ echo "%files"
+ echo '%defattr (-, root, root)'
+ echo "%dir /lib/modules"
+ echo "/lib/modules/$KERNELRELEASE"
++echo "/lib/firmware"
+ echo "/boot/*"
+ echo ""
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008
+Message-Id: <20081104232319.099400407@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ravikiran Thirumalai <kiran@scalex86.org>,
+ "H. Peter Anvin" <hpa@zytor.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 09/57] x86: fix /dev/mem mmap breakage when PAT is disabled
+Content-Disposition: inline; filename=x86-fix-dev-mem-mmap-breakage-when-pat-is-disabled.patch
+Content-Length: 1576
+Lines: 50
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ravikiran G Thirumalai <kiran@scalex86.org>
+
+commit 9e41bff2708e420e61e6b89a54c15232857069b1 upstream
+
+Impact: allow /dev/mem mmaps on non-PAT CPUs/platforms
+
+Fix mmap to /dev/mem when CONFIG_X86_PAT is off and CONFIG_STRICT_DEVMEM is
+off
+
+mmap to /dev/mem on kernel memory has been failing since the
+introduction of PAT (CONFIG_STRICT_DEVMEM=n case). Seems like
+the check to avoid cache aliasing with PAT is kicking in even
+when PAT is disabled. The bug seems to have crept in 2.6.26.
+
+This patch makes sure that the mmap to regular
+kernel memory succeeds if CONFIG_STRICT_DEVMEM=n and
+PAT is disabled, and the checks to avoid cache aliasing
+still happens if PAT is enabled.
+
+Signed-off-by: Ravikiran Thirumalai <kiran@scalex86.org>
+Tested-by: Tim Sirianni <tim@scalemp.com>
+Acked-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/pat.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/mm/pat.c
++++ b/arch/x86/mm/pat.c
+@@ -403,12 +403,16 @@ static inline int range_is_allowed(unsig
+ return 1;
+ }
+ #else
++/* This check is needed to avoid cache aliasing when PAT is enabled */
+ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
+ {
+ u64 from = ((u64)pfn) << PAGE_SHIFT;
+ u64 to = from + size;
+ u64 cursor = from;
+
++ if (!pat_enabled)
++ return 1;
++
+ while (cursor < to) {
+ if (!devmem_is_allowed(pfn)) {
+ printk(KERN_INFO
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008
+Message-Id: <20081104232319.263910694@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jay Cliburn <jacliburn@bellsouth.net>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 10/57] atl1: fix vlan tag regression
+Content-Disposition: inline; filename=atl1-fix-vlan-tag-regression.patch
+Content-Length: 1920
+Lines: 56
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jay Cliburn <jacliburn@bellsouth.net>
+
+commit dc5596d920b504d263c7ca38bd76326179b13dee upstream
+
+Commit 401c0aabec4b97320f962a0161a846d230a6f7aa introduced a regression
+in the atl1 driver by storing the VLAN tag in the wrong TX descriptor
+field.
+
+This patch causes the VLAN tag to be stored in its proper location.
+
+Tested-by: Ramon Casellas <ramon.casellas@cttc.es>
+Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/atlx/atl1.c | 7 ++++---
+ drivers/net/atlx/atl1.h | 2 +-
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/atlx/atl1.c
++++ b/drivers/net/atlx/atl1.c
+@@ -2317,7 +2317,8 @@ static void atl1_tx_queue(struct atl1_ad
+ if (tpd != ptpd)
+ memcpy(tpd, ptpd, sizeof(struct tx_packet_desc));
+ tpd->buffer_addr = cpu_to_le64(buffer_info->dma);
+- tpd->word2 = (cpu_to_le16(buffer_info->length) &
++ tpd->word2 &= ~(TPD_BUFLEN_MASK << TPD_BUFLEN_SHIFT);
++ tpd->word2 |= (cpu_to_le16(buffer_info->length) &
+ TPD_BUFLEN_MASK) << TPD_BUFLEN_SHIFT;
+
+ /*
+@@ -2426,8 +2427,8 @@ static int atl1_xmit_frame(struct sk_buf
+ vlan_tag = (vlan_tag << 4) | (vlan_tag >> 13) |
+ ((vlan_tag >> 9) & 0x8);
+ ptpd->word3 |= 1 << TPD_INS_VL_TAG_SHIFT;
+- ptpd->word3 |= (vlan_tag & TPD_VL_TAGGED_MASK) <<
+- TPD_VL_TAGGED_SHIFT;
++ ptpd->word2 |= (vlan_tag & TPD_VLANTAG_MASK) <<
++ TPD_VLANTAG_SHIFT;
+ }
+
+ tso = atl1_tso(adapter, skb, ptpd);
+--- a/drivers/net/atlx/atl1.h
++++ b/drivers/net/atlx/atl1.h
+@@ -504,7 +504,7 @@ struct rx_free_desc {
+ #define TPD_PKTNT_MASK 0x0001
+ #define TPD_PKTINT_SHIFT 15
+ #define TPD_VLANTAG_MASK 0xFFFF
+-#define TPD_VLAN_SHIFT 16
++#define TPD_VLANTAG_SHIFT 16
+
+ /* tpd word 3 bits 0:13 */
+ #define TPD_EOP_MASK 0x0001
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008
+Message-Id: <20081104232319.486492836@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 11/57] libertas: fix buffer overrun
+Content-Disposition: inline; filename=libertas-fix-buffer-overrun.patch
+Content-Length: 1203
+Lines: 31
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 48735d8d8bd701b1e0cd3d49c21e5e385ddcb077 upstream
+
+If somebody sends an invalid beacon/probe response, that can trash the
+whole BSS descriptor. The descriptor is, luckily, large enough so that
+it cannot scribble past the end of it; it's well above 400 bytes long.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/scan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/libertas/scan.c
++++ b/drivers/net/wireless/libertas/scan.c
+@@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_de
+
+ switch (elem->id) {
+ case MFIE_TYPE_SSID:
+- bss->ssid_len = elem->len;
+- memcpy(bss->ssid, elem->data, elem->len);
++ bss->ssid_len = min_t(int, 32, elem->len);
++ memcpy(bss->ssid, elem->data, bss->ssid_len);
+ lbs_deb_scan("got SSID IE: '%s', len %u\n",
+ escape_essid(bss->ssid, bss->ssid_len),
+ bss->ssid_len);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008
+Message-Id: <20081104232319.598652687@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dan Nicholson <dbn.lists@gmail.com>,
+ Jiri Kosina <jkosina@suse.cz>
+Subject: [patch 12/57] Revert "HID: Invert HWHEEL mappings for some Logitech mice"
+Content-Disposition: inline; filename=revert-hid-invert-hwheel-mappings-for-some-logitech-mice.patch
+Content-Length: 2107
+Lines: 48
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dan Nicholson <dbn.lists@gmail.com>
+
+commit 022b7024d4bb1f9a2f30021a2672a0f940ebfa7a upstream.
+
+This reverts commit 740f370dc61dc478d891d7d47660bb3ae39ddb4f.
+
+It turned out to be correct in the first place: a positive value should
+be sent when the wheel is moved to the right, and a negative value when
+moved to the left. This is the behavior expected by the Xorg evdev
+driver. I must have had a remapping somewhere else in my system when
+originally testing this. Testing on another system shows that the
+unpatched kernel is correct.
+
+Here is a bug report from Mandriva that brought the problem to my
+attention:
+
+ https://qa.mandriva.com/show_bug.cgi?id=44309#c19
+
+Signed-off-by: Dan Nicholson <dbn.lists@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/usbhid/hid-quirks.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -247,8 +247,6 @@
+ #define USB_DEVICE_ID_LD_MACHINETEST 0x2040
+
+ #define USB_VENDOR_ID_LOGITECH 0x046d
+-#define USB_DEVICE_ID_LOGITECH_LX3 0xc044
+-#define USB_DEVICE_ID_LOGITECH_V150 0xc047
+ #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
+ #define USB_DEVICE_ID_LOGITECH_HARMONY 0xc110
+ #define USB_DEVICE_ID_LOGITECH_HARMONY_2 0xc111
+@@ -603,8 +601,6 @@ static const struct hid_blacklist {
+
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
+- { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_LX3, HID_QUIRK_INVERT_HWHEEL },
+- { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_V150, HID_QUIRK_INVERT_HWHEEL },
+
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K, HID_QUIRK_MICROSOFT_KEYS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K, HID_QUIRK_MICROSOFT_KEYS },
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:19 2008
+Message-Id: <20081104232319.770397762@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 13/57] libata: initialize port_task when !CONFIG_ATA_SFF
+Content-Disposition: inline; filename=libata-initialize-port_task-when-config_ata_sff.patch
+Content-Length: 976
+Lines: 31
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+commit f667fdbbbea8bcce6cf9f7acb51b7cb4c264cc61 upstream
+
+ap->port_task was not initialized if !CONFIG_ATA_SFF later triggering
+lockdep warning. Make sure it's initialized.
+
+Reported by Larry Finger.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5259,6 +5259,8 @@ struct ata_port *ata_port_alloc(struct a
+
+ #ifdef CONFIG_ATA_SFF
+ INIT_DELAYED_WORK(&ap->port_task, ata_pio_task);
++#else
++ INIT_DELAYED_WORK(&ap->port_task, NULL);
+ #endif
+ INIT_DELAYED_WORK(&ap->hotplug_task, ata_scsi_hotplug);
+ INIT_WORK(&ap->scsi_rescan_task, ata_scsi_dev_rescan);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008
+Message-Id: <20081104232319.936950853@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Florian Westphal <fw@strlen.de>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 14/57] syncookies: fix inclusion of tcp options in syn-ack
+Content-Disposition: inline; filename=0001-syncookies-fix-inclusion-of-tcp-options-in-syn-ack.patch
+Content-Length: 1654
+Lines: 48
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 8b5f12d04b2e93842f3dda01f029842047bf3f81 ]
+
+David Miller noticed that commit
+33ad798c924b4a1afad3593f2796d465040aadd5 '(tcp: options clean up')
+did not move the req->cookie_ts check.
+This essentially disabled commit 4dfc2817025965a2fc78a18c50f540736a6b5c24
+'[Syncookies]: Add support for TCP options via timestamps.'.
+
+This restores the original logic.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2266,6 +2266,11 @@ struct sk_buff *tcp_make_synack(struct s
+ }
+
+ memset(&opts, 0, sizeof(opts));
++#ifdef CONFIG_SYN_COOKIES
++ if (unlikely(req->cookie_ts))
++ TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
++ else
++#endif
+ TCP_SKB_CB(skb)->when = tcp_time_stamp;
+ tcp_header_size = tcp_synack_options(sk, req,
+ dst_metric(dst, RTAX_ADVMSS),
+@@ -2292,11 +2297,6 @@ struct sk_buff *tcp_make_synack(struct s
+
+ /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
+ th->window = htons(min(req->rcv_wnd, 65535U));
+-#ifdef CONFIG_SYN_COOKIES
+- if (unlikely(req->cookie_ts))
+- TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
+- else
+-#endif
+ tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
+ th->doff = (tcp_header_size >> 2);
+ TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008
+Message-Id: <20081104232320.111650217@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@helsinki.fi>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 15/57] tcp: Restore ordering of TCP options for the sake of inter-operability
+Content-Disposition: inline; filename=0002-tcp-Restore-ordering-of-TCP-options-for-the-sake-of.patch
+Content-Length: 3224
+Lines: 80
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+
+[ Upstream commit fd6149d332973bafa50f03ddb0ea9513e67f4517 ]
+
+This is not our bug! Sadly some devices cannot cope with the change
+of TCP option ordering which was a result of the recent rewrite of
+the option code (not that there was some particular reason steming
+from the rewrite for the reordering) though any ordering of TCP
+options is perfectly legal. Thus we restore the original ordering
+to allow interoperability with/through such broken devices and add
+some warning about this trap. Since the reordering just happened
+without any particular reason, this change shouldn't cost us
+anything.
+
+There are already couple of known failure reports (within close
+proximity of the last release), so the problem might be more
+wide-spread than a single device. And other reports which may
+be due to the same problem though the symptoms were less obvious.
+Analysis of one of the case revealed (with very high probability)
+that sack capability cannot be negotiated as the first option
+(SYN never got a response).
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Reported-by: Aldo Maggi <sentiniate@tiscali.it>
+Tested-by: Aldo Maggi <sentiniate@tiscali.it>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -357,6 +357,17 @@ struct tcp_out_options {
+ __u32 tsval, tsecr; /* need to include OPTION_TS */
+ };
+
++/* Beware: Something in the Internet is very sensitive to the ordering of
++ * TCP options, we learned this through the hard way, so be careful here.
++ * Luckily we can at least blame others for their non-compliance but from
++ * inter-operatibility perspective it seems that we're somewhat stuck with
++ * the ordering which we have been using if we want to keep working with
++ * those broken things (not that it currently hurts anybody as there isn't
++ * particular reason why the ordering would need to be changed).
++ *
++ * At least SACK_PERM as the first option is known to lead to a disaster
++ * (but it may well be that other scenarios fail similarly).
++ */
+ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
+ const struct tcp_out_options *opts,
+ __u8 **md5_hash) {
+@@ -371,6 +382,12 @@ static void tcp_options_write(__be32 *pt
+ *md5_hash = NULL;
+ }
+
++ if (unlikely(opts->mss)) {
++ *ptr++ = htonl((TCPOPT_MSS << 24) |
++ (TCPOLEN_MSS << 16) |
++ opts->mss);
++ }
++
+ if (likely(OPTION_TS & opts->options)) {
+ if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) {
+ *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
+@@ -387,12 +404,6 @@ static void tcp_options_write(__be32 *pt
+ *ptr++ = htonl(opts->tsecr);
+ }
+
+- if (unlikely(opts->mss)) {
+- *ptr++ = htonl((TCPOPT_MSS << 24) |
+- (TCPOLEN_MSS << 16) |
+- opts->mss);
+- }
+-
+ if (unlikely(OPTION_SACK_ADVERTISE & opts->options &&
+ !(OPTION_TS & opts->options))) {
+ *ptr++ = htonl((TCPOPT_NOP << 24) |
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008
+Message-Id: <20081104232320.277160144@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@helsinki.fi>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 16/57] tcpv6: fix option space offsets with md5
+Content-Disposition: inline; filename=0003-tcpv6-fix-option-space-offsets-with-md5.patch
+Content-Length: 876
+Lines: 28
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+
+[ Upstream commit 53b125779fb0b29e5b316bf3dc7d199e6dcea567 ]
+
+More breakage :-), part of timestamps just were previously
+overwritten.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/tcp_ipv6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1087,7 +1087,7 @@ static void tcp_v6_send_ack(struct sk_bu
+ *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
+ (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
+ *topt++ = htonl(tcp_time_stamp);
+- *topt = htonl(ts);
++ *topt++ = htonl(ts);
+ }
+
+ #ifdef CONFIG_TCP_MD5SIG
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008
+Message-Id: <20081104232320.442963768@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jarek Poplawski <jarkao2@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 17/57] pkt_sched: sch_generic: Fix oops in sch_teql
+Content-Disposition: inline; filename=0004-pkt_sched-sch_generic-Fix-oops-in-sch_teql.patch
+Content-Length: 1435
+Lines: 43
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+[ Upstream commit 9f3ffae0dbce491a3e9871b686342fd5aa854f05 ]
+
+After these commands:
+# modprobe sch_teql
+# tc qdisc add dev eth0 root teql0
+# tc qdisc del dev eth0 root
+we get an oops in teql_destroy() when spin_lock is taken from a null
+qdisc_sleeping pointer. It's because at the moment teql0 dev haven't
+been activated yet, and a qdisc_root_sleeping() is pointing to noop
+qdisc's netdev_queue with qdisc_sleeping uninitialized. This patch
+fixes this both for noop and noqueue netdev_queues to avoid similar
+problems in the future.
+
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/sch_generic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -319,6 +319,7 @@ struct Qdisc_ops noop_qdisc_ops __read_m
+
+ static struct netdev_queue noop_netdev_queue = {
+ .qdisc = &noop_qdisc,
++ .qdisc_sleeping = &noop_qdisc,
+ };
+
+ struct Qdisc noop_qdisc = {
+@@ -344,6 +345,7 @@ static struct Qdisc_ops noqueue_qdisc_op
+ static struct Qdisc noqueue_qdisc;
+ static struct netdev_queue noqueue_netdev_queue = {
+ .qdisc = &noqueue_qdisc,
++ .qdisc_sleeping = &noqueue_qdisc,
+ };
+
+ static struct Qdisc noqueue_qdisc = {
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008
+Message-Id: <20081104232320.620281550@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andrea Shepard <andrea@persephoneslair.org>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 18/57] sparc64: Fix race in arch/sparc64/kernel/trampoline.S
+Content-Disposition: inline; filename=0001-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch
+Content-Length: 1907
+Lines: 70
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andrea Shepard <andrea@persephoneslair.org>
+
+[ Upstream commit e0037df3852b4b60edbe01f70f4968e4a9fdb272 ]
+
+Make arch/sparc64/kernel/trampoline.S in 2.6.27.1 lock prom_entry_lock
+when calling the PROM. This prevents a race condition that I observed
+causing a hang on startup on a 12-CPU E4500.
+
+I am not subscribed to this list, so please CC me on replies.
+
+Signed-off-by: Andrea Shepard <andrea@persephoneslair.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/trampoline.S | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/arch/sparc64/kernel/trampoline.S
++++ b/arch/sparc64/kernel/trampoline.S
+@@ -328,6 +328,12 @@ after_lock_tlb:
+
+ wrpr %g0, 0, %wstate
+
++ sethi %hi(prom_entry_lock), %g2
++1: ldstub [%g2 + %lo(prom_entry_lock)], %g1
++ membar #StoreLoad | #StoreStore
++ brnz,pn %g1, 1b
++ nop
++
+ /* As a hack, put &init_thread_union into %g6.
+ * prom_world() loads from here to restore the %asi
+ * register.
+@@ -337,7 +343,7 @@ after_lock_tlb:
+
+ sethi %hi(is_sun4v), %o0
+ lduw [%o0 + %lo(is_sun4v)], %o0
+- brz,pt %o0, 1f
++ brz,pt %o0, 2f
+ nop
+
+ TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
+@@ -369,10 +375,10 @@ after_lock_tlb:
+ call %o1
+ add %sp, (2047 + 128), %o0
+
+- ba,pt %xcc, 2f
++ ba,pt %xcc, 3f
+ nop
+
+-1: sethi %hi(sparc64_ttable_tl0), %o0
++2: sethi %hi(sparc64_ttable_tl0), %o0
+ set prom_set_trap_table_name, %g2
+ stx %g2, [%sp + 2047 + 128 + 0x00]
+ mov 1, %g2
+@@ -386,7 +392,11 @@ after_lock_tlb:
+ call %o1
+ add %sp, (2047 + 128), %o0
+
+-2: ldx [%l0], %g6
++3: sethi %hi(prom_entry_lock), %g2
++ stb %g0, [%g2 + %lo(prom_entry_lock)]
++ membar #StoreStore | #StoreLoad
++
++ ldx [%l0], %g6
+ ldx [%g6 + TI_TASK], %g4
+
+ mov 1, %g5
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:20 2008
+Message-Id: <20081104232320.795317339@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 19/57] math-emu: Fix signalling of underflow and inexact while packing result.
