--- /dev/null
+From linville@tuxdriver.com Wed Oct 31 07:40:46 2007
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Tue, 9 Oct 2007 22:46:33 -0400
+Subject: Add get_unaligned to ieee80211_get_radiotap_len
+To: stable@kernel.org
+Cc: warmcat <andy@warmcat.com>, "John W. Linville" <linville@tuxdriver.com>
+Message-ID: <11919843974140-git-send-email-linville@tuxdriver.com>
+
+
+From: Andy Green <andy@warmcat.com>
+
+patch dfe6e81deaa79c85086c0cc8d85b229e444ab97f in mainline.
+
+ieee80211_get_radiotap_len() tries to dereference radiotap length without
+taking care that it is completely unaligned and get_unaligned()
+is required.
+
+Signed-off-by: Andy Green <andy@warmcat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/ieee80211.c
++++ b/net/mac80211/ieee80211.c
+@@ -24,6 +24,7 @@
+ #include <linux/compiler.h>
+ #include <linux/bitmap.h>
+ #include <net/cfg80211.h>
++#include <asm/unaligned.h>
+
+ #include "ieee80211_common.h"
+ #include "ieee80211_i.h"
+@@ -338,7 +339,7 @@ static int ieee80211_get_radiotap_len(st
+ struct ieee80211_radiotap_header *hdr =
+ (struct ieee80211_radiotap_header *) skb->data;
+
+- return le16_to_cpu(hdr->it_len);
++ return le16_to_cpu(get_unaligned(&hdr->it_len));
+ }
+
+ #ifdef CONFIG_MAC80211_LOWTX_FRAME_DUMP
--- /dev/null
+From jacmet@sunsite.dk Wed Oct 31 07:55:19 2007
+From: Peter Korsgaard <jacmet@sunsite.dk>
+Date: Fri, 12 Oct 2007 14:14:02 +0200
+Subject: dm9601: Fix receive MTU
+To: stable@kernel.org
+Cc: jeff@garzik.org
+Message-ID: <87ir5cttrp.fsf@macbook.be.48ers.dk>
+
+From: Peter Korsgaard <jacmet@sunsite.dk>
+
+patch f662fe5a0b144efadbfc00e8040e603ec318746e in mainline.
+
+dm9601: Fix receive MTU
+
+dm9601 didn't take the ethernet header into account when calculating
+RX MTU, causing packets bigger than 1486 to fail.
+
+Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/usb/dm9601.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -405,7 +405,7 @@ static int dm9601_bind(struct usbnet *de
+ dev->net->ethtool_ops = &dm9601_ethtool_ops;
+ dev->net->hard_header_len += DM_TX_OVERHEAD;
+ dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+- dev->rx_urb_size = dev->net->mtu + DM_RX_OVERHEAD;
++ dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD;
+
+ dev->mii.dev = dev->net;
+ dev->mii.mdio_read = dm9601_mdio_read;
--- /dev/null
+From stefanr@s5r6.in-berlin.de Wed Oct 31 07:49:26 2007
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Date: Wed, 10 Oct 2007 22:37:25 +0200 (CEST)
+Subject: firewire: fix unloading of fw-ohci while devices are attached
+To: stable@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Message-ID: <tkrat.da18b1110ff68dcd@s5r6.in-berlin.de>
+Content-Disposition: INLINE
+
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+Fix panic in run_timer_softirq right after "modprobe -r firewire-ohci"
+if a FireWire disk was attached and firewire-sbp2 loaded.
