--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 24 05:56:29 2006
+Date: Tue, 24 Oct 2006 14:55:46 +0200
+Message-ID: <s5hiri9q3e5.wl%tiwai@suse.de>
+From: Takashi Iwai <tiwai@suse.de>
+To: stable@kernel.org
+MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
+Subject: ALSA: Fix re-use of va_list
+Content-Type: text/plain; charset="us-ascii"
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[PATCH] ALSA: Fix re-use of va_list
+
+The va_list is designed to be used only once. The current code
+may pass va_list arguments multiple times and may cause Oops.
+Copy/release the arguments temporarily to avoid this problem.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/info.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/sound/core/info.c
++++ linux-2.6.18.1/sound/core/info.c
+@@ -119,7 +119,10 @@ int snd_iprintf(struct snd_info_buffer *
+ len = buffer->len - buffer->size;
+ va_start(args, fmt);
+ for (;;) {
+- res = vsnprintf(buffer->buffer + buffer->curr, len, fmt, args);
++ va_list ap;
++ va_copy(ap, args);
++ res = vsnprintf(buffer->buffer + buffer->curr, len, fmt, ap);
++ va_end(ap);
+ if (res < len)
+ break;
+ err = resize_info_buffer(buffer, buffer->len + PAGE_SIZE);
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Oct 29 04:05:46 2006
+Date: Sun, 29 Oct 2006 13:03:49 +0100
+From: Al Viro <viro@ftp.linux.org.uk>
+To: stable@kernel.org
+Message-ID: <20061029120349.GA7012@deprecation.cyrius.com>
+MIME-Version: 1.0
+Content-Disposition: inline
+Subject: Audit: fix missing ifdefs in syscall classes hookup for generic targets
+Content-Type: text/plain; charset="us-ascii"
+
+From: Al Viro <viro@ftp.linux.org.uk>
+
+[PATCH] fix missing ifdefs in syscall classes hookup for generic targets
+
+several targets have no ....at() family and m32r calls its only chown variant
+chown32(), with __NR_chown being undefined. creat(2) is also absent in some
+targets.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-generic/audit_change_attr.h | 4 ++++
+ include/asm-generic/audit_dir_write.h | 4 ++++
+ lib/audit.c | 2 ++
+ 3 files changed, 10 insertions(+)
+
+--- linux-2.6.18.1.orig/include/asm-generic/audit_change_attr.h
++++ linux-2.6.18.1/include/asm-generic/audit_change_attr.h
+@@ -1,16 +1,20 @@
+ __NR_chmod,
+ __NR_fchmod,
++#ifdef __NR_chown
+ __NR_chown,
+ __NR_fchown,
+ __NR_lchown,
++#endif
+ __NR_setxattr,
+ __NR_lsetxattr,
+ __NR_fsetxattr,
+ __NR_removexattr,
+ __NR_lremovexattr,
+ __NR_fremovexattr,
++#ifdef __NR_fchownat
+ __NR_fchownat,
+ __NR_fchmodat,
++#endif
+ #ifdef __NR_chown32
+ __NR_chown32,
+ __NR_fchown32,
+--- linux-2.6.18.1.orig/include/asm-generic/audit_dir_write.h
++++ linux-2.6.18.1/include/asm-generic/audit_dir_write.h
+@@ -1,14 +1,18 @@
+ __NR_rename,
+ __NR_mkdir,
+ __NR_rmdir,
++#ifdef __NR_creat
+ __NR_creat,
++#endif
+ __NR_link,
+ __NR_unlink,
+ __NR_symlink,
+ __NR_mknod,
++#ifdef __NR_mkdirat
+ __NR_mkdirat,
+ __NR_mknodat,
+ __NR_unlinkat,
+ __NR_renameat,
+ __NR_linkat,
+ __NR_symlinkat,
++#endif
+--- linux-2.6.18.1.orig/lib/audit.c
++++ linux-2.6.18.1/lib/audit.c
+@@ -28,8 +28,10 @@ int audit_classify_syscall(int abi, unsi
+ switch(syscall) {
+ case __NR_open:
+ return 2;
++#ifdef __NR_openat
+ case __NR_openat:
+ return 3;
++#endif
+ #ifdef __NR_socketcall
+ case __NR_socketcall:
+ return 4;
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Oct 27 10:09:29 2006
+Message-ID: <454230E7.3090909@lwfinger.net>
+Date: Fri, 27 Oct 2006 11:16:39 -0500
+From: Michael Buesch <mb@bu3sch.de>
+MIME-Version: 1.0
+To: stable@kernel.org
+Cc: Michael Buesch <mb@bu3sch.de>
+Subject: bcm43xx: fix watchdog timeouts.
+Content-Type: text/plain; charset="us-ascii"
+
+From: Michael Buesch <mb@bu3sch.de>
+
+This fixes a netdev watchdog timeout problem.
+The problem is caused by a needed netif_tx_disable
+in the hardware calibration code and can be shown by the
+following timegraph.
+
+|---5secs - ~10 jiffies time---|---|OOPS
+^ ^
+last real TX periodic work stops netif
+
+At OOPS, the following happens:
+The watchdog timer triggers, because the timeout of 5secs
+is over. The watchdog first checks for stopped TX.
+_Usually_ TX is only stopped from the TX handler to indicate
+a full TX queue. But this is different. We need to stop TX here,
+regardless of the TX queue state. So the watchdog recognizes
+the stopped device and assumes it is stopped due to full
+TX queues (Which is a _wrong_ assumption in this case). It then
+tests how far the last TX has been in the past. If it's more than
+5secs (which is the case for low or no traffic), it will fire
+a TX timeout.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- linux-2.6.18.1.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
++++ linux-2.6.18.1/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+@@ -3165,7 +3165,15 @@ static void bcm43xx_periodic_work_handle
+
+ badness = estimate_periodic_work_badness(bcm->periodic_state);
+ mutex_lock(&bcm->mutex);
++
++ /* We must fake a started transmission here, as we are going to
++ * disable TX. If we wouldn't fake a TX, it would be possible to
++ * trigger the netdev watchdog, if the last real TX is already
++ * some time on the past (slightly less than 5secs)
++ */
++ bcm->net_dev->trans_start = jiffies;
+ netif_tx_disable(bcm->net_dev);
++
+ spin_lock_irqsave(&bcm->irq_lock, flags);
+ if (badness > BADNESS_LIMIT) {
+ /* Periodic work will take a long time, so we want it to
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Oct 28 14:53:34 2006
+Message-ID: <4543A73D.100@linuxtv.org>
+Date: Sat, 28 Oct 2006 14:53:49 -0400
+From: Michael Krufky <mkrufky@linuxtv.org>
+MIME-Version: 1.0
+To: stable@kernel.org
+Cc: Christopher Pascoe <c.pascoe@itee.uq.edu.au>, v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>
+Subject: DVB: fix dvb_pll_attach for mt352/zl10353 in cx88-dvb, and nxt200x
+Content-Type: text/plain; charset="us-ascii"
+
+From: Michael Krufky <mkrufky@linuxtv.org>
+
+DVB: fix dvb_pll_attach for mt352/zl10353 in cx88-dvb, and nxt200x
+
+Typical wiring of MT352, ZL10353, NXT2002 and NXT2004 based tuners
+differ from dvb-pll's expectation that the PLL is directly accessible.