+Content-Disposition: inline; filename=0002-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch
+Content-Length: 3676
+Lines: 116
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kumar Gala <galak@kernel.crashing.org>
+
+[ Upstream commit 930cc144a043ff95e56b6888fa51c618b33f89e7 ]
+
+I'm trying to move the powerpc math-emu code to use the include/math-emu bits.
+
+In doing so I've been using TestFloat to see how good or bad we are
+doing. For the most part the current math-emu code that PPC uses has
+a number of issues that the code in include/math-emu seems to solve
+(plus bugs we've had for ever that no one every realized).
+
+Anyways, I've come across a case that we are flagging underflow and
+inexact because we think we have a denormalized result from a double
+precision divide:
+
+000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE
+ soft: 001.0000000000000 ..... syst: 001.0000000000000 ...ux
+
+What it looks like is the results out of FP_DIV_D are:
+
+D:
+sign: 0
+mantissa: 01000000 00000000
+exp: -1023 (0)
+
+The problem seems like we aren't normalizing the result and bumping the exp.
+
+Now that I'm digging into this a bit I'm thinking my issue has to do with
+the fix DaveM put in place from back in Aug 2007 (commit
+405849610fd96b4f34cd1875c4c033228fea6c0f):
+
+[MATH-EMU]: Fix underflow exception reporting.
+
+ 2) we ended up rounding back up to normal (this is the case where
+ we set the exponent to 1 and set the fraction to zero), this
+ should set inexact too
+...
+
+ Another example, "0x0.0000000000001p-1022 / 16.0", should signal both
+ inexact and underflow. The cpu implementations and ieee1754
+ literature is very clear about this. This is case #2 above.
+
+Here is the distilled glibc test case from Jakub Jelinek which prompted that
+commit:
+
+--------------------
+#include <float.h>
+#include <fenv.h>
+#include <stdio.h>
+
+volatile double d = DBL_MIN;
+volatile double e = 0x0.0000000000001p-1022;
+volatile double f = 16.0;
+int
+main (void)
+{
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ d /= f;
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ e /= f;
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ return 0;
+}
+--------------------
+
+It looks like the case I have we are exact before rounding, but think it
+looks like the rounding case since it appears as if "overflow is set".
+
+000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE = 001.0000000000000
+
+I think the following adds the check for my case and still works for the
+issue your commit was trying to resolve.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/math-emu/op-common.h | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/include/math-emu/op-common.h
++++ b/include/math-emu/op-common.h
+@@ -139,18 +139,27 @@ do { \
+ if (X##_e <= _FP_WFRACBITS_##fs) \
+ { \
+ _FP_FRAC_SRS_##wc(X, X##_e, _FP_WFRACBITS_##fs); \
+- _FP_ROUND(wc, X); \
+ if (_FP_FRAC_HIGH_##fs(X) \
+ & (_FP_OVERFLOW_##fs >> 1)) \
+ { \
+ X##_e = 1; \
+ _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
+- FP_SET_EXCEPTION(FP_EX_INEXACT); \
+ } \
+ else \
+ { \
+- X##_e = 0; \
+- _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
++ _FP_ROUND(wc, X); \
++ if (_FP_FRAC_HIGH_##fs(X) \
++ & (_FP_OVERFLOW_##fs >> 1)) \
++ { \
++ X##_e = 1; \
++ _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
++ FP_SET_EXCEPTION(FP_EX_INEXACT); \
++ } \
++ else \
++ { \
++ X##_e = 0; \
++ _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
++ } \
+ } \
+ if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
+ (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008
+Message-Id: <20081104232320.967296679@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux1394-devel@lists.sourceforge.net,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [patch 20/57] firewire: fix setting tag and sy in iso transmission
+Content-Disposition: inline; filename=firewire-fix-setting-tag-and-sy-in-iso-transmission.patch
+Content-Length: 1053
+Lines: 29
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+commit 7a1003449c693f0d57443c8786bbf19717921ae0 upstream
+
+Reported by Jay Fenlason:
+The iso packet control accessors in fw-cdev.c had bogus masks.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/fw-cdev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/firewire/fw-cdev.c
++++ b/drivers/firewire/fw-cdev.c
+@@ -720,8 +720,8 @@ static int ioctl_create_iso_context(stru
+ #define GET_PAYLOAD_LENGTH(v) ((v) & 0xffff)
+ #define GET_INTERRUPT(v) (((v) >> 16) & 0x01)
+ #define GET_SKIP(v) (((v) >> 17) & 0x01)
+-#define GET_TAG(v) (((v) >> 18) & 0x02)
+-#define GET_SY(v) (((v) >> 20) & 0x04)
++#define GET_TAG(v) (((v) >> 18) & 0x03)
++#define GET_SY(v) (((v) >> 20) & 0x0f)
+ #define GET_HEADER_LENGTH(v) (((v) >> 24) & 0xff)
+
+ static int ioctl_queue_iso(struct client *client, void *buffer)
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008
+Message-Id: <20081104232321.143395169@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux1394-devel@lists.sourceforge.net,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [patch 21/57] firewire: fix ioctl() return code
+Content-Disposition: inline; filename=firewire-fix-ioctl-return-code.patch
+Content-Length: 785
+Lines: 30
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+commit 99692f71ee04c6f249d0bf6a581359f32f409a38 upstream
+
+Reported by Jay Fenlason: ioctl() did not return as intended
+ - the size of data read into ioctl_send_request,
+ - the number of datagrams enqueued by ioctl_queue_iso.
+
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/fw-cdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firewire/fw-cdev.c
++++ b/drivers/firewire/fw-cdev.c
+@@ -913,7 +913,7 @@ dispatch_ioctl(struct client *client, un
+ return -EFAULT;
+ }
+
+- return 0;
++ return retval;
+ }
+
+ static long
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008
+Message-Id: <20081104232321.306177799@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux1394-devel@lists.sourceforge.net,
+ Jay Fenlason <fenlason@redhat.com>,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [patch 22/57] firewire: Survive more than 256 bus resets
+Content-Disposition: inline; filename=firewire-survive-more-than-256-bus-resets.patch
+Content-Length: 1163
+Lines: 34
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jay Fenlason <fenlason@redhat.com>
+
+Same as commit 4f9740d4f5a17fa6a1b097fa3ccdfb7246660307 upstream
+
+The "color" is used during the topology building after a bus reset,
+hovever in "struct fw_node"s it is stored in a u8, but in struct fw_card
+it is stored in an int. When the value wraps in one struct, but not
+the other, disaster strikes.
+
+Fixes http://bugzilla.kernel.org/show_bug.cgi?id=10922 -
+machine locks up solid if a series of bus resets occurs.
+
+
+Signed-off-by: Jay Fenlason <fenlason@redhat.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/fw-transaction.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firewire/fw-transaction.h
++++ b/drivers/firewire/fw-transaction.h
+@@ -248,7 +248,7 @@ struct fw_card {
+ struct fw_node *local_node;
+ struct fw_node *root_node;
+ struct fw_node *irm_node;
+- int color;
++ u8 color; /* must be u8 to match the definition in struct fw_node */
+ int gap_count;
+ bool beta_repeaters_present;
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008
+Message-Id: <20081104232321.466568445@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux1394-devel@lists.sourceforge.net,
+ Jay Fenlason <fenlason@redhat.com>,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [patch 23/57] firewire: fix struct fw_node memory leak
+Content-Disposition: inline; filename=firewire-fix-struct-fw_node-memory-leak.patch
+Content-Length: 1155
+Lines: 39
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jay Fenlason <fenlason@redhat.com>
+
+commit 77e557191701afa55ae7320d42ad6458a2ad292e upstream
+
+With the bus_resets patch applied, it is easy to see this memory leak
+by repeatedly resetting the firewire bus while running slabtop in
+another window. Just watch kmalloc-32 grow and grow...
+
+Signed-off-by: Jay Fenlason <fenlason@redhat.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+---
+ drivers/firewire/fw-topology.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/firewire/fw-topology.c
++++ b/drivers/firewire/fw-topology.c
+@@ -413,7 +413,7 @@ static void
+ update_tree(struct fw_card *card, struct fw_node *root)
+ {
+ struct list_head list0, list1;
+- struct fw_node *node0, *node1;
++ struct fw_node *node0, *node1, *next1;
+ int i, event;
+
+ INIT_LIST_HEAD(&list0);
+@@ -485,7 +485,9 @@ update_tree(struct fw_card *card, struct
+ }
+
+ node0 = fw_node(node0->link.next);
+- node1 = fw_node(node1->link.next);
++ next1 = fw_node(node1->link.next);
++ fw_node_put(node1);
++ node1 = next1;
+ }
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008
+Message-Id: <20081104232321.635495424@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux1394-devel@lists.sourceforge.net,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [patch 24/57] firewire: fw-sbp2: delay first login to avoid retries
+Content-Disposition: inline; filename=firewire-fw-sbp2-delay-first-login-to-avoid-retries.patch
+Content-Length: 1702
+Lines: 43
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+commit 0dcfeb7e3c8695c5aa3677dda8efb9bef2e7e64d upstream
+
+This optimizes firewire-sbp2's device probe for the case that the local
+node and the SBP-2 node were discovered at the same time. In this case,
+fw-core's bus management work and fw-sbp2's login and SCSI probe work
+are scheduled in parallel (in the globally shared workqueue and in
+fw-sbp2's workqueue, respectively). The bus reset from fw-core may then
+disturb and extremely delay the login and SCSI probe because the latter
+fails with several command timeouts and retries and has to be retried
+from scratch.
+
+We avoid this particular situation of sbp2_login() and fw_card_bm_work()
+running in parallel by delaying the first sbp2_login() a little bit.
+
+This is meant to be a short-term fix for
+https://bugzilla.redhat.com/show_bug.cgi?id=466679. In the long run,
+the SCSI probe, i.e. fw-sbp2's call of __scsi_add_device(), should be
+parallelized with sbp2_reconnect().
+
+Problem reported and fix tested and confirmed by Alex Kanavin.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/fw-sbp2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firewire/fw-sbp2.c
++++ b/drivers/firewire/fw-sbp2.c
+@@ -1158,7 +1158,7 @@ static int sbp2_probe(struct device *dev
+
+ /* Do the login in a workqueue so we can easily reschedule retries. */
+ list_for_each_entry(lu, &tgt->lu_list, link)
+- sbp2_queue_work(lu, 0);
++ sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
+ return 0;
+
+ fail_tgt_put:
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:21 2008
+Message-Id: <20081104232321.794834597@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux1394-devel@lists.sourceforge.net,
+ Jay Fenlason <fenlason@redhat.com>,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [patch 25/57] firewire: fw-sbp2: fix races
+Content-Disposition: inline; filename=firewire-fw-sbp2-fix-races.patch
+Content-Length: 3328
+Lines: 98
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jay Fenlason <fenlason@redhat.com>
+
+Same as commit cd1f70fdb4823c97328a1f151f328eb36fafd579 upstream
+
+1: There is a small race between queue_delayed_work() and its
+ corresponding kref_get(). Do the kref_get first, and _put it again
+ if the queue_delayed_work() failed, so there is no chance of the
+ kref going to zero while the work is scheduled.
+2: An SBP2_LOGOUT_REQUEST could be sent out with a login_id full of
+ garbage. Initialize it to an invalid value so we can tell if we
+ ever got a valid login_id.
+3: The node ID and generation may have changed but the new values may
+ not yet have been recorded in lu and tgt when the final logout is
+ attempted. Use the latest values from the device in
+ sbp2_release_target().
+
+Signed-off-by: Jay Fenlason <fenlason@redhat.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/fw-sbp2.c | 36 ++++++++++++++++++++++++++----------
+ 1 file changed, 26 insertions(+), 10 deletions(-)
+
+--- a/drivers/firewire/fw-sbp2.c
++++ b/drivers/firewire/fw-sbp2.c
+@@ -172,6 +172,9 @@ struct sbp2_target {
+ int blocked; /* ditto */
+ };
+
++/* Impossible login_id, to detect logout attempt before successful login */
++#define INVALID_LOGIN_ID 0x10000
++
+ /*
+ * Per section 7.4.8 of the SBP-2 spec, a mgt_ORB_timeout value can be
+ * provided in the config rom. Most devices do provide a value, which
+@@ -791,9 +794,20 @@ static void sbp2_release_target(struct k
+ scsi_remove_device(sdev);
+ scsi_device_put(sdev);
+ }
+- sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
+- SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
+-
++ if (lu->login_id != INVALID_LOGIN_ID) {
++ int generation, node_id;
++ /*
++ * tgt->node_id may be obsolete here if we failed
++ * during initial login or after a bus reset where
++ * the topology changed.
++ */
++ generation = device->generation;
++ smp_rmb(); /* node_id vs. generation */
++ node_id = device->node_id;
++ sbp2_send_management_orb(lu, node_id, generation,
++ SBP2_LOGOUT_REQUEST,
++ lu->login_id, NULL);
++ }
+ fw_core_remove_address_handler(&lu->address_handler);
+ list_del(&lu->link);
+ kfree(lu);
+@@ -808,19 +822,20 @@ static void sbp2_release_target(struct k
+
+ static struct workqueue_struct *sbp2_wq;
+
++static void sbp2_target_put(struct sbp2_target *tgt)
++{
++ kref_put(&tgt->kref, sbp2_release_target);
++}
++
+ /*
+ * Always get the target's kref when scheduling work on one its units.
+ * Each workqueue job is responsible to call sbp2_target_put() upon return.
+ */
+ static void sbp2_queue_work(struct sbp2_logical_unit *lu, unsigned long delay)
+ {
+- if (queue_delayed_work(sbp2_wq, &lu->work, delay))
+- kref_get(&lu->tgt->kref);
+-}
+-
+-static void sbp2_target_put(struct sbp2_target *tgt)
+-{
+- kref_put(&tgt->kref, sbp2_release_target);
++ kref_get(&lu->tgt->kref);
++ if (!queue_delayed_work(sbp2_wq, &lu->work, delay))
++ sbp2_target_put(lu->tgt);
+ }
+
+ static void
+@@ -993,6 +1008,7 @@ static int sbp2_add_logical_unit(struct
+
+ lu->tgt = tgt;
+ lu->lun = lun_entry & 0xffff;
++ lu->login_id = INVALID_LOGIN_ID;
+ lu->retries = 0;
+ lu->has_sdev = false;
+ lu->blocked = false;
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008
+Message-Id: <20081104232321.969662832@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-acpi@vger.kernel.org,
+ Guillem Jover <guillem.jover@nokia.com>,
+ Dmitry Torokhov <dtor@mail.ru>,
+ Len Brown <len.brown@intel.com>
+Subject: [patch 26/57] ACPI: Always report a sync event after a lid state change
+Content-Disposition: inline; filename=acpi-always-report-a-sync-event-after-a-lid-state-change.patch
+Content-Length: 1286
+Lines: 40
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Guillem Jover <guillem.jover@nokia.com>
+
+upstream commit df316e939100e789b3c5d4d102619ccf5834bd00
+
+Currently not always an EV_SYN event is reported to userland
+after the EV_SW SW_LID event has been sent. This is easy to verify
+by using “input-events” from input-utils and just closing and opening
+the lid.
+
+Signed-off-by: Guillem Jover <guillem.jover@nokia.com>
+Acked-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/button.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -262,6 +262,7 @@ static int acpi_lid_send_state(struct ac
+ return -ENODEV;
+ /* input layer checks if event is redundant */
+ input_report_switch(button->input, SW_LID, !state);
++ input_sync(button->input);
+ return 0;
+ }
+
+@@ -285,8 +286,8 @@ static void acpi_button_notify(acpi_hand
+ input_report_key(input, keycode, 1);
+ input_sync(input);
+ input_report_key(input, keycode, 0);
++ input_sync(input);
+ }
+- input_sync(input);
+
+ acpi_bus_generate_proc_event(button->device, event,
+ ++button->pushed);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008
+Message-Id: <20081104232322.133279291@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Guennadi Liakhovetski <g.liakhovetski@gmx.de>,
+ Kumar Gala <galak@kernel.crashing.org>
+Subject: [patch 27/57] powerpc: fix i2c on PPC linkstation / kurobox machines
+Content-Disposition: inline; filename=powerpc-fix-i2c-on-ppc-linkstation-kurobox-machines.patch
+Content-Length: 2482
+Lines: 79
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit 22e181ba7f09197dd6f35a48013cb86289644eb6 upstream.