+
+Same as commit 8a2d9ed3210464d22fccb9834970629c1c36fa36.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/fw-card.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/firewire/fw-card.c
++++ b/drivers/firewire/fw-card.c
+@@ -507,9 +507,11 @@ fw_core_remove_card(struct fw_card *card
+ /* Set up the dummy driver. */
+ card->driver = &dummy_driver;
+
+- fw_flush_transactions(card);
+-
+ fw_destroy_nodes(card);
++ flush_scheduled_work();
++
++ fw_flush_transactions(card);
++ del_timer_sync(&card->flush_timer);
+
+ fw_card_put(card);
+ }
--- /dev/null
+From khali@linux-fr.org Wed Oct 31 07:58:20 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 15 Oct 2007 14:02:36 +0200
+Subject: hwmon/lm87: Disable VID when it should be
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20071015140236.06b4d97a@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=889af3d5d9586db795a06c619e416b4baee11da8
+
+A stupid bit shifting bug caused the VID value to be always exported
+even when the hardware is configured for something different.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm87.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm87.c
++++ b/drivers/hwmon/lm87.c
+@@ -145,7 +145,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A,
+ #define CHAN_NO_FAN(nr) (1 << (nr))
+ #define CHAN_TEMP3 (1 << 2)
+ #define CHAN_VCC_5V (1 << 3)
+-#define CHAN_NO_VID (1 << 8)
++#define CHAN_NO_VID (1 << 7)
+
+ /*
+ * Functions declaration
--- /dev/null
+From khali@linux-fr.org Wed Oct 31 07:57:45 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 15 Oct 2007 13:49:50 +0200
+Subject: hwmon/lm87: Fix a division by zero
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20071015134950.15b1e97d@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=b965d4b7f614522170af6a7e450be0333792ccd2
+
+Missing parentheses in the definition of FAN_FROM_REG cause a
+division by zero for a specific register value.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Hans de Goede <j.w.r.degoede@hhs.nl>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm87.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm87.c
++++ b/drivers/hwmon/lm87.c
+@@ -129,7 +129,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A,
+ (((val) < 0 ? (val)-500 : (val)+500) / 1000))
+
+ #define FAN_FROM_REG(reg,div) ((reg) == 255 || (reg) == 0 ? 0 : \
+- 1350000 + (reg)*(div) / 2) / ((reg)*(div))
++ (1350000 + (reg)*(div) / 2) / ((reg)*(div)))
+ #define FAN_TO_REG(val,div) ((val)*(div) * 255 <= 1350000 ? 255 : \
+ (1350000 + (val)*(div) / 2) / ((val)*(div)))
+
--- /dev/null
+From khali@linux-fr.org Wed Oct 31 07:59:11 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 15 Oct 2007 15:02:42 +0200
+Subject: hwmon/w83627hf: Don't assume bank 0
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20071015150242.643837b8@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d58df9cd788e6fb4962e1c8d5ba7b8b95d639a44
+
+The bank switching code assumes that the bank selector is set to 0
+when the driver is loaded. This might not be the case. This is exactly
+the same bug as was fixed in the w83627ehf driver two months ago:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0956895aa6f8dc6a33210967252fd7787652537d
+
+In practice, this bug was causing the sensor thermal types to be
+improperly reported for my W83627THF the first time I was loading the
+w83627hf driver. From the driver history, I'd say that it has been
+broken since September 2005 (when we stopped resetting the chip by
+default at driver load.)
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/w83627hf.c | 44 ++++++++++++++++++++++----------------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -1209,6 +1209,24 @@ static int __devexit w83627hf_remove(str
+ }
+
+
++/* Registers 0x50-0x5f are banked */
++static inline void w83627hf_set_bank(struct w83627hf_data *data, u16 reg)
++{
++ if ((reg & 0x00f0) == 0x50) {
++ outb_p(W83781D_REG_BANK, data->addr + W83781D_ADDR_REG_OFFSET);
++ outb_p(reg >> 8, data->addr + W83781D_DATA_REG_OFFSET);
++ }
++}
++
++/* Not strictly necessary, but play it safe for now */
++static inline void w83627hf_reset_bank(struct w83627hf_data *data, u16 reg)
++{
++ if (reg & 0xff00) {
++ outb_p(W83781D_REG_BANK, data->addr + W83781D_ADDR_REG_OFFSET);
++ outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
++ }
++}
++
+ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg)
+ {
+ int res, word_sized;
+@@ -1219,12 +1237,7 @@ static int w83627hf_read_value(struct w8
+ && (((reg & 0x00ff) == 0x50)
+ || ((reg & 0x00ff) == 0x53)
+ || ((reg & 0x00ff) == 0x55));
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(reg >> 8,
+- data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_set_bank(data, reg);
+ outb_p(reg & 0xff, data->addr + W83781D_ADDR_REG_OFFSET);
+ res = inb_p(data->addr + W83781D_DATA_REG_OFFSET);
+ if (word_sized) {
+@@ -1234,11 +1247,7 @@ static int w83627hf_read_value(struct w8
+ (res << 8) + inb_p(data->addr +
+ W83781D_DATA_REG_OFFSET);
+ }
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_reset_bank(data, reg);
+ mutex_unlock(&data->lock);
+ return res;
+ }
+@@ -1309,12 +1318,7 @@ static int w83627hf_write_value(struct w
+ || ((reg & 0xff00) == 0x200))
+ && (((reg & 0x00ff) == 0x53)
+ || ((reg & 0x00ff) == 0x55));
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(reg >> 8,
+- data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_set_bank(data, reg);
+ outb_p(reg & 0xff, data->addr + W83781D_ADDR_REG_OFFSET);
+ if (word_sized) {
+ outb_p(value >> 8,
+@@ -1324,11 +1328,7 @@ static int w83627hf_write_value(struct w
+ }
+ outb_p(value & 0xff,
+ data->addr + W83781D_DATA_REG_OFFSET);
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_reset_bank(data, reg);
+ mutex_unlock(&data->lock);
+ return 0;
+ }
--- /dev/null
+From khali@linux-fr.org Wed Oct 31 07:58:46 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 15 Oct 2007 14:32:27 +0200
+Subject: hwmon/w83627hf: Fix setting fan min right after driver load
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20071015143227.6548d45b@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c09c5184a26158da32801e89d5849d774605f0dd
+
+We need to read the fan clock dividers at initialization time,
+otherwise the code in store_fan_min() may use uninitialized values.
