--- /dev/null
+From 5a31bec014449dc9ca994e4c1dbf2802b7ca458a Mon Sep 17 00:00:00 2001
+From: Brian Haley <brian.haley@hp.com>
+Date: Mon, 13 Apr 2009 00:11:30 -0700
+Subject: Bonding: fix zero address hole bug in arp_ip_target list
+
+upstream commit: 5a31bec014449dc9ca994e4c1dbf2802b7ca458a
+
+Fix a zero address hole bug in the bonding arp_ip_target list
+that was causing the bond to ignore ARP replies (bugz 13006).
+Instead of just setting the array entry to zero, we now
+copy any additional entries down one slot, putting the
+zero entry at the end. With this change we can now have
+all the loops that walk the array stop when they hit a zero
+since there will be no addresses after it.
+
+Changes are based in part on code fragment provided in kernel:
+bugzilla 13006:
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=13006
+
+by Steve Howard <steve@astutenetworks.com>
+
+Signed-off-by: Brian Haley <brian.haley@hp.com>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ Documentation/networking/bonding.txt | 2 +-
+ drivers/net/bonding/bond_main.c | 5 ++---
+ drivers/net/bonding/bond_sysfs.c | 14 ++++++++------
+ 3 files changed, 11 insertions(+), 10 deletions(-)
+
+--- a/Documentation/networking/bonding.txt
++++ b/Documentation/networking/bonding.txt
+@@ -1242,7 +1242,7 @@ monitoring is enabled, and vice-versa.
+ To add ARP targets:
+ # echo +192.168.0.100 > /sys/class/net/bond0/bonding/arp_ip_target
+ # echo +192.168.0.101 > /sys/class/net/bond0/bonding/arp_ip_target
+- NOTE: up to 10 target addresses may be specified.
++ NOTE: up to 16 target addresses may be specified.
+
+ To remove an ARP target:
+ # echo -192.168.0.100 > /sys/class/net/bond0/bonding/arp_ip_target
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2565,7 +2565,7 @@ static void bond_arp_send_all(struct bon
+
+ for (i = 0; (i < BOND_MAX_ARP_TARGETS); i++) {
+ if (!targets[i])
+- continue;
++ break;
+ pr_debug("basa: target %x\n", targets[i]);
+ if (list_empty(&bond->vlan_list)) {
+ pr_debug("basa: empty vlan: arp_send\n");
+@@ -2672,7 +2672,6 @@ static void bond_validate_arp(struct bon
+ int i;
+ __be32 *targets = bond->params.arp_targets;
+
+- targets = bond->params.arp_targets;
+ for (i = 0; (i < BOND_MAX_ARP_TARGETS) && targets[i]; i++) {
+ pr_debug("bva: sip %pI4 tip %pI4 t[%d] %pI4 bhti(tip) %d\n",
+ &sip, &tip, i, &targets[i], bond_has_this_ip(bond, tip));
+@@ -3294,7 +3293,7 @@ static void bond_info_show_master(struct
+
+ for(i = 0; (i < BOND_MAX_ARP_TARGETS) ;i++) {
+ if (!bond->params.arp_targets[i])
+- continue;
++ break;
+ if (printed)
+ seq_printf(seq, ",");
+ seq_printf(seq, " %pI4", &bond->params.arp_targets[i]);
+--- a/drivers/net/bonding/bond_sysfs.c
++++ b/drivers/net/bonding/bond_sysfs.c
+@@ -684,17 +684,15 @@ static ssize_t bonding_store_arp_targets
+ goto out;
+ }
+ /* look for an empty slot to put the target in, and check for dupes */
+- for (i = 0; (i < BOND_MAX_ARP_TARGETS); i++) {
++ for (i = 0; (i < BOND_MAX_ARP_TARGETS) && !done; i++) {
+ if (targets[i] == newtarget) { /* duplicate */
+ printk(KERN_ERR DRV_NAME
+ ": %s: ARP target %pI4 is already present\n",
+ bond->dev->name, &newtarget);
+- if (done)
+- targets[i] = 0;
+ ret = -EINVAL;
+ goto out;
+ }
+- if (targets[i] == 0 && !done) {
++ if (targets[i] == 0) {
+ printk(KERN_INFO DRV_NAME
+ ": %s: adding ARP target %pI4.\n",
+ bond->dev->name, &newtarget);
+@@ -720,12 +718,16 @@ static ssize_t bonding_store_arp_targets
+ goto out;
+ }
+
+- for (i = 0; (i < BOND_MAX_ARP_TARGETS); i++) {
++ for (i = 0; (i < BOND_MAX_ARP_TARGETS) && !done; i++) {
+ if (targets[i] == newtarget) {
++ int j;
+ printk(KERN_INFO DRV_NAME
+ ": %s: removing ARP target %pI4.\n",
+ bond->dev->name, &newtarget);
+- targets[i] = 0;
++ for (j = i; (j < (BOND_MAX_ARP_TARGETS-1)) && targets[j+1]; j++)
++ targets[j] = targets[j+1];
++
++ targets[j] = 0;
+ done = 1;
+ }
+ }
--- /dev/null
+From d119b3927994e3d620d6adb0dd1ea6bf24427875 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Tue, 14 Apr 2009 15:16:55 -0700
+Subject: skge: fix occasional BUG during MTU change
+
+upstream commit: d119b3927994e3d620d6adb0dd1ea6bf24427875
+
+The BUG_ON(skge->tx_ring.to_use != skge->tx_ring.to_clean) in skge_up()
+was sometimes observed when setting MTU.
+
+skge_down() disables the TX queue, but then reenables it by mistake via
+skge_tx_clean().
+Fix it by moving the waking of the queue from skge_tx_clean() to the
+other caller. And to make sure start_xmit is not in progress on another
+CPU, skge_down() should call netif_tx_disable().
+
+The bug was reported to me by Jiri Jilek whose Debian system sometimes
+failed to boot. He tested the patch and the bug did not happen anymore.
+
+Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+Acked-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/net/skge.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/skge.c
++++ b/drivers/net/skge.c
+@@ -2674,7 +2674,7 @@ static int skge_down(struct net_device *
+ if (netif_msg_ifdown(skge))
+ printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
+
+- netif_stop_queue(dev);
++ netif_tx_disable(dev);
+
+ if (hw->chip_id == CHIP_ID_GENESIS && hw->phy_type == SK_PHY_XMAC)
+ del_timer_sync(&skge->link_timer);
+@@ -2881,7 +2881,6 @@ static void skge_tx_clean(struct net_dev
+ }
+
+ skge->tx_ring.to_clean = e;
+- netif_wake_queue(dev);
+ }
+
+ static void skge_tx_timeout(struct net_device *dev)
+@@ -2893,6 +2892,7 @@ static void skge_tx_timeout(struct net_d
+
+ skge_write8(skge->hw, Q_ADDR(txqaddr[skge->port], Q_CSR), CSR_STOP);
+ skge_tx_clean(dev);
++ netif_wake_queue(dev);
+ }
+
+ static int skge_change_mtu(struct net_device *dev, int new_mtu)