+
+The i2c bus defn is broken on linkstation / kurobox machines since at
+least 2.6.27. Fix it. Also remove CONFIG_SERIAL_OF_PLATFORM, which, if
+enabled, breaks the serial console after the
+"console handover: boot [udbg0] -> real [ttyS1]" message.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/configs/linkstation_defconfig | 7 +++----
+ arch/powerpc/platforms/embedded6xx/linkstation.c | 14 ++++++++++++++
+ 2 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/configs/linkstation_defconfig
++++ b/arch/powerpc/configs/linkstation_defconfig
+@@ -1,7 +1,7 @@
+ #
+ # Automatically generated make config: don't edit
+-# Linux kernel version: 2.6.27-rc4
+-# Thu Aug 21 00:52:05 2008
++# Linux kernel version: 2.6.27
++# Fri Oct 24 00:42:39 2008
+ #
+ # CONFIG_PPC64 is not set
+
+@@ -934,7 +934,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+ CONFIG_SERIAL_CORE=y
+ CONFIG_SERIAL_CORE_CONSOLE=y
+ # CONFIG_SERIAL_JSM is not set
+-CONFIG_SERIAL_OF_PLATFORM=y
++# CONFIG_SERIAL_OF_PLATFORM is not set
+ CONFIG_UNIX98_PTYS=y
+ CONFIG_LEGACY_PTYS=y
+ CONFIG_LEGACY_PTY_COUNT=256
+@@ -1211,7 +1211,6 @@ CONFIG_USB_STORAGE=m
+ # CONFIG_USB_STORAGE_ALAUDA is not set
+ # CONFIG_USB_STORAGE_ONETOUCH is not set
+ # CONFIG_USB_STORAGE_KARMA is not set
+-# CONFIG_USB_STORAGE_SIERRA is not set
+ # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+ # CONFIG_USB_LIBUSUAL is not set
+
+--- a/arch/powerpc/platforms/embedded6xx/linkstation.c
++++ b/arch/powerpc/platforms/embedded6xx/linkstation.c
+@@ -13,6 +13,7 @@
+ #include <linux/kernel.h>
+ #include <linux/initrd.h>
+ #include <linux/mtd/physmap.h>
++#include <linux/of_platform.h>
+
+ #include <asm/time.h>
+ #include <asm/prom.h>
+@@ -54,6 +55,19 @@ static struct mtd_partition linkstation_
+ },
+ };
+
++static __initdata struct of_device_id of_bus_ids[] = {
++ { .type = "soc", },
++ { .compatible = "simple-bus", },
++ {},
++};
++
++static int __init declare_of_platform_devices(void)
++{
++ of_platform_bus_probe(NULL, of_bus_ids, NULL);
++ return 0;
++}
++machine_device_initcall(linkstation, declare_of_platform_devices);
++
+ static int __init linkstation_add_bridge(struct device_node *dev)
+ {
+ #ifdef CONFIG_PCI
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008
+Message-Id: <20081104232322.364422911@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jon Tollefson <kniht@linux.vnet.ibm.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 28/57] powerpc: Reserve in bootmem lmb reserved regions that cross NUMA nodes
+Content-Disposition: inline; filename=powerpc-reserve-in-bootmem-lmb-reserved-regions-that-cross-numa-nodes.patch
+Content-Length: 6658
+Lines: 186
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jon Tollefson <kniht@linux.vnet.ibm.com>
+
+commit 8f64e1f2d1e09267ac926e15090fd505c1c0cbcb upstream
+
+If there are multiple reserved memory blocks via lmb_reserve() that are
+contiguous addresses and on different NUMA nodes we are losing track of which
+address ranges to reserve in bootmem on which node. I discovered this
+when I recently got to try 16GB huge pages on a system with more then 2 nodes.
+
+When scanning the device tree in early boot we call lmb_reserve() with
+the addresses of the 16G pages that we find so that the memory doesn't
+get used for something else. For example the addresses for the pages
+could be 4000000000, 4400000000, 4800000000, 4C00000000, etc - 8 pages,
+one on each of eight nodes. In the lmb after all the pages have been
+reserved it will look something like the following:
+
+lmb_dump_all:
+ memory.cnt = 0x2
+ memory.size = 0x3e80000000
+ memory.region[0x0].base = 0x0
+ .size = 0x1e80000000
+ memory.region[0x1].base = 0x4000000000
+ .size = 0x2000000000
+ reserved.cnt = 0x5
+ reserved.size = 0x3e80000000
+ reserved.region[0x0].base = 0x0
+ .size = 0x7b5000
+ reserved.region[0x1].base = 0x2a00000
+ .size = 0x78c000
+ reserved.region[0x2].base = 0x328c000
+ .size = 0x43000
+ reserved.region[0x3].base = 0xf4e8000
+ .size = 0xb18000
+ reserved.region[0x4].base = 0x4000000000
+ .size = 0x2000000000
+
+The reserved.region[0x4] contains the 16G pages. In
+arch/powerpc/mm/num.c: do_init_bootmem() we loop through each of the
+node numbers looking for the reserved regions that belong to the
+particular node. It is not able to identify region 0x4 as being a part
+of each of the 8 nodes. It is assuming that a reserved region is only
+on a single node.
+
+This patch takes out the reserved region loop from inside
+the loop that goes over each node. It looks up the active region containing
+the start of the reserved region. If it extends past that active region then
+it adjusts the size and gets the next active region containing it.
+
+Signed-off-by: Jon Tollefson <kniht@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/mm/numa.c | 108 ++++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 80 insertions(+), 28 deletions(-)
+
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -89,6 +89,46 @@ static int __cpuinit fake_numa_create_ne
+ return 0;
+ }
+
++/*
++ * get_active_region_work_fn - A helper function for get_node_active_region
++ * Returns datax set to the start_pfn and end_pfn if they contain
++ * the initial value of datax->start_pfn between them
++ * @start_pfn: start page(inclusive) of region to check
++ * @end_pfn: end page(exclusive) of region to check
++ * @datax: comes in with ->start_pfn set to value to search for and
++ * goes out with active range if it contains it
++ * Returns 1 if search value is in range else 0
++ */
++static int __init get_active_region_work_fn(unsigned long start_pfn,
++ unsigned long end_pfn, void *datax)
++{
++ struct node_active_region *data;
++ data = (struct node_active_region *)datax;
++
++ if (start_pfn <= data->start_pfn && end_pfn > data->start_pfn) {
++ data->start_pfn = start_pfn;
++ data->end_pfn = end_pfn;
++ return 1;
++ }
++ return 0;
++
++}
++
++/*
++ * get_node_active_region - Return active region containing start_pfn
++ * @start_pfn: The page to return the region for.
++ * @node_ar: Returned set to the active region containing start_pfn
++ */
++static void __init get_node_active_region(unsigned long start_pfn,
++ struct node_active_region *node_ar)
++{
++ int nid = early_pfn_to_nid(start_pfn);
++
++ node_ar->nid = nid;
++ node_ar->start_pfn = start_pfn;
++ work_with_active_regions(nid, get_active_region_work_fn, node_ar);
++}
++
+ static void __cpuinit map_cpu_to_node(int cpu, int node)
+ {
+ numa_cpu_lookup_table[cpu] = node;
+@@ -837,38 +877,50 @@ void __init do_init_bootmem(void)
+ start_pfn, end_pfn);
+
+ free_bootmem_with_active_regions(nid, end_pfn);
++ }
+
+- /* Mark reserved regions on this node */
+- for (i = 0; i < lmb.reserved.cnt; i++) {
+- unsigned long physbase = lmb.reserved.region[i].base;
+- unsigned long size = lmb.reserved.region[i].size;
+- unsigned long start_paddr = start_pfn << PAGE_SHIFT;
+- unsigned long end_paddr = end_pfn << PAGE_SHIFT;
+-
+- if (early_pfn_to_nid(physbase >> PAGE_SHIFT) != nid &&
+- early_pfn_to_nid((physbase+size-1) >> PAGE_SHIFT) != nid)
+- continue;
+-
+- if (physbase < end_paddr &&
+- (physbase+size) > start_paddr) {
+- /* overlaps */
+- if (physbase < start_paddr) {
+- size -= start_paddr - physbase;
+- physbase = start_paddr;
+- }
+-
+- if (size > end_paddr - physbase)
+- size = end_paddr - physbase;
+-
+- dbg("reserve_bootmem %lx %lx\n", physbase,
+- size);
+- reserve_bootmem_node(NODE_DATA(nid), physbase,
+- size, BOOTMEM_DEFAULT);
+- }
++ /* Mark reserved regions */
++ for (i = 0; i < lmb.reserved.cnt; i++) {
++ unsigned long physbase = lmb.reserved.region[i].base;
++ unsigned long size = lmb.reserved.region[i].size;
++ unsigned long start_pfn = physbase >> PAGE_SHIFT;
++ unsigned long end_pfn = ((physbase + size) >> PAGE_SHIFT);
++ struct node_active_region node_ar;
++
++ get_node_active_region(start_pfn, &node_ar);
++ while (start_pfn < end_pfn) {
++ /*
++ * if reserved region extends past active region
++ * then trim size to active region
++ */
++ if (end_pfn > node_ar.end_pfn)
++ size = (node_ar.end_pfn << PAGE_SHIFT)
++ - (start_pfn << PAGE_SHIFT);
++ dbg("reserve_bootmem %lx %lx nid=%d\n", physbase, size,
++ node_ar.nid);
++ reserve_bootmem_node(NODE_DATA(node_ar.nid), physbase,
++ size, BOOTMEM_DEFAULT);
++ /*
++ * if reserved region is contained in the active region
++ * then done.
++ */
++ if (end_pfn <= node_ar.end_pfn)
++ break;
++
++ /*
++ * reserved region extends past the active region
++ * get next active region that contains this
++ * reserved region
++ */
++ start_pfn = node_ar.end_pfn;
++ physbase = start_pfn << PAGE_SHIFT;
++ get_node_active_region(start_pfn, &node_ar);
+ }
+
+- sparse_memory_present_with_active_regions(nid);
+ }
++
++ for_each_online_node(nid)
++ sparse_memory_present_with_active_regions(nid);
+ }
+
+ void __init paging_init(void)
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008
+Message-Id: <20081104232322.481201031@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jon Tollefson <kniht@linux.vnet.ibm.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 29/57] powerpc/numa: Make memory reserve code more robust
+Content-Disposition: inline; filename=powerpc-numa-make-memory-reserve-code-more-robust.patch
+Content-Length: 2488
+Lines: 71
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jon Tollefson <kniht@us.ibm.com>
+
+commit e81703724a966120ace6504c993bda9e084cbf3e upstream.
+
+Adjust amount to reserve based on previous nodes for reserves spanning
+multiple nodes. Check if the node active range is empty before attempting
+to pass the reserve to bootmem. In practice the range shouldn't be empty,
+but to be sure we check.
+
+Signed-off-by: Jon Tollefson <kniht@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/mm/numa.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -116,6 +116,7 @@ static int __init get_active_region_work
+
+ /*
+ * get_node_active_region - Return active region containing start_pfn
++ * Active range returned is empty if none found.
+ * @start_pfn: The page to return the region for.
+ * @node_ar: Returned set to the active region containing start_pfn
+ */
+@@ -126,6 +127,7 @@ static void __init get_node_active_regio
+
+ node_ar->nid = nid;
+ node_ar->start_pfn = start_pfn;
++ node_ar->end_pfn = start_pfn;
+ work_with_active_regions(nid, get_active_region_work_fn, node_ar);
+ }
+
+@@ -888,18 +890,20 @@ void __init do_init_bootmem(void)
+ struct node_active_region node_ar;
+
+ get_node_active_region(start_pfn, &node_ar);
+- while (start_pfn < end_pfn) {
++ while (start_pfn < end_pfn &&
++ node_ar.start_pfn < node_ar.end_pfn) {
++ unsigned long reserve_size = size;
+ /*
+ * if reserved region extends past active region
+ * then trim size to active region
+ */
+ if (end_pfn > node_ar.end_pfn)
+- size = (node_ar.end_pfn << PAGE_SHIFT)
++ reserve_size = (node_ar.end_pfn << PAGE_SHIFT)
+ - (start_pfn << PAGE_SHIFT);
+- dbg("reserve_bootmem %lx %lx nid=%d\n", physbase, size,
+- node_ar.nid);
++ dbg("reserve_bootmem %lx %lx nid=%d\n", physbase,
++ reserve_size, node_ar.nid);
+ reserve_bootmem_node(NODE_DATA(node_ar.nid), physbase,
+- size, BOOTMEM_DEFAULT);
++ reserve_size, BOOTMEM_DEFAULT);
+ /*
+ * if reserved region is contained in the active region
+ * then done.
+@@ -914,6 +918,7 @@ void __init do_init_bootmem(void)
+ */
+ start_pfn = node_ar.end_pfn;
+ physbase = start_pfn << PAGE_SHIFT;
++ size = size - reserve_size;
+ get_node_active_region(start_pfn, &node_ar);
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008
+Message-Id: <20081104232322.681989038@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jon Tollefson <kniht@linux.vnet.ibm.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 30/57] powerpc: Dont use a 16G page if beyond mem= limits
+Content-Disposition: inline; filename=powerpc-don-t-use-a-16g-page-if-beyond-mem-limits.patch
+Content-Length: 1219
+Lines: 33
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jon Tollefson <kniht@us.ibm.com>
+
+commit 4792adbac9eb41cea77a45ab76258ea10d411173 upstream
+
+If mem= is used on the boot command line to limit memory then the memory block where a 16G page resides may not be available.
+
+Thanks to Michael Ellerman for finding the problem.
+
+Signed-off-by: Jon Tollefson <kniht@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/mm/hash_utils_64.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/mm/hash_utils_64.c
++++ b/arch/powerpc/mm/hash_utils_64.c
+@@ -381,8 +381,10 @@ static int __init htab_dt_scan_hugepage_
+ printk(KERN_INFO "Huge page(16GB) memory: "
+ "addr = 0x%lX size = 0x%lX pages = %d\n",
+ phys_addr, block_size, expected_pages);
+- lmb_reserve(phys_addr, block_size * expected_pages);
+- add_gpage(phys_addr, block_size, expected_pages);
++ if (phys_addr + (16 * GB) <= lmb_end_of_DRAM()) {
++ lmb_reserve(phys_addr, block_size * expected_pages);
++ add_gpage(phys_addr, block_size, expected_pages);
++ }
+ return 0;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:22 2008
+Message-Id: <20081104232322.819327166@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 31/57] i2c: The i2c mailing list is moving
+Content-Disposition: inline; filename=i2c-the-i2c-mailing-list-is-moving.patch
+Content-Length: 3273
+Lines: 121
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 846557d3ceb6c7493e090921db5d6158ec237228 upstream
+
+Replace all references to the old i2c mailing list.
+
+This isn't a bug fix, but I would hate to miss bug reports because
+they're sent to a dead mailing list.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/i2c/busses/i2c-sis96x | 2 +-
+ MAINTAINERS | 20 ++++++++++----------
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+--- a/Documentation/i2c/busses/i2c-sis96x
++++ b/Documentation/i2c/busses/i2c-sis96x
+@@ -42,7 +42,7 @@ I suspect that this driver could be made
+ chipsets as well: 635, and 635T. If anyone owns a board with those chips
+ AND is willing to risk crashing & burning an otherwise well-behaved kernel
+ in the name of progress... please contact me at <mhoffman@lightlink.com> or
+-via the project's mailing list: <i2c@lm-sensors.org>. Please send bug
++via the linux-i2c mailing list: <linux-i2c@vger.kernel.org>. Please send bug
+ reports and/or success stories as well.
+
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -360,7 +360,7 @@ S: Maintained
+ ALI1563 I2C DRIVER
+ P: Rudolf Marek
+ M: r.marek@assembler.cz
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ S: Maintained
+
+ ALPHA PORT
+@@ -1681,7 +1681,7 @@ FREESCALE I2C CPM DRIVER
+ P: Jochen Friedrich
+ M: jochen@scram.de
+ L: linuxppc-dev@ozlabs.org
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ S: Maintained
+
+ FREESCALE SOC FS_ENET DRIVER
+@@ -1982,7 +1982,7 @@ S: Maintained
+ I2C/SMBUS STUB DRIVER
+ P: Mark M. Hoffman
+ M: mhoffman@lightlink.com
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ S: Maintained
+
+ I2C SUBSYSTEM
+@@ -1990,14 +1990,14 @@ P: Jean Delvare (PC drivers, core)
+ M: khali@linux-fr.org
+ P: Ben Dooks (embedded platforms)
+ M: ben-linux@fluff.org
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ T: quilt http://khali.linux-fr.org/devel/linux-2.6/jdelvare-i2c/
+ S: Maintained
+
+ I2C-TINY-USB DRIVER
+ P: Till Harbaum
+ M: till@harbaum.org
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ T: http://www.harbaum.org/till/i2c_tiny_usb
+ S: Maintained
+
+@@ -3070,7 +3070,7 @@ S: Maintained
+ OPENCORES I2C BUS DRIVER
+ P: Peter Korsgaard
+ M: jacmet@sunsite.dk
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ S: Maintained
+
+ ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
+@@ -3144,7 +3144,7 @@ S: Maintained
+ PA SEMI SMBUS DRIVER
+ P: Olof Johansson
+ M: olof@lixom.net
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ S: Maintained
+
+ PARALLEL PORT SUPPORT
+@@ -3280,7 +3280,7 @@ S: Maintained
+ PNXxxxx I2C DRIVER
+ P: Vitaly Wool
+ M: vitalywool@gmail.com
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ S: Maintained
+
+ PPP PROTOCOL DRIVERS AND COMPRESSORS
+@@ -3725,7 +3725,7 @@ S: Maintained
+ SIS 96X I2C/SMBUS DRIVER
+ P: Mark M. Hoffman
+ M: mhoffman@lightlink.com
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ S: Maintained
+
+ SIS FRAMEBUFFER DRIVER
+@@ -4445,7 +4445,7 @@ S: Maintained
+ VIAPRO SMBUS DRIVER
+ P: Jean Delvare
+ M: khali@linux-fr.org
+-L: i2c@lm-sensors.org
++L: linux-i2c@vger.kernel.org
+ S: Maintained
+
+ VIA VELOCITY NETWORK DRIVER
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008
+Message-Id: <20081104232322.982918778@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Len Sorensen <lsorense@csclub.uwaterloo.ca>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 32/57] scx200_i2c: Add missing class parameter
+Content-Disposition: inline; filename=scx200_i2c-add-missing-class-parameter.patch
+Content-Length: 969
+Lines: 30
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+
+commit 4a029abee0f1d69cb0445657d6fa5a38597bd17d upstream
+
+The scx200_i2c driver is missing the .class parameter, which means no
+i2c drivers are willing to probe for devices on the bus and attach to
+them.
+
+Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/i2c/busses/scx200_i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/i2c/busses/scx200_i2c.c
++++ b/drivers/i2c/busses/scx200_i2c.c
+@@ -81,6 +81,7 @@ static struct i2c_algo_bit_data scx200_i
+
+ static struct i2c_adapter scx200_i2c_ops = {
+ .owner = THIS_MODULE,
++ .class = I2C_CLASS_HWMON | I2C_CLASS_SPD,
+ .id = I2C_HW_B_SCX200,
+ .algo_data = &scx200_i2c_data,
+ .name = "NatSemi SCx200 I2C",
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008
+Message-Id: <20081104232323.155870147@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>,
+ Jaroslav Kysela <perex@perex.cz>,
+ Chris Wedgwood <cw@f00f.org>
+Subject: [patch 33/57] ALSA: use correct lock in snd_ctl_dev_disconnect()
+Content-Disposition: inline; filename=alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch
+Content-Length: 1254
+Lines: 36
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+commit d8009882e9f5e1a76986c741f071edd2ad760c97 upstream
+
+The lock used in snd_ctl_dev_disconnect() should be card->ctl_files_rwlock
+for protection of card->ctl_files entries, instead of card->controls_rwsem.