+That's pretty much the same bug and same fix as for the w83627ehf
+driver last month.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/w83627hf.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -335,6 +335,7 @@ static int w83627hf_remove(struct platfo
+
+ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg);
+ static int w83627hf_write_value(struct w83627hf_data *data, u16 reg, u16 value);
++static void w83627hf_update_fan_div(struct w83627hf_data *data);
+ static struct w83627hf_data *w83627hf_update_device(struct device *dev);
+ static void w83627hf_init_device(struct platform_device *pdev);
+
+@@ -1127,6 +1128,7 @@ static int __devinit w83627hf_probe(stru
+ data->fan_min[0] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(1));
+ data->fan_min[1] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(2));
+ data->fan_min[2] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(3));
++ w83627hf_update_fan_div(data);
+
+ /* Register common device attributes */
+ if ((err = sysfs_create_group(&dev->kobj, &w83627hf_group)))
+@@ -1430,6 +1432,24 @@ static void __devinit w83627hf_init_devi
+ | 0x01);
+ }
+
++static void w83627hf_update_fan_div(struct w83627hf_data *data)
++{
++ int reg;
++
++ reg = w83627hf_read_value(data, W83781D_REG_VID_FANDIV);
++ data->fan_div[0] = (reg >> 4) & 0x03;
++ data->fan_div[1] = (reg >> 6) & 0x03;
++ if (data->type != w83697hf) {
++ data->fan_div[2] = (w83627hf_read_value(data,
++ W83781D_REG_PIN) >> 6) & 0x03;
++ }
++ reg = w83627hf_read_value(data, W83781D_REG_VBAT);
++ data->fan_div[0] |= (reg >> 3) & 0x04;
++ data->fan_div[1] |= (reg >> 4) & 0x04;
++ if (data->type != w83697hf)
++ data->fan_div[2] |= (reg >> 5) & 0x04;
++}
++
+ static struct w83627hf_data *w83627hf_update_device(struct device *dev)
+ {
+ struct w83627hf_data *data = dev_get_drvdata(dev);
+@@ -1493,18 +1513,8 @@ static struct w83627hf_data *w83627hf_up
+ w83627hf_read_value(data, W83781D_REG_TEMP_HYST(3));
+ }
+
+- i = w83627hf_read_value(data, W83781D_REG_VID_FANDIV);
+- data->fan_div[0] = (i >> 4) & 0x03;
+- data->fan_div[1] = (i >> 6) & 0x03;
+- if (data->type != w83697hf) {
+- data->fan_div[2] = (w83627hf_read_value(data,
+- W83781D_REG_PIN) >> 6) & 0x03;
+- }
+- i = w83627hf_read_value(data, W83781D_REG_VBAT);
+- data->fan_div[0] |= (i >> 3) & 0x04;
+- data->fan_div[1] |= (i >> 4) & 0x04;
+- if (data->type != w83697hf)
+- data->fan_div[2] |= (i >> 5) & 0x04;
++ w83627hf_update_fan_div(data);
++
+ data->alarms =
+ w83627hf_read_value(data, W83781D_REG_ALARM1) |
+ (w83627hf_read_value(data, W83781D_REG_ALARM2) << 8) |
--- /dev/null
+From airlied@linux.ie Wed Oct 31 08:00:29 2007
+From: Dave Airlie <airlied@linux.ie>
+Date: Tue, 16 Oct 2007 01:05:49 +0100 (IST)
+Subject: i915: fix vbl swap allocation size.
