--- /dev/null
+From stable-bounces@linux.kernel.org Mon Mar 5 22:14:01 2007
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 6 Mar 2007 17:11:29 +1100
+Subject: Avoid using nfsd process pools on SMP machines.
+To: stable@kernel.org
+Message-ID: <1070306061129.10623@suse.de>
+
+From: NeilBrown <neilb@suse.de>
+
+
+process-pools have real benefits for NUMA, but on SMP
+machines they only work if network interface interrupts
+go to all CPUs (via round-robin or multiple nics). This is
+not always the case, so disable the pools in this case until
+a better solution is developped.
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+diff .prev/net/sunrpc/svc.c ./net/sunrpc/svc.c
+---
+ net/sunrpc/svc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- linux-2.6.20.1.orig/net/sunrpc/svc.c
++++ linux-2.6.20.1/net/sunrpc/svc.c
+@@ -79,7 +79,11 @@ svc_pool_map_choose_mode(void)
+ * x86_64 kernel on Xeons. In this case we
+ * want to divide the pools on cpu boundaries.
+ */
+- return SVC_POOL_PERCPU;
++ /* actually, unless your IRQs round-robin nicely,
++ * this turns out to be really bad, so just
++ * go GLOBAL for now until a better fix can be developped
++ */
++ return SVC_POOL_GLOBAL;
+ }
+
+ /* default: one global pool */
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 13 11:54:29 2007
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 13 Feb 2007 14:53:06 -0500 (EST)
+Subject: EHCI: turn off remote wakeup during shutdown
+To: stable@kernel.org
+Message-ID: <Pine.LNX.4.44L0.0702131448400.2573-100000@iolanthe.rowland.org>
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+This patch (as850b) disables remote wakeup (and everything else!) on
+all EHCI ports when the shutdown() method is called. If remote wakeup
+is left active then some systems will reboot instead of powering off.
+This fixes Bugzilla #7828.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-hcd.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- linux-2.6.20.1.orig/drivers/usb/host/ehci-hcd.c
++++ linux-2.6.20.1/drivers/usb/host/ehci-hcd.c
+@@ -296,6 +296,18 @@ static void ehci_watchdog (unsigned long
+ spin_unlock_irqrestore (&ehci->lock, flags);
+ }
+
++/* On some systems, leaving remote wakeup enabled prevents system shutdown.
++ * The firmware seems to think that powering off is a wakeup event!
++ * This routine turns off remote wakeup and everything else, on all ports.
++ */
++static void ehci_turn_off_all_ports(struct ehci_hcd *ehci)
++{
++ int port = HCS_N_PORTS(ehci->hcs_params);
++
++ while (port--)
++ writel(PORT_RWC_BITS, &ehci->regs->port_status[port]);
++}
++
+ /* ehci_shutdown kick in for silicon on any bus (not just pci, etc).
+ * This forcibly disables dma and IRQs, helping kexec and other cases
+ * where the next system software may expect clean state.
+@@ -307,9 +319,13 @@ ehci_shutdown (struct usb_hcd *hcd)
+
+ ehci = hcd_to_ehci (hcd);
+ (void) ehci_halt (ehci);
++ ehci_turn_off_all_ports(ehci);
+
+ /* make BIOS/etc use companion controller during reboot */
+ writel (0, &ehci->regs->configured_flag);
++
++ /* unblock posted writes */
++ readl(&ehci->regs->configured_flag);
+ }
+
+ static void ehci_port_power (struct ehci_hcd *ehci, int is_on)
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 21:59:45 2007
+From: Alexey Dobriyan <adobriyan@openvz.org>
+Date: Tue, 06 Feb 2007 21:58:27 -0800 (PST)
+Subject: Fix allocation failure handling in multicast
+To: stable@kernel.org
+Cc: bunk@stusta.de
+Message-ID: <20070206.215827.124083972.davem@davemloft.net>
+
+From: Alexey Dobriyan <adobriyan@openvz.org>
+
+[IPV4/IPV6] multicast: Check add_grhead() return value
+
+add_grhead() allocates memory with GFP_ATOMIC and in at least two places skb
+from it passed to skb_put() without checking.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/igmp.c | 2 ++
+ net/ipv6/mcast.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- linux-2.6.20.1.orig/net/ipv4/igmp.c
++++ linux-2.6.20.1/net/ipv4/igmp.c
+@@ -455,6 +455,8 @@ static struct sk_buff *add_grec(struct s
+ skb = add_grhead(skb, pmc, type, &pgr);
+ first = 0;
+ }
++ if (!skb)
++ return NULL;
+ psrc = (__be32 *)skb_put(skb, sizeof(__be32));
+ *psrc = psf->sf_inaddr;
+ scount++; stotal++;
+--- linux-2.6.20.1.orig/net/ipv6/mcast.c
++++ linux-2.6.20.1/net/ipv6/mcast.c
+@@ -1582,6 +1582,8 @@ static struct sk_buff *add_grec(struct s
+ skb = add_grhead(skb, pmc, type, &pgr);
+ first = 0;
+ }
++ if (!skb)
++ return NULL;
+ psrc = (struct in6_addr *)skb_put(skb, sizeof(*psrc));
+ *psrc = psf->sf_addr;
+ scount++; stotal++;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 21:57:59 2007
+From: Daniel Walker <dwalker@mvista.com>
+Date: Tue, 06 Feb 2007 21:56:37 -0800 (PST)
+Subject: Fix ATM initcall ordering.
