--- /dev/null
+From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007
+Message-Id: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/31] [00/@num@] -stable review
+Status: RO
+Content-Length: 709
+Lines: 17
+
+This is the start of the stable review cycle for the 2.6.20.7 release.
+There are 31 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by April 13, 20:00:00 UTC. Anything received
+after that time might be too late.
+
+thanks,
+
+greg k-h
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007
+Message-Id: <20070411224442.376948423@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Oleg Verych <olecom@flower.upol.cz>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andrew Morton <akpm@osdl.org>,
+ Linus Torvalds <torvalds@osdl.org>,
+ Jan Beulich <jbeulich@novell.com>,
+ Sam Ravnborg <sam@ravnborg.org>
+Subject: [patch 01/31] kbuild: fix dependency generation
+Content-Disposition: inline; filename=kbuild-fix-dependency-generation.patch
+Status: RO
+Content-Length: 2123
+Lines: 59
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jan Beulich <jbeulich@novell.com>
+
+Commit 2e3646e51b2d6415549b310655df63e7e0d7a080 changed the way
+the split config tree is built, but failed to also adjust fixdep
+accordingly - if changing a config option from or to m, files
+referencing the respective CONFIG_..._MODULE (but not the
+corresponding CONFIG_...) didn't get rebuilt.
+
+The problem is that trisate symbol are represent with three
+different symbols:
+SYMBOL=n => no symbol defined
+SYMBOL=y => CONFIG_SYMBOL defined to '1'
+SYMBOL=m => CONFIG_SYMBOL_MODULE defined to '1'
+
+But conf_split_config do not distingush between the =y and =m case,
+so only the =y case is honoured.
+This is fixed in fixdep so when a CONFIG symbol with
+_MODULE is found we skip that part and only look
+for the CONFIG_SYMBOL version.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/basic/fixdep.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/scripts/basic/fixdep.c
++++ b/scripts/basic/fixdep.c
+@@ -28,9 +28,11 @@
+ * the dependency on linux/autoconf.h by a dependency on every config
+ * option which is mentioned in any of the listed prequisites.
+ *
+- * To be exact, split-include populates a tree in include/config/,
+- * e.g. include/config/his/driver.h, which contains the #define/#undef
+- * for the CONFIG_HIS_DRIVER option.
++ * kconfig populates a tree in include/config/ with an empty file
++ * for each config symbol and when the configuration is updated
++ * the files representing changed config options are touched
++ * which then let make pick up the changes and the files that use
++ * the config symbols are rebuilt.
+ *
+ * So if the user changes his CONFIG_HIS_DRIVER option, only the objects
+ * which depend on "include/linux/config/his/driver.h" will be rebuilt,
+@@ -245,6 +247,8 @@ void parse_config_file(char *map, size_t
+ continue;
+
+ found:
++ if (!memcmp(q - 7, "_MODULE", 7))
++ q -= 7;
+ use_config(p+7, q-p-7);
+ }
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007
+Message-Id: <20070411224442.505215545@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Manfred Spraul <manfred@colorfullife.com>,
+ Adrian Bunk <bunk@stusta.de>,
+ Ingo Molnar <mingo@elte.hu>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 02/31] i386: fix file_read_actor() and pipe_read() for original i386 systems
+Content-Disposition: inline; filename=i386-fix-file_read_actor-and-pipe_read-for-original-i386-systems.patch
+Content-Length: 1826
+Lines: 57
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+The __copy_to_user_inatomic() calls in file_read_actor() and pipe_read()
+are broken on original i386 machines, where WP-works-ok == false, as
+__copy_to_user_inatomic() on such systems calls functions which might
+sleep and/or contain cond_resched() calls inside of a kmap_atomic()
+region.
+
+The original check for WP-works-ok was in access_ok(), but got moved
+during the 2.5 series to fix a race vs. swap.
+
+Return the number of bytes to copy in the case where we are in an atomic
+region, so the non atomic code pathes in file_read_actor() and
+pipe_read() are taken.