+
+Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Cc: Chris Wedgwood <cw@f00f.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/control.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1427,12 +1427,12 @@ static int snd_ctl_dev_disconnect(struct
+ cardnum = card->number;
+ snd_assert(cardnum >= 0 && cardnum < SNDRV_CARDS, return -ENXIO);
+
+- down_read(&card->controls_rwsem);
++ read_lock(&card->ctl_files_rwlock);
+ list_for_each_entry(ctl, &card->ctl_files, list) {
+ wake_up(&ctl->change_sleep);
+ kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
+ }
+- up_read(&card->controls_rwsem);
++ read_unlock(&card->ctl_files_rwlock);
+
+ if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL,
+ card, -1)) < 0)
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008
+Message-Id: <20081104232323.311316441@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Boris Dores <babal@via.ecp.fr>,
+ v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
+ Mike Isely <isely@pobox.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 34/57] V4L: pvrusb2: Keep MPEG PTSs from drifting away
+Content-Disposition: inline; filename=v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch
+Content-Length: 1145
+Lines: 34
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Boris Dores <babal@via.ecp.fr>
+
+cherry picked from commit 3f93d1adca658201c64251c43a147cc79d468c3f
+
+V4L: pvrusb2: Keep MPEG PTSs from drifting away
+
+This change was empirically figured out by Boris Dores after
+empirically comparing against behavior in the Windows driver.
+
+Signed-off-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/pvrusb2/pvrusb2-encoder.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/video/pvrusb2/pvrusb2-encoder.c
++++ b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
+@@ -402,6 +402,10 @@ static int pvr2_encoder_prep_config(stru
+ ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 0,3,0,0);
+ ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4,15,0,0,0);
+
++ /* prevent the PTSs from slowly drifting away in the generated
++ MPEG stream */
++ ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC, 2, 4, 1);
++
+ return ret;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008
+Message-Id: <20081104232323.474028821@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
+ Steven Toth <stoth@linuxtv.org>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 35/57] DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits
+Content-Disposition: inline; filename=dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch
+Content-Length: 1847
+Lines: 55
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Steven Toth <stoth@linuxtv.org>
+
+cherry picked from commit 1af46b450fa49c57d73764d66f267335ccd807e2
+
+DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits
+
+Adding a serialmode function to read/and/or/write the register for safety.
+
+Signed-off-by: Steven Toth <stoth@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/s5h1411.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb/frontends/s5h1411.c
++++ b/drivers/media/dvb/frontends/s5h1411.c
+@@ -471,6 +471,20 @@ static int s5h1411_set_spectralinversion
+ return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0x24, val);
+ }
+
++static int s5h1411_set_serialmode(struct dvb_frontend *fe, int serial)
++{
++ struct s5h1411_state *state = fe->demodulator_priv;
++ u16 val;
++
++ dprintk("%s(%d)\n", __func__, serial);
++ val = s5h1411_readreg(state, S5H1411_I2C_TOP_ADDR, 0xbd) & ~0x100;
++
++ if (serial == 1)
++ val |= 0x100;
++
++ return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, val);
++}
++
+ static int s5h1411_enable_modulation(struct dvb_frontend *fe,
+ fe_modulation_t m)
+ {
+@@ -612,10 +626,10 @@ static int s5h1411_init(struct dvb_front
+
+ if (state->config->output_mode == S5H1411_SERIAL_OUTPUT)
+ /* Serial */
+- s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1101);
++ s5h1411_set_serialmode(fe, 1);
+ else
+ /* Parallel */
+- s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1001);
++ s5h1411_set_serialmode(fe, 0);
+
+ s5h1411_set_spectralinversion(fe, state->config->inversion);
+ s5h1411_set_if_freq(fe, state->config->vsb_if);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008
+Message-Id: <20081104232323.644532814@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
+ Steven Toth <stoth@linuxtv.org>,
+ Devin Heitmueller <devin.heitmueller@gmail.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 36/57] DVB: s5h1411: Perform s5h1411 soft reset after tuning
+Content-Disposition: inline; filename=dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch
+Content-Length: 1516
+Lines: 47
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Devin Heitmueller <devin.heitmueller@gmail.com>
+
+cherry picked from commit f0d041e50bc6c8a677922d72b010f80af9b23b18
+
+DVB: s5h1411: Perform s5h1411 soft reset after tuning
+
+If you instruct the tuner to change frequencies, it can take up to 2500ms to
+get a demod lock. By performing a soft reset after the tuning call (which
+is consistent with how the Pinnacle 801e Windows driver behaves), you get
+a demod lock inside of 300ms
+
+Signed-off-by: Devin Heitmueller <devin.heitmueller@gmail.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Acked-by: Steven Toth <stoth@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/s5h1411.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/dvb/frontends/s5h1411.c
++++ b/drivers/media/dvb/frontends/s5h1411.c
+@@ -588,9 +588,6 @@ static int s5h1411_set_frontend(struct d
+
+ s5h1411_enable_modulation(fe, p->u.vsb.modulation);
+
+- /* Allow the demod to settle */
+- msleep(100);
+-
+ if (fe->ops.tuner_ops.set_params) {
+ if (fe->ops.i2c_gate_ctrl)
+ fe->ops.i2c_gate_ctrl(fe, 1);
+@@ -601,6 +598,10 @@ static int s5h1411_set_frontend(struct d
+ fe->ops.i2c_gate_ctrl(fe, 0);
+ }
+
++ /* Issue a reset to the demod so it knows to resync against the
++ newly tuned frequency */
++ s5h1411_softreset(fe);
++
+ return 0;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:23 2008
+Message-Id: <20081104232323.814985552@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
+ Steven Toth <stoth@linuxtv.org>,
+ Devin Heitmueller <devin.heitmueller@gmail.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 37/57] DVB: s5h1411: Power down s5h1411 when not in use
+Content-Disposition: inline; filename=dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch
+Content-Length: 2015
+Lines: 63
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Devin Heitmueller <devin.heitmueller@gmail.com>
+
+cherry picked from commit 11fc9a4a440112b5afc1a99d86ba92d70205a688
+
+DVB: s5h1411: Power down s5h1411 when not in use
+
+Power down the s5h1411 demodulator when not in use
+(on the Pinnacle 801e, this brings idle power from
+123ma down to 84ma).
+
+Signed-off-by: Devin Heitmueller <devin.heitmueller@gmail.com>
+Acked-by: Steven Toth <stoth@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/s5h1411.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb/frontends/s5h1411.c
++++ b/drivers/media/dvb/frontends/s5h1411.c
+@@ -549,7 +549,7 @@ static int s5h1411_set_gpio(struct dvb_f
+ return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xe0, val);
+ }
+
+-static int s5h1411_sleep(struct dvb_frontend *fe, int enable)
++static int s5h1411_set_powerstate(struct dvb_frontend *fe, int enable)
+ {
+ struct s5h1411_state *state = fe->demodulator_priv;
+
+@@ -565,6 +565,11 @@ static int s5h1411_sleep(struct dvb_fron
+ return 0;
+ }
+
++static int s5h1411_sleep(struct dvb_frontend *fe)
++{
++ return s5h1411_set_powerstate(fe, 1);
++}
++
+ static int s5h1411_register_reset(struct dvb_frontend *fe)
+ {
+ struct s5h1411_state *state = fe->demodulator_priv;
+@@ -614,7 +619,7 @@ static int s5h1411_init(struct dvb_front
+
+ dprintk("%s()\n", __func__);
+
+- s5h1411_sleep(fe, 0);
++ s5h1411_set_powerstate(fe, 0);
+ s5h1411_register_reset(fe);
+
+ for (i = 0; i < ARRAY_SIZE(init_tab); i++)
+@@ -878,6 +883,7 @@ static struct dvb_frontend_ops s5h1411_o
+ },
+
+ .init = s5h1411_init,
++ .sleep = s5h1411_sleep,
+ .i2c_gate_ctrl = s5h1411_i2c_gate_ctrl,
+ .set_frontend = s5h1411_set_frontend,
+ .get_frontend = s5h1411_get_frontend,
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008
+Message-Id: <20081104232323.976542478@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Chubb <peterc@gelato.unsw.edu.au>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Bjorn Helgaas <bjorn.helgaas@hp.com>
+Subject: [patch 38/57] PCI: fix 64-vbit prefetchable memory resource BARs
+Content-Disposition: inline; filename=pci-fix-64-vbit-prefetchable-memory-resource-bars.patch
+Content-Length: 1310
+Lines: 37
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Peter Chubb <peterc@gelato.unsw.edu.au>
+
+commit e354597cce8d219d135d65e585dc4f30323486b9 upstream.
+
+Since patch 6ac665c63dcac8fcec534a1d224ecbb8b867ad59 my infiniband
+controller hasn't worked. This is because it has 64-bit prefetchable
+memory, which was mistakenly being taken to be 32-bit memory. The
+resource flags in this case are PCI_BASE_ADDRESS_MEM_TYPE_64 |
+PCI_BASE_ADDRESS_MEM_PREFETCH.
+
+This patch checks only for the PCI_BASE_ADDRESS_MEM_TYPE_64 bit; thus
+whether the region is prefetchable or not is ignored. This fixes my
+Infiniband.
+
+Reviewed-by: Matthew Wilcox <matthew@wil.cx>
+Signed-off-by: Peter Chubb <peterc@gelato.unsw.edu.au>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -219,7 +219,7 @@ static inline enum pci_bar_type decode_b
+
+ res->flags = bar & ~PCI_BASE_ADDRESS_MEM_MASK;
+
+- if (res->flags == PCI_BASE_ADDRESS_MEM_TYPE_64)
++ if (res->flags & PCI_BASE_ADDRESS_MEM_TYPE_64)
+ return pci_bar_mem64;
+ return pci_bar_mem32;
+ }
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008
+Message-Id: <20081104232324.144651614@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Zijlstra <peterz@infradead.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 39/57] sched: disable the hrtick for now
+Content-Disposition: inline; filename=sched-disable-the-hrtick-for-now.patch
+Content-Length: 1070
+Lines: 36
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ingo Molnar <mingo@elte.hu>
+
+commit 0c4b83da58ec2e96ce9c44c211d6eac5f9dae478 upstream
+
+sched: disable the hrtick for now
+
+David Miller reported that hrtick update overhead has tripled the
+wakeup overhead on Sparc64.
+
+That is too much - disable the HRTICK feature for now by default,
+until a faster implementation is found.
+
+Reported-by: David Miller <davem@davemloft.net>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched_features.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/sched_features.h
++++ b/kernel/sched_features.h
+@@ -5,7 +5,7 @@ SCHED_FEAT(START_DEBIT, 1)
+ SCHED_FEAT(AFFINE_WAKEUPS, 1)
+ SCHED_FEAT(CACHE_HOT_BUDDY, 1)
+ SCHED_FEAT(SYNC_WAKEUPS, 1)
+-SCHED_FEAT(HRTICK, 1)
++SCHED_FEAT(HRTICK, 0)
+ SCHED_FEAT(DOUBLE_TICK, 0)
+ SCHED_FEAT(ASYM_GRAN, 1)
+ SCHED_FEAT(LB_BIAS, 1)
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008
+Message-Id: <20081104232324.301439138@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Zijlstra <peterz@infradead.org>,
+ Molnar <mingo@elte.hu>,
+ Ingo@hera.kernel.org,
+ Dave Kleikamp <shaggy@linux.vnet.ibm.com>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>
+Subject: [patch 40/57] sched_clock: prevent scd->clock from moving backwards
+Content-Disposition: inline; filename=sched_clock-prevent-scd-clock-from-moving-backwards.patch
+Content-Length: 1606
+Lines: 45
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+
+commit 5b7dba4ff834259a5623e03a565748704a8fe449 upstream
+
+sched_clock: prevent scd->clock from moving backwards
+
+When sched_clock_cpu() couples the clocks between two cpus, it may
+increment scd->clock beyond the GTOD tick window that __update_sched_clock()
+uses to clamp the clock. A later call to __update_sched_clock() may move
+the clock back to scd->tick_gtod + TICK_NSEC, violating the clock's
+monotonic property.
+
+This patch ensures that scd->clock will not be set backward.
+
+Signed-off-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched_clock.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/sched_clock.c
++++ b/kernel/sched_clock.c
+@@ -118,13 +118,13 @@ static u64 __update_sched_clock(struct s
+
+ /*
+ * scd->clock = clamp(scd->tick_gtod + delta,
+- * max(scd->tick_gtod, scd->clock),
+- * scd->tick_gtod + TICK_NSEC);
++ * max(scd->tick_gtod, scd->clock),
++ * max(scd->clock, scd->tick_gtod + TICK_NSEC));
+ */
+
+ clock = scd->tick_gtod + delta;
+ min_clock = wrap_max(scd->tick_gtod, scd->clock);
+- max_clock = scd->tick_gtod + TICK_NSEC;
++ max_clock = wrap_max(scd->clock, scd->tick_gtod + TICK_NSEC);
+
+ clock = wrap_max(clock, min_clock);
+ clock = wrap_min(clock, max_clock);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008
+Message-Id: <20081104232324.459449593@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ David Rientjes <rientjes@google.com>
+Subject: [patch 41/57] x86: avoid dereferencing beyond stack + THREAD_SIZE
+Content-Disposition: inline; filename=x86-avoid-dereferencing-beyond-stack-thread_size.patch
+Content-Length: 1345
+Lines: 39
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Rientjes <rientjes@google.com>
+
+commit e1e23bb0513520035ec934fa3483507cb6648b7c upstream
+
+x86: avoid dereferencing beyond stack + THREAD_SIZE
+
+It's possible for get_wchan() to dereference past task->stack + THREAD_SIZE
+while iterating through instruction pointers if fp equals the upper boundary,
+causing a kernel panic.
+
+Signed-off-by: David Rientjes <rientjes@google.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/process_64.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -729,12 +729,12 @@ unsigned long get_wchan(struct task_stru
+ if (!p || p == current || p->state==TASK_RUNNING)
+ return 0;
+ stack = (unsigned long)task_stack_page(p);
+- if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
++ if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
+ return 0;
+ fp = *(u64 *)(p->thread.sp);
+ do {
+ if (fp < (unsigned long)stack ||
+- fp > (unsigned long)stack+THREAD_SIZE)
++ fp >= (unsigned long)stack+THREAD_SIZE)
+ return 0;
+ ip = *(u64 *)(fp+8);
+ if (!in_sched_functions(ip))
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008
+Message-Id: <20081104232324.618853017@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <dbrownell@users.sourceforge.net>,
+ Bjorn Helgaas <bjorn.helgaas@hp.com>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 42/57] rtc-cmos: look for PNP RTC first, then for platform RTC
+Content-Disposition: inline; filename=rtc-cmos-look-for-pnp-rtc-first-then-for-platform-rtc.patch
+Content-Length: 2704
+Lines: 91
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bjorn Helgaas <bjorn.helgaas@hp.com>
+
+commit 72f22b1eb6ca5e4676a632a04d40d46cb61d4562 upstream
+
+rtc-cmos: look for PNP RTC first, then for platform RTC
+
+We shouldn't rely on "pnp_platform_devices" to tell us whether there
+is a PNP RTC device.
+
+I introduced "pnp_platform_devices", but I think it was a mistake.
+All it tells us is whether we found any PNPBIOS or PNPACPI devices.
+Many machines have some PNP devices, but do not describe the RTC
+via PNP. On those machines, we need to do the platform driver probe
+to find the RTC.
+
+We should just register the PNP driver and see whether it claims anything.
+If we don't find a PNP RTC, fall back to the platform driver probe.
+
+This (in conjunction with the arch/x86/kernel/rtc.c patch to add
+a platform RTC device when PNP doesn't have one) should resolve
+these issues:
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=11580
+ https://bugzilla.redhat.com/show_bug.cgi?id=451188
+
+Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: David Brownell <dbrownell@users.sourceforge.net>
+Reported-by: Rik Theys <rik.theys@esat.kuleuven.be>
+Reported-by: shr_msn@yahoo.com.tw
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-cmos.c | 33 ++++++++++++++++++---------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -1030,29 +1030,32 @@ static struct platform_driver cmos_platf
+
+ static int __init cmos_init(void)
+ {
++ int retval = 0;
++
++#ifdef CONFIG_PNP
++ pnp_register_driver(&cmos_pnp_driver);
++#endif
++
++ if (!cmos_rtc.dev)
++ retval = platform_driver_probe(&cmos_platform_driver,
++ cmos_platform_probe);
++
++ if (retval == 0)
++ return 0;
++
+ #ifdef CONFIG_PNP
+- if (pnp_platform_devices)
+- return pnp_register_driver(&cmos_pnp_driver);
+- else
+- return platform_driver_probe(&cmos_platform_driver,
+- cmos_platform_probe);
+-#else
+- return platform_driver_probe(&cmos_platform_driver,
+- cmos_platform_probe);
+-#endif /* CONFIG_PNP */
++ pnp_unregister_driver(&cmos_pnp_driver);
++#endif
++ return retval;
+ }
+ module_init(cmos_init);
+
+ static void __exit cmos_exit(void)
+ {
+ #ifdef CONFIG_PNP
+- if (pnp_platform_devices)
+- pnp_unregister_driver(&cmos_pnp_driver);
+- else
+- platform_driver_unregister(&cmos_platform_driver);
+-#else
++ pnp_unregister_driver(&cmos_pnp_driver);
++#endif
+ platform_driver_unregister(&cmos_platform_driver);
+-#endif /* CONFIG_PNP */
+ }
+ module_exit(cmos_exit);
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:24 2008
+Message-Id: <20081104232324.778794289@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Phil Dibowitz <phil@ipom.com>,
+ Alexandre Oliva <oliva@lsd.ic.unicamp.br>
+Subject: [patch 43/57] USB: storage: Avoid I/O errors when issuing SCSI ioctls to JMicron USB/ATA bridge
+Content-Disposition: inline; filename=usb-storage-avoid-i-o-errors-when-issuing-scsi-ioctls-to-jmicron-usb-ata-bridge.patch
+Content-Length: 2149
+Lines: 56
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Phil Dibowitz <phil@ipom.com>
+
+commit 3030ca4cf4abbdd2dd850a14d20e9fca5937ffb5 upstream
+
+USB: storage: Avoid I/O errors when issuing SCSI ioctls to JMicron USB/ATA bridge
+
+Here's the patch that implements the fix you suggested to avoid the
+I/O errors that I was running into with my new USB enclosure with a
+JMicron USB/ATA bridge, while issuing scsi-io USN or other such
+queries used by Fedora's mkinitrd.