+To: stable@kernel.org
+Message-ID: <alpine.DEB.0.82.0710160104270.13104@skynet.skynet.ie>
+
+From: Dave Airlie <airlied@linux.ie>
+
+This is upstream as 54583bf4efda79388fc13163e35c016c8bc5de81
+
+Oops...
+
+Signed-off-by: Dave Airlie <airlied@linux.ie>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/drm/i915_irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/drm/i915_irq.c
++++ b/drivers/char/drm/i915_irq.c
+@@ -541,7 +541,7 @@ int i915_vblank_swap(DRM_IOCTL_ARGS)
+ return DRM_ERR(EBUSY);
+ }
+
+- vbl_swap = drm_calloc(1, sizeof(vbl_swap), DRM_MEM_DRIVER);
++ vbl_swap = drm_calloc(1, sizeof(*vbl_swap), DRM_MEM_DRIVER);
+
+ if (!vbl_swap) {
+ DRM_ERROR("Failed to allocate memory to queue swap\n");
--- /dev/null
+From linville@tuxdriver.com Wed Oct 31 07:43:56 2007
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Tue, 9 Oct 2007 22:46:36 -0400
+Subject: libertas: fix endianness breakage
+To: stable@kernel.org
+Cc: Al Viro <viro@zeniv.linux.org.uk>, "John W. Linville" <linville@tuxdriver.com>, Al Viro <viro@ftp.linux.org.uk>
+Message-ID: <11919843971952-git-send-email-linville@tuxdriver.com>
+
+
+From: Al Viro <viro@ftp.linux.org.uk>
+
+patch 5707708111ca6c4e9a1160acffdc98a98d95e462 in mainline.
+
+ wep->keytype[] is u8
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+---
+ drivers/net/wireless/libertas/cmd.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/libertas/cmd.c
++++ b/drivers/net/wireless/libertas/cmd.c
+@@ -185,14 +185,12 @@ static int wlan_cmd_802_11_set_wep(wlan_
+
+ switch (pkey->len) {
+ case KEY_LEN_WEP_40:
+- wep->keytype[i] =
+- cpu_to_le16(cmd_type_wep_40_bit);
++ wep->keytype[i] = cmd_type_wep_40_bit;
+ memmove(&wep->keymaterial[i], pkey->key,
+ pkey->len);
+ break;
+ case KEY_LEN_WEP_104:
+- wep->keytype[i] =
+- cpu_to_le16(cmd_type_wep_104_bit);
++ wep->keytype[i] = cmd_type_wep_104_bit;
+ memmove(&wep->keymaterial[i], pkey->key,
+ pkey->len);
+ break;
--- /dev/null
+From linville@tuxdriver.com Wed Oct 31 07:47:33 2007
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Tue, 9 Oct 2007 22:46:37 -0400
+Subject: libertas: more endianness breakage
+To: stable@kernel.org
+Cc: Al Viro <viro@zeniv.linux.org.uk>, "John W. Linville" <linville@tuxdriver.com>, Al Viro <viro@ftp.linux.org.uk>
+Message-ID: <11919843974173-git-send-email-linville@tuxdriver.com>
+
+
+From: Al Viro <viro@ftp.linux.org.uk>
+
+based on patch 8362cd413e8116306fafbaf414f0419db0595142 in mainline.
+
+ domain->header.len is le16 and has just been assigned
+cpu_to_le16(arithmetical expression). And all fields of adapter->logmsg
+are __le32; not a single 16-bit among them...