+To: stable@kernel.org
+Cc: bunk@stusta.de
+Message-ID: <20070206.215637.55835926.davem@davemloft.net>
+
+From: Daniel Walker <dwalker@mvista.com>
+
+[ATM]: Fix for crash in adummy_init()
+
+This was reported by Ingo Molnar here,
+
+http://lkml.org/lkml/2006/12/18/119
+
+The problem is that adummy_init() depends on atm_init() , but adummy_init()
+is called first.
+
+So I put atm_init() into subsys_initcall which seems appropriate, and it
+will still get module_init() if it becomes a module.
+
+Interesting to note that you could crash your system here if you just load
+the modules in the wrong order.
+
+Signed-off-by: Daniel Walker <dwalker@mvista.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/atm/common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.20.1.orig/net/atm/common.c
++++ linux-2.6.20.1/net/atm/common.c
+@@ -816,7 +816,8 @@ static void __exit atm_exit(void)
+ proto_unregister(&vcc_proto);
+ }
+
+-module_init(atm_init);
++subsys_initcall(atm_init);
++
+ module_exit(atm_exit);
+
+ MODULE_LICENSE("GPL");
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Feb 9 07:44:05 2007
+From: Rojhalat Ibrahim <imr@rtschenk.de>
+Date: Fri, 9 Feb 2007 09:39:57 -0600 (CST)
+Subject: Fix compile error for e500 core based processors
+To: stable@kernel.org
+Cc: imr@rtschenk.de, linux-kernel@vger.kernel.org, linuxppc-embedded@ozlabs.org
+Message-ID: <Pine.LNX.4.64.0702090938360.26617@localhost.localdomain>
+
+From: Rojhalat Ibrahim <imr@rtschenk.de>
+
+We get the following compiler error:
+
+ CC arch/ppc/kernel/ppc_ksyms.o
+arch/ppc/kernel/ppc_ksyms.c:275: error: '__mtdcr' undeclared here (not in a function)
+arch/ppc/kernel/ppc_ksyms.c:275: warning: type defaults to 'int' in declaration of '__mtdcr'
+arch/ppc/kernel/ppc_ksyms.c:276: error: '__mfdcr' undeclared here (not in a function)
+arch/ppc/kernel/ppc_ksyms.c:276: warning: type defaults to 'int' in declaration of '__mfdcr'
+make[1]: *** [arch/ppc/kernel/ppc_ksyms.o] Error 1
+
+This is due to the EXPORT_SYMBOL for __mtdcr/__mfdcr not having the proper CONFIG protection
+
+Signed-off-by: Rojhalat Ibrahim <imr@rtschenk.de>
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ppc/kernel/ppc_ksyms.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.20.1.orig/arch/ppc/kernel/ppc_ksyms.c
++++ linux-2.6.20.1/arch/ppc/kernel/ppc_ksyms.c
+@@ -270,7 +270,7 @@ EXPORT_SYMBOL(mmu_hash_lock); /* For MOL
+ extern long *intercept_table;
+ EXPORT_SYMBOL(intercept_table);
+ #endif /* CONFIG_PPC_STD_MMU */
+-#if defined(CONFIG_40x) || defined(CONFIG_BOOKE)
++#ifdef CONFIG_PPC_DCR_NATIVE
+ EXPORT_SYMBOL(__mtdcr);
+ EXPORT_SYMBOL(__mfdcr);
+ #endif
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Feb 9 17:31:14 2007
+From: Michael Hanselmann <linux-kernel@hansmi.ch>
+Date: Sat, 10 Feb 2007 01:18:23 +0100
+Subject: Fix null pointer dereference in appledisplay driver
+To: linux-kernel@vger.kernel.org
+Cc: len.brown@intel.com, akpm@linux-foundation.org, cappaberra@gmail.com
+Message-ID: <20070210001823.GA3557@hansmi.ch>
+Content-Disposition: inline
+
+From: Michael Hanselmann <linux-kernel@hansmi.ch>
+
+Commit 40b20c257a13c5a526ac540bc5e43d0fdf29792a by Len Brown introduced
+a null pointer dereference in the appledisplay driver. This patch fixes
+it.