+
+This could be optimized to avoid the kmap_atomic by moving the check for
+WP-works-ok into fault_in_pages_writeable(), but this is more intrusive
+and can be done later.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/lib/usercopy.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/i386/lib/usercopy.c
++++ b/arch/i386/lib/usercopy.c
+@@ -10,6 +10,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/module.h>
+ #include <linux/backing-dev.h>
++#include <linux/interrupt.h>
+ #include <asm/uaccess.h>
+ #include <asm/mmx.h>
+
+@@ -719,6 +720,14 @@ unsigned long __copy_to_user_ll(void __u
+ #ifndef CONFIG_X86_WP_WORKS_OK
+ if (unlikely(boot_cpu_data.wp_works_ok == 0) &&
+ ((unsigned long )to) < TASK_SIZE) {
++ /*
++ * When we are in an atomic section (see
++ * mm/filemap.c:file_read_actor), return the full
++ * length to take the slow path.
++ */
++ if (in_atomic())
++ return n;
++
+ /*
+ * CPU does not honor the WP bit when writing
+ * from supervisory mode, and due to preemption or SMP,
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007
+Message-Id: <20070411224442.634603000@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ <davef1624@aol.com>,
+ Stephen Hemminger <shemminger@linux-foundation.org>
+Subject: [patch 03/31] sky2: reliable recovery
+Content-Disposition: inline; filename=sky2-reliable-recovery.patch
+Content-Length: 3984
+Lines: 140
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+This adds working recovery from transmit timeouts. Previous code
+didn't do enough to truly reset chip.
+
+It is a backport of the 2.6.21 code.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 81 +++++++++++++++++++++++++++++++++++------------------
+ drivers/net/sky2.h | 1
+ 2 files changed, 56 insertions(+), 26 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -1802,38 +1802,22 @@ static void sky2_tx_timeout(struct net_d
+ {
+ struct sky2_port *sky2 = netdev_priv(dev);
+ struct sky2_hw *hw = sky2->hw;
+- unsigned txq = txqaddr[sky2->port];
+- u16 report, done;
++ unsigned port = sky2->port;
+
+ if (netif_msg_timer(sky2))
+ printk(KERN_ERR PFX "%s: tx timeout\n", dev->name);
+
+- report = sky2_read16(hw, sky2->port == 0 ? STAT_TXA1_RIDX : STAT_TXA2_RIDX);
+- done = sky2_read16(hw, Q_ADDR(txq, Q_DONE));
+-
+- printk(KERN_DEBUG PFX "%s: transmit ring %u .. %u report=%u done=%u\n",
+- dev->name,
+- sky2->tx_cons, sky2->tx_prod, report, done);
+-
+- if (report != done) {
+- printk(KERN_INFO PFX "status burst pending (irq moderation?)\n");
++ /* Get information for bug report :-) */
++ printk(KERN_INFO PFX "%s: transmit ring %u .. %u report=%u done=%u\n",
++ dev->name, sky2->tx_cons, sky2->tx_prod,
++ sky2_read16(hw, port == 0 ? STAT_TXA1_RIDX : STAT_TXA2_RIDX),
++ sky2_read16(hw, Q_ADDR(txqaddr[sky2->port], Q_DONE)));
+
+- sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_STOP);
+- sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_START);
+- } else if (report != sky2->tx_cons) {
+- printk(KERN_INFO PFX "status report lost?\n");
+- sky2_tx_complete(sky2, report);
+- } else {
+- printk(KERN_INFO PFX "hardware hung? flushing\n");
++ printk(KERN_INFO PFX "gmac control %#x status %#x\n",
++ gma_read16(hw, port, GM_GP_CTRL), gma_read16(hw, port, GM_GP_STAT));
+
+- sky2_write32(hw, Q_ADDR(txq, Q_CSR), BMU_STOP);
+- sky2_write32(hw, Y2_QADDR(txq, PREF_UNIT_CTRL), PREF_UNIT_RST_SET);
+-
+- sky2_tx_complete(sky2, sky2->tx_prod);
+-
+- sky2_qset(hw, txq);
+- sky2_prefetch_init(hw, txq, sky2->tx_le_map, TX_RING_SIZE - 1);
+- }
++ /* can't restart safely under softirq */
++ schedule_work(&hw->restart_work);
+ }
+
+ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
+@@ -2565,6 +2549,49 @@ static int sky2_reset(struct sky2_hw *hw