+On these boards, the PLL is actually hidden behind the demodulator, and
+as such can only be accessed via the demodulator's interface. It was
+failing to communicate with the PLL during an attach test and
+subsequently not connecting the tuner ops.
+
+By passing a NULL I2C bus handle to dvb_pll_attach, this accessibility
+check can be bypassed. Do this for the affected boards. Also fix a
+possible NULL dereference at sleep time, which would otherwise be
+exposed by this change.
+
+This patch has been backported to the 2.6.18.y stable kernel series
+from the original changesets from Chris Pascoe and Michael Krufky,
+already present in the upstream 2.6.19 kernel tree.
+
+Signed-off-by: Chris Pascoe <c.pascoe@itee.uq.edu.au>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/b2c2/flexcop-fe-tuner.c | 2 +-
+ drivers/media/dvb/frontends/dvb-pll.c | 3 +++
+ drivers/media/video/cx88/cx88-dvb.c | 14 +++++++-------
+ drivers/media/video/saa7134/saa7134-dvb.c | 4 ++--
+ 4 files changed, 13 insertions(+), 10 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
++++ linux-2.6.18.1/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
+@@ -527,7 +527,7 @@ int flexcop_frontend_init(struct flexcop
+ /* try the air atsc 2nd generation (nxt2002) */
+ if ((fc->fe = nxt200x_attach(&samsung_tbmv_config, &fc->i2c_adap)) != NULL) {
+ fc->dev_type = FC_AIR_ATSC2;
+- dvb_pll_attach(fc->fe, 0x61, &fc->i2c_adap, &dvb_pll_samsung_tbmv);
++ dvb_pll_attach(fc->fe, 0x61, NULL, &dvb_pll_samsung_tbmv);
+ info("found the nxt2002 at i2c address: 0x%02x",samsung_tbmv_config.demod_address);
+ } else
+ /* try the air atsc 3nd generation (lgdt3303) */
+--- linux-2.6.18.1.orig/drivers/media/dvb/frontends/dvb-pll.c
++++ linux-2.6.18.1/drivers/media/dvb/frontends/dvb-pll.c
+@@ -493,6 +493,9 @@ static int dvb_pll_sleep(struct dvb_fron
+ int i;
+ int result;
+
++ if (priv->i2c == NULL)
++ return -EINVAL;
++
+ for (i = 0; i < priv->pll_desc->count; i++) {
+ if (priv->pll_desc->entries[i].limit == 0)
+ break;
+--- linux-2.6.18.1.orig/drivers/media/video/cx88/cx88-dvb.c
++++ linux-2.6.18.1/drivers/media/video/cx88/cx88-dvb.c
+@@ -576,7 +576,7 @@ static int dvb_register(struct cx8802_de
+ &dev->core->i2c_adap);
+ if (dev->dvb.frontend != NULL) {
+ dvb_pll_attach(dev->dvb.frontend, 0x60,
+- &dev->core->i2c_adap,
++ NULL,
+ &dvb_pll_thomson_dtt7579);
+ break;
+ }
+@@ -587,7 +587,7 @@ static int dvb_register(struct cx8802_de
+ &dev->core->i2c_adap);
+ if (dev->dvb.frontend != NULL) {
+ dvb_pll_attach(dev->dvb.frontend, 0x60,
+- &dev->core->i2c_adap,
++ NULL,
+ &dvb_pll_thomson_dtt7579);
+ }
+ #endif
+@@ -600,7 +600,7 @@ static int dvb_register(struct cx8802_de
+ &dev->core->i2c_adap);
+ if (dev->dvb.frontend != NULL) {
+ dvb_pll_attach(dev->dvb.frontend, 0x61,
+- &dev->core->i2c_adap,
++ NULL,
+ &dvb_pll_thomson_dtt7579);
+ break;
+ }
+@@ -611,7 +611,7 @@ static int dvb_register(struct cx8802_de
+ &dev->core->i2c_adap);
+ if (dev->dvb.frontend != NULL) {
+ dvb_pll_attach(dev->dvb.frontend, 0x61,
+- &dev->core->i2c_adap,
++ NULL,
+ &dvb_pll_thomson_dtt7579);
+ }
+ #endif
+@@ -623,7 +623,7 @@ static int dvb_register(struct cx8802_de
+ &dev->core->i2c_adap);
+ if (dev->dvb.frontend != NULL) {
+ dvb_pll_attach(dev->dvb.frontend, 0x61,
+- &dev->core->i2c_adap,
++ NULL,
+ &dvb_pll_lg_z201);
+ }
+ break;
+@@ -634,7 +634,7 @@ static int dvb_register(struct cx8802_de
+ &dev->core->i2c_adap);
+ if (dev->dvb.frontend != NULL) {
+ dvb_pll_attach(dev->dvb.frontend, 0x61,
+- &dev->core->i2c_adap,
++ NULL,
+ &dvb_pll_unknown_1);
+ }
+ break;
+@@ -757,7 +757,7 @@ static int dvb_register(struct cx8802_de
+ &dev->core->i2c_adap);
+ if (dev->dvb.frontend != NULL) {
+ dvb_pll_attach(dev->dvb.frontend, 0x61,
+- &dev->core->i2c_adap,
++ NULL,
+ &dvb_pll_tuv1236d);
+ }
+ break;
+--- linux-2.6.18.1.orig/drivers/media/video/saa7134/saa7134-dvb.c
++++ linux-2.6.18.1/drivers/media/video/saa7134/saa7134-dvb.c
+@@ -1158,13 +1158,13 @@ static int dvb_init(struct saa7134_dev *
+ case SAA7134_BOARD_AVERMEDIA_AVERTVHD_A180:
+ dev->dvb.frontend = nxt200x_attach(&avertvhda180, &dev->i2c_adap);
+ if (dev->dvb.frontend) {
+- dvb_pll_attach(dev->dvb.frontend, 0x61, &dev->i2c_adap, &dvb_pll_tdhu2);
++ dvb_pll_attach(dev->dvb.frontend, 0x61, NULL, &dvb_pll_tdhu2);
+ }
+ break;
+ case SAA7134_BOARD_KWORLD_ATSC110:
+ dev->dvb.frontend = nxt200x_attach(&kworldatsc110, &dev->i2c_adap);
+ if (dev->dvb.frontend) {
+- dvb_pll_attach(dev->dvb.frontend, 0x61, &dev->i2c_adap, &dvb_pll_tuv1236d);
++ dvb_pll_attach(dev->dvb.frontend, 0x61, NULL, &dvb_pll_tuv1236d);
+ }
+ break;
+ #endif
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Oct 20 14:19:30 2006
+Message-ID: <45393D3B.1040904@vmware.com>
+Date: Fri, 20 Oct 2006 14:18:51 -0700
+From: Zachary Amsden <zach@vmware.com>
+MIME-Version: 1.0
+To: stable@kernel.org
+Subject: Fix potential interrupts during alternative patching
+
+From: Zachary Amsden <zach@vmware.com>
+
+Interrupts must be disabled during alternative instruction patching.
