--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jul 16 13:57:50 2007
+From: Venki Pallipadi <venkatesh.pallipadi@intel.com>
+Date: Mon, 16 Jul 2007 16:57:38 -0400
+Subject: acpi-cpufreq: Proper ReadModifyWrite of PERF_CTL MSR
+Cc: Dave Jones <davej@redhat.com>
+Message-ID: <469BDBC2.3030701@redhat.com>
+
+
+From: Venki Pallipadi <venkatesh.pallipadi@intel.com>
+
+[CPUFREQ] acpi-cpufreq: Proper ReadModifyWrite of PERF_CTL MSR
+
+During recent acpi-cpufreq changes, writing to PERF_CTL msr
+changed from RMW of entire 64 bit to RMW of low 32 bit and clearing of
+upper 32 bit. Fix it back to do a proper RMW of the MSR.
+
+Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Signed-off-by: Dave Jones <davej@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
++++ b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
+@@ -167,11 +167,13 @@ static void do_drv_read(struct drv_cmd *
+
+ static void do_drv_write(struct drv_cmd *cmd)
+ {
+- u32 h = 0;
++ u32 lo, hi;
+
+ switch (cmd->type) {
+ case SYSTEM_INTEL_MSR_CAPABLE:
+- wrmsr(cmd->addr.msr.reg, cmd->val, h);
++ rdmsr(cmd->addr.msr.reg, lo, hi);
++ lo = (lo & ~INTEL_MSR_RANGE) | (cmd->val & INTEL_MSR_RANGE);
++ wrmsr(cmd->addr.msr.reg, lo, hi);
+ break;
+ case SYSTEM_IO_CAPABLE:
+ acpi_os_write_port((acpi_io_address)cmd->addr.io.port,
+@@ -372,7 +374,6 @@ static int acpi_cpufreq_target(struct cp
+ struct cpufreq_freqs freqs;
+ cpumask_t online_policy_cpus;
+ struct drv_cmd cmd;
+- unsigned int msr;
+ unsigned int next_state = 0; /* Index into freq_table */
+ unsigned int next_perf_state = 0; /* Index into perf table */
+ unsigned int i;
+@@ -417,11 +418,7 @@ static int acpi_cpufreq_target(struct cp
+ case SYSTEM_INTEL_MSR_CAPABLE:
+ cmd.type = SYSTEM_INTEL_MSR_CAPABLE;
+ cmd.addr.msr.reg = MSR_IA32_PERF_CTL;
+- msr =
+- (u32) perf->states[next_perf_state].
+- control & INTEL_MSR_RANGE;
+- cmd.val = get_cur_val(online_policy_cpus);
+- cmd.val = (cmd.val & ~INTEL_MSR_RANGE) | msr;
++ cmd.val = (u32) perf->states[next_perf_state].control;
+ break;
+ case SYSTEM_IO_CAPABLE:
+ cmd.type = SYSTEM_IO_CAPABLE;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jul 10 14:04:56 2007
+From: Jens Axboe <jens.axboe@oracle.com>
+Date: Tue, 10 Jul 2007 22:11:00 +0200
+Subject: cfq-iosched: fix async queue behaviour
+To: stable@kernel.org
+Message-ID: <20070710201059.GB4587@kernel.dk>
+Content-Disposition: inline
+
+From: Jens Axboe <jens.axboe@oracle.com>
+
+With the cfq_queue hash removal, we inadvertently got rid of the
+async queue sharing. This was not intentional, in fact CFQ purposely
+shares the async queue per priority level to get good merging for
+async writes.
+
+So put some logic in cfq_get_queue() to track the shared queues.
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c | 39 ++++++++++++++++++++++++++++++++++++---
+ include/linux/ioprio.h | 6 ++++--
+ 2 files changed, 40 insertions(+), 5 deletions(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -92,6 +92,8 @@ struct cfq_data {
+ struct cfq_queue *active_queue;
+ struct cfq_io_context *active_cic;
+
++ struct cfq_queue *async_cfqq[IOPRIO_BE_NR];
++
+ struct timer_list idle_class_timer;
+
+ sector_t last_position;
+@@ -1351,8 +1353,8 @@ static void cfq_ioc_set_ioprio(struct io
+ }
+
+ static struct cfq_queue *
+-cfq_get_queue(struct cfq_data *cfqd, int is_sync, struct task_struct *tsk,
+- gfp_t gfp_mask)
++cfq_find_alloc_queue(struct cfq_data *cfqd, int is_sync,
++ struct task_struct *tsk, gfp_t gfp_mask)
+ {
+ struct cfq_queue *cfqq, *new_cfqq = NULL;
+ struct cfq_io_context *cic;
+@@ -1405,12 +1407,35 @@ retry:
+ if (new_cfqq)
+ kmem_cache_free(cfq_pool, new_cfqq);
+
+- atomic_inc(&cfqq->ref);
+ out:
+ WARN_ON((gfp_mask & __GFP_WAIT) && !cfqq);
+ return cfqq;
+ }
+
++static struct cfq_queue *
++cfq_get_queue(struct cfq_data *cfqd, int is_sync, struct task_struct *tsk,
++ gfp_t gfp_mask)
++{
++ const int ioprio = task_ioprio(tsk);
++ struct cfq_queue *cfqq = NULL;
++
++ if (!is_sync)
++ cfqq = cfqd->async_cfqq[ioprio];
++ if (!cfqq)
++ cfqq = cfq_find_alloc_queue(cfqd, is_sync, tsk, gfp_mask);
++
++ /*
++ * pin the queue now that it's allocated, scheduler exit will prune it
++ */
++ if (!is_sync && !cfqd->async_cfqq[ioprio]) {
++ atomic_inc(&cfqq->ref);
++ cfqd->async_cfqq[ioprio] = cfqq;
++ }
++
++ atomic_inc(&cfqq->ref);
++ return cfqq;
++}
++
+ /*
+ * We drop cfq io contexts lazily, so we may find a dead one.