+
+Signed-off-by: Michael Hanselmann <linux-kernel@hansmi.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/usb/misc/appledisplay.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.20.1.orig/drivers/usb/misc/appledisplay.c
++++ linux-2.6.20.1/drivers/usb/misc/appledisplay.c
+@@ -281,8 +281,8 @@ static int appledisplay_probe(struct usb
+ /* Register backlight device */
+ snprintf(bl_name, sizeof(bl_name), "appledisplay%d",
+ atomic_inc_return(&count_displays) - 1);
+- pdata->bd = backlight_device_register(bl_name, NULL, NULL,
+- &appledisplay_bl_data);
++ pdata->bd = backlight_device_register(bl_name, NULL,
++ pdata, &appledisplay_bl_data);
+ if (IS_ERR(pdata->bd)) {
+ err("appledisplay: Backlight registration failed");
+ goto error;
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Mar 5 22:14:11 2007
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 6 Mar 2007 17:11:33 +1100
+Subject: Fix recently introduced problem with shutting down a busy NFS server.
+To: stable@kernel.org
+Message-ID: <1070306061133.10640@suse.de>
+
+From: NeilBrown <neilb@suse.de>
+
+
+When the last thread of nfsd exits, it shuts down all related sockets.
+It currently uses svc_close_socket to do this, but that only is
+immediately effective if the socket is not SK_BUSY.
+
+If the socket is busy - i.e. if a request has arrived that has not yet
+been processes - svc_close_socket is not effective and the shutdown
+process spins.
+
+So create a new svc_force_close_socket which removes the SK_BUSY flag
+is set and then calls svc_close_socket.
+
+Also change some open-codes loops in svc_destroy to use
+list_for_each_entry_safe.
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ include/linux/sunrpc/svcsock.h | 2 +-
+ net/sunrpc/svc.c | 23 ++++++++++-------------
+ net/sunrpc/svcsock.c | 16 +++++++++++++++-
+ 3 files changed, 26 insertions(+), 15 deletions(-)
+
+--- linux-2.6.20.1.orig/include/linux/sunrpc/svcsock.h
++++ linux-2.6.20.1/include/linux/sunrpc/svcsock.h
+@@ -63,7 +63,7 @@ struct svc_sock {
+ * Function prototypes.
+ */
+ int svc_makesock(struct svc_serv *, int, unsigned short);
+-void svc_close_socket(struct svc_sock *);
++void svc_force_close_socket(struct svc_sock *);
+ int svc_recv(struct svc_rqst *, long);
+ int svc_send(struct svc_rqst *);
+ void svc_drop(struct svc_rqst *);
+--- linux-2.6.20.1.orig/net/sunrpc/svc.c
++++ linux-2.6.20.1/net/sunrpc/svc.c
+@@ -371,6 +371,7 @@ void
+ svc_destroy(struct svc_serv *serv)
+ {
+ struct svc_sock *svsk;
++ struct svc_sock *tmp;
+
+ dprintk("RPC: svc_destroy(%s, %d)\n",
+ serv->sv_program->pg_name,
+@@ -386,22 +387,18 @@ svc_destroy(struct svc_serv *serv)
+
+ del_timer_sync(&serv->sv_temptimer);
+
+- while (!list_empty(&serv->sv_tempsocks)) {
+- svsk = list_entry(serv->sv_tempsocks.next,
+- struct svc_sock,
+- sk_list);
+- svc_close_socket(svsk);
+- }
++ list_for_each_entry_safe(svsk, tmp, &serv->sv_tempsocks, sk_list)
++ svc_force_close_socket(svsk);
++
+ if (serv->sv_shutdown)
+ serv->sv_shutdown(serv);
+
+- while (!list_empty(&serv->sv_permsocks)) {
+- svsk = list_entry(serv->sv_permsocks.next,
+- struct svc_sock,
+- sk_list);
+- svc_close_socket(svsk);
+- }
+-
++ list_for_each_entry_safe(svsk, tmp, &serv->sv_permsocks, sk_list)
++ svc_force_close_socket(svsk);