+On systems with high timer IRQ rates, or when running in an emulator,
+timing differences can result in random kernel panics because of
+running partially patched instructions. This doesn't yet fix NMIs,
+which requires extricating the patch code from the late bug checking
+and is logically separate (and also less likely to cause problems).
+
+Signed-off-by: Zachary Amsden <zach@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/kernel/alternative.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- linux-2.6.18.1.orig/arch/i386/kernel/alternative.c
++++ linux-2.6.18.1/arch/i386/kernel/alternative.c
+@@ -344,6 +344,7 @@ void alternatives_smp_switch(int smp)
+
+ void __init alternative_instructions(void)
+ {
++ unsigned long flags;
+ if (no_replacement) {
+ printk(KERN_INFO "(SMP-)alternatives turned off\n");
+ free_init_pages("SMP alternatives",
+@@ -351,6 +352,8 @@ void __init alternative_instructions(voi
+ (unsigned long)__smp_alt_end);
+ return;
+ }
++
++ local_irq_save(flags);
+ apply_alternatives(__alt_instructions, __alt_instructions_end);
+
+ /* switch to patch-once-at-boottime-only mode and free the
+@@ -386,4 +389,5 @@ void __init alternative_instructions(voi
+ alternatives_smp_switch(0);
+ }
+ #endif
++ local_irq_restore(flags);
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Oct 18 02:09:28 2006
+To: stable@kernel.org
+Message-Id: <E1Ga7Pa-0003VE-00@dorka.pomaz.szeredi.hu>
+From: Miklos Szeredi <miklos@szeredi.hu>
+Date: Wed, 18 Oct 2006 11:08:30 +0200
+Subject: fuse: fix hang on SMP
+MIME-Version: 1.0
+Content-Type: text/plain; charset="us-ascii"
+
+From: Miklos Szeredi <miklos@szeredi.hu>
+
+Fuse didn't always call i_size_write() with i_mutex held which caused
+rare hangs on SMP/32bit. This bug has been present since fuse-2.2,
+well before being merged into mainline.
+
+The simplest solution is to protect i_size_write() with the
+per-connection spinlock. Using i_mutex for this purpose would require
+some restructuring of the code and I'm not even sure it's always safe
+to acquire i_mutex in all places i_size needs to be set.
+
+Since most of vmtruncate is already duplicated for other reasons,
+duplicate the remaining part as well, making all i_size_write() calls
+internal to fuse.
+
+Using i_size_write() was unnecessary in fuse_init_inode(), since this
+function is only called on a newly created locked inode.
+
+Reported by a few people over the years, but special thanks to Dana
+Henriksen who was persistent enough in helping me debug it.
+
+Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fuse/dir.c | 30 +++++++++++++++++++++---------
+ fs/fuse/file.c | 12 +++++++++---
+ fs/fuse/inode.c | 5 ++++-
+ 3 files changed, 34 insertions(+), 13 deletions(-)
+
+--- linux-2.6.18.1.orig/fs/fuse/dir.c
++++ linux-2.6.18.1/fs/fuse/dir.c
+@@ -935,14 +935,30 @@ static void iattr_to_fattr(struct iattr
+ }
+ }
+
++static void fuse_vmtruncate(struct inode *inode, loff_t offset)
++{
++ struct fuse_conn *fc = get_fuse_conn(inode);
++ int need_trunc;
++
++ spin_lock(&fc->lock);
++ need_trunc = inode->i_size > offset;
++ i_size_write(inode, offset);
++ spin_unlock(&fc->lock);
++
++ if (need_trunc) {
++ struct address_space *mapping = inode->i_mapping;
++ unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
++ truncate_inode_pages(mapping, offset);
++ }
++}
++
+ /*
+ * Set attributes, and at the same time refresh them.
+ *
+ * Truncation is slightly complicated, because the 'truncate' request
+ * may fail, in which case we don't want to touch the mapping.
+- * vmtruncate() doesn't allow for this case. So do the rlimit
+- * checking by hand and call vmtruncate() only after the file has
+- * actually been truncated.
++ * vmtruncate() doesn't allow for this case, so do the rlimit checking
++ * and the actual truncation by hand.
+ */
+ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
+ {
+@@ -993,12 +1009,8 @@ static int fuse_setattr(struct dentry *e
+ make_bad_inode(inode);
+ err = -EIO;
+ } else {
+- if (is_truncate) {
+- loff_t origsize = i_size_read(inode);
+- i_size_write(inode, outarg.attr.size);
+- if (origsize > outarg.attr.size)
+- vmtruncate(inode, outarg.attr.size);
+- }
++ if (is_truncate)
++ fuse_vmtruncate(inode, outarg.attr.size);
+ fuse_change_attributes(inode, &outarg.attr);
+ fi->i_time = time_to_jiffies(outarg.attr_valid,
+ outarg.attr_valid_nsec);
+--- linux-2.6.18.1.orig/fs/fuse/file.c
++++ linux-2.6.18.1/fs/fuse/file.c
+@@ -481,8 +481,10 @@ static int fuse_commit_write(struct file
+ err = -EIO;
+ if (!err) {
+ pos += count;
+- if (pos > i_size_read(inode))
++ spin_lock(&fc->lock);
++ if (pos > inode->i_size)
+ i_size_write(inode, pos);
++ spin_unlock(&fc->lock);
+
+ if (offset == 0 && to == PAGE_CACHE_SIZE) {
+ clear_page_dirty(page);
+@@ -586,8 +588,12 @@ static ssize_t fuse_direct_io(struct fil
+ }
+ fuse_put_request(fc, req);
+ if (res > 0) {
+- if (write && pos > i_size_read(inode))
+- i_size_write(inode, pos);
++ if (write) {
++ spin_lock(&fc->lock);
++ if (pos > inode->i_size)
++ i_size_write(inode, pos);
++ spin_unlock(&fc->lock);
++ }
+ *ppos = pos;
+ }
+ fuse_invalidate_attr(inode);
+--- linux-2.6.18.1.orig/fs/fuse/inode.c
++++ linux-2.6.18.1/fs/fuse/inode.c
+@@ -109,6 +109,7 @@ static int fuse_remount_fs(struct super_
+
+ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
+ {
++ struct fuse_conn *fc = get_fuse_conn(inode);
+ if (S_ISREG(inode->i_mode) && i_size_read(inode) != attr->size)
+ invalidate_inode_pages(inode->i_mapping);
+
+@@ -117,7 +118,9 @@ void fuse_change_attributes(struct inode
+ inode->i_nlink = attr->nlink;
+ inode->i_uid = attr->uid;
+ inode->i_gid = attr->gid;
++ spin_lock(&fc->lock);
+ i_size_write(inode, attr->size);
++ spin_unlock(&fc->lock);
+ inode->i_blksize = PAGE_CACHE_SIZE;
+ inode->i_blocks = attr->blocks;
+ inode->i_atime.tv_sec = attr->atime;
+@@ -131,7 +134,7 @@ void fuse_change_attributes(struct inode
+ static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr)
+ {
+ inode->i_mode = attr->mode & S_IFMT;
+- i_size_write(inode, attr->size);
++ inode->i_size = attr->size;
+ if (S_ISREG(inode->i_mode)) {
+ fuse_init_common(inode);
+ fuse_init_file_inode(inode);
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 16:23:45 2006
+To: stable@kernel.org
+From: Arthur Kepner <akepner@sgi.com>
+Date: Tue, 17 Oct 2006 16:22:59 -0700
+Message-ID: <ada4pu2sf1o.fsf@cisco.com>
+MIME-Version: 1.0
+Subject: IB/mthca: Use mmiowb after doorbell ring
+Content-Type: text/plain; charset="us-ascii"
+
+From: Arthur Kepner <akepner@sgi.com>
+
+We discovered a problem when running IPoIB applications on multiple
+CPUs on an Altix system. Many messages such as:
+
+ib_mthca 0002:01:00.0: SQ 000014 full (19941644 head, 19941707 tail, 64 max, 0 nreq)
+
+appear in syslog, and the driver wedges up.