+ */
+@@ -2019,6 +2044,7 @@ static void cfq_exit_queue(elevator_t *e
+ {
+ struct cfq_data *cfqd = e->elevator_data;
+ request_queue_t *q = cfqd->queue;
++ int i;
+
+ cfq_shutdown_timer_wq(cfqd);
+
+@@ -2035,6 +2061,13 @@ static void cfq_exit_queue(elevator_t *e
+ __cfq_exit_single_io_context(cfqd, cic);
+ }
+
++ /*
++ * Put the async queues
++ */
++ for (i = 0; i < IOPRIO_BE_NR; i++)
++ if (cfqd->async_cfqq[i])
++ cfq_put_queue(cfqd->async_cfqq[i]);
++
+ spin_unlock_irq(q->queue_lock);
+
+ cfq_shutdown_timer_wq(cfqd);
+--- a/include/linux/ioprio.h
++++ b/include/linux/ioprio.h
+@@ -47,8 +47,10 @@ enum {
+ #define IOPRIO_NORM (4)
+ static inline int task_ioprio(struct task_struct *task)
+ {
+- WARN_ON(!ioprio_valid(task->ioprio));
+- return IOPRIO_PRIO_DATA(task->ioprio);
++ if (ioprio_valid(task->ioprio))
++ return IOPRIO_PRIO_DATA(task->ioprio);
++
++ return IOPRIO_NORM;
+ }
+
+ static inline int task_nice_ioprio(struct task_struct *task)
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jul 17 04:17:35 2007
+From: Oleg Nesterov <oleg@tv-sign.ru>
+Date: Tue, 17 Jul 2007 04:03:55 -0700
+Subject: destroy_workqueue() can livelock
+To: torvalds@linux-foundation.org
+Cc: vatsa@in.ibm.com, akpm@linux-foundation.org, mschmidt@redhat.com, oleg@tv-sign.ru, stable@kernel.org
+Message-ID: <200707171103.l6HB3t59013472@imap1.linux-foundation.org>
+
+
+From: Oleg Nesterov <oleg@tv-sign.ru>
+
+Pointed out by Michal Schmidt <mschmidt@redhat.com>.
+
+The bug was introduced in 2.6.22 by me.
+
+cleanup_workqueue_thread() does flush_cpu_workqueue(cwq) in a loop until
+->worklist becomes empty. This is live-lockable, a re-niced caller can get
+CPU after wake_up() and insert a new barrier before the lower-priority
+cwq->thread has a chance to clear ->current_work.
+
+Change cleanup_workqueue_thread() to do flush_cpu_workqueue(cwq) only once.
+ We can rely on the fact that run_workqueue() won't return until it flushes
+all works. So it is safe to call kthread_stop() after that, the "should
+stop" request won't be noticed until run_workqueue() returns.
+
+Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
+Cc: Michal Schmidt <mschmidt@redhat.com>
+Cc: Srivatsa Vaddagiri <vatsa@in.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/workqueue.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -739,18 +739,17 @@ static void cleanup_workqueue_thread(str
+ if (cwq->thread == NULL)
+ return;
+
++ flush_cpu_workqueue(cwq);
+ /*
+- * If the caller is CPU_DEAD the single flush_cpu_workqueue()
+- * is not enough, a concurrent flush_workqueue() can insert a
+- * barrier after us.
++ * If the caller is CPU_DEAD and cwq->worklist was not empty,
++ * a concurrent flush_workqueue() can insert a barrier after us.
++ * However, in that case run_workqueue() won't return and check
++ * kthread_should_stop() until it flushes all work_struct's.
+ * When ->worklist becomes empty it is safe to exit because no
+ * more work_structs can be queued on this cwq: flush_workqueue
+ * checks list_empty(), and a "normal" queue_work() can't use
+ * a dead CPU.
+ */
+- while (flush_cpu_workqueue(cwq))
+- ;
+-
+ kthread_stop(cwq->thread);
+ cwq->thread = NULL;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jul 15 23:49:08 2007
+From: Herbert van den Bergh <Herbert.van.den.Bergh@oracle.com>
+Date: Sun, 15 Jul 2007 23:38:25 -0700
+Subject: do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY
+To: torvalds@linux-foundation.org
+Cc: Herbert.van.den.Bergh@oracle.com, akpm@linux-foundation.org, stable@kernel.org, chris.mason@oracle.com, herbert.van.den.bergh@oracle.com
+Message-ID: <200707160638.l6G6cP6N014235@imap1.linux-foundation.org>
+
+
+From: Herbert van den Bergh <Herbert.van.den.Bergh@oracle.com>
+
+Fix a bug in mm/mlock.c on 32-bit architectures that prevents a user from
+locking more than 4GB of shared memory, or allocating more than 4GB of
+shared memory in hugepages, when rlim[RLIMIT_MEMLOCK] is set to
+RLIM_INFINITY.
+
+Signed-off-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com>
+Acked-by: Chris Mason <chris.mason@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mlock.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -244,9 +244,12 @@ int user_shm_lock(size_t size, struct us
+
+ locked = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
++ if (lock_limit == RLIM_INFINITY)
++ allowed = 1;
+ lock_limit >>= PAGE_SHIFT;
+ spin_lock(&shmlock_user_lock);
+- if (locked + user->locked_shm > lock_limit && !capable(CAP_IPC_LOCK))
++ if (!allowed &&
++ locked + user->locked_shm > lock_limit && !capable(CAP_IPC_LOCK))
+ goto out;
+ get_uid(user);
+ user->locked_shm += locked;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jul 17 04:15:55 2007
+From: Adrian Bunk <bunk@stusta.de>
+Date: Tue, 17 Jul 2007 04:05:53 -0700
+Subject: drivers/video/macmodes.c:mac_find_mode() mustn't be __devinit
+To: torvalds@linux-foundation.org
+Cc: adaplas@pol.net, akpm@linux-foundation.org, michal.k.k.piotrowski@gmail.com, stable@kernel.org, bunk@stusta.de
+Message-ID: <200707171105.l6HB5rQT014210@imap1.linux-foundation.org>
+
+
+From: Adrian Bunk <bunk@stusta.de>
+
+If it's EXPORT_SYMBOL'ed it can't be __devinit.