++
++ BUG_ON(!list_empty(&serv->sv_permsocks));
++ BUG_ON(!list_empty(&serv->sv_tempsocks));
++
+ cache_clean_deferred(serv);
+
+ /* Unregister service with the portmapper */
+--- linux-2.6.20.1.orig/net/sunrpc/svcsock.c
++++ linux-2.6.20.1/net/sunrpc/svcsock.c
+@@ -80,6 +80,7 @@ static void svc_delete_socket(struct sv
+ static void svc_udp_data_ready(struct sock *, int);
+ static int svc_udp_recvfrom(struct svc_rqst *);
+ static int svc_udp_sendto(struct svc_rqst *);
++static void svc_close_socket(struct svc_sock *svsk);
+
+ static struct svc_deferred_req *svc_deferred_dequeue(struct svc_sock *svsk);
+ static int svc_deferred_recv(struct svc_rqst *rqstp);
+@@ -1668,7 +1669,7 @@ svc_delete_socket(struct svc_sock *svsk)
+ spin_unlock_bh(&serv->sv_lock);
+ }
+
+-void svc_close_socket(struct svc_sock *svsk)
++static void svc_close_socket(struct svc_sock *svsk)
+ {
+ set_bit(SK_CLOSE, &svsk->sk_flags);
+ if (test_and_set_bit(SK_BUSY, &svsk->sk_flags))
+@@ -1681,6 +1682,19 @@ void svc_close_socket(struct svc_sock *s
+ svc_sock_put(svsk);
+ }
+
++void svc_force_close_socket(struct svc_sock *svsk)
++{
++ set_bit(SK_CLOSE, &svsk->sk_flags);
++ if (test_bit(SK_BUSY, &svsk->sk_flags)) {
++ /* Waiting to be processed, but no threads left,
++ * So just remove it from the waiting list
++ */
++ list_del_init(&svsk->sk_ready);
++ clear_bit(SK_BUSY, &svsk->sk_flags);
++ }
++ svc_close_socket(svsk);
++}
++
+ /*
+ * Make a socket for nfsd and lockd
+ */
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 21:58:49 2007
+From: John Heffner <jheffner@psc.edu>
+Date: Tue, 06 Feb 2007 21:57:34 -0800 (PST)
+Subject: Fix TCP FIN handling
+To: stable@kernel.org
+Cc: bunk@stusta.de
+Message-ID: <20070206.215734.83621142.davem@davemloft.net>
+
+From: John Heffner <jheffner@psc.edu>
+
+We can accidently spit out a huge burst of packets with TSO
+when the FIN back is piggybacked onto the final packet.
+
+[TCP]: Don't apply FIN exception to full TSO segments.
+
+Signed-off-by: John Heffner <jheffner@psc.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.20.1.orig/net/ipv4/tcp_output.c
++++ linux-2.6.20.1/net/ipv4/tcp_output.c
+@@ -965,7 +965,8 @@ static inline unsigned int tcp_cwnd_test
+ u32 in_flight, cwnd;
+
+ /* Don't be strict about the congestion window for the final FIN. */
+- if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
++ if ((TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN) &&
++ tcp_skb_pcount(skb) == 1)
+ return 1;
+
+ in_flight = tcp_packets_in_flight(tp);
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Feb 9 15:46:19 2007
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Date: Sat, 10 Feb 2007 00:44:44 +0100 (CET)
+Subject: ieee1394: fix host device registering when nodemgr disabled
+To: stable@kernel.org
+Cc: linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org
+Message-ID: <tkrat.46b3d35bbcfb07d9@s5r6.in-berlin.de>
+Content-Disposition: INLINE
+
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+Since my commit 8252bbb1363b7fe963a3eb6f8a36da619a6f5a65 in 2.6.20-rc1,
+host devices have a dummy driver attached. Alas the driver was not
+registered before use if ieee1394 was loaded with disable_nodemgr=1.
+
+This resulted in non-functional FireWire drivers or kernel lockup.