+
+Apparently this is because writes to the doorbells from different CPUs
+reach the device out of order. The following patch adds mmiowb() calls
+after doorbell rings to ensure the doorbell writes are ordered.
+
+Signed-off-by: Arthur Kepner <akepner@sgi.com>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/hw/mthca/mthca_cq.c | 7 +++++++
+ drivers/infiniband/hw/mthca/mthca_qp.c | 19 +++++++++++++++++++
+ drivers/infiniband/hw/mthca/mthca_srq.c | 8 ++++++++
+ 3 files changed, 34 insertions(+)
+
+--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_cq.c
++++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -39,6 +39,8 @@
+ #include <linux/init.h>
+ #include <linux/hardirq.h>
+
++#include <asm/io.h>
++
+ #include <rdma/ib_pack.h>
+
+ #include "mthca_dev.h"
+@@ -210,6 +212,11 @@ static inline void update_cons_index(str
+ mthca_write64(doorbell,
+ dev->kar + MTHCA_CQ_DOORBELL,
+ MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
++ /*
++ * Make sure doorbells don't leak out of CQ spinlock
++ * and reach the HCA out of order:
++ */
++ mmiowb();
+ }
+ }
+
+--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_qp.c
++++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_qp.c
+@@ -39,6 +39,8 @@
+ #include <linux/string.h>
+ #include <linux/slab.h>
+
++#include <asm/io.h>
++
+ #include <rdma/ib_verbs.h>
+ #include <rdma/ib_cache.h>
+ #include <rdma/ib_pack.h>
+@@ -1730,6 +1732,11 @@ out:
+ mthca_write64(doorbell,
+ dev->kar + MTHCA_SEND_DOORBELL,
+ MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
++ /*
++ * Make sure doorbells don't leak out of SQ spinlock
++ * and reach the HCA out of order:
++ */
++ mmiowb();
+ }
+
+ qp->sq.next_ind = ind;
+@@ -1849,6 +1856,12 @@ out:
+ qp->rq.next_ind = ind;
+ qp->rq.head += nreq;
+
++ /*
++ * Make sure doorbells don't leak out of RQ spinlock and reach
++ * the HCA out of order:
++ */
++ mmiowb();
++
+ spin_unlock_irqrestore(&qp->rq.lock, flags);
+ return err;
+ }
+@@ -2110,6 +2123,12 @@ out:
+ MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+ }
+
++ /*
++ * Make sure doorbells don't leak out of SQ spinlock and reach
++ * the HCA out of order:
++ */
++ mmiowb();
++
+ spin_unlock_irqrestore(&qp->sq.lock, flags);
+ return err;
+ }
+--- linux-2.6.18.1.orig/drivers/infiniband/hw/mthca/mthca_srq.c
++++ linux-2.6.18.1/drivers/infiniband/hw/mthca/mthca_srq.c
+@@ -35,6 +35,8 @@
+ #include <linux/slab.h>
+ #include <linux/string.h>
+
++#include <asm/io.h>
++
+ #include "mthca_dev.h"
+ #include "mthca_cmd.h"
+ #include "mthca_memfree.h"
+@@ -593,6 +595,12 @@ int mthca_tavor_post_srq_recv(struct ib_
+ MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+ }
+
++ /*
++ * Make sure doorbells don't leak out of SRQ spinlock and
++ * reach the HCA out of order:
++ */
++ mmiowb();
++
+ spin_unlock_irqrestore(&srq->lock, flags);
+ return err;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 16:23:45 2006
+To: stable@kernel.org
+From: Eli Cohen <eli@mellanox.co.il>
+Date: Tue, 17 Oct 2006 16:23:25 -0700
+Message-ID: <adazmbur0gi.fsf@cisco.com>
+MIME-Version: 1.0
+Subject: IPoIB: Rejoin all multicast groups after a port event
+Content-Type: text/plain; charset="us-ascii"
+
+From: Eli Cohen <eli@mellanox.co.il>
+
+When ipoib_ib_dev_flush() is called because of a port event, the
+driver needs to rejoin all multicast groups, since the flush will call
+ipoib_mcast_dev_flush() (via ipoib_ib_dev_down()). Otherwise no
+(non-broadcast) multicast groups will be rejoined until the networking
+core calls ->set_multicast_list again, and so multicast reception will
+be broken for potentially a long time.
+
+Signed-off-by: Eli Cohen <eli@mellanox.co.il>
+Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ linux-2.6.18.1/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -619,8 +619,10 @@ void ipoib_ib_dev_flush(void *_dev)
+ * The device could have been brought down between the start and when
+ * we get here, don't bring it back up if it's not configured up
+ */
+- if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
++ if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)) {
+ ipoib_ib_dev_up(dev);
++ ipoib_mcast_restart_task(dev);
++ }
+
+ mutex_lock(&priv->vlan_mutex);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 24 23:30:17 2006
+Date: Mon, 23 Oct 2006 17:00:13 GMT
+Message-Id: <200610231700.k9NH0Dp4016676@hera.kernel.org>
+From: Dave Kleikamp <shaggy@austin.ibm.com>
+MIME-Version: 1.0
+Subject: JFS: pageno needs to be long
+Content-Type: text/plain; charset="us-ascii"
+
+From: Dave Kleikamp <shaggy@austin.ibm.com>
+
+JFS: pageno needs to be long
+
+diRead and diWrite are representing the page number as an unsigned int.