+
+Reported by Mikael Pettersson.
+
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Cc: "Antonino A. Daplas" <adaplas@pol.net>
+Cc: Michal Piotrowski <michal.k.k.piotrowski@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/macmodes.c | 5 ++---
+ drivers/video/macmodes.h | 8 ++++----
+ 2 files changed, 6 insertions(+), 7 deletions(-)
+
+--- a/drivers/video/macmodes.c
++++ b/drivers/video/macmodes.c
+@@ -369,9 +369,8 @@ EXPORT_SYMBOL(mac_map_monitor_sense);
+ *
+ */
+
+-int __devinit mac_find_mode(struct fb_var_screeninfo *var,
+- struct fb_info *info, const char *mode_option,
+- unsigned int default_bpp)
++int mac_find_mode(struct fb_var_screeninfo *var, struct fb_info *info,
++ const char *mode_option, unsigned int default_bpp)
+ {
+ const struct fb_videomode *db = NULL;
+ unsigned int dbsize = 0;
+--- a/drivers/video/macmodes.h
++++ b/drivers/video/macmodes.h
+@@ -55,10 +55,10 @@ extern int mac_vmode_to_var(int vmode, i
+ extern int mac_var_to_vmode(const struct fb_var_screeninfo *var, int *vmode,
+ int *cmode);
+ extern int mac_map_monitor_sense(int sense);
+-extern int __devinit mac_find_mode(struct fb_var_screeninfo *var,
+- struct fb_info *info,
+- const char *mode_option,
+- unsigned int default_bpp);
++extern int mac_find_mode(struct fb_var_screeninfo *var,
++ struct fb_info *info,
++ const char *mode_option,
++ unsigned int default_bpp);
+
+
+ /*
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 19 02:07:34 2007
+From: Michael Halcrow <mhalcrow@us.ibm.com>
+Date: Thu, 19 Jul 2007 01:47:54 -0700
+Subject: eCryptfs: ecryptfs_setattr() bugfix
+To: torvalds@linux-foundation.org
+Cc: akpm@linux-foundation.org, mhalcrow@us.ibm.com, stable@kernel.org
+Message-ID: <200707190847.l6J8lsEP023004@imap1.linux-foundation.org>
+
+
+From: Michael Halcrow <mhalcrow@us.ibm.com>
+
+There is another bug recently introduced into the ecryptfs_setattr()
+function in 2.6.22. eCryptfs will attempt to treat special files like
+regular eCryptfs files on chmod, chown, and so forth. This leads to a NULL
+pointer dereference. This patch validates that the file is a regular file
+before proceeding with operations related to the inode's crypt_stat.
+
+Thanks to Ryusuke Konishi for finding this bug and suggesting the fix.
+
+Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/inode.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -902,8 +902,9 @@ static int ecryptfs_setattr(struct dentr
+ mutex_lock(&crypt_stat->cs_mutex);
+ if (S_ISDIR(dentry->d_inode->i_mode))
+ crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
+- else if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
+- || !(crypt_stat->flags & ECRYPTFS_KEY_VALID)) {
++ else if (S_ISREG(dentry->d_inode->i_mode)
++ && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
++ || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {
+ struct vfsmount *lower_mnt;
+ struct file *lower_file = NULL;
+ struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jul 16 15:39:18 2007
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+Date: Mon, 16 Jul 2007 09:49:51 -0400
+Subject: forcedeth bug fix: cicada phy
+To: stable@kernel.org
+Message-ID: <469B777F.3000309@nvidia.com>
+
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+
+This patch contains errata fixes for the cicada phy. It only renamed the
+defines to be phy specific.
+
+
+Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -557,12 +557,12 @@ union ring_type {
+ #define PHYID2_MODEL_MASK 0x03f0
+ #define PHY_MODEL_MARVELL_E3016 0x220
+ #define PHY_MARVELL_E3016_INITMASK 0x0300
+-#define PHY_INIT1 0x0f000
+-#define PHY_INIT2 0x0e00
+-#define PHY_INIT3 0x01000
+-#define PHY_INIT4 0x0200
+-#define PHY_INIT5 0x0004
+-#define PHY_INIT6 0x02000
++#define PHY_CICADA_INIT1 0x0f000
++#define PHY_CICADA_INIT2 0x0e00
++#define PHY_CICADA_INIT3 0x01000
++#define PHY_CICADA_INIT4 0x0200
++#define PHY_CICADA_INIT5 0x0004
++#define PHY_CICADA_INIT6 0x02000
+ #define PHY_GIGABIT 0x0100
+
+ #define PHY_TIMEOUT 0x1
+@@ -1141,14 +1141,14 @@ static int phy_init(struct net_device *d
+ /* phy vendor specific configuration */
+ if ((np->phy_oui == PHY_OUI_CICADA) && (phyinterface & PHY_RGMII) ) {
+ phy_reserved = mii_rw(dev, np->phyaddr, MII_RESV1, MII_READ);
+- phy_reserved &= ~(PHY_INIT1 | PHY_INIT2);
+- phy_reserved |= (PHY_INIT3 | PHY_INIT4);
++ phy_reserved &= ~(PHY_CICADA_INIT1 | PHY_CICADA_INIT2);
++ phy_reserved |= (PHY_CICADA_INIT3 | PHY_CICADA_INIT4);
+ if (mii_rw(dev, np->phyaddr, MII_RESV1, phy_reserved)) {
+ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+ return PHY_ERROR;
+ }
+ phy_reserved = mii_rw(dev, np->phyaddr, MII_NCONFIG, MII_READ);
+- phy_reserved |= PHY_INIT5;
++ phy_reserved |= PHY_CICADA_INIT5;
+ if (mii_rw(dev, np->phyaddr, MII_NCONFIG, phy_reserved)) {
+ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+ return PHY_ERROR;
+@@ -1156,7 +1156,7 @@ static int phy_init(struct net_device *d
+ }
+ if (np->phy_oui == PHY_OUI_CICADA) {
+ phy_reserved = mii_rw(dev, np->phyaddr, MII_SREVISION, MII_READ);
+- phy_reserved |= PHY_INIT6;
++ phy_reserved |= PHY_CICADA_INIT6;
+ if (mii_rw(dev, np->phyaddr, MII_SREVISION, phy_reserved)) {
+ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+ return PHY_ERROR;
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jul 16 15:38:04 2007
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+Date: Mon, 16 Jul 2007 09:50:24 -0400
+Subject: forcedeth bug fix: realtek phy
+To: stable@kernel.org
+Message-ID: <469B77A0.7080206@nvidia.com>
+
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+
+This patch contains errata fixes for the realtek phy. It only renamed the
+defines to be phy specific.