+http://bugzilla.kernel.org/show_bug.cgi?id=7942
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ieee1394/nodemgr.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+--- linux-2.6.20.1.orig/drivers/ieee1394/nodemgr.c
++++ linux-2.6.20.1/drivers/ieee1394/nodemgr.c
+@@ -274,7 +274,6 @@ static struct device_driver nodemgr_mid_
+ struct device nodemgr_dev_template_host = {
+ .bus = &ieee1394_bus_type,
+ .release = nodemgr_release_host,
+- .driver = &nodemgr_mid_layer_driver,
+ };
+
+
+@@ -1889,22 +1888,31 @@ int init_ieee1394_nodemgr(void)
+
+ error = class_register(&nodemgr_ne_class);
+ if (error)
+- return error;
+-
++ goto fail_ne;
+ error = class_register(&nodemgr_ud_class);
+- if (error) {
+- class_unregister(&nodemgr_ne_class);
+- return error;
+- }
++ if (error)
++ goto fail_ud;
+ error = driver_register(&nodemgr_mid_layer_driver);
++ if (error)
++ goto fail_ml;
++ /* This driver is not used if nodemgr is off (disable_nodemgr=1). */
++ nodemgr_dev_template_host.driver = &nodemgr_mid_layer_driver;
++
+ hpsb_register_highlevel(&nodemgr_highlevel);
+ return 0;
++
++fail_ml:
++ class_unregister(&nodemgr_ud_class);
++fail_ud:
++ class_unregister(&nodemgr_ne_class);
++fail_ne:
++ return error;
+ }
+
+ void cleanup_ieee1394_nodemgr(void)
+ {
+ hpsb_unregister_highlevel(&nodemgr_highlevel);
+-
++ driver_unregister(&nodemgr_mid_layer_driver);
+ class_unregister(&nodemgr_ud_class);
+ class_unregister(&nodemgr_ne_class);
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Feb 9 15:42:53 2007
+From: David Moore <dcm@acm.org>
+Date: Sat, 10 Feb 2007 00:41:28 +0100 (CET)
+Subject: ieee1394: video1394: DMA fix
+To: stable@kernel.org
+Cc: linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org
+Message-ID: <tkrat.c5f99af899e152d1@s5r6.in-berlin.de>
+Content-Disposition: INLINE
+
+From: David Moore <dcm@acm.org>
+
+This together with the phys_to_virt fix in lib/swiotlb.c::swiotlb_sync_sg
+fixes video1394 DMA on machines with DMA bounce buffers, especially Intel
+x86-64 machines with > 3GB RAM.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: David Moore <dcm@acm.org>
+Tested-by: Nicolas Turro <Nicolas.Turro@inrialpes.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ieee1394/video1394.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- linux-2.6.20.1.orig/drivers/ieee1394/video1394.c
++++ linux-2.6.20.1/drivers/ieee1394/video1394.c
+@@ -489,6 +489,9 @@ static void wakeup_dma_ir_ctx(unsigned l
+ reset_ir_status(d, i);
+ d->buffer_status[d->buffer_prg_assignment[i]] = VIDEO1394_BUFFER_READY;
+ do_gettimeofday(&d->buffer_time[d->buffer_prg_assignment[i]]);
++ dma_region_sync_for_cpu(&d->dma,
++ d->buffer_prg_assignment[i] * d->buf_size,
++ d->buf_size);
+ }
+ }
+
+@@ -1096,6 +1099,8 @@ static long video1394_ioctl(struct file
+ DBGMSG(ohci->host->id, "Starting iso transmit DMA ctx=%d",
+ d->ctx);
+ put_timestamp(ohci, d, d->last_buffer);
++ dma_region_sync_for_device(&d->dma,
++ v.buffer * d->buf_size, d->buf_size);
+
+ /* Tell the controller where the first program is */
+ reg_write(ohci, d->cmdPtr,
+@@ -1111,6 +1116,9 @@ static long video1394_ioctl(struct file
+ "Waking up iso transmit dma ctx=%d",
+ d->ctx);
+ put_timestamp(ohci, d, d->last_buffer);
++ dma_region_sync_for_device(&d->dma,
++ v.buffer * d->buf_size, d->buf_size);
++
+ reg_write(ohci, d->ctrlSet, 0x1000);
+ }
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Feb 12 16:50:02 2007
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Date: Tue, 13 Feb 2007 09:48:41 +0900 (JST)
+Subject: IPV6: HASHTABLES: Use appropriate seed for caluculating ehash index.
+To: davem@davemloft.net
+Cc: yoshfuji@linux-ipv6.org, netdev@vger.kernel.org, handat@pm.nttdata.co.jp, stable@kernel.org
+Message-ID: <20070213.094841.17517365.yoshfuji@linux-ipv6.org>
+
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+
+Tetsuo Handa <handat@pm.nttdata.co.jp> told me that connect(2) with TCPv6
+socket almost always took a few minutes to return when we did not have any
+ports available in the range of net.ipv4.ip_local_port_range.
+
+The reason was that we used incorrect seed for calculating index of
+hash when we check established sockets in __inet6_check_established().
+
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/inet6_hashtables.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.20.1.orig/net/ipv6/inet6_hashtables.c
++++ linux-2.6.20.1/net/ipv6/inet6_hashtables.c
+@@ -172,7 +172,7 @@ static int __inet6_check_established(str
+ const struct in6_addr *saddr = &np->daddr;
+ const int dif = sk->sk_bound_dev_if;
+ const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+- const unsigned int hash = inet6_ehashfn(daddr, inet->num, saddr,
++ const unsigned int hash = inet6_ehashfn(daddr, lport, saddr,
+ inet->dport);
+ struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
+ struct sock *sk2;
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Feb 12 10:54:21 2007
+From: "Paolo 'Blaisorblade' Giarrusso" <blaisorblade@yahoo.it>
+Date: Sat, 10 Feb 2007 17:45:37 +0100
+Subject: Kconfig: FAULT_INJECTION can be selected only if LOCKDEP is enabled.