+This causes file system corruption on volumes larger than 16TB.
+
+Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jfs/jfs_imap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.1.orig/fs/jfs/jfs_imap.c
++++ linux-2.6.18.1/fs/jfs/jfs_imap.c
+@@ -318,7 +318,7 @@ int diRead(struct inode *ip)
+ struct inomap *imap;
+ int block_offset;
+ int inodes_left;
+- uint pageno;
++ unsigned long pageno;
+ int rel_inode;
+
+ jfs_info("diRead: ino = %ld", ip->i_ino);
+@@ -606,7 +606,7 @@ int diWrite(tid_t tid, struct inode *ip)
+ int block_offset;
+ int inodes_left;
+ struct metapage *mp;
+- uint pageno;
++ unsigned long pageno;
+ int rel_inode;
+ int dioffset;
+ struct inode *ipimap;
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 19 18:53:27 2006
+From: NeilBrown <neilb@suse.de>
+To: Andrew Morton <akpm@osdl.org>
+Date: Fri, 20 Oct 2006 11:52:44 +1000
+Message-Id: <1061020015244.26756@suse.de>
+Cc: Adrian Bunk <bunk@stusta.de>, nfs@lists.sourceforge.net, linux-kernel@vger.kernel.org, stable@kernel.org
+Subject: knfsd: Fix race that can disable NFS server.
+MIME-Version: 1.0
+Content-Type: text/plain; charset="us-ascii"
+
+From: NeilBrown <neilb@suse.de>
+
+This is a long standing bug that seems to have only recently become
+apparent, presumably due to increasing use of NFS over TCP - many
+distros seem to be making it the default.
+
+The SK_CONN bit gets set when a listening socket may be ready
+for an accept, just as SK_DATA is set when data may be available.
+
+It is entirely possible for svc_tcp_accept to be called with neither
+of these set. It doesn't happen often but there is a small race in
+svc_sock_enqueue as SK_CONN and SK_DATA are tested outside the
+spin_lock. They could be cleared immediately after the test and
+before the lock is gained.
+
+This normally shouldn't be a problem. The sockets are non-blocking so
+trying to read() or accept() when ther is nothing to do is not a problem.
+
+However: svc_tcp_recvfrom makes the decision "Should I accept() or
+should I read()" based on whether SK_CONN is set or not. This usually
+works but is not safe. The decision should be based on whether it is
+a TCP_LISTEN socket or a TCP_CONNECTED socket.
+
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/svcsock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/net/sunrpc/svcsock.c
++++ linux-2.6.18.1/net/sunrpc/svcsock.c
+@@ -902,7 +902,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
+ return 0;
+ }
+
+- if (test_bit(SK_CONN, &svsk->sk_flags)) {
++ if (svsk->sk_sk->sk_state == TCP_LISTEN) {
+ svc_tcp_accept(svsk);
+ svc_sock_received(svsk);
+ return 0;
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 23 00:08:31 2006
+From: NeilBrown <neilb@suse.de>
+To: Andrew Morton <akpm@osdl.org>
+Date: Mon, 23 Oct 2006 17:07:48 +1000
+Message-Id: <1061023070748.29223@suse.de>
+Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org
+Subject: md: Fix bug where spares don't always get rebuilt properly when they become live.
+MIME-Version: 1.0
+Content-Type: text/plain; charset="us-ascii"
+
+From: NeilBrown <neilb@suse.de>
+
+If save_raid_disk is >= 0, then the device could be a device that is
+already in sync that is being re-added. So we need to default this
+value to -1.
+
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.18.1.orig/drivers/md/md.c
++++ linux-2.6.18.1/drivers/md/md.c
+@@ -1994,6 +1994,7 @@ static mdk_rdev_t *md_import_device(dev_
+ kobject_init(&rdev->kobj);
+
+ rdev->desc_nr = -1;
++ rdev->saved_raid_disk = -1;
+ rdev->flags = 0;
+ rdev->data_offset = 0;
+ rdev->sb_events = 0;
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 19 20:26:21 2006
+From: NeilBrown <neilb@suse.de>
+To: Andrew Morton <akpm@osdl.org>
+Date: Fri, 20 Oct 2006 13:25:30 +1000
+Message-Id: <1061020032530.1668@suse.de>
+Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org
+Subject: md: Fix calculation of ->degraded for multipath and raid10
+MIME-Version: 1.0
+Content-Type: text/plain; charset="us-ascii"
+
+From: NeilBrown <neilb@suse.de>
+
+Two less-used md personalities have bugs in the calculation of
+ ->degraded (the extent to which the array is degraded).
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/multipath.c | 2 +-
+ drivers/md/raid10.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/md/multipath.c
++++ linux-2.6.18.1/drivers/md/multipath.c
+@@ -480,7 +480,7 @@ static int multipath_run (mddev_t *mddev
+ mdname(mddev));
+ goto out_free_conf;
+ }
+- mddev->degraded = conf->raid_disks = conf->working_disks;
++ mddev->degraded = conf->raid_disks - conf->working_disks;
+
+ conf->pool = mempool_create_kzalloc_pool(NR_RESERVED_BUFS,
+ sizeof(struct multipath_bh));
+--- linux-2.6.18.1.orig/drivers/md/raid10.c
++++ linux-2.6.18.1/drivers/md/raid10.c
+@@ -2042,7 +2042,7 @@ static int run(mddev_t *mddev)
+ disk = conf->mirrors + i;
+
+ if (!disk->rdev ||
+- !test_bit(In_sync, &rdev->flags)) {
++ !test_bit(In_sync, &disk->rdev->flags)) {
+ disk->head_position = 0;
+ mddev->degraded++;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Oct 29 16:12:23 2006
+Date: Sun, 29 Oct 2006 16:11:38 -0800 (PST)
+Message-Id: <20061029.161138.63123403.davem@davemloft.net>
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Mime-Version: 1.0
+Subject: NET: Fix skb_segment() handling of fully linear SKBs
+Content-Type: text/plain; charset="us-ascii"
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[NET]: Fix segmentation of linear packets
+
+skb_segment fails to segment linear packets correctly because it
+tries to write all linear parts of the original skb into each
+segment. This will always panic as each segment only contains
+enough space for one MSS.