+ return 0;
+ }
+
++static void sky2_restart(struct work_struct *work)
++{
++ struct sky2_hw *hw = container_of(work, struct sky2_hw, restart_work);
++ struct net_device *dev;
++ int i, err;
++
++ dev_dbg(&hw->pdev->dev, "restarting\n");
++
++ del_timer_sync(&hw->idle_timer);
++
++ rtnl_lock();
++ sky2_write32(hw, B0_IMSK, 0);
++ sky2_read32(hw, B0_IMSK);
++
++ netif_poll_disable(hw->dev[0]);
++
++ for (i = 0; i < hw->ports; i++) {
++ dev = hw->dev[i];
++ if (netif_running(dev))
++ sky2_down(dev);
++ }
++
++ sky2_reset(hw);
++ sky2_write32(hw, B0_IMSK, Y2_IS_BASE);
++ netif_poll_enable(hw->dev[0]);
++
++ for (i = 0; i < hw->ports; i++) {
++ dev = hw->dev[i];
++ if (netif_running(dev)) {
++ err = sky2_up(dev);
++ if (err) {
++ printk(KERN_INFO PFX "%s: could not restart %d\n",
++ dev->name, err);
++ dev_close(dev);
++ }
++ }
++ }
++
++ sky2_idle_start(hw);
++
++ rtnl_unlock();
++}
++
+ static u32 sky2_supported_modes(const struct sky2_hw *hw)
+ {
+ if (sky2_is_copper(hw)) {
+@@ -3508,6 +3535,8 @@ static int __devinit sky2_probe(struct p
+ }
+
+ setup_timer(&hw->idle_timer, sky2_idle, (unsigned long) hw);
++ INIT_WORK(&hw->restart_work, sky2_restart);
++
+ sky2_idle_start(hw);
+
+ pci_set_drvdata(pdev, hw);
+--- a/drivers/net/sky2.h
++++ b/drivers/net/sky2.h
+@@ -1898,6 +1898,7 @@ struct sky2_hw {
+ dma_addr_t st_dma;
+
+ struct timer_list idle_timer;
++ struct work_struct restart_work;
+ int msi;
+ wait_queue_head_t msi_wait;
+ };
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007
+Message-Id: <20070411224442.767163145@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ Stephen Hemminger <shemminger@linux-foundation.org>
+Subject: [patch 04/31] skge: turn carrier off when down
+Content-Disposition: inline; filename=skge-carrier.patch
+Content-Length: 857
+Lines: 28
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+Driver needs to turn off carrier when down, otherwise it can
+confuse bonding and bridging and looks like carrier is on immediately
+when it is brought back up.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/skge.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/skge.c
++++ b/drivers/net/skge.c
+@@ -2462,6 +2462,7 @@ static int skge_down(struct net_device *
+ printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
+
+ netif_stop_queue(dev);
++ netif_carrier_off(dev);
+ if (hw->chip_id == CHIP_ID_GENESIS && hw->phy_type == SK_PHY_XMAC)
+ cancel_rearming_delayed_work(&skge->link_thread);
+
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007
+Message-Id: <20070411224442.896959898@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ Stephen Hemminger <shemminger@linux-foundation.org>
+Subject: [patch 05/31] sky2: turn carrier off when down
+Content-Disposition: inline; filename=sky2-carrier.patch
+Content-Length: 660
+Lines: 26
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+Driver needs to turn off carrier when down.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -1506,6 +1506,7 @@ static int sky2_down(struct net_device *
+
+ /* Stop more packets from being queued */
+ netif_stop_queue(dev);
++ netif_carrier_off(dev);
+
+ /* Disable port IRQ */
+ imask = sky2_read32(hw, B0_IMSK);
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007
+Message-Id: <20070411224443.034720228@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ Stephen Hemminger <shemminger@linux-foundation.org>
+Subject: [patch 06/31] sky2: turn on clocks when doing resume
+Content-Disposition: inline; filename=sky2-ec-clocks-resume.patch
+Content-Length: 1160
+Lines: 41
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+Some of these chips are disabled until clock is enabled.