+
+Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -551,6 +551,7 @@ union ring_type {
+ #define PHY_OUI_MARVELL 0x5043
+ #define PHY_OUI_CICADA 0x03f1
+ #define PHY_OUI_VITESSE 0x01c1
++#define PHY_OUI_REALTEK 0x01c1
+ #define PHYID1_OUI_MASK 0x03ff
+ #define PHYID1_OUI_SHFT 6
+ #define PHYID2_OUI_MASK 0xfc00
+@@ -580,6 +581,13 @@ union ring_type {
+ #define PHY_VITESSE_INIT8 0x0100
+ #define PHY_VITESSE_INIT9 0x8f82
+ #define PHY_VITESSE_INIT10 0x0
++#define PHY_REALTEK_INIT_REG1 0x1f
++#define PHY_REALTEK_INIT_REG2 0x19
++#define PHY_REALTEK_INIT_REG3 0x13
++#define PHY_REALTEK_INIT1 0x0000
++#define PHY_REALTEK_INIT2 0x8e00
++#define PHY_REALTEK_INIT3 0x0001
++#define PHY_REALTEK_INIT4 0xad17
+
+ #define PHY_GIGABIT 0x0100
+
+@@ -1114,6 +1122,28 @@ static int phy_init(struct net_device *d
+ return PHY_ERROR;
+ }
+ }
++ if (np->phy_oui == PHY_OUI_REALTEK) {
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ }
+
+ /* set advertise register */
+ reg = mii_rw(dev, np->phyaddr, MII_ADVERTISE, MII_READ);
+@@ -1250,6 +1280,30 @@ static int phy_init(struct net_device *d
+ return PHY_ERROR;
+ }
+ }
++ if (np->phy_oui == PHY_OUI_REALTEK) {
++ /* reset could have cleared these out, set them back */
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ }
++
+ /* some phys clear out pause advertisment on reset, set it back */
+ mii_rw(dev, np->phyaddr, MII_ADVERTISE, reg);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jul 16 15:38:04 2007
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+Date: Mon, 16 Jul 2007 09:50:01 -0400
+Subject: forcedeth bug fix: vitesse phy
+To: stable@kernel.org
+Message-ID: <469B7789.5090703@nvidia.com>
+
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+
+This patch contains errata fixes for the vitesse phy. It only renamed the
+defines to be phy specific.
+
+Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 88 insertions(+)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -550,6 +550,7 @@ union ring_type {
+ /* PHY defines */
+ #define PHY_OUI_MARVELL 0x5043
+ #define PHY_OUI_CICADA 0x03f1
++#define PHY_OUI_VITESSE 0x01c1
+ #define PHYID1_OUI_MASK 0x03ff
+ #define PHYID1_OUI_SHFT 6
+ #define PHYID2_OUI_MASK 0xfc00
+@@ -563,6 +564,23 @@ union ring_type {
+ #define PHY_CICADA_INIT4 0x0200
+ #define PHY_CICADA_INIT5 0x0004
+ #define PHY_CICADA_INIT6 0x02000
++#define PHY_VITESSE_INIT_REG1 0x1f
++#define PHY_VITESSE_INIT_REG2 0x10
++#define PHY_VITESSE_INIT_REG3 0x11
++#define PHY_VITESSE_INIT_REG4 0x12
++#define PHY_VITESSE_INIT_MSK1 0xc
++#define PHY_VITESSE_INIT_MSK2 0x0180
++#define PHY_VITESSE_INIT1 0x52b5
++#define PHY_VITESSE_INIT2 0xaf8a
++#define PHY_VITESSE_INIT3 0x8
++#define PHY_VITESSE_INIT4 0x8f8a
++#define PHY_VITESSE_INIT5 0xaf86
++#define PHY_VITESSE_INIT6 0x8f86
++#define PHY_VITESSE_INIT7 0xaf82
++#define PHY_VITESSE_INIT8 0x0100
++#define PHY_VITESSE_INIT9 0x8f82
++#define PHY_VITESSE_INIT10 0x0
++
+ #define PHY_GIGABIT 0x0100
+
+ #define PHY_TIMEOUT 0x1
+@@ -1162,6 +1180,76 @@ static int phy_init(struct net_device *d
+ return PHY_ERROR;
+ }
+ }
++ if (np->phy_oui == PHY_OUI_VITESSE) {
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT1)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT2)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
++ phy_reserved &= ~PHY_VITESSE_INIT_MSK1;
++ phy_reserved |= PHY_VITESSE_INIT3;
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT4)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT5)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
++ phy_reserved &= ~PHY_VITESSE_INIT_MSK1;
++ phy_reserved |= PHY_VITESSE_INIT3;
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT6)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT7)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
++ phy_reserved &= ~PHY_VITESSE_INIT_MSK2;
++ phy_reserved |= PHY_VITESSE_INIT8;
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT9)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT10)) {
++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
++ return PHY_ERROR;
++ }
++ }
+ /* some phys clear out pause advertisment on reset, set it back */
+ mii_rw(dev, np->phyaddr, MII_ADVERTISE, reg);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 19 17:27:52 2007
+From: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
+Date: Thu, 19 Jul 2007 17:27:22 -0700
+Subject: fs: 9p/conv.c error path fix
+To: stable@kernel.org
+Cc: Latchesar Ionkov <lucho@ionkov.net>, Mariusz Kozlowski <m.kozlowski@tuxland.pl>, Eric Van Hensbergen <ericvh@ericvh.myip.org>
+Message-ID: <20070719172722.1d4500f1.akpm@linux-foundation.org>
+
+
+From: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
+
+
+When buf_check_overflow() returns != 0 we will hit kfree(ERR_PTR(err))
+and it will not be happy about it.