+http://bugzilla.kernel.org/show_bug.cgi?id=9638#c85
+
+
+/proc/bus/usb/devices:
+T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=04 Dev#= 5 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=152d ProdID=2329 Rev= 1.00
+S: Manufacturer=JMicron
+S: Product=USB to ATA/ATAPI Bridge
+S: SerialNumber=DE5088854FFF
+C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr= 2mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+(patch applied and retested on a modified 2.6.27.2-libre.24.rc1.fc10)
+
+Signed-off-by: Phil Dibowitz <phil@ipom.com>
+Cc: Alexandre Oliva <oliva@lsd.ic.unicamp.br>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1745,6 +1745,15 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE ),
+
++/* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
++ * JMicron responds to USN and several other SCSI ioctls with a
++ * residue that causes subsequent I/O requests to fail. */
++UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
++ "JMicron",
++ "USB to ATA/ATAPI Bridge",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_IGNORE_RESIDUE ),
++
+ /* Reported by Robert Schedel <r.schedel@yahoo.de>
+ * Note: this is a 'super top' device like the above 14cd/6600 device */
+ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008
+Message-Id: <20081104232324.943633265@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <dbrownell@users.sourceforge.net>,
+ Bjorn Helgaas <bjorn.helgaas@hp.com>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 44/57] x86: register a platform RTC device if PNP doesnt describe it
+Content-Disposition: inline; filename=x86-register-a-platform-rtc-device-if-pnp-doesn-t-describe-it.patch
+Content-Length: 2071
+Lines: 65
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bjorn Helgaas <bjorn.helgaas@hp.com>
+
+commit 758a7f7bb86b520aadc484f23da85e547b3bf3d8 upstream
+
+x86: register a platform RTC device if PNP doesn't describe it
+
+Most if not all x86 platforms have an RTC device, but sometimes the RTC
+is not exposed as a PNP0b00/PNP0b01/PNP0b02 device in PNPBIOS or ACPI:
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=11580
+ https://bugzilla.redhat.com/show_bug.cgi?id=451188
+
+It's best if we can discover the RTC via PNP because then we know
+which flavor of device it is, where it lives, and which IRQ it uses.
+
+But if we can't, we should register a platform device using the
+compiled-in RTC_PORT/RTC_IRQ resource assumptions.
+
+Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: David Brownell <dbrownell@users.sourceforge.net>
+Reported-by: Rik Theys <rik.theys@esat.kuleuven.be>
+Reported-by: shr_msn@yahoo.com.tw
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/rtc.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kernel/rtc.c
++++ b/arch/x86/kernel/rtc.c
+@@ -223,11 +223,25 @@ static struct platform_device rtc_device
+ static __init int add_rtc_cmos(void)
+ {
+ #ifdef CONFIG_PNP
+- if (!pnp_platform_devices)
+- platform_device_register(&rtc_device);
+-#else
++ static const char *ids[] __initconst =
++ { "PNP0b00", "PNP0b01", "PNP0b02", };
++ struct pnp_dev *dev;
++ struct pnp_id *id;
++ int i;
++
++ pnp_for_each_dev(dev) {
++ for (id = dev->id; id; id = id->next) {
++ for (i = 0; i < ARRAY_SIZE(ids); i++) {
++ if (compare_pnp_id(id, ids[i]) != 0)
++ return 0;
++ }
++ }
++ }
++#endif
++
+ platform_device_register(&rtc_device);
+-#endif /* CONFIG_PNP */
++ dev_info(&rtc_device.dev,
++ "registered platform RTC device (no PNP device found)\n");
+ return 0;
+ }
+ device_initcall(add_rtc_cmos);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008
+Message-Id: <20081104232325.109638649@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikael Pettersson <mikpe@it.uu.se>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 45/57] sata_promise: add ATA engine reset to reset ops
+Content-Disposition: inline; filename=sata_promise-add-ata-engine-reset-to-reset-ops.patch
+Content-Length: 2945
+Lines: 79
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mikael Pettersson <mikpe@it.uu.se>
+
+commit cadef677e4a9b9c1d069675043767df486782986 upstream
+
+Promise ATA engines need to be reset when errors occur.
+That's currently done for errors detected by sata_promise itself,
+but it's not done for errors like timeouts detected outside of
+the low-level driver.
+
+The effect of this omission is that a timeout tends to result
+in a sequence of failed COMRESETs after which libata EH gives
+up and disables the port. At that point the port's ATA engine
+hangs and even reloading the driver will not resume it.
+
+To fix this, make sata_promise override ->hardreset on SATA
+ports with code which calls pdc_reset_port() on the port in
+question before calling libata's hardreset. PATA ports don't
+use ->hardreset, so for those we override ->softreset instead.
+
+Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_promise.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/ata/sata_promise.c
++++ b/drivers/ata/sata_promise.c
+@@ -153,6 +153,10 @@ static void pdc_freeze(struct ata_port *
+ static void pdc_sata_freeze(struct ata_port *ap);
+ static void pdc_thaw(struct ata_port *ap);
+ static void pdc_sata_thaw(struct ata_port *ap);
++static int pdc_pata_softreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline);
++static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline);
+ static void pdc_error_handler(struct ata_port *ap);
+ static void pdc_post_internal_cmd(struct ata_queued_cmd *qc);
+ static int pdc_pata_cable_detect(struct ata_port *ap);
+@@ -186,6 +190,7 @@ static struct ata_port_operations pdc_sa
+ .scr_read = pdc_sata_scr_read,
+ .scr_write = pdc_sata_scr_write,
+ .port_start = pdc_sata_port_start,
++ .hardreset = pdc_sata_hardreset,
+ };
+
+ /* First-generation chips need a more restrictive ->check_atapi_dma op */
+@@ -200,6 +205,7 @@ static struct ata_port_operations pdc_pa
+ .freeze = pdc_freeze,
+ .thaw = pdc_thaw,
+ .port_start = pdc_common_port_start,
++ .softreset = pdc_pata_softreset,
+ };
+
+ static const struct ata_port_info pdc_port_info[] = {
+@@ -691,6 +697,20 @@ static void pdc_sata_thaw(struct ata_por
+ readl(host_mmio + hotplug_offset); /* flush */
+ }
+
++static int pdc_pata_softreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline)
++{
++ pdc_reset_port(link->ap);
++ return ata_sff_softreset(link, class, deadline);
++}
++
++static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline)
++{
++ pdc_reset_port(link->ap);
++ return sata_sff_hardreset(link, class, deadline);
++}
++
+ static void pdc_error_handler(struct ata_port *ap)
+ {
+ if (!(ap->pflags & ATA_PFLAG_FROZEN))
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008
+Message-Id: <20081104232325.303788739@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 46/57] sata_nv: fix generic, nf2/3 detection regression
+Content-Disposition: inline; filename=sata_nv-fix-generic-nf2-3-detection-regression.patch
+Content-Length: 5029
+Lines: 146
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+commit 3c324283e6cdb79210cf7975c3e40d3ba3e672b2 upstream
+
+All three flavors of sata_nv's are different in how their hardreset
+behaves.
+
+* generic: Hardreset is not reliable. Link often doesn't come online
+ after hardreset.
+
+* nf2/3: A little bit better - link comes online with longer debounce
+ timing. However, nf2/3 can't reliable wait for the first D2H
+ Register FIS, so it can't wait for device readiness or classify the
+ device after hardreset. Follow-up SRST required.
+
+* ck804: Hardreset finally works.
+
+The core layer change to prefer hardreset and follow up changes
+exposed the above issues and caused various detection regressions for
+all three flavors. This patch, hopefully, fixes all the known issues
+and should make sata_nv error handling more reliable.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_nv.c | 53 +++++++++++++++++++++++---------------------------
+ 1 file changed, 25 insertions(+), 28 deletions(-)
+
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -307,10 +307,10 @@ static int nv_scr_write(struct ata_port
+
+ static void nv_nf2_freeze(struct ata_port *ap);
+ static void nv_nf2_thaw(struct ata_port *ap);
++static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline);
+ static void nv_ck804_freeze(struct ata_port *ap);
+ static void nv_ck804_thaw(struct ata_port *ap);
+-static int nv_hardreset(struct ata_link *link, unsigned int *class,
+- unsigned long deadline);
+ static int nv_adma_slave_config(struct scsi_device *sdev);
+ static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
+ static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
+@@ -405,17 +405,8 @@ static struct scsi_host_template nv_swnc
+ .slave_configure = nv_swncq_slave_config,
+ };
+
+-/* OSDL bz3352 reports that some nv controllers can't determine device
+- * signature reliably and nv_hardreset is implemented to work around
+- * the problem. This was reported on nf3 and it's unclear whether any
+- * other controllers are affected. However, the workaround has been
+- * applied to all variants and there isn't much to gain by trying to
+- * find out exactly which ones are affected at this point especially
+- * because NV has moved over to ahci for newer controllers.
+- */
+ static struct ata_port_operations nv_common_ops = {
+ .inherits = &ata_bmdma_port_ops,
+- .hardreset = nv_hardreset,
+ .scr_read = nv_scr_read,
+ .scr_write = nv_scr_write,
+ };
+@@ -429,12 +420,22 @@ static struct ata_port_operations nv_gen
+ .hardreset = ATA_OP_NULL,
+ };
+
++/* OSDL bz3352 reports that nf2/3 controllers can't determine device
++ * signature reliably. Also, the following thread reports detection
++ * failure on cold boot with the standard debouncing timing.
++ *
++ * http://thread.gmane.org/gmane.linux.ide/34098
++ *
++ * Debounce with hotplug timing and request follow-up SRST.
++ */
+ static struct ata_port_operations nv_nf2_ops = {
+ .inherits = &nv_common_ops,
+ .freeze = nv_nf2_freeze,
+ .thaw = nv_nf2_thaw,
++ .hardreset = nv_nf2_hardreset,
+ };
+
++/* CK804 finally gets hardreset right */
+ static struct ata_port_operations nv_ck804_ops = {
+ .inherits = &nv_common_ops,
+ .freeze = nv_ck804_freeze,
+@@ -443,7 +444,7 @@ static struct ata_port_operations nv_ck8
+ };
+
+ static struct ata_port_operations nv_adma_ops = {
+- .inherits = &nv_common_ops,
++ .inherits = &nv_ck804_ops,
+
+ .check_atapi_dma = nv_adma_check_atapi_dma,
+ .sff_tf_read = nv_adma_tf_read,
+@@ -467,7 +468,7 @@ static struct ata_port_operations nv_adm
+ };
+
+ static struct ata_port_operations nv_swncq_ops = {
+- .inherits = &nv_common_ops,
++ .inherits = &nv_generic_ops,
+
+ .qc_defer = ata_std_qc_defer,
+ .qc_prep = nv_swncq_qc_prep,
+@@ -1553,6 +1554,17 @@ static void nv_nf2_thaw(struct ata_port
+ iowrite8(mask, scr_addr + NV_INT_ENABLE);
+ }
+
++static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline)
++{
++ bool online;
++ int rc;
++
++ rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
++ &online, NULL);
++ return online ? -EAGAIN : rc;
++}
++
+ static void nv_ck804_freeze(struct ata_port *ap)
+ {
+ void __iomem *mmio_base = ap->host->iomap[NV_MMIO_BAR];
+@@ -1605,21 +1617,6 @@ static void nv_mcp55_thaw(struct ata_por
+ ata_sff_thaw(ap);
+ }
+
+-static int nv_hardreset(struct ata_link *link, unsigned int *class,
+- unsigned long deadline)
+-{
+- int rc;
+-
+- /* SATA hardreset fails to retrieve proper device signature on
+- * some controllers. Request follow up SRST. For more info,
+- * see http://bugzilla.kernel.org/show_bug.cgi?id=3352
+- */
+- rc = sata_sff_hardreset(link, class, deadline);
+- if (rc)
+- return rc;
+- return -EAGAIN;
+-}
+-
+ static void nv_adma_error_handler(struct ata_port *ap)
+ {
+ struct nv_adma_port_priv *pp = ap->private_data;
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008
+Message-Id: <20081104232325.485611718@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Starikovskiy <astarikovskiy@suse.de>,
+ Len Brown <len.brown@intel.com>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 47/57] ACPI: EC: do transaction from interrupt context
+Content-Disposition: inline; filename=acpi-ec-do-transaction-from-interrupt-context.patch
+Content-Length: 16282
+Lines: 532
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alexey Starikovskiy <astarikovskiy@suse.de>
+
+commit 7c6db4e050601f359081fde418ca6dc4fc2d0011 upstream.
+
+It is easier and faster to do transaction directly from interrupt context
+rather than waking control thread.
+Also, cleaner GPE storm avoidance is implemented.
+References: http://bugzilla.kernel.org/show_bug.cgi?id=9998
+ http://bugzilla.kernel.org/show_bug.cgi?id=10724
+ http://bugzilla.kernel.org/show_bug.cgi?id=10919
+ http://bugzilla.kernel.org/show_bug.cgi?id=11309
+ http://bugzilla.kernel.org/show_bug.cgi?id=11549
+
+Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
+Tested-by: Sitsofe Wheeler <sitsofe@yahoo.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/ec.c | 309 ++++++++++++++++++++++++++----------------------------
+ 1 file changed, 149 insertions(+), 160 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1,7 +1,7 @@
+ /*
+- * ec.c - ACPI Embedded Controller Driver (v2.0)
++ * ec.c - ACPI Embedded Controller Driver (v2.1)
+ *
+- * Copyright (C) 2006, 2007 Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>
++ * Copyright (C) 2006-2008 Alexey Starikovskiy <astarikovskiy@suse.de>
+ * Copyright (C) 2006 Denis Sadykov <denis.m.sadykov@intel.com>
+ * Copyright (C) 2004 Luming Yu <luming.yu@intel.com>
+ * Copyright (C) 2001, 2002 Andy Grover <andrew.grover@intel.com>
+@@ -26,7 +26,7 @@
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+
+-/* Uncomment next line to get verbose print outs*/
++/* Uncomment next line to get verbose printout */
+ /* #define DEBUG */
+
+ #include <linux/kernel.h>
+@@ -38,6 +38,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/interrupt.h>
+ #include <linux/list.h>
++#include <linux/spinlock.h>
+ #include <asm/io.h>
+ #include <acpi/acpi_bus.h>
+ #include <acpi/acpi_drivers.h>
+@@ -65,22 +66,21 @@ enum ec_command {
+ ACPI_EC_COMMAND_QUERY = 0x84,
+ };
+
+-/* EC events */
+-enum ec_event {
+- ACPI_EC_EVENT_OBF_1 = 1, /* Output buffer full */
+- ACPI_EC_EVENT_IBF_0, /* Input buffer empty */
+-};
+-
+ #define ACPI_EC_DELAY 500 /* Wait 500ms max. during EC ops */
+ #define ACPI_EC_UDELAY_GLK 1000 /* Wait 1ms max. to get global lock */
+ #define ACPI_EC_UDELAY 100 /* Wait 100us before polling EC again */
+
++#define ACPI_EC_STORM_THRESHOLD 20 /* number of false interrupts
++ per one transaction */
++
+ enum {
+- EC_FLAGS_WAIT_GPE = 0, /* Don't check status until GPE arrives */
+ EC_FLAGS_QUERY_PENDING, /* Query is pending */
+- EC_FLAGS_GPE_MODE, /* Expect GPE to be sent for status change */
++ EC_FLAGS_GPE_MODE, /* Expect GPE to be sent
++ * for status change */
+ EC_FLAGS_NO_GPE, /* Don't use GPE mode */
+- EC_FLAGS_RESCHEDULE_POLL /* Re-schedule poll */
++ EC_FLAGS_GPE_STORM, /* GPE storm detected */
++ EC_FLAGS_HANDLERS_INSTALLED /* Handlers for GPE and
++ * OpReg are installed */
+ };
+
+ /* If we find an EC via the ECDT, we need to keep a ptr to its context */
+@@ -95,6 +95,14 @@ struct acpi_ec_query_handler {
+ u8 query_bit;
+ };
+
++struct transaction_data {
++ const u8 *wdata;
++ u8 *rdata;
++ unsigned short irq_count;
++ u8 wlen;
++ u8 rlen;
++};
++
+ static struct acpi_ec {
+ acpi_handle handle;
+ unsigned long gpe;
+@@ -105,9 +113,8 @@ static struct acpi_ec {
+ struct mutex lock;
+ wait_queue_head_t wait;
+ struct list_head list;
+- struct delayed_work work;
+- atomic_t irq_count;
+- u8 handlers_installed;
++ struct transaction_data *t;
++ spinlock_t t_lock;
+ } *boot_ec, *first_ec;
+
+ /*
+@@ -150,7 +157,7 @@ static inline u8 acpi_ec_read_data(struc
+ {
+ u8 x = inb(ec->data_addr);
+ pr_debug(PREFIX "---> data = 0x%2.2x\n", x);
+- return inb(ec->data_addr);
++ return x;
+ }
+
+ static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command)
+@@ -165,68 +172,79 @@ static inline void acpi_ec_write_data(st
+ outb(data, ec->data_addr);
+ }
+
+-static inline int acpi_ec_check_status(struct acpi_ec *ec, enum ec_event event)
++static int ec_transaction_done(struct acpi_ec *ec)
+ {
+- if (test_bit(EC_FLAGS_WAIT_GPE, &ec->flags))
+- return 0;
+- if (event == ACPI_EC_EVENT_OBF_1) {
+- if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_OBF)
+- return 1;
+- } else if (event == ACPI_EC_EVENT_IBF_0) {
+- if (!(acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF))
+- return 1;
+- }
+-
+- return 0;
++ unsigned long flags;
++ int ret = 0;
++ spin_lock_irqsave(&ec->t_lock, flags);
++ if (!ec->t || (!ec->t->wlen && !ec->t->rlen))
++ ret = 1;
++ spin_unlock_irqrestore(&ec->t_lock, flags);
++ return ret;
+ }
+
+-static void ec_schedule_ec_poll(struct acpi_ec *ec)
++static void gpe_transaction(struct acpi_ec *ec, u8 status)
+ {
+- if (test_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags))
+- schedule_delayed_work(&ec->work,
+- msecs_to_jiffies(ACPI_EC_DELAY));
++ unsigned long flags;
++ spin_lock_irqsave(&ec->t_lock, flags);
++ if (!ec->t)
++ goto unlock;
++ if (ec->t->wlen > 0) {
++ if ((status & ACPI_EC_FLAG_IBF) == 0) {
++ acpi_ec_write_data(ec, *(ec->t->wdata++));
++ --ec->t->wlen;
++ } else
++ /* false interrupt, state didn't change */
++ ++ec->t->irq_count;
++
++ } else if (ec->t->rlen > 0) {
++ if ((status & ACPI_EC_FLAG_OBF) == 1) {
++ *(ec->t->rdata++) = acpi_ec_read_data(ec);
++ --ec->t->rlen;
++ } else
++ /* false interrupt, state didn't change */
++ ++ec->t->irq_count;
++ }
++unlock:
++ spin_unlock_irqrestore(&ec->t_lock, flags);
+ }
+
+-static void ec_switch_to_poll_mode(struct acpi_ec *ec)
++static int acpi_ec_wait(struct acpi_ec *ec)
+ {
++ if (wait_event_timeout(ec->wait, ec_transaction_done(ec),