+To: Andrew Morton <akpm@osdl.org>, stable@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Message-ID: <11711259371905-git-send-email-blaisorblade@yahoo.it>
+
+From: "Paolo 'Blaisorblade' Giarrusso" <blaisorblade@yahoo.it>
+
+There is no prompt for STACKTRACE, so it is enabled only when 'select'ed.
+FAULT_INJECTION depends on it, while LOCKDEP selects it. So FAULT_INJECTION
+becomes visible in Kconfig only when LOCKDEP is enabled.
+
+Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.20.1.orig/lib/Kconfig.debug
++++ linux-2.6.20.1/lib/Kconfig.debug
+@@ -400,7 +400,7 @@ config LKDTM
+ config FAULT_INJECTION
+ bool "Fault-injection framework"
+ depends on DEBUG_KERNEL
+- depends on STACKTRACE
++ select STACKTRACE
+ select FRAME_POINTER
+ help
+ Provide fault-injection framework.
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Feb 7 14:30:28 2007
+From: Neil Brown <neilb@suse.de>
+Date: Thu, 8 Feb 2007 09:28:28 +1100
+Subject: md: Avoid possible BUG_ON in md bitmap handling.
+To: akpm@linux-foundation.org
+Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org
+Message-ID: <17866.21132.606116.583062@notabene.brown>
+
+From: Neil Brown <neilb@suse.de>
+
+md/bitmap tracks how many active write requests are pending on blocks
+associated with each bit in the bitmap, so that it knows when it can
+clear the bit (when count hits zero).
+
+The counter has 14 bits of space, so if there are ever more than 16383,
+we cannot cope.
+
+Currently the code just calles BUG_ON as "all" drivers have request queue
+limits much smaller than this.
+
+However is seems that some don't. Apparently some multipath configurations
+can allow more than 16383 concurrent write requests.
+
+So, in this unlikely situation, instead of calling BUG_ON we now wait
+for the count to drop down a bit. This requires a new wait_queue_head,
+some waiting code, and a wakeup call.
+
+Tested by limiting the counter to 20 instead of 16383 (writes go a lot slower
+in that case...).
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+diff .prev/drivers/md/bitmap.c ./drivers/md/bitmap.c
+---
+ drivers/md/bitmap.c | 22 +++++++++++++++++++++-
+ include/linux/raid/bitmap.h | 1 +
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+--- linux-2.6.20.1.orig/drivers/md/bitmap.c
++++ linux-2.6.20.1/drivers/md/bitmap.c
+@@ -1160,6 +1160,22 @@ int bitmap_startwrite(struct bitmap *bit
+ return 0;
+ }
+
++ if (unlikely((*bmc & COUNTER_MAX) == COUNTER_MAX)) {
++ DEFINE_WAIT(__wait);
++ /* note that it is safe to do the prepare_to_wait
++ * after the test as long as we do it before dropping
++ * the spinlock.
++ */
++ prepare_to_wait(&bitmap->overflow_wait, &__wait,
++ TASK_UNINTERRUPTIBLE);
++ spin_unlock_irq(&bitmap->lock);
++ bitmap->mddev->queue
++ ->unplug_fn(bitmap->mddev->queue);
++ schedule();
++ finish_wait(&bitmap->overflow_wait, &__wait);
++ continue;
++ }
++
+ switch(*bmc) {
+ case 0:
+ bitmap_file_set_bit(bitmap, offset);
+@@ -1169,7 +1185,7 @@ int bitmap_startwrite(struct bitmap *bit
+ case 1:
+ *bmc = 2;
+ }
+- BUG_ON((*bmc & COUNTER_MAX) == COUNTER_MAX);
++
+ (*bmc)++;
+
+ spin_unlock_irq(&bitmap->lock);
+@@ -1207,6 +1223,9 @@ void bitmap_endwrite(struct bitmap *bitm
+ if (!success && ! (*bmc & NEEDED_MASK))
+ *bmc |= NEEDED_MASK;
+
++ if ((*bmc & COUNTER_MAX) == COUNTER_MAX)
++ wake_up(&bitmap->overflow_wait);
++
+ (*bmc)--;
+ if (*bmc <= 2) {
+ set_page_attr(bitmap,
+@@ -1431,6 +1450,7 @@ int bitmap_create(mddev_t *mddev)
+ spin_lock_init(&bitmap->lock);
+ atomic_set(&bitmap->pending_writes, 0);
+ init_waitqueue_head(&bitmap->write_wait);
++ init_waitqueue_head(&bitmap->overflow_wait);
+
+ bitmap->mddev = mddev;
+
+--- linux-2.6.20.1.orig/include/linux/raid/bitmap.h
++++ linux-2.6.20.1/include/linux/raid/bitmap.h
+@@ -247,6 +247,7 @@ struct bitmap {
+
+ atomic_t pending_writes; /* pending writes to the bitmap file */
+ wait_queue_head_t write_wait;
++ wait_queue_head_t overflow_wait;
+
+ };
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Feb 12 15:27:53 2007
+From: David Woodhouse <dwmw2@infradead.org>
+Date: Tue, 13 Feb 2007 09:56:22 +1030