+
+This was not detected earlier because linear packets should be
+rare for GSO. In fact it still remains to be seen what exactly
+created the linear packets that triggered this bug. Basically
+the only time this should happen is if someone enables GSO
+emulation on an interface that does not support SG.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/skbuff.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- linux-2.6.18.1.orig/net/core/skbuff.c
++++ linux-2.6.18.1/net/core/skbuff.c
+@@ -1945,7 +1945,7 @@ struct sk_buff *skb_segment(struct sk_bu
+ do {
+ struct sk_buff *nskb;
+ skb_frag_t *frag;
+- int hsize, nsize;
++ int hsize;
+ int k;
+ int size;
+
+@@ -1956,11 +1956,10 @@ struct sk_buff *skb_segment(struct sk_bu
+ hsize = skb_headlen(skb) - offset;
+ if (hsize < 0)
+ hsize = 0;
+- nsize = hsize + doffset;
+- if (nsize > len + doffset || !sg)
+- nsize = len + doffset;
++ if (hsize > len || !sg)
++ hsize = len;
+
+- nskb = alloc_skb(nsize + headroom, GFP_ATOMIC);
++ nskb = alloc_skb(hsize + doffset + headroom, GFP_ATOMIC);
+ if (unlikely(!nskb))
+ goto err;
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 22:49:31 2006
+Date: Sun, 24 Sep 2006 04:01:16 GMT
+Message-Id: <200609240401.k8O41GAH026953@hera.kernel.org>
+From: James Bottomley <James.Bottomley@steeleye.com>
+MIME-Version: 1.0
+Subject: SCSI: aic7xxx: avoid checking SBLKCTL register for certain cards
+Content-Type: text/plain; charset="us-ascii"
+
+From: James Bottomley <James.Bottomley@steeleye.com>
+
+[SCSI] aic7xxx: avoid checking SBLKCTL register for certain cards
+
+For cards that don't support LVD, checking the SBLKCTL register to
+determine the bus singalling doesn't work. So, check that the card
+supports LVD first (AHC_ULTRA2) before checking the register.
+
+Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/aic7xxx/aic7xxx_osm.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/scsi/aic7xxx/aic7xxx_osm.c
++++ linux-2.6.18.1/drivers/scsi/aic7xxx/aic7xxx_osm.c
+@@ -2539,15 +2539,23 @@ static void ahc_linux_set_iu(struct scsi
+ static void ahc_linux_get_signalling(struct Scsi_Host *shost)
+ {
+ struct ahc_softc *ahc = *(struct ahc_softc **)shost->hostdata;
+- u8 mode = ahc_inb(ahc, SBLKCTL);
++ u8 mode;
+
+- if (mode & ENAB40)
+- spi_signalling(shost) = SPI_SIGNAL_LVD;
+- else if (mode & ENAB20)
++ if (!(ahc->features & AHC_ULTRA2)) {
++ /* non-LVD chipset, may not have SBLKCTL reg */
+ spi_signalling(shost) =
+ ahc->features & AHC_HVD ?
+ SPI_SIGNAL_HVD :
+ SPI_SIGNAL_SE;
++ return;
++ }
++
++ mode = ahc_inb(ahc, SBLKCTL);
++
++ if (mode & ENAB40)
++ spi_signalling(shost) = SPI_SIGNAL_LVD;
++ else if (mode & ENAB20)
++ spi_signalling(shost) = SPI_SIGNAL_SE;
+ else
+ spi_signalling(shost) = SPI_SIGNAL_UNKNOWN;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 17 22:49:31 2006
+Date: Sun, 24 Sep 2006 04:01:16 GMT
+Message-Id: <200609240401.k8O41G02026969@hera.kernel.org>
+From: Doug Ledford <dledford@redhat.com>
+MIME-Version: 1.0
+Subject: SCSI: aic7xxx: pause sequencer before touching SBLKCTL
+Content-Type: text/plain; charset="us-ascii"
+
+From: Doug Ledford <dledford@redhat.com>
+
+[SCSI] aic7xxx: pause sequencer before touching SBLKCTL
+
+Some cards need to pause the sequencer before the SBLKCTL register is
+touched. This fixes a PCI related oops seen on powerpc macs with this
+card caused by trying to ascertain the bus signalling before beginning
+domain validation.
+
+Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/aic7xxx/aic7xxx_osm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- linux-2.6.18.1.orig/drivers/scsi/aic7xxx/aic7xxx_osm.c
++++ linux-2.6.18.1/drivers/scsi/aic7xxx/aic7xxx_osm.c
+@@ -2539,6 +2539,7 @@ static void ahc_linux_set_iu(struct scsi
+ static void ahc_linux_get_signalling(struct Scsi_Host *shost)
+ {
+ struct ahc_softc *ahc = *(struct ahc_softc **)shost->hostdata;
++ unsigned long flags;
+ u8 mode;
+
+ if (!(ahc->features & AHC_ULTRA2)) {
+@@ -2550,7 +2551,11 @@ static void ahc_linux_get_signalling(str
+ return;
+ }
+
++ ahc_lock(ahc, &flags);
++ ahc_pause(ahc);
+ mode = ahc_inb(ahc, SBLKCTL);
++ ahc_unpause(ahc);
++ ahc_unlock(ahc, &flags);
+
+ if (mode & ENAB40)
+ spi_signalling(shost) = SPI_SIGNAL_LVD;
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Oct 29 23:49:17 2006
+Date: Sun, 29 Oct 2006 23:48:51 -0800 (PST)
+Message-Id: <20061029.234851.48808018.davem@davemloft.net>
+From: Herbert Xu <herbert@gondor.apana.org.au>
+To: stable@kernel.org
+Mime-Version: 1.0
+Subject: SCTP: Always linearise packet on input
+Content-Type: text/plain; charset="us-ascii"
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+I was looking at a RHEL5 bug report involving Xen and SCTP
+(https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212550).
+It turns out that SCTP wasn't written to handle skb fragments at
+all. The absence of any calls to skb_may_pull is testament to
+that.
+
+It just so happens that Xen creates fragmented packets more often
+than other scenarios (header & data split when going from domU to
+dom0). That's what caused this bug to show up.