+
+Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/9p/conv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/9p/conv.c
++++ b/fs/9p/conv.c
+@@ -742,6 +742,7 @@ struct v9fs_fcall *v9fs_create_twrite(u3
+ if (err) {
+ kfree(fc);
+ fc = ERR_PTR(err);
++ goto error;
+ }
+
+ if (buf_check_overflow(bufp)) {
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jul 15 23:48:48 2007
+From: Joe Jin <joe.jin@oracle.com>
+Date: Sun, 15 Jul 2007 23:38:12 -0700
+Subject: hugetlb: fix race in alloc_fresh_huge_page()
+To: torvalds@linux-foundation.org
+Cc: akpm@linux-foundation.org, joe.jin@oracle.com, stable@kernel.org, gurudas.pai@oracle.com
+Message-ID: <200707160638.l6G6cC01014158@imap1.linux-foundation.org>
+
+
+From: Joe Jin <joe.jin@oracle.com>
+
+That static `nid' index needs locking. Without it we can end up calling
+alloc_pages_node() with an illegal node ID and the kernel crashes.
+
+Acked-by: Gurudas Pai <gurudas.pai@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -101,13 +101,20 @@ static void free_huge_page(struct page *
+
+ static int alloc_fresh_huge_page(void)
+ {
+- static int nid = 0;
++ static int prev_nid;
+ struct page *page;
+- page = alloc_pages_node(nid, GFP_HIGHUSER|__GFP_COMP|__GFP_NOWARN,
+- HUGETLB_PAGE_ORDER);
+- nid = next_node(nid, node_online_map);
++ static DEFINE_SPINLOCK(nid_lock);
++ int nid;
++
++ spin_lock(&nid_lock);
++ nid = next_node(prev_nid, node_online_map);
+ if (nid == MAX_NUMNODES)
+ nid = first_node(node_online_map);
++ prev_nid = nid;
++ spin_unlock(&nid_lock);
++
++ page = alloc_pages_node(nid, GFP_HIGHUSER|__GFP_COMP|__GFP_NOWARN,
++ HUGETLB_PAGE_ORDER);
+ if (page) {
+ set_compound_page_dtor(page, free_huge_page);
+ spin_lock(&hugetlb_lock);
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Aug 4 09:39:55 2007
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Date: Sat, 4 Aug 2007 18:39:34 +0200 (CEST)
+Subject: ieee1394: revert "sbp2: enforce 32bit DMA mapping"
+To: stable@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Message-ID: <tkrat.f06cfd50476dd0f7@s5r6.in-berlin.de>
+Content-Disposition: INLINE
+
+
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+Revert commit 0555659d63c285ceb7ead3115532e1b71b0f27a7 from 2.6.22-rc1.
+The dma_set_mask call somehow failed on a PowerMac G5, PPC64:
+http://lkml.org/lkml/2007/8/1/344
+
+Should there ever occur a DMA mapping beyond the physical DMA range, a
+proper SBP-2 firmware will report transport errors. So let's leave it
+at that.