++ msecs_to_jiffies(ACPI_EC_DELAY)))
++ return 0;
++ /* missing GPEs, switch back to poll mode */
++ if (printk_ratelimit())
++ pr_info(PREFIX "missing confirmations, "
++ "switch off interrupt mode.\n");
+ set_bit(EC_FLAGS_NO_GPE, &ec->flags);
+ clear_bit(EC_FLAGS_GPE_MODE, &ec->flags);
+- acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
+- set_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
++ return 1;
+ }
+
+-static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, int force_poll)
++static void acpi_ec_gpe_query(void *ec_cxt);
++
++static int ec_check_sci(struct acpi_ec *ec, u8 state)
+ {
+- atomic_set(&ec->irq_count, 0);
+- if (likely(test_bit(EC_FLAGS_GPE_MODE, &ec->flags)) &&
+- likely(!force_poll)) {
+- if (wait_event_timeout(ec->wait, acpi_ec_check_status(ec, event),
+- msecs_to_jiffies(ACPI_EC_DELAY)))
+- return 0;
+- clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
+- if (acpi_ec_check_status(ec, event)) {
+- /* missing GPEs, switch back to poll mode */
+- if (printk_ratelimit())
+- pr_info(PREFIX "missing confirmations, "
+- "switch off interrupt mode.\n");
+- ec_switch_to_poll_mode(ec);
+- ec_schedule_ec_poll(ec);
+- return 0;
+- }
+- } else {
+- unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
+- clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
+- while (time_before(jiffies, delay)) {
+- if (acpi_ec_check_status(ec, event))
+- return 0;
+- msleep(1);
+- }
+- if (acpi_ec_check_status(ec,event))
++ if (state & ACPI_EC_FLAG_SCI) {
++ if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
++ return acpi_os_execute(OSL_EC_BURST_HANDLER,
++ acpi_ec_gpe_query, ec);
++ }
++ return 0;
++}
++
++static int ec_poll(struct acpi_ec *ec)
++{
++ unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
++ msleep(1);
++ while (time_before(jiffies, delay)) {
++ gpe_transaction(ec, acpi_ec_read_status(ec));
++ msleep(1);
++ if (ec_transaction_done(ec))
+ return 0;
+ }
+- pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n",
+- acpi_ec_read_status(ec),
+- (event == ACPI_EC_EVENT_OBF_1) ? "\"b0=1\"" : "\"b1=0\"");
+ return -ETIME;
+ }
+
+@@ -235,45 +253,51 @@ static int acpi_ec_transaction_unlocked(
+ u8 * rdata, unsigned rdata_len,
+ int force_poll)
+ {
+- int result = 0;
+- set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
++ unsigned long tmp;
++ struct transaction_data t = {.wdata = wdata, .rdata = rdata,
++ .wlen = wdata_len, .rlen = rdata_len,
++ .irq_count = 0};
++ int ret = 0;
+ pr_debug(PREFIX "transaction start\n");
++ /* disable GPE during transaction if storm is detected */
++ if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
++ clear_bit(EC_FLAGS_GPE_MODE, &ec->flags);
++ acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
++ }
++ /* start transaction */
++ spin_lock_irqsave(&ec->t_lock, tmp);
++ /* following two actions should be kept atomic */
++ ec->t = &t;
+ acpi_ec_write_cmd(ec, command);
+- for (; wdata_len > 0; --wdata_len) {
+- result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll);
+- if (result) {
+- pr_err(PREFIX
+- "write_cmd timeout, command = %d\n", command);
+- goto end;
+- }
+- set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
+- acpi_ec_write_data(ec, *(wdata++));
+- }
+-
+- if (!rdata_len) {
+- result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll);
+- if (result) {
+- pr_err(PREFIX
+- "finish-write timeout, command = %d\n", command);
+- goto end;
+- }
+- } else if (command == ACPI_EC_COMMAND_QUERY)
++ if (command == ACPI_EC_COMMAND_QUERY)
+ clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+-
+- for (; rdata_len > 0; --rdata_len) {
+- result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1, force_poll);
+- if (result) {
+- pr_err(PREFIX "read timeout, command = %d\n", command);
+- goto end;
+- }
+- /* Don't expect GPE after last read */
+- if (rdata_len > 1)
+- set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
+- *(rdata++) = acpi_ec_read_data(ec);
+- }
+- end:
++ spin_unlock_irqrestore(&ec->t_lock, tmp);
++ /* if we selected poll mode or failed in GPE-mode do a poll loop */
++ if (force_poll ||
++ !test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ||
++ acpi_ec_wait(ec))
++ ret = ec_poll(ec);
+ pr_debug(PREFIX "transaction end\n");
+- return result;
++ spin_lock_irqsave(&ec->t_lock, tmp);
++ ec->t = NULL;
++ spin_unlock_irqrestore(&ec->t_lock, tmp);
++ if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
++ /* check if we received SCI during transaction */
++ ec_check_sci(ec, acpi_ec_read_status(ec));
++ /* it is safe to enable GPE outside of transaction */
++ acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
++ } else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
++ t.irq_count > ACPI_EC_STORM_THRESHOLD) {
++ pr_debug(PREFIX "GPE storm detected\n");
++ set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
++ }
++ return ret;
++}
++
++static int ec_check_ibf0(struct acpi_ec *ec)
++{
++ u8 status = acpi_ec_read_status(ec);
++ return (status & ACPI_EC_FLAG_IBF) == 0;
+ }
+
+ static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
+@@ -283,40 +307,34 @@ static int acpi_ec_transaction(struct ac
+ {
+ int status;
+ u32 glk;
+-
+ if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata))
+ return -EINVAL;
+-
+ if (rdata)
+ memset(rdata, 0, rdata_len);
+-
+ mutex_lock(&ec->lock);
+ if (ec->global_lock) {
+ status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
+ if (ACPI_FAILURE(status)) {
+- mutex_unlock(&ec->lock);
+- return -ENODEV;
++ status = -ENODEV;
++ goto unlock;
+ }
+ }
+-
+- status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, 0);
+- if (status) {
++ if (!wait_event_timeout(ec->wait, ec_check_ibf0(ec),
++ msecs_to_jiffies(ACPI_EC_DELAY))) {
+ pr_err(PREFIX "input buffer is not empty, "
+ "aborting transaction\n");
++ status = -ETIME;
+ goto end;
+ }
+-
+ status = acpi_ec_transaction_unlocked(ec, command,
+ wdata, wdata_len,
+ rdata, rdata_len,
+ force_poll);
+-
+- end:
+-
++end:
+ if (ec->global_lock)
+ acpi_release_global_lock(glk);
++unlock:
+ mutex_unlock(&ec->lock);
+-
+ return status;
+ }
+
+@@ -332,7 +350,9 @@ int acpi_ec_burst_enable(struct acpi_ec
+
+ int acpi_ec_burst_disable(struct acpi_ec *ec)
+ {
+- return acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE, NULL, 0, NULL, 0, 0);
++ return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ?
++ acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE,
++ NULL, 0, NULL, 0, 0) : 0;
+ }
+
+ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
+@@ -513,46 +533,26 @@ static void acpi_ec_gpe_query(void *ec_c
+
+ static u32 acpi_ec_gpe_handler(void *data)
+ {
+- acpi_status status = AE_OK;
+ struct acpi_ec *ec = data;
+- u8 state = acpi_ec_read_status(ec);
++ u8 status;
+
+ pr_debug(PREFIX "~~~> interrupt\n");
+- atomic_inc(&ec->irq_count);
+- if (atomic_read(&ec->irq_count) > 5) {
+- pr_err(PREFIX "GPE storm detected, disabling EC GPE\n");
+- ec_switch_to_poll_mode(ec);
+- goto end;
+- }
+- clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
+- if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags))
++ status = acpi_ec_read_status(ec);
++
++ gpe_transaction(ec, status);
++ if (ec_transaction_done(ec) && (status & ACPI_EC_FLAG_IBF) == 0)
+ wake_up(&ec->wait);
+
+- if (state & ACPI_EC_FLAG_SCI) {
+- if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
+- status = acpi_os_execute(OSL_EC_BURST_HANDLER,
+- acpi_ec_gpe_query, ec);
+- } else if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
+- !test_bit(EC_FLAGS_NO_GPE, &ec->flags) &&
+- in_interrupt()) {
++ ec_check_sci(ec, status);
++ if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
++ !test_bit(EC_FLAGS_NO_GPE, &ec->flags)) {
+ /* this is non-query, must be confirmation */
+ if (printk_ratelimit())
+ pr_info(PREFIX "non-query interrupt received,"
+ " switching to interrupt mode\n");
+ set_bit(EC_FLAGS_GPE_MODE, &ec->flags);
+- clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
+ }
+-end:
+- ec_schedule_ec_poll(ec);
+- return ACPI_SUCCESS(status) ?
+- ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED;
+-}
+-
+-static void do_ec_poll(struct work_struct *work)
+-{
+- struct acpi_ec *ec = container_of(work, struct acpi_ec, work.work);
+- atomic_set(&ec->irq_count, 0);
+- (void)acpi_ec_gpe_handler(ec);
++ return ACPI_INTERRUPT_HANDLED;
+ }
+
+ /* --------------------------------------------------------------------------
+@@ -696,8 +696,7 @@ static struct acpi_ec *make_acpi_ec(void
+ mutex_init(&ec->lock);
+ init_waitqueue_head(&ec->wait);
+ INIT_LIST_HEAD(&ec->list);
+- INIT_DELAYED_WORK_DEFERRABLE(&ec->work, do_ec_poll);
+- atomic_set(&ec->irq_count, 0);
++ spin_lock_init(&ec->t_lock);
+ return ec;
+ }
+
+@@ -736,22 +735,15 @@ ec_parse_device(acpi_handle handle, u32
+ return AE_CTRL_TERMINATE;
+ }
+
+-static void ec_poll_stop(struct acpi_ec *ec)
+-{
+- clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
+- cancel_delayed_work(&ec->work);
+-}
+-
+ static void ec_remove_handlers(struct acpi_ec *ec)
+ {
+- ec_poll_stop(ec);
+ if (ACPI_FAILURE(acpi_remove_address_space_handler(ec->handle,
+ ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
+ pr_err(PREFIX "failed to remove space handler\n");
+ if (ACPI_FAILURE(acpi_remove_gpe_handler(NULL, ec->gpe,
+ &acpi_ec_gpe_handler)))
+ pr_err(PREFIX "failed to remove gpe handler\n");
+- ec->handlers_installed = 0;
++ clear_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
+ }
+
+ static int acpi_ec_add(struct acpi_device *device)
+@@ -846,17 +838,15 @@ ec_parse_io_ports(struct acpi_resource *
+ static int ec_install_handlers(struct acpi_ec *ec)
+ {
+ acpi_status status;
+- if (ec->handlers_installed)
++ if (test_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags))
+ return 0;
+ status = acpi_install_gpe_handler(NULL, ec->gpe,
+- ACPI_GPE_EDGE_TRIGGERED,
+- &acpi_ec_gpe_handler, ec);
++ ACPI_GPE_EDGE_TRIGGERED,
++ &acpi_ec_gpe_handler, ec);
+ if (ACPI_FAILURE(status))
+ return -ENODEV;
+-
+ acpi_set_gpe_type(NULL, ec->gpe, ACPI_GPE_TYPE_RUNTIME);
+ acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
+-
+ status = acpi_install_address_space_handler(ec->handle,
+ ACPI_ADR_SPACE_EC,
+ &acpi_ec_space_handler,
+@@ -866,7 +856,7 @@ static int ec_install_handlers(struct ac
+ return -ENODEV;
+ }
+
+- ec->handlers_installed = 1;
++ set_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
+ return 0;
+ }
+
+@@ -887,7 +877,6 @@ static int acpi_ec_start(struct acpi_dev
+
+ /* EC is fully operational, allow queries */
+ clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+- ec_schedule_ec_poll(ec);
+ return ret;
+ }
+
+@@ -906,7 +895,7 @@ static int acpi_ec_stop(struct acpi_devi
+
+ int __init acpi_boot_ec_enable(void)
+ {
+- if (!boot_ec || boot_ec->handlers_installed)
++ if (!boot_ec || test_bit(EC_FLAGS_HANDLERS_INSTALLED, &boot_ec->flags))
+ return 0;
+ if (!ec_install_handlers(boot_ec)) {
+ first_ec = boot_ec;
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008
+Message-Id: <20081104232325.708594095@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Starikovskiy <astarikovskiy@suse.de>,
+ "Rafael J. Wysocki" <rjw@suse.com>,
+ Len Brown <len.brown@intel.com>
+Subject: [patch 48/57] ACPI: EC: Rename some variables
+Content-Disposition: inline; filename=acpi-ec-rename-some-variables.patch
+Content-Length: 8692
+Lines: 286
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alexey Starikovskiy <astarikovskiy@suse.de>
+
+commit 8463200a00fe2aea938b40173198a0983f2929ef upstream
+(needed by the next patch)
+
+No functional changes.
+
+Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
+Acked-by: Rafael J. Wysocki <rjw@suse.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/ec.c | 118 ++++++++++++++++++++++++++++--------------------------
+ 1 file changed, 63 insertions(+), 55 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -95,10 +95,11 @@ struct acpi_ec_query_handler {
+ u8 query_bit;
+ };
+
+-struct transaction_data {
++struct transaction {
+ const u8 *wdata;
+ u8 *rdata;
+ unsigned short irq_count;
++ u8 command;
+ u8 wlen;
+ u8 rlen;
+ };
+@@ -113,8 +114,8 @@ static struct acpi_ec {
+ struct mutex lock;
+ wait_queue_head_t wait;
+ struct list_head list;
+- struct transaction_data *t;
+- spinlock_t t_lock;
++ struct transaction *curr;
++ spinlock_t curr_lock;
+ } *boot_ec, *first_ec;
+
+ /*
+@@ -176,37 +177,37 @@ static int ec_transaction_done(struct ac
+ {
+ unsigned long flags;
+ int ret = 0;
+- spin_lock_irqsave(&ec->t_lock, flags);
+- if (!ec->t || (!ec->t->wlen && !ec->t->rlen))
++ spin_lock_irqsave(&ec->curr_lock, flags);
++ if (!ec->curr || (!ec->curr->wlen && !ec->curr->rlen))
+ ret = 1;
+- spin_unlock_irqrestore(&ec->t_lock, flags);
++ spin_unlock_irqrestore(&ec->curr_lock, flags);
+ return ret;
+ }
+
+ static void gpe_transaction(struct acpi_ec *ec, u8 status)
+ {
+ unsigned long flags;
+- spin_lock_irqsave(&ec->t_lock, flags);
+- if (!ec->t)
++ spin_lock_irqsave(&ec->curr_lock, flags);
++ if (!ec->curr)
+ goto unlock;
+- if (ec->t->wlen > 0) {
++ if (ec->curr->wlen > 0) {
+ if ((status & ACPI_EC_FLAG_IBF) == 0) {
+- acpi_ec_write_data(ec, *(ec->t->wdata++));
+- --ec->t->wlen;
++ acpi_ec_write_data(ec, *(ec->curr->wdata++));
++ --ec->curr->wlen;
+ } else
+ /* false interrupt, state didn't change */
+- ++ec->t->irq_count;
++ ++ec->curr->irq_count;
+
+- } else if (ec->t->rlen > 0) {
++ } else if (ec->curr->rlen > 0) {
+ if ((status & ACPI_EC_FLAG_OBF) == 1) {
+- *(ec->t->rdata++) = acpi_ec_read_data(ec);
+- --ec->t->rlen;
++ *(ec->curr->rdata++) = acpi_ec_read_data(ec);
++ --ec->curr->rlen;
+ } else
+ /* false interrupt, state didn't change */
+- ++ec->t->irq_count;
++ ++ec->curr->irq_count;
+ }
+ unlock:
+- spin_unlock_irqrestore(&ec->t_lock, flags);
++ spin_unlock_irqrestore(&ec->curr_lock, flags);
+ }
+
+ static int acpi_ec_wait(struct acpi_ec *ec)
+@@ -248,15 +249,11 @@ static int ec_poll(struct acpi_ec *ec)
+ return -ETIME;
+ }
+
+-static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command,
+- const u8 * wdata, unsigned wdata_len,
+- u8 * rdata, unsigned rdata_len,
++static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
++ struct transaction *t,
+ int force_poll)
+ {
+ unsigned long tmp;
+- struct transaction_data t = {.wdata = wdata, .rdata = rdata,
+- .wlen = wdata_len, .rlen = rdata_len,
+- .irq_count = 0};
+ int ret = 0;
+ pr_debug(PREFIX "transaction start\n");
+ /* disable GPE during transaction if storm is detected */
+@@ -265,29 +262,30 @@ static int acpi_ec_transaction_unlocked(
+ acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
+ }
+ /* start transaction */
+- spin_lock_irqsave(&ec->t_lock, tmp);
++ spin_lock_irqsave(&ec->curr_lock, tmp);
+ /* following two actions should be kept atomic */
+- ec->t = &t;
+- acpi_ec_write_cmd(ec, command);
+- if (command == ACPI_EC_COMMAND_QUERY)
++ t->irq_count = 0;
++ ec->curr = t;
++ acpi_ec_write_cmd(ec, ec->curr->command);
++ if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
+ clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+- spin_unlock_irqrestore(&ec->t_lock, tmp);
++ spin_unlock_irqrestore(&ec->curr_lock, tmp);
+ /* if we selected poll mode or failed in GPE-mode do a poll loop */
+ if (force_poll ||
+ !test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ||
+ acpi_ec_wait(ec))
+ ret = ec_poll(ec);
+ pr_debug(PREFIX "transaction end\n");
+- spin_lock_irqsave(&ec->t_lock, tmp);
+- ec->t = NULL;
+- spin_unlock_irqrestore(&ec->t_lock, tmp);
++ spin_lock_irqsave(&ec->curr_lock, tmp);
++ ec->curr = NULL;
++ spin_unlock_irqrestore(&ec->curr_lock, tmp);
+ if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
+ /* check if we received SCI during transaction */
+ ec_check_sci(ec, acpi_ec_read_status(ec));
+ /* it is safe to enable GPE outside of transaction */
+ acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
+ } else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
+- t.irq_count > ACPI_EC_STORM_THRESHOLD) {
++ t->irq_count > ACPI_EC_STORM_THRESHOLD) {
+ pr_debug(PREFIX "GPE storm detected\n");
+ set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
+ }
+@@ -300,17 +298,15 @@ static int ec_check_ibf0(struct acpi_ec
+ return (status & ACPI_EC_FLAG_IBF) == 0;
+ }
+
+-static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
+- const u8 * wdata, unsigned wdata_len,
+- u8 * rdata, unsigned rdata_len,
++static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t,
+ int force_poll)
+ {
+ int status;
+ u32 glk;
+- if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata))
++ if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))
+ return -EINVAL;
+- if (rdata)
+- memset(rdata, 0, rdata_len);
++ if (t->rdata)
++ memset(t->rdata, 0, t->rlen);
+ mutex_lock(&ec->lock);
+ if (ec->global_lock) {
+ status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
+@@ -326,10 +322,7 @@ static int acpi_ec_transaction(struct ac
+ status = -ETIME;
+ goto end;
+ }
+- status = acpi_ec_transaction_unlocked(ec, command,
+- wdata, wdata_len,
+- rdata, rdata_len,
+- force_poll);
++ status = acpi_ec_transaction_unlocked(ec, t, force_poll);
+ end:
+ if (ec->global_lock)
+ acpi_release_global_lock(glk);
+@@ -345,23 +338,32 @@ unlock:
+ int acpi_ec_burst_enable(struct acpi_ec *ec)
+ {
+ u8 d;
+- return acpi_ec_transaction(ec, ACPI_EC_BURST_ENABLE, NULL, 0, &d, 1, 0);
++ struct transaction t = {.command = ACPI_EC_BURST_ENABLE,
++ .wdata = NULL, .rdata = &d,
++ .wlen = 0, .rlen = 1};
++
++ return acpi_ec_transaction(ec, &t, 0);
+ }
+
+ int acpi_ec_burst_disable(struct acpi_ec *ec)
+ {
++ struct transaction t = {.command = ACPI_EC_BURST_DISABLE,
++ .wdata = NULL, .rdata = NULL,
++ .wlen = 0, .rlen = 0};
++
+ return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ?
+- acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE,
+- NULL, 0, NULL, 0, 0) : 0;
++ acpi_ec_transaction(ec, &t, 0) : 0;
+ }
+
+ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
+ {
+ int result;
+ u8 d;
++ struct transaction t = {.command = ACPI_EC_COMMAND_READ,
++ .wdata = &address, .rdata = &d,
++ .wlen = 1, .rlen = 1};
+
+- result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_READ,
+- &address, 1, &d, 1, 0);
++ result = acpi_ec_transaction(ec, &t, 0);
+ *data = d;
+ return result;
+ }
+@@ -369,8 +371,11 @@ static int acpi_ec_read(struct acpi_ec *
+ static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
+ {
+ u8 wdata[2] = { address, data };
+- return acpi_ec_transaction(ec, ACPI_EC_COMMAND_WRITE,
+- wdata, 2, NULL, 0, 0);
++ struct transaction t = {.command = ACPI_EC_COMMAND_WRITE,
++ .wdata = wdata, .rdata = NULL,
++ .wlen = 2, .rlen = 0};
++
++ return acpi_ec_transaction(ec, &t, 0);
+ }
+
+ /*
+@@ -432,12 +437,13 @@ int ec_transaction(u8 command,
+ u8 * rdata, unsigned rdata_len,
+ int force_poll)
+ {
++ struct transaction t = {.command = command,
++ .wdata = wdata, .rdata = rdata,
++ .wlen = wdata_len, .rlen = rdata_len};
+ if (!first_ec)
+ return -ENODEV;
+
+- return acpi_ec_transaction(first_ec, command, wdata,
+- wdata_len, rdata, rdata_len,
+- force_poll);
++ return acpi_ec_transaction(first_ec, &t, force_poll);
+ }
+
+ EXPORT_SYMBOL(ec_transaction);
+@@ -446,7 +452,9 @@ static int acpi_ec_query(struct acpi_ec
+ {
+ int result;
+ u8 d;
+-
++ struct transaction t = {.command = ACPI_EC_COMMAND_QUERY,
++ .wdata = NULL, .rdata = &d,
++ .wlen = 0, .rlen = 1};
+ if (!ec || !data)
+ return -EINVAL;
+
+@@ -456,7 +464,7 @@ static int acpi_ec_query(struct acpi_ec
+ * bit to be cleared (and thus clearing the interrupt source).
+ */
+
+- result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_QUERY, NULL, 0, &d, 1, 0);
++ result = acpi_ec_transaction(ec, &t, 0);
+ if (result)
+ return result;
+
+@@ -696,7 +704,7 @@ static struct acpi_ec *make_acpi_ec(void
+ mutex_init(&ec->lock);
+ init_waitqueue_head(&ec->wait);
+ INIT_LIST_HEAD(&ec->list);
+- spin_lock_init(&ec->t_lock);
++ spin_lock_init(&ec->curr_lock);
+ return ec;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:25 2008
+Message-Id: <20081104232325.819662055@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Starikovskiy <astarikovskiy@suse.de>,
+ Len Brown <len.brown@intel.com>
+Subject: [patch 49/57] ACPI: EC: Check for IBF=0 periodically if not in GPE mode
+Content-Disposition: inline; filename=acpi-ec-check-for-ibf-0-periodically-if-not-in-gpe-mode.patch
+Content-Length: 1532
+Lines: 46
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alexey Starikovskiy <astarikovskiy@suse.de>
+
+commit c0ff17720ec5f42205b3d2ca03a18da0a8272976 upstream.
+
+Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
+Tested-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/ec.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -298,6 +298,18 @@ static int ec_check_ibf0(struct acpi_ec
+ return (status & ACPI_EC_FLAG_IBF) == 0;
+ }
+
++static int ec_wait_ibf0(struct acpi_ec *ec)
++{
++ unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
++ /* interrupt wait manually if GPE mode is not active */
++ unsigned long timeout = test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ?
++ msecs_to_jiffies(ACPI_EC_DELAY) : msecs_to_jiffies(1);
++ while (time_before(jiffies, delay))
++ if (wait_event_timeout(ec->wait, ec_check_ibf0(ec), timeout))
++ return 0;
++ return -ETIME;
++}
++
+ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t,
+ int force_poll)
+ {
+@@ -315,8 +327,7 @@ static int acpi_ec_transaction(struct ac
+ goto unlock;
+ }
+ }
+- if (!wait_event_timeout(ec->wait, ec_check_ibf0(ec),
+- msecs_to_jiffies(ACPI_EC_DELAY))) {
++ if (ec_wait_ibf0(ec)) {
+ pr_err(PREFIX "input buffer is not empty, "
+ "aborting transaction\n");
+ status = -ETIME;
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008
+Message-Id: <20081104232325.968509404@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@redhat.com>,
+ Ondrej Zary <linux@rainbow-software.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 50/57] libata: Fix LBA48 on pata_it821x RAID volumes.
+Content-Disposition: inline; filename=libata-fix-lba48-on-pata_it821x-raid-volumes.patch
+Content-Length: 1183
+Lines: 35
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ondrej Zary <linux@rainbow-software.org>
+
+Subject: [patch 50/57] libata: Fix LBA48 on pata_it821x RAID volumes.
+
+commit 054e5f616b5becdc096b793407dc33fe379749ac upstream
+
+libata: Fix LBA48 on pata_it821x RAID volumes.
+
+[http://lkml.org/lkml/2008/10/18/82]
+
+Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
+Acked-by: Alan Cox <alan@redhat.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_it821x.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/ata/pata_it821x.c
++++ b/drivers/ata/pata_it821x.c
+@@ -557,9 +557,8 @@ static unsigned int it821x_read_id(struc
+ if (strstr(model_num, "Integrated Technology Express")) {
+ /* Set feature bits the firmware neglects */
+ id[49] |= 0x0300; /* LBA, DMA */
+- id[82] |= 0x0400; /* LBA48 */
+ id[83] &= 0x7FFF;
+- id[83] |= 0x4000; /* Word 83 is valid */
++ id[83] |= 0x4400; /* Word 83 is valid and LBA48 */
+ id[86] |= 0x0400; /* LBA48 on */
+ id[ATA_ID_MAJOR_VER] |= 0x1F;
+ }
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008
+Message-Id: <20081104232326.140638815@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Len Brown <len.brown@intel.com>,
+ Zhao Yakui <yakui.zhao@intel.com>
+Subject: [patch 51/57] ACPI: Ingore the RESET_REG_SUP bit when using ACPI reset mechanism
+Content-Disposition: inline; filename=acpi-ingore-the-reset_reg_sup-bit-when-using-acpi-reset-mechanism.patch
+Content-Length: 2707
+Lines: 75
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+Subject: [patch 51/57] ACPI: Ingore the RESET_REG_SUP bit when using ACPI reset mechanism
+
+commit 8fd145917fb62368a9b80db59562c20576238f5a upstream
+
+ACPI: Ingore the RESET_REG_SUP bit when using ACPI reset mechanism
+
+According to ACPI 3.0, FADT.flags.RESET_REG_SUP indicates
+whether the ACPI reboot mechanism is supported.
+
+However, some boxes have this bit clear, have a valid
+ACPI_RESET_REG & RESET_VALUE, and ACPI reboot is the only
+mechanism that works for them after S3.
+
+This suggests that other operating systems may not be checking
+the RESET_REG_SUP bit, and are using other means to decide
+whether to use the ACPI reboot mechanism or not.
+
+Here we stop checking RESET_REG_SUP.
+Instead, When acpi reboot is requested,
+only the reset_register is checked. If the following
+conditions are met, it indicates that the reset register is supported.
+ a. reset_register is not zero
+ b. the access width is eight
+ c. the bit_offset is zero
+
+http://bugzilla.kernel.org/show_bug.cgi?id=7299
+http://bugzilla.kernel.org/show_bug.cgi?id=1148
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/reboot.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/reboot.c
++++ b/drivers/acpi/reboot.c
+@@ -15,9 +15,28 @@ void acpi_reboot(void)
+
+ rr = &acpi_gbl_FADT.reset_register;
+
+- /* Is the reset register supported? */
+- if (!(acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER) ||
+- rr->bit_width != 8 || rr->bit_offset != 0)
++ /*
++ * Is the ACPI reset register supported?
++ *
++ * According to ACPI 3.0, FADT.flags.RESET_REG_SUP indicates
++ * whether the ACPI reset mechanism is supported.
++ *
++ * However, some boxes have this bit clear, yet a valid
++ * ACPI_RESET_REG & RESET_VALUE, and ACPI reboot is the only
++ * mechanism that works for them after S3.
++ *
++ * This suggests that other operating systems may not be checking
++ * the RESET_REG_SUP bit, and are using other means to decide
++ * whether to use the ACPI reboot mechanism or not.
++ *
++ * So when acpi reboot is requested,
++ * only the reset_register is checked. If the following
++ * conditions are met, it indicates that the reset register is supported.
++ * a. reset_register is not zero
++ * b. the access width is eight
++ * c. the bit_offset is zero
++ */
++ if (!(rr->address) || rr->bit_width != 8 || rr->bit_offset != 0)
+ return;
+
+ reset_value = acpi_gbl_FADT.reset_value;
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008
+Message-Id: <20081104232326.314265769@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Len Brown <len.brown@intel.com>,
+ Matthew Garrett <mjg@redhat.com>,
+ Andi Kleen <ak@linux.intel.com>
+Subject: [patch 52/57] ACPI: Clear WAK_STS on resume
+Content-Disposition: inline; filename=acpi-clear-wak_sts-on-resume.patch
+Content-Length: 1585
+Lines: 47
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Matthew Garrett <mjg59@srcf.ucam.org>
+
+Subject: [patch 52/57] ACPI: Clear WAK_STS on resume
+
+commit a68823ee5285e65b51ceb96f8b13a5b4f99a6888 upstream.
+
+ACPI: Clear WAK_STS on resume
+
+The leading other brand OS appears to clear the WAK_STS flag on resume.
+When rebooted, certain BIOSes assume that the system is actually
+resuming if it's still set and so fail to reboot correctly. Make sure
+that it's cleared at resume time.
+
+Comment clarified as suggested by Bob Moore
+
+http://bugzilla.kernel.org/show_bug.cgi?id=11634
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Tested-by: Romano Giannetti <romano.giannetti@gmail.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/hardware/hwsleep.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/acpi/hardware/hwsleep.c
++++ b/drivers/acpi/hardware/hwsleep.c
+@@ -612,6 +612,13 @@ acpi_status acpi_leave_sleep_state(u8 sl
+ }
+ /* TBD: _WAK "sometimes" returns stuff - do we want to look at it? */
+
++ /*
++ * Some BIOSes assume that WAK_STS will be cleared on resume and use
++ * it to determine whether the system is rebooting or resuming. Clear
++ * it for compatibility.
++ */
++ acpi_set_register(ACPI_BITREG_WAKE_STATUS, 1);
++
+ acpi_gbl_system_awake_and_running = TRUE;
+
+ /* Enable power button */
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008
+Message-Id: <20081104232326.481451483@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dmitry Torokhov <dtor@mail.ru>,
+ Matthew Garrett <mjg@redhat.com>
+Subject: [patch 53/57] Input: atkbd - expand Latitudes force release quirk to other Dells
+Content-Disposition: inline; filename=input-atkbd-expand-latitude-s-force-release-quirk-to-other-dells.patch
+Content-Length: 1887
+Lines: 55
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Matthew Garrett <mjg59@srcf.ucam.org>
+
+commit 61579ba83934d397a4fa2bb7372de9ae112587d5 upstream.
+
+Input: atkbd - expand Latitude's force release quirk to other Dells
+
+Dell laptops fail to send key up events for several of their special
+keys. There's an existing quirk in the kernel to handle this, but it's
+limited to the Latitude range. This patch extends it to cover all
+portable Dells.
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/keyboard/atkbd.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -834,10 +834,10 @@ static void atkbd_disconnect(struct seri
+ }
+
+ /*
+- * Most special keys (Fn+F?) on Dell Latitudes do not generate release
++ * Most special keys (Fn+F?) on Dell laptops do not generate release
+ * events so we have to do it ourselves.
+ */
+-static void atkbd_latitude_keymap_fixup(struct atkbd *atkbd)
++static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
+ {
+ const unsigned int forced_release_keys[] = {
+ 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93,
+@@ -1461,13 +1461,13 @@ static int __init atkbd_setup_fixup(cons
+
+ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
+ {
+- .ident = "Dell Latitude series",
++ .ident = "Dell Laptop",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Latitude"),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
+ },
+ .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_latitude_keymap_fixup,
++ .driver_data = atkbd_dell_laptop_keymap_fixup,
+ },
+ {
+ .ident = "HP 2133",
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008
+Message-Id: <20081104232326.652815710@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Sesterhenn <snakebyte@gmx.de>,
+ Roman Zippel <zippel@linux-m68k.org>
+Subject: [patch 54/57] hfsplus: fix Buffer overflow with a corrupted image
+Content-Disposition: inline; filename=hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch
+Content-Length: 6366
+Lines: 122
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Sesterhenn <snakebyte@gmx.de>
+
+commit efc7ffcb4237f8cb9938909041c4ed38f6e1bf40 upstream
+
+When an hfsplus image gets corrupted it might happen that the catalog
+namelength field gets b0rked. If we mount such an image the memcpy() in
+hfsplus_cat_build_key_uni() writes more than the 255 that fit in the name
+field. Depending on the size of the overwritten data, we either only get
+memory corruption or also trigger an oops like this:
+
+[ 221.628020] BUG: unable to handle kernel paging request at c82b0000
+[ 221.629066] IP: [<c022d4b1>] hfsplus_find_cat+0x10d/0x151
+[ 221.629066] *pde = 0ea29163 *pte = 082b0160
+[ 221.629066] Oops: 0002 [#1] PREEMPT DEBUG_PAGEALLOC
+[ 221.629066] Modules linked in:
+[ 221.629066]
+[ 221.629066] Pid: 4845, comm: mount Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #28)
+[ 221.629066] EIP: 0060:[<c022d4b1>] EFLAGS: 00010206 CPU: 0
+[ 221.629066] EIP is at hfsplus_find_cat+0x10d/0x151
+[ 221.629066] EAX: 00000029 EBX: 00016210 ECX: 000042c2 EDX: 00000002
+[ 221.629066] ESI: c82d70ca EDI: c82b0000 EBP: c82d1bcc ESP: c82d199c
+[ 221.629066] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
+[ 221.629066] Process mount (pid: 4845, ti=c82d1000 task=c8224060 task.ti=c82d1000)
+[ 221.629066] Stack: c080b3c4 c82aa8f8 c82d19c2 00016210 c080b3be c82d1bd4 c82aa8f0 00000300
+[ 221.629066] 01000000 750008b1 74006e00 74006900 65006c00 c82d6400 c013bd35 c8224060
+[ 221.629066] 00000036 00000046 c82d19f0 00000082 c8224548 c8224060 00000036 c0d653cc
+[ 221.629066] Call Trace:
+[ 221.629066] [<c013bd35>] ? trace_hardirqs_off+0xb/0xd
+[ 221.629066] [<c013bca3>] ? trace_hardirqs_off_caller+0x14/0x9b
+[ 221.629066] [<c013bd35>] ? trace_hardirqs_off+0xb/0xd
+[ 221.629066] [<c013bca3>] ? trace_hardirqs_off_caller+0x14/0x9b
+[ 221.629066] [<c013bd35>] ? trace_hardirqs_off+0xb/0xd
+[ 221.629066] [<c0107aa3>] ? native_sched_clock+0x82/0x96
+[ 221.629066] [<c01302d2>] ? __kernel_text_address+0x1b/0x27
+[ 221.629066] [<c010487a>] ? dump_trace+0xca/0xd6
+[ 221.629066] [<c0109e32>] ? save_stack_address+0x0/0x2c
+[ 221.629066] [<c0109eaf>] ? save_stack_trace+0x1c/0x3a
+[ 221.629066] [<c013b571>] ? save_trace+0x37/0x8d
+[ 221.629066] [<c013b62e>] ? add_lock_to_list+0x67/0x8d
+[ 221.629066] [<c013ea1c>] ? validate_chain+0x8a4/0x9f4
+[ 221.629066] [<c013553d>] ? down+0xc/0x2f
+[ 221.629066] [<c013f1f6>] ? __lock_acquire+0x68a/0x6e0
+[ 221.629066] [<c013bd35>] ? trace_hardirqs_off+0xb/0xd
+[ 221.629066] [<c013bca3>] ? trace_hardirqs_off_caller+0x14/0x9b
+[ 221.629066] [<c013bd35>] ? trace_hardirqs_off+0xb/0xd
+[ 221.629066] [<c0107aa3>] ? native_sched_clock+0x82/0x96
+[ 221.629066] [<c013da5d>] ? mark_held_locks+0x43/0x5a
+[ 221.629066] [<c013dc3a>] ? trace_hardirqs_on+0xb/0xd
+[ 221.629066] [<c013dbf4>] ? trace_hardirqs_on_caller+0xf4/0x12f
+[ 221.629066] [<c06abec8>] ? _spin_unlock_irqrestore+0x42/0x58
+[ 221.629066] [<c013555c>] ? down+0x2b/0x2f
+[ 221.629066] [<c022aa68>] ? hfsplus_iget+0xa0/0x154
+[ 221.629066] [<c022b0b9>] ? hfsplus_fill_super+0x280/0x447
+[ 221.629066] [<c0107aa3>] ? native_sched_clock+0x82/0x96
+[ 221.629066] [<c013bca3>] ? trace_hardirqs_off_caller+0x14/0x9b
+[ 221.629066] [<c013bca3>] ? trace_hardirqs_off_caller+0x14/0x9b
+[ 221.629066] [<c013f1f6>] ? __lock_acquire+0x68a/0x6e0
+[ 221.629066] [<c041c9e4>] ? string+0x2b/0x74
+[ 221.629066] [<c041cd16>] ? vsnprintf+0x2e9/0x512
+[ 221.629066] [<c010487a>] ? dump_trace+0xca/0xd6
+[ 221.629066] [<c0109eaf>] ? save_stack_trace+0x1c/0x3a
+[ 221.629066] [<c0109eaf>] ? save_stack_trace+0x1c/0x3a
+[ 221.629066] [<c013b571>] ? save_trace+0x37/0x8d
+[ 221.629066] [<c013b62e>] ? add_lock_to_list+0x67/0x8d
+[ 221.629066] [<c013ea1c>] ? validate_chain+0x8a4/0x9f4
+[ 221.629066] [<c01354d3>] ? up+0xc/0x2f
+[ 221.629066] [<c013f1f6>] ? __lock_acquire+0x68a/0x6e0
+[ 221.629066] [<c013bd35>] ? trace_hardirqs_off+0xb/0xd
+[ 221.629066] [<c013bca3>] ? trace_hardirqs_off_caller+0x14/0x9b
+[ 221.629066] [<c013bd35>] ? trace_hardirqs_off+0xb/0xd
+[ 221.629066] [<c0107aa3>] ? native_sched_clock+0x82/0x96
+[ 221.629066] [<c041cfb7>] ? snprintf+0x1b/0x1d
+[ 221.629066] [<c01ba466>] ? disk_name+0x25/0x67
+[ 221.629066] [<c0183960>] ? get_sb_bdev+0xcd/0x10b
+[ 221.629066] [<c016ad92>] ? kstrdup+0x2a/0x4c
+[ 221.629066] [<c022a7b3>] ? hfsplus_get_sb+0x13/0x15
+[ 221.629066] [<c022ae39>] ? hfsplus_fill_super+0x0/0x447
+[ 221.629066] [<c0183583>] ? vfs_kern_mount+0x3b/0x76
+[ 221.629066] [<c0183602>] ? do_kern_mount+0x32/0xba
+[ 221.629066] [<c01960d4>] ? do_new_mount+0x46/0x74
+[ 221.629066] [<c0196277>] ? do_mount+0x175/0x193
+[ 221.629066] [<c013dbf4>] ? trace_hardirqs_on_caller+0xf4/0x12f
+[ 221.629066] [<c01663b2>] ? __get_free_pages+0x1e/0x24
+[ 221.629066] [<c06ac07b>] ? lock_kernel+0x19/0x8c
+[ 221.629066] [<c01962e6>] ? sys_mount+0x51/0x9b
+[ 221.629066] [<c01962f9>] ? sys_mount+0x64/0x9b
+[ 221.629066] [<c01038bd>] ? sysenter_do_call+0x12/0x31
+[ 221.629066] =======================
+[ 221.629066] Code: 89 c2 c1 e2 08 c1 e8 08 09 c2 8b 85 e8 fd ff ff 66 89 50 06 89 c7 53 83 c7 08 56 57 68 c4 b3 80 c0 e8 8c 5c ef ff 89 d9 c1 e9 02 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 83 c3 06 8b 95 e8 fd ff ff 0f
+[ 221.629066] EIP: [<c022d4b1>] hfsplus_find_cat+0x10d/0x151 SS:ESP 0068:c82d199c
+[ 221.629066] ---[ end trace e417a1d67f0d0066 ]---
+
+Since hfsplus_cat_build_key_uni() returns void and only has one callsite,
+the check is performed at the callsite.