+This fixes:
+ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404107
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -2421,6 +2421,10 @@ static int sky2_reset(struct sky2_hw *hw
+ return -EOPNOTSUPP;
+ }
+
++ /* Make sure and enable all clocks */
++ if (hw->chip_id == CHIP_ID_YUKON_EC_U)
++ sky2_pci_write32(hw, PCI_DEV_REG3, 0);
++
+ hw->chip_rev = (sky2_read8(hw, B2_MAC_CFG) & CFG_CHIP_R_MSK) >> 4;
+
+ /* This rev is really old, and requires untested workarounds */
+@@ -3639,6 +3643,9 @@ static int sky2_resume(struct pci_dev *p
+
+ pci_restore_state(pdev);
+ pci_enable_wake(pdev, PCI_D0, 0);
++
++ if (hw->chip_id == CHIP_ID_YUKON_EC_U)
++ sky2_pci_write32(hw, PCI_DEV_REG3, 0);
+ sky2_set_power_state(hw, PCI_D0);
+
+ err = sky2_reset(hw);
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007
+Message-Id: <20070411224443.226229395@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ Stephen Hemminger <shemminger@linux-foundation.org>
+Subject: [patch 07/31] sky2: phy workarounds for Yukon EC-U A1
+Content-Disposition: inline; filename=sky2-ec-u-a1.patch
+Content-Length: 1320
+Lines: 41
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+The workaround Yukon EC-U wasn't comparing with correct
+version and wasn't doing correct setup. Without it, 88e8056
+throws all sorts of errors.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -524,9 +524,9 @@ static void sky2_phy_init(struct sky2_hw
+ ledover &= ~PHY_M_LED_MO_RX;
+ }
+
+- if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev == CHIP_REV_YU_EC_A1) {
++ if (hw->chip_id == CHIP_ID_YUKON_EC_U &&
++ hw->chip_rev == CHIP_REV_YU_EC_U_A1) {
+ /* apply fixes in PHY AFE */
+- pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
+ gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 255);
+
+ /* increase differential signal amplitude in 10BASE-T */
+@@ -538,7 +538,7 @@ static void sky2_phy_init(struct sky2_hw
+ gm_phy_write(hw, port, 0x17, 0x2002);
+
+ /* set page register to 0 */
+- gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
++ gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 0);
+ } else {
+ gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
+
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007
+Message-Id: <20070411224443.303808617@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andreas Oberritter <obi@linuxtv.org>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 08/31] DVB: tda10086: fix DiSEqC message length
+Content-Disposition: inline; filename=dvb-tda10086-fix-diseqc-message-length.patch
+Content-Length: 1100
+Lines: 34
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andreas Oberritter <obi@linuxtv.org>
+
+DVB: tda10086: fix DiSEqC message length
+
+Setting the message length to zero means to send one byte, so you need a
+subtraction instead of an addition.
+
+(cherry picked from commit d420cb44693b8370cbf06c3e31b4b5dec66c9f86)
+
+Signed-off-by: Andreas Oberritter <obi@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/tda10086.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb/frontends/tda10086.c
++++ b/drivers/media/dvb/frontends/tda10086.c
+@@ -212,7 +212,7 @@ static int tda10086_send_master_cmd (str
+ for(i=0; i< cmd->msg_len; i++) {
+ tda10086_write_byte(state, 0x48+i, cmd->msg[i]);
+ }
+- tda10086_write_byte(state, 0x36, 0x08 | ((cmd->msg_len + 1) << 4));
++ tda10086_write_byte(state, 0x36, 0x08 | ((cmd->msg_len - 1) << 4));
+
+ tda10086_diseqc_wait(state);
+
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007
+Message-Id: <20070411224443.442065693@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andreas Oberritter <obi@linuxtv.org>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 09/31] DVB: pluto2: fix incorrect TSCR register setting
+Content-Disposition: inline; filename=dvb-pluto2-fix-incorrect-tscr-register-setting.patch
+Content-Length: 2712
+Lines: 98
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andreas Oberritter <obi@linuxtv.org>
+
+DVB: pluto2: fix incorrect TSCR register setting
+
+The ADEF bits in the TSCR register have different meanings in read
+and write mode. For this reason ADEF has to be reset on every
+read-modify-write operation.
+
+This patch introduces a special write function for this register, which
+takes care of it.
+
+Thanks to Holger Magnussen for pointing my nose at this problem.