+
+Until someone has the time sits down and audits the entire net/sctp
+directory, here is a conservative and safe solution that simply
+linearises all packets on input.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sctp/input.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- linux-2.6.18.1.orig/net/sctp/input.c
++++ linux-2.6.18.1/net/sctp/input.c
+@@ -135,6 +135,9 @@ int sctp_rcv(struct sk_buff *skb)
+
+ SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS);
+
++ if (skb_linearize(skb))
++ goto discard_it;
++
+ sh = (struct sctphdr *) skb->h.raw;
+
+ /* Pull up the IP and SCTP headers. */
serial-fix-resume-handling-bug.patch
serial-fix-oops-when-removing-suspended-serial-port.patch
bluetooth-check-if-dlc-is-still-attached-to-the-tty.patch
+jfs-pageno-needs-to-be-long.patch
+sparc64-fix-central-fhc-bus-handling-on-ex000-systems.patch
+sparc64-fix-memory-corruption-in-pci_4u_free_consistent.patch
+bcm43xx-fix-watchdog-timeouts.patch
+dvb-fix-dvb_pll_attach-for-mt352-zl10353-in-cx88-dvb-and-nxt200x.patch
+alsa-fix-re-use-of-va_list.patch
+md-fix-bug-where-spares-don-t-always-get-rebuilt-properly-when-they-become-live.patch
+md-fix-calculation-of-degraded-for-multipath-and-raid10.patch
+knfsd-fix-race-that-can-disable-nfs-server.patch
+scsi-aic7xxx-avoid-checking-sblkctl-register-for-certain-cards.patch
+ipoib-rejoin-all-multicast-groups-after-a-port-event.patch
+ib-mthca-use-mmiowb-after-doorbell-ring.patch
+fuse-fix-hang-on-smp.patch
+fix-potential-interrupts-during-alternative-patching.patch
+sky2-88e803x-transmit-lockup.patch
+scsi-aic7xxx-pause-sequencer-before-touching-sblkctl.patch
+audit-fix-missing-ifdefs-in-syscall-classes-hookup-for-generic-targets.patch
+net-fix-skb_segment-handling-of-fully-linear-skbs.patch
+sctp-always-linearise-packet-on-input.patch
+x86-64-fix-c3-timer-test.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Oct 20 17:14:23 2006
+Date: Fri, 20 Oct 2006 17:13:20 -0700
+From: Stephen Hemminger <shemminger@osdl.org>
+To: stable@kernel.org
+Message-ID: <20061020171320.4a4c8140@freekitty>
+Mime-Version: 1.0
+Subject: sky2: 88E803X transmit lockup (2.6.18)
+Content-Type: text/plain; charset="us-ascii"
+
+From: Stephen Hemminger <shemminger@osdl.org>
+
+The reason sky2 driver was locking up on transmit on the Yukon-FE chipset
+is that it was misconfiguring the internal RAM buffer so the transmitter
+and receiver were sharing the same space. It is a wonder it worked at all!
+
+This patch addresses this, and fixes an easily reproducible hang on Transmit.
+Only the Yukon-FE chip is Marvell 88E803X (10/100 only) are affected.
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 33 ++++++++++++---------------------
+ 1 file changed, 12 insertions(+), 21 deletions(-)
+
+--- linux-2.6.18.1.orig/drivers/net/sky2.c
++++ linux-2.6.18.1/drivers/net/sky2.c
+@@ -690,16 +690,10 @@ static void sky2_mac_init(struct sky2_hw
+
+ }
+
+-/* Assign Ram Buffer allocation.
+- * start and end are in units of 4k bytes
+- * ram registers are in units of 64bit words
+- */
+-static void sky2_ramset(struct sky2_hw *hw, u16 q, u8 startk, u8 endk)
++/* Assign Ram Buffer allocation in units of 64bit (8 bytes) */
++static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 end)
+ {
+- u32 start, end;
+-
+- start = startk * 4096/8;
+- end = (endk * 4096/8) - 1;
++ pr_debug(PFX "q %d %#x %#x\n", q, start, end);
+
+ sky2_write8(hw, RB_ADDR(q, RB_CTRL), RB_RST_CLR);
+ sky2_write32(hw, RB_ADDR(q, RB_START), start);
+@@ -708,7 +702,7 @@ static void sky2_ramset(struct sky2_hw *
+ sky2_write32(hw, RB_ADDR(q, RB_RP), start);
+
+ if (q == Q_R1 || q == Q_R2) {
+- u32 space = (endk - startk) * 4096/8;
++ u32 space = end - start + 1;
+ u32 tp = space - space/4;
+
+ /* On receive queue's set the thresholds
+@@ -1090,19 +1084,16 @@ static int sky2_up(struct net_device *de
+
+ sky2_mac_init(hw, port);
+
+- /* Determine available ram buffer space (in 4K blocks).
+- * Note: not sure about the FE setting below yet
+- */
+- if (hw->chip_id == CHIP_ID_YUKON_FE)
+- ramsize = 4;
+- else
+- ramsize = sky2_read8(hw, B2_E_0);
++ /* Determine available ram buffer space in qwords. */
++ ramsize = sky2_read8(hw, B2_E_0) * 4096/8;
+
+- /* Give transmitter one third (rounded up) */
+- rxspace = ramsize - (ramsize + 2) / 3;
++ if (ramsize > 6*1024/8)
++ rxspace = ramsize - (ramsize + 2) / 3;
++ else
++ rxspace = ramsize / 2;
+
+- sky2_ramset(hw, rxqaddr[port], 0, rxspace);
+- sky2_ramset(hw, txqaddr[port], rxspace, ramsize);
++ sky2_ramset(hw, rxqaddr[port], 0, rxspace-1);
++ sky2_ramset(hw, txqaddr[port], rxspace, ramsize-1);
+
+ /* Make sure SyncQ is disabled */
+ sky2_write8(hw, RB_ADDR(port == 0 ? Q_XS1 : Q_XS2, RB_CTRL),
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Oct 25 23:50:44 2006
+Date: Wed, 25 Oct 2006 23:50:12 -0700 (PDT)
+Message-Id: <20061025.235012.48807053.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Mime-Version: 1.0
+Subject: SPARC64: Fix central/FHC bus handling on Ex000 systems.
+Content-Type: text/plain; charset="us-ascii"
+
+From: David Miller <davem@davemloft.net>
+
+1) probe_other_fhcs() wants to see only non-central FHC
+ busses, so skip FHCs that don't sit off the root
+
+2) Like SBUS, FHC can lack the appropriate address and
+ size cell count properties, so add an of_busses[]
+ entry and handlers for that.
+
+3) Central FHC irq translator probing was buggy. We
+ were trying to use dp->child in irq_trans_init but
+ that linkage is not setup at this point.
+
+ So instead, pass in the parent of "dp" and look for
+ the child "fhc" with parent "central".
+
+Thanks to the tireless assistence of Ben Collins in tracking
+down these problems and testing out these fixes.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/central.c | 4 ++++
+ arch/sparc64/kernel/of_device.c | 33 ++++++++++++++++++++++++---------
+ arch/sparc64/kernel/prom.c | 30 +++++++++++++++---------------
+ 3 files changed, 43 insertions(+), 24 deletions(-)
+
+--- linux-2.6.18.1.orig/arch/sparc64/kernel/central.c
++++ linux-2.6.18.1/arch/sparc64/kernel/central.c
+@@ -126,6 +126,10 @@ static void probe_other_fhcs(void)
+ int board;
+ u32 tmp;
+
++ if (dp->parent &&
++ dp->parent->parent != NULL)
++ continue;
++
+ fhc = (struct linux_fhc *)
+ central_alloc_bootmem(sizeof(struct linux_fhc));
+ if (fhc == NULL)
+--- linux-2.6.18.1.orig/arch/sparc64/kernel/of_device.c
++++ linux-2.6.18.1/arch/sparc64/kernel/of_device.c
+@@ -398,16 +398,22 @@ static void of_bus_sbus_count_cells(stru
+ *sizec = 1;
+ }
+
+-static int of_bus_sbus_map(u32 *addr, const u32 *range, int na, int ns, int pna)
+-{
+- return of_bus_default_map(addr, range, na, ns, pna);
+-}
+-
+-static unsigned int of_bus_sbus_get_flags(u32 *addr)
++/*
++ * FHC/Central bus specific translator.