+
+Same as commit a9c2f18800753c82c45fc13b27bdc148849bdbb2.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Tested-by: Olaf Hering <olh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ieee1394/sbp2.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/ieee1394/sbp2.c
++++ b/drivers/ieee1394/sbp2.c
+@@ -774,11 +774,6 @@ static struct sbp2_lu *sbp2_alloc_device
+ SBP2_ERR("failed to register lower 4GB address range");
+ goto failed_alloc;
+ }
+-#else
+- if (dma_set_mask(hi->host->device.parent, DMA_32BIT_MASK)) {
+- SBP2_ERR("failed to set 4GB DMA mask");
+- goto failed_alloc;
+- }
+ #endif
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jul 15 23:37:47 2007
+From: Jan Kara <jack@suse.cz>
+Date: Sun, 15 Jul 2007 23:37:18 -0700
+Subject: jbd commit: fix transaction dropping
+To: torvalds@linux-foundation.org
+Cc: dev@openvz.org, jack@suse.cz, cebbert@redhat.com, akpm@linux-foundation.org, linux-ext4@vger.kernel.org, stable@kernel.org
+Message-ID: <200707160637.l6G6bIOv013980@imap1.linux-foundation.org>
+
+
+From: Jan Kara <jack@suse.cz>
+
+We have to check that also the second checkpoint list is non-empty before
+dropping the transaction.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Cc: Kirill Korotaev <dev@openvz.org>
+Cc: <linux-ext4@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd/commit.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/jbd/commit.c
++++ b/fs/jbd/commit.c
+@@ -887,7 +887,8 @@ restart_loop:
+ journal->j_committing_transaction = NULL;
+ spin_unlock(&journal->j_state_lock);
+
+- if (commit_transaction->t_checkpoint_list == NULL) {
++ if (commit_transaction->t_checkpoint_list == NULL &&
++ commit_transaction->t_checkpoint_io_list == NULL) {
+ __journal_drop_transaction(journal, commit_transaction);
+ } else {
+ if (journal->j_checkpoint_transactions == NULL) {
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jul 15 23:37:38 2007
+From: Jan Kara <jack@suse.cz>
+Date: Sun, 15 Jul 2007 23:37:20 -0700
+Subject: jbd2 commit: fix transaction dropping
+To: torvalds@linux-foundation.org
+Cc: dev@openvz.org, jack@suse.cz, cebbert@redhat.com, akpm@linux-foundation.org, linux-ext4@vger.kernel.org, stable@kernel.org
+Message-ID: <200707160637.l6G6bKPk013984@imap1.linux-foundation.org>
+
+
+From: Jan Kara <jack@suse.cz>
+
+We have to check that also the second checkpoint list is non-empty before
+dropping the transaction.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Cc: Kirill Korotaev <dev@openvz.org>
+Cc: <linux-ext4@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd2/commit.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -896,7 +896,8 @@ restart_loop:
+ journal->j_committing_transaction = NULL;
+ spin_unlock(&journal->j_state_lock);
+
+- if (commit_transaction->t_checkpoint_list == NULL) {
++ if (commit_transaction->t_checkpoint_list == NULL &&
++ commit_transaction->t_checkpoint_io_list == NULL) {
+ __jbd2_journal_drop_transaction(journal, commit_transaction);
+ } else {
+ if (journal->j_checkpoint_transactions == NULL) {
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jul 10 00:16:33 2007
+From: Tejun Heo <htejun@gmail.com>
+Date: Tue, 10 Jul 2007 16:16:18 +0900
+Subject: libata: add FUJITSU MHV2080BH to NCQ blacklist
+To: Jeff Garzik <jeff@garzik.org>, linux-ide@vger.kernel.org, Serge van Thillo <nulleke@hotmail.com>, stable@kernel.org
+Message-ID: <20070710071618.GB23568@htj.dyndns.org>
+Content-Disposition: inline
+
+
+Please warmly welcome the first member from FUJITSU to the prestigious
+NCQ spurious completion club.
+
+This is reported by Serge Van Thillo in bugzilla bug 8730.
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=8730
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Cc: Serge van Thillo <nulleke@hotmail.com>
+Cc: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3800,6 +3800,7 @@ static const struct ata_blacklist_entry
+ { "HTS541612J9SA00", "SBDIC7JP", ATA_HORKAGE_NONCQ, },
+ { "Hitachi HTS541616J9SA00", "SB4OC70P", ATA_HORKAGE_NONCQ, },
+ { "WDC WD740ADFD-00NLR1", NULL, ATA_HORKAGE_NONCQ, },
++ { "FUJITSU MHV2080BH", "00840028", ATA_HORKAGE_NONCQ, },
+
+ /* Devices with NCQ limits */
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jul 23 18:44:35 2007
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Mon, 23 Jul 2007 18:43:52 -0700
+Subject: nfsd: fix possible oops on re-insertion of rpcsec_gss modules
+To: torvalds@linux-foundation.org
+Cc: neilb@suse.de, bfields@citi.umich.edu, akinobu.mita@gmail.com, trond.myklebust@fys.uio.no, akpm@linux-foundation.org, stable@kernel.org
+Message-ID: <200707240143.l6O1hqkS022398@imap1.linux-foundation.org>
+
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+The handling of the re-registration case is wrong here; the "test" that was
+returned from auth_domain_lookup will not be used again, so that reference
+should be put. And auth_domain_lookup never did anything with "new" in
+this case, so we should just clean it up ourself.
+
+Thanks to Akinobu Mita for bug report, analysis, and testing.
+
+Cc: Akinobu Mita <akinobu.mita@gmail.com>
+Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu>
+Cc: Neil Brown <neilb@suse.de>
+Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/svcauth_gss.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -760,11 +760,12 @@ svcauth_gss_register_pseudoflavor(u32 ps
+ new->h.flavour = &svcauthops_gss;
+ new->pseudoflavor = pseudoflavor;
+
++ stat = 0;
+ test = auth_domain_lookup(name, &new->h);
+- if (test != &new->h) { /* XXX Duplicate registration? */
+- auth_domain_put(&new->h);
+- /* dangling ref-count... */
+- goto out;
++ if (test != &new->h) { /* Duplicate registration */
++ auth_domain_put(test);
++ kfree(new->h.name);
++ goto out_free_dom;
+ }
+ return 0;
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 19 02:18:50 2007
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Thu, 19 Jul 2007 01:49:18 -0700
+Subject: nfsd: fix possible read-ahead cache and export table corruption
+To: torvalds@linux-foundation.org
+Cc: neilb@suse.de, stable@kernel.org, akpm@linux-foundation.org, bfields@citi.umich.edu, gnb@melbourne.sgi.com
+Message-ID: <200707190849.l6J8nIm4023400@imap1.linux-foundation.org>
+
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+The value of nperbucket calculated here is too small--we should be rounding up
+instead of down--with the result that the index j in the following loop can
+overflow the raparm_hash array. At least in my case, the next thing in memory
+turns out to be export_table, so the symptoms I see are crashes caused by the
+appearance of four zeroed-out export entries in the first bucket of the hash
+table of exports (which were actually entries in the readahead cache, a
+pointer to which had been written to the export table in this initialization
+code).