+
+Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
+Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Cc: Roman Zippel <zippel@linux-m68k.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfsplus/catalog.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/hfsplus/catalog.c
++++ b/fs/hfsplus/catalog.c
+@@ -168,6 +168,11 @@ int hfsplus_find_cat(struct super_block
+ return -EIO;
+ }
+
++ if (be16_to_cpu(tmp.thread.nodeName.length) > 255) {
++ printk(KERN_ERR "hfs: catalog name length corrupted\n");
++ return -EIO;
++ }
++
+ hfsplus_cat_build_key_uni(fd->search_key, be32_to_cpu(tmp.thread.parentID),
+ &tmp.thread.nodeName);
+ return hfs_brec_find(fd);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:26 2008
+Message-Id: <20081104232326.823379916@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Sesterhenn <snakebyte@gmx.de>,
+ Roman Zippel <zippel@linux-m68k.org>
+Subject: [patch 55/57] hfsplus: check read_mapping_page() return value
+Content-Disposition: inline; filename=hfsplus-check-read_mapping_page-return-value.patch
+Content-Length: 4690
+Lines: 103
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Sesterhenn <snakebyte@gmx.de>
+
+While testing more corrupted images with hfsplus, i came across
+one which triggered the following bug:
+
+[15840.675016] BUG: unable to handle kernel paging request at fffffffb
+[15840.675016] IP: [<c0116a4f>] kmap+0x15/0x56
+[15840.675016] *pde = 00008067 *pte = 00000000
+[15840.675016] Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC
+[15840.675016] Modules linked in:
+[15840.675016]
+[15840.675016] Pid: 11575, comm: ln Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #29)
+[15840.675016] EIP: 0060:[<c0116a4f>] EFLAGS: 00010202 CPU: 0
+[15840.675016] EIP is at kmap+0x15/0x56
+[15840.675016] EAX: 00000246 EBX: fffffffb ECX: 00000000 EDX: cab919c0
+[15840.675016] ESI: 000007dd EDI: cab0bcf4 EBP: cab0bc98 ESP: cab0bc94
+[15840.675016] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
+[15840.675016] Process ln (pid: 11575, ti=cab0b000 task=cab919c0 task.ti=cab0b000)
+[15840.675016] Stack: 00000000 cab0bcdc c0231cfb 00000000 cab0bce0 00000800 ca9290c0 fffffffb
+[15840.675016] cab145d0 cab919c0 cab15998 22222222 22222222 22222222 00000001 cab15960
+[15840.675016] 000007dd cab0bcf4 cab0bd04 c022cb3a cab0bcf4 cab15a6c ca9290c0 00000000
+[15840.675016] Call Trace:
+[15840.675016] [<c0231cfb>] ? hfsplus_block_allocate+0x6f/0x2d3
+[15840.675016] [<c022cb3a>] ? hfsplus_file_extend+0xc4/0x1db
+[15840.675016] [<c022ce41>] ? hfsplus_get_block+0x8c/0x19d
+[15840.675016] [<c06adde4>] ? sub_preempt_count+0x9d/0xab
+[15840.675016] [<c019ece6>] ? __block_prepare_write+0x147/0x311
+[15840.675016] [<c0161934>] ? __grab_cache_page+0x52/0x73
+[15840.675016] [<c019ef4f>] ? block_write_begin+0x79/0xd5
+[15840.675016] [<c022cdb5>] ? hfsplus_get_block+0x0/0x19d
+[15840.675016] [<c019f22a>] ? cont_write_begin+0x27f/0x2af
+[15840.675016] [<c022cdb5>] ? hfsplus_get_block+0x0/0x19d
+[15840.675016] [<c0139ebe>] ? tick_program_event+0x28/0x4c
+[15840.675016] [<c013bd35>] ? trace_hardirqs_off+0xb/0xd
+[15840.675016] [<c022b723>] ? hfsplus_write_begin+0x2d/0x32
+[15840.675016] [<c022cdb5>] ? hfsplus_get_block+0x0/0x19d
+[15840.675016] [<c0161988>] ? pagecache_write_begin+0x33/0x107
+[15840.675016] [<c01879e5>] ? __page_symlink+0x3c/0xae
+[15840.675016] [<c019ad34>] ? __mark_inode_dirty+0x12f/0x137
+[15840.675016] [<c0187a70>] ? page_symlink+0x19/0x1e
+[15840.675016] [<c022e6eb>] ? hfsplus_symlink+0x41/0xa6
+[15840.675016] [<c01886a9>] ? vfs_symlink+0x99/0x101
+[15840.675016] [<c018a2f6>] ? sys_symlinkat+0x6b/0xad
+[15840.675016] [<c018a348>] ? sys_symlink+0x10/0x12
+[15840.675016] [<c01038bd>] ? sysenter_do_call+0x12/0x31
+[15840.675016] =======================
+[15840.675016] Code: 00 00 75 10 83 3d 88 2f ec c0 02 75 07 89 d0 e8 12 56 05 00 5d c3 55 ba 06 00 00 00 89 e5 53 89 c3 b8 3d eb 7e c0 e8 16 74 00 00 <8b> 03 c1 e8 1e 69 c0 d8 02 00 00 05 b8 69 8e c0 2b 80 c4 02 00
+[15840.675016] EIP: [<c0116a4f>] kmap+0x15/0x56 SS:ESP 0068:cab0bc94
+[15840.675016] ---[ end trace 4fea40dad6b70e5f ]---
+
+This happens because the return value of read_mapping_page() is passed on
+to kmap unchecked. The bug is triggered after the first
+read_mapping_page() in hfsplus_block_allocate(), this patch fixes all
+three usages in this functions but leaves the ones further down in the
+file unchanged.
+
+Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
+Cc: Roman Zippel <zippel@linux-m68k.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfsplus/bitmap.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/fs/hfsplus/bitmap.c
++++ b/fs/hfsplus/bitmap.c
+@@ -32,6 +32,10 @@ int hfsplus_block_allocate(struct super_
+ mutex_lock(&HFSPLUS_SB(sb).alloc_file->i_mutex);
+ mapping = HFSPLUS_SB(sb).alloc_file->i_mapping;
+ page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, NULL);
++ if (IS_ERR(page)) {
++ start = size;
++ goto out;
++ }
+ pptr = kmap(page);
+ curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32;
+ i = offset % 32;
+@@ -73,6 +77,10 @@ int hfsplus_block_allocate(struct super_
+ break;
+ page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
+ NULL);
++ if (IS_ERR(page)) {
++ start = size;
++ goto out;
++ }
+ curr = pptr = kmap(page);
+ if ((size ^ offset) / PAGE_CACHE_BITS)
+ end = pptr + PAGE_CACHE_BITS / 32;
+@@ -120,6 +128,10 @@ found:
+ offset += PAGE_CACHE_BITS;
+ page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
+ NULL);
++ if (IS_ERR(page)) {
++ start = size;
++ goto out;
++ }
+ pptr = kmap(page);
+ curr = pptr;
+ end = pptr + PAGE_CACHE_BITS / 32;
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:27 2008
+Message-Id: <20081104232326.998473618@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andy Gospodarek <andy@greyhouse.net>,
+ Jay Vosburgh <fubar@us.ibm.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 56/57] bonding: fix panic when taking bond interface down before removing module
+Content-Disposition: inline; filename=bonding-fix-panic-when-taking-bond-interface-down-before-removing-module.patch
+Content-Length: 2575
+Lines: 69
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andy Gospodarek <andy@greyhouse.net>
+
+commit ce39a800ea87c655de49af021c8b20ee323cb40d upstream.
+
+A panic was discovered with bonding when using mode 5 or 6 and trying to
+remove the slaves from the bond after the interface was taken down.
+When calling 'ifconfig bond0 down' the following happens:
+
+ bond_close()
+ bond_alb_deinitialize()
+ tlb_deinitialize()
+ kfree(bond_info->tx_hashtbl)
+ bond_info->tx_hashtbl = NULL
+
+Unfortunately if there are still slaves in the bond, when removing the
+module the following happens:
+
+ bonding_exit()
+ bond_free_all()
+ bond_release_all()
+ bond_alb_deinit_slave()
+ tlb_clear_slave()
+ tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl
+ u32 next_index = tx_hash_table[index].next
+
+As you might guess we panic when trying to access a few entries into the
+table that no longer exists.
+
+I experimented with several options (like moving the calls to
+tlb_deinitialize somewhere else), but it really makes the most sense to
+be part of the bond_close routine. It also didn't seem logical move
+tlb_clear_slave around too much, so the simplest option seems to add a
+check in tlb_clear_slave to make sure we haven't already wiped the
+tx_hashtbl away before searching for all the non-existent hash-table
+entries that used to point to the slave as the output interface.
+
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bonding/bond_alb.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -167,11 +167,14 @@ static void tlb_clear_slave(struct bondi
+ /* clear slave from tx_hashtbl */
+ tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl;
+
+- index = SLAVE_TLB_INFO(slave).head;
+- while (index != TLB_NULL_INDEX) {
+- u32 next_index = tx_hash_table[index].next;
+- tlb_init_table_entry(&tx_hash_table[index], save_load);
+- index = next_index;
++ /* skip this if we've already freed the tx hash table */
++ if (tx_hash_table) {
++ index = SLAVE_TLB_INFO(slave).head;
++ while (index != TLB_NULL_INDEX) {
++ u32 next_index = tx_hash_table[index].next;
++ tlb_init_table_entry(&tx_hash_table[index], save_load);
++ index = next_index;
++ }
+ }
+
+ tlb_init_slave(slave);
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:27 2008
+Message-Id: <20081104232327.167153494@mini.kroah.org>
+References: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:22:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Serge Hallyn <serue@us.ibm.com>,
+ David Howells <dhowells@redhat.com>,
+ "Andrew G. Morgan" <morgan@kernel.org>
+Subject: [patch 57/57] file caps: always start with clear bprm->caps_*
+Content-Disposition: inline; filename=file-caps-always-start-with-clear-bprm-caps_.patch
+Content-Length: 1400
+Lines: 41
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Serge Hallyn <serue@us.ibm.com>
+
+commit 3318a386e4ca68c76e0294363d29bdc46fcad670 upstream
+
+While Linux doesn't honor setuid on scripts. However, it mistakenly
+behaves differently for file capabilities.
+
+This patch fixes that behavior by making sure that get_file_caps()
+begins with empty bprm->caps_*. That way when a script is loaded,
+its bprm->caps_* may be filled when binfmt_misc calls prepare_binprm(),
+but they will be cleared again when binfmt_elf calls prepare_binprm()
+next to read the interpreter's file capabilities.
+
+Signed-off-by: Serge Hallyn <serue@us.ibm.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Acked-by: Andrew G. Morgan <morgan@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/commoncap.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -279,10 +279,10 @@ static int get_file_caps(struct linux_bi
+ struct vfs_cap_data vcaps;
+ struct inode *inode;
+
+- if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
+- bprm_clear_caps(bprm);
++ bprm_clear_caps(bprm);
++
++ if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
+ return 0;
+- }
+
+ dentry = dget(bprm->file->f_dentry);
+ inode = dentry->d_inode;
+
+--
+
+From gregkh@mini.kroah.org Tue Nov 4 15:23:17 2008
+Message-Id: <20081104232144.186593464@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Tue, 04 Nov 2008 15:21:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/57] 2.6.27-stable review
+Status: RO
+Content-Length: 4250
+Lines: 81
+
+This is the start of the stable review cycle for the 2.6.27.5 release.
+There are 57 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Thursday, November 6, 23:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.5-rc1.gz
+and the diffstat can be found below.
+
+thanks,
+
+greg k-h
+
+-------------
+
+ Documentation/i2c/busses/i2c-sis96x | 2
+ MAINTAINERS | 20 -
+ Makefile | 2
+ arch/powerpc/configs/linkstation_defconfig | 7
+ arch/powerpc/mm/hash_utils_64.c | 6
+ arch/powerpc/mm/numa.c | 113 +++++-
+ arch/powerpc/platforms/embedded6xx/linkstation.c | 14
+ arch/s390/kernel/smp.c | 24 -
+ arch/sparc64/kernel/trampoline.S | 18 -
+ arch/x86/kernel/process_64.c | 4
+ arch/x86/kernel/rtc.c | 22 +
+ arch/x86/mm/pat.c | 4
+ drivers/acpi/button.c | 3
+ drivers/acpi/ec.c | 374 +++++++++++------------
+ drivers/acpi/hardware/hwsleep.c | 7
+ drivers/acpi/reboot.c | 25 +
+ drivers/ata/libata-core.c | 2
+ drivers/ata/pata_it821x.c | 3
+ drivers/ata/sata_nv.c | 53 +--
+ drivers/ata/sata_promise.c | 20 +
+ drivers/base/sys.c | 6
+ drivers/char/agp/intel-agp.c | 12
+ drivers/char/ipmi/ipmi_devintf.c | 1
+ drivers/firewire/fw-cdev.c | 6
+ drivers/firewire/fw-sbp2.c | 38 +-
+ drivers/firewire/fw-topology.c | 6
+ drivers/firewire/fw-transaction.h | 2
+ drivers/hid/usbhid/hid-quirks.c | 4
+ drivers/i2c/busses/scx200_i2c.c | 1
+ drivers/input/keyboard/atkbd.c | 10
+ drivers/media/dvb/frontends/s5h1411.c | 35 +-
+ drivers/media/video/pvrusb2/pvrusb2-encoder.c | 4
+ drivers/net/atlx/atl1.c | 7
+ drivers/net/atlx/atl1.h | 2
+ drivers/net/bonding/bond_alb.c | 13
+ drivers/net/wireless/libertas/scan.c | 4
+ drivers/pci/probe.c | 2
+ drivers/rtc/rtc-cmos.c | 33 +-
+ drivers/scsi/sd.c | 10
+ drivers/usb/core/hcd.c | 35 +-
+ drivers/usb/core/hcd.h | 1
+ drivers/usb/core/hub.c | 1
+ drivers/usb/core/urb.c | 15
+ drivers/usb/storage/unusual_devs.h | 9
+ fs/hfsplus/bitmap.c | 12
+ fs/hfsplus/catalog.c | 5
+ include/math-emu/op-common.h | 17 -
+ kernel/sched_clock.c | 6
+ kernel/sched_features.h | 2
+ net/ipv4/tcp_output.c | 33 +-
+ net/ipv6/tcp_ipv6.c | 2
+ net/sched/sch_generic.c | 2
+ scripts/package/mkspec | 3
+ security/commoncap.c | 6
+ sound/core/control.c | 4
+ sound/pci/hda/hda_intel.c | 29 +
+ 56 files changed, 717 insertions(+), 384 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