++ *
++ * This is just needed to hard-code the address and size cell
++ * counts. 'fhc' and 'central' nodes lack the #address-cells and
++ * #size-cells properties, and if you walk to the root on such
++ * Enterprise boxes all you'll get is a #size-cells of 2 which is
++ * not what we want to use.
++ */
++static int of_bus_fhc_match(struct device_node *np)
+ {
+- return IORESOURCE_MEM;
++ return !strcmp(np->name, "fhc") ||
++ !strcmp(np->name, "central");
+ }
+
++#define of_bus_fhc_count_cells of_bus_sbus_count_cells
+
+ /*
+ * Array of bus specific translators
+@@ -429,8 +435,17 @@ static struct of_bus of_busses[] = {
+ .addr_prop_name = "reg",
+ .match = of_bus_sbus_match,
+ .count_cells = of_bus_sbus_count_cells,
+- .map = of_bus_sbus_map,
+- .get_flags = of_bus_sbus_get_flags,
++ .map = of_bus_default_map,
++ .get_flags = of_bus_default_get_flags,
++ },
++ /* FHC */
++ {
++ .name = "fhc",
++ .addr_prop_name = "reg",
++ .match = of_bus_fhc_match,
++ .count_cells = of_bus_fhc_count_cells,
++ .map = of_bus_default_map,
++ .get_flags = of_bus_default_get_flags,
+ },
+ /* Default */
+ {
+--- linux-2.6.18.1.orig/arch/sparc64/kernel/prom.c
++++ linux-2.6.18.1/arch/sparc64/kernel/prom.c
+@@ -1080,23 +1080,22 @@ static void sun4v_vdev_irq_trans_init(st
+
+ static void irq_trans_init(struct device_node *dp)
+ {
+- const char *model;
+ #ifdef CONFIG_PCI
++ const char *model;
+ int i;
+ #endif
+
++#ifdef CONFIG_PCI
+ model = of_get_property(dp, "model", NULL);
+ if (!model)
+ model = of_get_property(dp, "compatible", NULL);
+- if (!model)
+- return;
+-
+-#ifdef CONFIG_PCI
+- for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) {
+- struct irq_trans *t = &pci_irq_trans_table[i];
++ if (model) {
++ for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) {
++ struct irq_trans *t = &pci_irq_trans_table[i];
+
+- if (!strcmp(model, t->name))
+- return t->init(dp);
++ if (!strcmp(model, t->name))
++ return t->init(dp);
++ }
+ }
+ #endif
+ #ifdef CONFIG_SBUS
+@@ -1104,8 +1103,9 @@ static void irq_trans_init(struct device
+ !strcmp(dp->name, "sbi"))
+ return sbus_irq_trans_init(dp);
+ #endif
+- if (!strcmp(dp->name, "central"))
+- return central_irq_trans_init(dp->child);
++ if (!strcmp(dp->name, "fhc") &&
++ !strcmp(dp->parent->name, "central"))
++ return central_irq_trans_init(dp);
+ if (!strcmp(dp->name, "virtual-devices"))
+ return sun4v_vdev_irq_trans_init(dp);
+ }
+@@ -1517,7 +1517,7 @@ static char * __init get_one_property(ph
+ return buf;
+ }
+
+-static struct device_node * __init create_node(phandle node)
++static struct device_node * __init create_node(phandle node, struct device_node *parent)
+ {
+ struct device_node *dp;
+
+@@ -1526,6 +1526,7 @@ static struct device_node * __init creat
+
+ dp = prom_early_alloc(sizeof(*dp));
+ dp->unique_id = unique_id++;
++ dp->parent = parent;
+
+ kref_init(&dp->kref);
+
+@@ -1544,12 +1545,11 @@ static struct device_node * __init build
+ {
+ struct device_node *dp;
+
+- dp = create_node(node);
++ dp = create_node(node, parent);
+ if (dp) {
+ *(*nextp) = dp;
+ *nextp = &dp->allnext;
+
+- dp->parent = parent;
+ dp->path_component_name = build_path_component(dp);
+ dp->full_name = build_full_name(dp);
+
+@@ -1565,7 +1565,7 @@ void __init prom_build_devicetree(void)
+ {
+ struct device_node **nextp;
+
+- allnodes = create_node(prom_root_node);
++ allnodes = create_node(prom_root_node, NULL);
+ allnodes->path_component_name = "";
+ allnodes->full_name = "/";
+
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Oct 25 23:51:42 2006
+Date: Wed, 25 Oct 2006 23:51:07 -0700 (PDT)
+Message-Id: <20061025.235107.39158283.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Mime-Version: 1.0
+Subject: SPARC64: Fix memory corruption in pci_4u_free_consistent().
+Content-Type: text/plain; charset="us-ascii"
+
+From: David Miller <davem@davemloft.net>
+
+The second argument to free_npages() was being incorrectly
+calculated, which would thus access far past the end of the
+arena->map[] bitmap.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/pci_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/arch/sparc64/kernel/pci_iommu.c
++++ linux-2.6.18.1/arch/sparc64/kernel/pci_iommu.c
+@@ -281,7 +281,7 @@ static void pci_4u_free_consistent(struc
+
+ spin_lock_irqsave(&iommu->lock, flags);
+
+- free_npages(iommu, dvma, npages);
++ free_npages(iommu, dvma - iommu->page_table_map_base, npages);
+
+ spin_unlock_irqrestore(&iommu->lock, flags);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 30 07:58:11 2006
+Date: Sun, 22 Oct 2006 00:59:04 GMT
+Message-Id: <200610220059.k9M0x4e8025532@hera.kernel.org>
+From: Andi Kleen <ak@suse.de>
+MIME-Version: 1.0
+Subject: x86-64: Fix C3 timer test
+Content-Type: text/plain; charset="us-ascii"
+
+From: Andi Kleen <ak@suse.de>
+
+There was a typo in the C3 latency test to decide of the TSC
+should be used or not. It used the C2 latency threshold, not the
+C3 one. Fix that.
+
+This should fix the time on various dual core laptops.
+
+Signed-off-by: Andi Kleen <ak@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86_64/kernel/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.1.orig/arch/x86_64/kernel/time.c
++++ linux-2.6.18.1/arch/x86_64/kernel/time.c
+@@ -960,7 +960,7 @@ __cpuinit int unsynchronized_tsc(void)
+ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
+ #ifdef CONFIG_ACPI
+ /* But TSC doesn't tick in C3 so don't use it there */
+- if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 100)
++ if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 1000)
+ return 1;
+ #endif
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