+ That's incremental to the previous one
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/11d.c | 2 +-
+ drivers/net/wireless/libertas/wext.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/libertas/11d.c
++++ b/drivers/net/wireless/libertas/11d.c
+@@ -562,7 +562,7 @@ int libertas_cmd_802_11d_domain_info(wla
+ nr_subband * sizeof(struct ieeetypes_subbandset));
+
+ cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
+- domain->header.len +
++ le16_to_cpu(domain->header.len) +
+ sizeof(struct mrvlietypesheader) +
+ S_DS_GEN);
+ } else {
+--- a/drivers/net/wireless/libertas/wext.c
++++ b/drivers/net/wireless/libertas/wext.c
+@@ -973,7 +973,7 @@ static struct iw_statistics *wlan_get_wi
+ /* Quality by TX errors */
+ priv->wstats.discard.retries = priv->stats.tx_errors;
+
+- tx_retries = le16_to_cpu(adapter->logmsg.retry);
++ tx_retries = le32_to_cpu(adapter->logmsg.retry);
+
+ if (tx_retries > 75)
+ tx_qual = (90 - tx_retries) * POOR / 15;
+@@ -989,10 +989,10 @@ static struct iw_statistics *wlan_get_wi
+ (PERFECT - VERY_GOOD) / 50 + VERY_GOOD;
+ quality = min(quality, tx_qual);
+
+- priv->wstats.discard.code = le16_to_cpu(adapter->logmsg.wepundecryptable);
+- priv->wstats.discard.fragment = le16_to_cpu(adapter->logmsg.rxfrag);
++ priv->wstats.discard.code = le32_to_cpu(adapter->logmsg.wepundecryptable);
++ priv->wstats.discard.fragment = le32_to_cpu(adapter->logmsg.rxfrag);
+ priv->wstats.discard.retries = tx_retries;
+- priv->wstats.discard.misc = le16_to_cpu(adapter->logmsg.ackfailure);
++ priv->wstats.discard.misc = le32_to_cpu(adapter->logmsg.ackfailure);
+
+ /* Calculate quality */
+ priv->wstats.qual.qual = max(quality, (u32)100);
--- /dev/null
+From linville@tuxdriver.com Wed Oct 31 07:42:39 2007
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Tue, 9 Oct 2007 22:46:35 -0400
+Subject: mac80211: filter locally-originated multicast frames
+To: stable@kernel.org
+Cc: "John W. Linville" <linville@tuxdriver.com>
+Message-ID: <1191984397477-git-send-email-linville@tuxdriver.com>
+
+
+From: John W. Linville <linville@tuxdriver.com>
+
+patch b331615722779b078822988843ddffd4eaec9f83 in mainline.
+
+In STA mode, the AP will echo our traffic. This includes multicast
+traffic.
+
+Receiving these frames confuses some protocols and applications,
+notably IPv6 Duplicate Address Detection.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Acked-by: Michael Wu <flamingice@sourmilk.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/ieee80211.c
++++ b/net/mac80211/ieee80211.c
+@@ -2615,9 +2615,10 @@ ieee80211_rx_h_data(struct ieee80211_txr
+ memcpy(dst, hdr->addr1, ETH_ALEN);
+ memcpy(src, hdr->addr3, ETH_ALEN);
+
+- if (sdata->type != IEEE80211_IF_TYPE_STA) {
++ if (sdata->type != IEEE80211_IF_TYPE_STA ||
++ (is_multicast_ether_addr(dst) &&
++ !compare_ether_addr(src, dev->dev_addr)))
+ return TXRX_DROP;
+- }
+ break;
+ case 0:
+ /* DA SA BSSID */
--- /dev/null
+From f6c4286590e7cb13dd16cb2a6e4dc4a27ce6df1d Mon Sep 17 00:00:00 2001
+From: Jeff Garzik <jeff@garzik.org>
+Date: Tue, 17 Jul 2007 00:01:09 -0400
+Subject: netdrvr: natsemi: Fix device removal bug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+This episode illustrates how an overused warning can train people to
+ignore that warning, which winds up hiding bugs.
+
+The warning
+
+drivers/net/natsemi.c: In function ‘natsemi_remove1’:
+drivers/net/natsemi.c:3222: warning: ignoring return value of
+‘device_create_file’, declared with attribute warn_unused_result
+
+is oft-ignored, even though at close inspection one notices this occurs
+in the /remove/ function, not normally where creation occurs. A quick
+s/create/remove/ and we are fixed, with the warning gone.
+
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Cc: Karsten Keil <kkeil@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/natsemi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/natsemi.c
++++ b/drivers/net/natsemi.c
+@@ -671,7 +671,7 @@ static ssize_t natsemi_show_##_name(stru
+ #define NATSEMI_CREATE_FILE(_dev, _name) \
+ device_create_file(&_dev->dev, &dev_attr_##_name)
+ #define NATSEMI_REMOVE_FILE(_dev, _name) \
+- device_create_file(&_dev->dev, &dev_attr_##_name)
++ device_remove_file(&_dev->dev, &dev_attr_##_name)
+
+ NATSEMI_ATTR(dspcfg_workaround);
+
--- /dev/null
+From ba02946a903015840ef672ccc9dc8620a7e83de6 Mon Sep 17 00:00:00 2001
+From: Kumar Gala <galak@kernel.crashing.org>
+Date: Thu, 11 Oct 2007 17:07:34 -0500
+Subject: POWERPC: Fix handling of stfiwx math emulation
+
+From: Kumar Gala <galak@kernel.crashing.org>
+
+patch ba02946a903015840ef672ccc9dc8620a7e83de6 in mainline
+
+Its legal for the stfiwx instruction to have RA = 0 as part of its
+effective address calculation. This is illegal for all other XE
+form instructions.