+
+It looks like the bug was probably introduced with commit
+fce1456a19f5c08b688c29f00ef90fdfa074c79b ("knfsd: make the readahead params
+cache SMP-friendly").
+
+Cc: Greg Banks <gnb@melbourne.sgi.com>
+Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu>
+Acked-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1890,7 +1890,7 @@ nfsd_racache_init(int cache_size)
+ raparm_hash[i].pb_head = NULL;
+ spin_lock_init(&raparm_hash[i].pb_lock);
+ }
+- nperbucket = cache_size >> RAPARM_HASH_BITS;
++ nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE);
+ for (i = 0; i < cache_size - 1; i++) {
+ if (i % nperbucket == 0)
+ raparm_hash[j++].pb_head = raparml + i;
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 19 02:21:38 2007
+From: Fengguang Wu <wfg@mail.ustc.edu.cn>
+Date: Thu, 19 Jul 2007 01:47:58 -0700
+Subject: readahead: MIN_RA_PAGES/MAX_RA_PAGES macros
+To: torvalds@linux-foundation.org
+Cc: slpratt@austin.ibm.com, rusty@rustcorp.com.au, linuxram@us.ibm.com, wfg@mail.ustc.edu.cn, akpm@linux-foundation.org, stable@kernel.org
+Message-ID: <200707190847.l6J8lw9h023020@imap1.linux-foundation.org>
+
+
+From: Fengguang Wu <wfg@mail.ustc.edu.cn>
+
+Define two convenient macros for read-ahead:
+ - MAX_RA_PAGES: rounded down counterpart of VM_MAX_READAHEAD
+ - MIN_RA_PAGES: rounded _up_ counterpart of VM_MIN_READAHEAD
+
+Note that the rounded up MIN_RA_PAGES will work flawlessly with _large_
+page sizes like 64k.
+
+Signed-off-by: Fengguang Wu <wfg@mail.ustc.edu.cn>
+Cc: Steven Pratt <slpratt@austin.ibm.com>
+Cc: Ram Pai <linuxram@us.ibm.com>
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/readahead.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/mm/readahead.c
++++ b/mm/readahead.c
+@@ -21,8 +21,16 @@ void default_unplug_io_fn(struct backing
+ }
+ EXPORT_SYMBOL(default_unplug_io_fn);
+
++/*
++ * Convienent macros for min/max read-ahead pages.
++ * Note that MAX_RA_PAGES is rounded down, while MIN_RA_PAGES is rounded up.
++ * The latter is necessary for systems with large page size(i.e. 64k).
++ */
++#define MAX_RA_PAGES (VM_MAX_READAHEAD*1024 / PAGE_CACHE_SIZE)
++#define MIN_RA_PAGES DIV_ROUND_UP(VM_MIN_READAHEAD*1024, PAGE_CACHE_SIZE)
++
+ struct backing_dev_info default_backing_dev_info = {
+- .ra_pages = (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE,
++ .ra_pages = MAX_RA_PAGES,
+ .state = 0,
+ .capabilities = BDI_CAP_MAP_COPY,
+ .unplug_io_fn = default_unplug_io_fn,
+@@ -51,7 +59,7 @@ static inline unsigned long get_max_read
+
+ static inline unsigned long get_min_readahead(struct file_ra_state *ra)
+ {
+- return (VM_MIN_READAHEAD * 1024) / PAGE_CACHE_SIZE;
++ return MIN_RA_PAGES;
+ }
+
+ static inline void reset_ahead_window(struct file_ra_state *ra)
i386-hpet-check-if-the-counter-works.patch
fw-ohci-fix-scheduling-while-atomic.patch
firewire-fix-memory-leak-of-fw_request-instances.patch
+softmac-fix-essid-problem.patch
+ecryptfs-ecryptfs_setattr-bugfix.patch
+nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch
+readahead-min_ra_pages-max_ra_pages-macros.patch
+fs-9p-conv.c-error-path-fix.patch
+forcedeth-bug-fix-cicada-phy.patch
+forcedeth-bug-fix-vitesse-phy.patch
+forcedeth-bug-fix-realtek-phy.patch
+acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch
+jbd-commit-fix-transaction-dropping.patch
+jbd2-commit-fix-transaction-dropping.patch
+hugetlb-fix-race-in-alloc_fresh_huge_page.patch
+do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch
+uml-limit-request-size-on-cowed-devices.patch
+sony-laptop-fix-bug-in-event-handling.patch
+destroy_workqueue-can-livelock.patch
+drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch
+cfq-iosched-fix-async-queue-behaviour.patch
+libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch
+ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch
+nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jul 17 08:47:14 2007
+From: Jean Tourrilhes <jt@hpl.hp.com>
+Date: Tue, 17 Jul 2007 10:46:33 -0500
+Subject: softmac: Fix ESSID problem
+To: stable@kernel.org
+Cc: linux-wireless@vger.kernel.org
+Message-ID: <469CE459.4070300@lwfinger.net>
+
+
+From: Jean Tourrilhes <jt@hpl.hp.com>
+
+Victor Porton reported that the SoftMAC layer had random problem when setting the ESSID :
+http://bugzilla.kernel.org/show_bug.cgi?id=8686 After investigation, it turned out to be
+worse, the SoftMAC layer is left in an inconsistent state. The fix is pretty trivial.