+Subject: MTD: Fatal regression in drivers/mtd/redboot.c in 2.6.20
+To: stable@kernel.org
+Cc: Andrew Morton <akpm@osdl.org>, David Woodhouse <dwmw2@infradead.org>, Martin Michlmayr <tbm@cyrius.com>, Yoshinori Sato <ysato@users.sourceforge.jp>
+Message-ID: <45D0F79E.7010104@whitby.id.au>
+
+From: David Woodhouse <dwmw2@infradead.org>
+
+[MTD] Fix regression in RedBoot partition scanning
+
+This fixes a regression introduced by the attempt to handle RedBoot FIS
+tables which are smaller than an eraseblock, in commit
+0b47d654089c5ce3f2ea26a4485db9bcead1e515
+
+It moves the recalculation of the number of slots in the table to the
+correct place, and improves the heuristic for when we think we need to
+byte-swap what we read from the flash.
+
+Signed-off-by: David Woodhouse <dwmw2@infradead.org>
+Cc: Rod Whitby <rod@whitby.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/redboot.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- linux-2.6.20.1.orig/drivers/mtd/redboot.c
++++ linux-2.6.20.1/drivers/mtd/redboot.c
+@@ -94,8 +94,19 @@ static int parse_redboot_partitions(stru
+ * (NOTE: this is 'size' not 'data_length'; size is
+ * the full size of the entry.)
+ */
+- if (swab32(buf[i].size) == master->erasesize) {
++
++ /* RedBoot can combine the FIS directory and
++ config partitions into a single eraseblock;
++ we assume wrong-endian if either the swapped
++ 'size' matches the eraseblock size precisely,
++ or if the swapped size actually fits in an
++ eraseblock while the unswapped size doesn't. */
++ if (swab32(buf[i].size) == master->erasesize ||
++ (buf[i].size > master->erasesize
++ && swab32(buf[i].size) < master->erasesize)) {
+ int j;
++ /* Update numslots based on actual FIS directory size */
++ numslots = swab32(buf[i].size) / sizeof (struct fis_image_desc);
+ for (j = 0; j < numslots; ++j) {
+
+ /* A single 0xff denotes a deleted entry.
+@@ -120,11 +131,11 @@ static int parse_redboot_partitions(stru
+ swab32s(&buf[j].desc_cksum);
+ swab32s(&buf[j].file_cksum);
+ }
++ } else if (buf[i].size < master->erasesize) {
++ /* Update numslots based on actual FIS directory size */
++ numslots = buf[i].size / sizeof(struct fis_image_desc);
+ }
+ break;
+- } else {
+- /* re-calculate of real numslots */
+- numslots = buf[i].size / sizeof(struct fis_image_desc);
+ }
+ }
+ if (i == numslots) {
usb-audio-fixes-2.patch
hda-intel-don-t-try-to-probe-invalid-codecs.patch
fix-various-bugs-with-aligned-reads-in-raid5.patch
+fix-atm-initcall-ordering.patch
+fix-tcp-fin-handling.patch
+fix-allocation-failure-handling-in-multicast.patch
+md-avoid-possible-bug_on-in-md-bitmap-handling.patch
+fix-compile-error-for-e500-core-based-processors.patch
+ieee1394-video1394-dma-fix.patch
+ieee1394-fix-host-device-registering-when-nodemgr-disabled.patch
+fix-null-pointer-dereference-in-appledisplay-driver.patch
+usb-hid-fix-usb-vendor-and-product-ids-endianness-for-usb-hid-devices.patch
+kconfig-fault_injection-can-be-selected-only-if-lockdep-is-enabled.patch
+mtd-fatal-regression-in-drivers-mtd-redboot.c-in-2.6.20.patch
+ipv6-hashtables-use-appropriate-seed-for-caluculating-ehash-index.patch
+ehci-turn-off-remote-wakeup-during-shutdown.patch
+avoid-using-nfsd-process-pools-on-smp-machines.patch
+fix-recently-introduced-problem-with-shutting-down-a-busy-nfs-server.patch
+uhci-fix-port-resume-problem.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Feb 26 14:17:37 2007
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 26 Feb 2007 17:16:06 -0500 (EST)
+Subject: UHCI: fix port resume problem
+To: Greg KH <greg@kroah.com>, <stable@kernel.org>
+Cc: Guilherme Salgado <gsalgado@gmail.com>, USB development list <linux-usb-devel@lists.sourceforge.net>
+Message-ID: <Pine.LNX.4.44L0.0702261713080.3374-100000@iolanthe.rowland.org>
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+This patch (as863) fixes a problem encountered sometimes when resuming
+a port on a UHCI controller. The hardware may turn off the
+Resume-Detect bit before turning off the Suspend bit, leading usbcore
+to think that the port is still suspended and the resume has failed.