+
+Add code to compute the proper effective address for stfiwx if
+RA = 0 rather than treating it as illegal.
+
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/math-emu/math.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/math-emu/math.c
++++ b/arch/powerpc/math-emu/math.c
+@@ -407,11 +407,16 @@ do_mathemu(struct pt_regs *regs)
+
+ case XE:
+ idx = (insn >> 16) & 0x1f;
+- if (!idx)
+- goto illegal;
+-
+ op0 = (void *)¤t->thread.fpr[(insn >> 21) & 0x1f];
+- op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
++ if (!idx) {
++ if (((insn >> 1) & 0x3ff) == STFIWX)
++ op1 = (void *)(regs->gpr[(insn >> 11) & 0x1f]);
++ else
++ goto illegal;
++ } else {
++ op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
++ }
++
+ break;
+
+ case XEU:
fix-tcp-s-fastpath_cnt_hit-handling.patch
fix-tcp-md5-on-big-endian.patch
fix-tcp-initial-sequence-number-selection.patch
+mac80211-filter-locally-originated-multicast-frames.patch
+libertas-fix-endianness-breakage.patch
+libertas-more-endianness-breakage.patch
+add-get_unaligned-to-ieee80211_get_radiotap_len.patch
+firewire-fix-unloading-of-fw-ohci-while-devices-are-attached.patch
+netdrvr-natsemi-fix-device-removal-bug.patch
+dm9601-fix-receive-mtu.patch
+v4l-ivtv-fix-udma-yuv-bug.patch
+hwmon-lm87-fix-a-division-by-zero.patch
+hwmon-lm87-disable-vid-when-it-should-be.patch
+hwmon-w83627hf-fix-setting-fan-min-right-after-driver-load.patch
+hwmon-w83627hf-don-t-assume-bank-0.patch
+i915-fix-vbl-swap-allocation-size.patch
+powerpc-fix-handling-of-stfiwx-math-emulation.patch
--- /dev/null
+From mkrufky@linuxtv.org Wed Oct 31 07:56:04 2007
+From: Michael Krufky <mkrufky@linuxtv.org>
+Date: Sun, 14 Oct 2007 11:53:46 -0400
+Subject: V4L: ivtv: fix udma yuv bug
+To: stable@kernel.org
+Cc: Hans Verkuil <hverkuil@xs4all.nl>, v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Ian Armstrong <ian@iarmst.co.uk>, Mauro Carvalho Chehab <mchehab@infradead.org>
+Message-ID: <47123B8A.1010401@linuxtv.org>
+
+
+From: Ian Armstrong <ian@iarmst.demon.co.uk>
+
+Based on cb50f548c0ee9b2aac39743fc4021a7188825a98 in mainline
+
+[PATCH] V4L: ivtv: fix udma yuv bug
+
+Using udma yuv causes the driver to become locked into that mode. This
+prevents use of the mpeg decoder & non-udma yuv output.
+
+This patch clears the operating mode when the device is closed.
+
+Signed-off-by: Ian Armstrong <ian@iarmst.demon.co.uk>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/ivtv/ivtv-fileops.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/video/ivtv/ivtv-fileops.c
++++ b/drivers/media/video/ivtv/ivtv-fileops.c
+@@ -753,6 +753,8 @@ static void ivtv_stop_decoding(struct iv
+ }
+ if (s->type == IVTV_DEC_STREAM_TYPE_YUV && itv->output_mode == OUT_YUV)
+ itv->output_mode = OUT_NONE;
++ else if (s->type == IVTV_DEC_STREAM_TYPE_YUV && itv->output_mode == OUT_UDMA_YUV)
++ itv->output_mode = OUT_NONE;
+ else if (s->type == IVTV_DEC_STREAM_TYPE_MPG && itv->output_mode == OUT_MPG)
+ itv->output_mode = OUT_NONE;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