+
+Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
+Acked-by: Michael Buesch <mb@bu3sch.df>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Acked-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ieee80211/softmac/ieee80211softmac_assoc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
++++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
+@@ -271,8 +271,11 @@ ieee80211softmac_assoc_work(struct work_
+ */
+ dprintk(KERN_INFO PFX "Associate: Scanning for networks first.\n");
+ ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify_scan, NULL);
+- if (ieee80211softmac_start_scan(mac))
++ if (ieee80211softmac_start_scan(mac)) {
+ dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
++ mac->associnfo.associating = 0;
++ mac->associnfo.associated = 0;
++ }
+ goto out;
+ } else {
+ mac->associnfo.associating = 0;
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jul 15 10:45:08 2007
+From: Mattia Dongili <malattia@linux.it>
+Date: Mon, 16 Jul 2007 02:44:58 +0900
+Subject: sony-laptop: fix bug in event handling
+To: stable@kernel.org
+Cc: Stelian Pop <stelian@popies.net>, Len Brown <lenb@kernel.org>
+Message-ID: <20070715174458.GA22949@inferi.kami.home>
+Content-Disposition: inline
+
+From: Mattia Dongili <malattia@linux.it>
+
+The rewritten event reading code from sonypi was absolutely wrong,
+this patche makes things functional for type2 and type1 models.
+
+Cc: Andrei Paskevich <andrei@capet.iut-fbleau.fr>
+Signed-off-by: Mattia Dongili <malattia@linux.it>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/sony-laptop.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/misc/sony-laptop.c
++++ b/drivers/misc/sony-laptop.c
+@@ -908,7 +908,9 @@ static struct acpi_driver sony_nc_driver
+ #define SONYPI_DEVICE_TYPE2 0x00000002
+ #define SONYPI_DEVICE_TYPE3 0x00000004
+
+-#define SONY_PIC_EV_MASK 0xff
++#define SONYPI_TYPE1_OFFSET 0x04
++#define SONYPI_TYPE2_OFFSET 0x12
++#define SONYPI_TYPE3_OFFSET 0x12
+
+ struct sony_pic_ioport {
+ struct acpi_resource_io io;
+@@ -922,6 +924,7 @@ struct sony_pic_irq {
+
+ struct sony_pic_dev {
+ int model;
++ u16 evport_offset;
+ u8 camera_power;
+ u8 bluetooth_power;
+ u8 wwan_power;
+@@ -1998,20 +2001,17 @@ end:
+ static irqreturn_t sony_pic_irq(int irq, void *dev_id)
+ {
+ int i, j;
+- u32 port_val = 0;
+ u8 ev = 0;
+ u8 data_mask = 0;
+ u8 device_event = 0;
+
+ struct sony_pic_dev *dev = (struct sony_pic_dev *) dev_id;
+
+- acpi_os_read_port(dev->cur_ioport->io.minimum, &port_val,
+- dev->cur_ioport->io.address_length);
+- ev = port_val & SONY_PIC_EV_MASK;
+- data_mask = 0xff & (port_val >> (dev->cur_ioport->io.address_length - 8));
++ ev = inb_p(dev->cur_ioport->io.minimum);
++ data_mask = inb_p(dev->cur_ioport->io.minimum + dev->evport_offset);
+
+- dprintk("event (0x%.8x [%.2x] [%.2x]) at port 0x%.4x\n",
+- port_val, ev, data_mask, dev->cur_ioport->io.minimum);
++ dprintk("event ([%.2x] [%.2x]) at port 0x%.4x(+0x%.2x)\n",
++ ev, data_mask, dev->cur_ioport->io.minimum, dev->evport_offset);
+
+ if (ev == 0x00 || ev == 0xff)
+ return IRQ_HANDLED;
+@@ -2102,6 +2102,20 @@ static int sony_pic_add(struct acpi_devi
+ spic_dev.model = sony_pic_detect_device_type();
+ mutex_init(&spic_dev.lock);
+
++ /* model specific characteristics */
++ switch(spic_dev.model) {
++ case SONYPI_DEVICE_TYPE1:
++ spic_dev.evport_offset = SONYPI_TYPE1_OFFSET;
++ break;
++ case SONYPI_DEVICE_TYPE3:
++ spic_dev.evport_offset = SONYPI_TYPE3_OFFSET;
++ break;
++ case SONYPI_DEVICE_TYPE2:
++ default:
++ spic_dev.evport_offset = SONYPI_TYPE2_OFFSET;
++ break;
++ }
++
+ /* read _PRS resources */
+ result = sony_pic_possible_resources(device);
+ if (result) {
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jul 15 23:49:08 2007
+From: Jeff Dike <jdike@addtoit.com>
+Date: Sun, 15 Jul 2007 23:38:58 -0700
+Subject: uml: limit request size on COWed devices
+To: torvalds@linux-foundation.org
+Cc: akpm@linux-foundation.org, jdike@linux.intel.com, blaisorblade@yahoo.it, jdike@addtoit.com, stable@kernel.org
+Message-ID: <200707160638.l6G6cw5e014373@imap1.linux-foundation.org>
+
+
+From: Jeff Dike <jdike@addtoit.com>
+
+COWed devices can't handle more than 32 (64 on x86_64) sectors in one request
+due to the size of the bitmap being carried around in the io_thread_req.
+
+Enforce that by telling the block layer not to put too many sectors in
+requests to COWed devices.
+
+Signed-off-by: Jeff Dike <jdike@linux.intel.com>
+Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/drivers/ubd_kern.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/um/drivers/ubd_kern.c
++++ b/arch/um/drivers/ubd_kern.c
+@@ -712,6 +712,8 @@ static int ubd_add(int n, char **error_o
+ ubd_dev->queue->queuedata = ubd_dev;
+
+ blk_queue_max_hw_segments(ubd_dev->queue, MAX_SG);
++ if(ubd_dev->cow.file != NULL)
++ blk_queue_max_sectors(ubd_dev->queue, 8 * sizeof(long));
+ err = ubd_disk_register(MAJOR_NR, ubd_dev->size, n, &ubd_gendisk[n]);
+ if(err){
+ *error_out = "Failed to register device";
projects / thirdparty / kernel / stable-queue.git / commitdiff