+The patch makes uhci_finish_suspend() wait until both bits are safely
+off.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/uhci-hub.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- linux-2.6.20.1.orig/drivers/usb/host/uhci-hub.c
++++ linux-2.6.20.1/drivers/usb/host/uhci-hub.c
+@@ -33,6 +33,9 @@ static __u8 root_hub_hub_des[] =
+ /* status change bits: nonzero writes will clear */
+ #define RWC_BITS (USBPORTSC_OCC | USBPORTSC_PEC | USBPORTSC_CSC)
+
++/* suspend/resume bits: port suspended or port resuming */
++#define SUSPEND_BITS (USBPORTSC_SUSP | USBPORTSC_RD)
++
+ /* A port that either is connected or has a changed-bit set will prevent
+ * us from AUTO_STOPPING.
+ */
+@@ -96,8 +99,8 @@ static void uhci_finish_suspend(struct u
+ int status;
+ int i;
+
+- if (inw(port_addr) & (USBPORTSC_SUSP | USBPORTSC_RD)) {
+- CLR_RH_PORTSTAT(USBPORTSC_SUSP | USBPORTSC_RD);
++ if (inw(port_addr) & SUSPEND_BITS) {
++ CLR_RH_PORTSTAT(SUSPEND_BITS);
+ if (test_bit(port, &uhci->resuming_ports))
+ set_bit(port, &uhci->port_c_suspend);
+
+@@ -107,7 +110,7 @@ static void uhci_finish_suspend(struct u
+ * Experiments show that some controllers take longer, so
+ * we'll poll for completion. */
+ for (i = 0; i < 10; ++i) {
+- if (!(inw(port_addr) & USBPORTSC_RD))
++ if (!(inw(port_addr) & SUSPEND_BITS))
+ break;
+ udelay(1);
+ }
+@@ -289,7 +292,7 @@ static int uhci_hub_control(struct usb_h
+ wPortStatus |= USB_PORT_STAT_CONNECTION;
+ if (status & USBPORTSC_PE) {
+ wPortStatus |= USB_PORT_STAT_ENABLE;
+- if (status & (USBPORTSC_SUSP | USBPORTSC_RD))
++ if (status & SUSPEND_BITS)
+ wPortStatus |= USB_PORT_STAT_SUSPEND;
+ }
+ if (status & USBPORTSC_OC)
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Feb 11 09:28:13 2007
+From: Julien BLACHE <jb@jblache.org>
+Date: Sun, 11 Feb 2007 18:27:09 +0100 (CET)
+Subject: USB HID: Fix USB vendor and product IDs endianness for USB HID devices
+To: stable@kernel.org
+Cc: Julien BLACHE <jb@jblache.org>
+Message-ID: <Pine.LNX.4.64.0702111825170.22290@jikos.suse.cz>
+
+From: Julien BLACHE <jb@jblache.org>
+
+[PATCH] USB HID: Fix USB vendor and product IDs endianness for USB HID devices
+
+The USB vendor and product IDs are not byteswapped appropriately, and
+thus come out in the wrong endianness when fetched through the evdev
+using ioctl() on big endian platforms.
+
+Signed-off-by: Julien BLACHE <jb@jblache.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/usb/input/hid-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.20.1.orig/drivers/usb/input/hid-core.c
++++ linux-2.6.20.1/drivers/usb/input/hid-core.c
+@@ -1212,8 +1212,8 @@ static struct hid_device *usb_hid_config
+ le16_to_cpu(dev->descriptor.idProduct));
+
+ hid->bus = BUS_USB;
+- hid->vendor = dev->descriptor.idVendor;
+- hid->product = dev->descriptor.idProduct;
++ hid->vendor = le16_to_cpu(dev->descriptor.idVendor);
++ hid->product = le16_to_cpu(dev->descriptor.idProduct);
+
+ usb_make_path(dev, hid->phys, sizeof(hid->phys));
+ strlcat(hid->phys, "/input", sizeof(hid->phys));
projects / thirdparty / kernel / stable-queue.git / commitdiff