+
+(cherry picked from commit 1489f90a49f0603a393e1800d729050f6e332bec)
+
+Signed-off-by: Andreas Oberritter <obi@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/pluto2/pluto2.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/dvb/pluto2/pluto2.c
++++ b/drivers/media/dvb/pluto2/pluto2.c
+@@ -149,6 +149,15 @@ static inline void pluto_rw(struct pluto
+ writel(val, &pluto->io_mem[reg]);
+ }
+
++static void pluto_write_tscr(struct pluto *pluto, u32 val)
++{
++ /* set the number of packets */
++ val &= ~TSCR_ADEF;
++ val |= TS_DMA_PACKETS / 2;
++
++ pluto_writereg(pluto, REG_TSCR, val);
++}
++
+ static void pluto_setsda(void *data, int state)
+ {
+ struct pluto *pluto = data;
+@@ -213,11 +222,11 @@ static void pluto_reset_ts(struct pluto
+
+ if (val & TSCR_RSTN) {
+ val &= ~TSCR_RSTN;
+- pluto_writereg(pluto, REG_TSCR, val);
++ pluto_write_tscr(pluto, val);
+ }
+ if (reenable) {
+ val |= TSCR_RSTN;
+- pluto_writereg(pluto, REG_TSCR, val);
++ pluto_write_tscr(pluto, val);
+ }
+ }
+
+@@ -339,7 +348,7 @@ static irqreturn_t pluto_irq(int irq, vo
+ }
+
+ /* ACK the interrupt */
+- pluto_writereg(pluto, REG_TSCR, tscr | TSCR_IACK);
++ pluto_write_tscr(pluto, tscr | TSCR_IACK);
+
+ return IRQ_HANDLED;
+ }
+@@ -348,9 +357,6 @@ static void __devinit pluto_enable_irqs(
+ {
+ u32 val = pluto_readreg(pluto, REG_TSCR);
+
+- /* set the number of packets */
+- val &= ~TSCR_ADEF;
+- val |= TS_DMA_PACKETS / 2;
+ /* disable AFUL and LOCK interrupts */
+ val |= (TSCR_MSKA | TSCR_MSKL);
+ /* enable DMA and OVERFLOW interrupts */
+@@ -358,7 +364,7 @@ static void __devinit pluto_enable_irqs(
+ /* clear pending interrupts */
+ val |= TSCR_IACK;
+
+- pluto_writereg(pluto, REG_TSCR, val);
++ pluto_write_tscr(pluto, val);
+ }
+
+ static void pluto_disable_irqs(struct pluto *pluto)
+@@ -370,7 +376,7 @@ static void pluto_disable_irqs(struct pl
+ /* clear pending interrupts */
+ val |= TSCR_IACK;
+
+- pluto_writereg(pluto, REG_TSCR, val);
++ pluto_write_tscr(pluto, val);
+ }
+
+ static int __devinit pluto_hw_init(struct pluto *pluto)
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007
+Message-Id: <20070411224443.579186791@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Adam Kropelin <akropel1@rochester.rr.com>,
+ Jiri Kosina <jkosina@suse.cz>
+Subject: [patch 10/31] HID: Do not discard truncated input reports
+Content-Disposition: inline; filename=hid-do-not-discard-truncated-input-reports.patch
+Content-Length: 1248
+Lines: 39
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Adam Kropelin <akropel1@rochester.rr.com>
+
+HID: Do not discard truncated input reports
+
+Truncated reports should not be discarded since it prevents buggy
+devices from communicating with userspace.
+
+Prior to the regession introduced in 2.6.20, a shorter-than-expected
+report in hid_input_report() was passed thru after having the missing
+bytes cleared. This behavior was established over a few patches in the
+2.6.early-teens days, including commit
+cd6104572bca9e4afe0dcdb8ecd65ef90b01297b.
+
+This patch restores the previous behavior and fixes the regression.
+
+Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hid-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -975,7 +975,7 @@ int hid_input_report(struct hid_device *
+
+ if (size < rsize) {
+ dbg("report %d is too short, (%d < %d)", report->id, size, rsize);
+- return -1;
++ memset(data + size, 0, rsize - size);
+ }
+
+ if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007
+Message-Id: <20070411224443.719000038@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Reuben Farrelly <reuben-linuxkernel@reub.net>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-raid@vger.kernel.org,
+ Neil Brown <neilb@suse.de>
+Subject: [patch 11/31] Fix calculation for size of filemap_attr array in md/bitmap.
+Content-Disposition: inline; filename=fix-calculation-for-size-of-filemap_attr-array-in-md-bitmap.patch
+Content-Length: 977
+Lines: 32
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Neil Brown <neilb@suse.de>
+
+If 'num_pages' were ever 1 more than a multiple of 8 (32bit platforms)
+for of 16 (64 bit platforms). filemap_attr would be allocated one
+'unsigned long' shorter than required. We need a round-up in there.
+
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -863,9 +863,7 @@ static int bitmap_init_from_disk(struct
+
+ /* We need 4 bits per page, rounded up to a multiple of sizeof(unsigned long) */
+ bitmap->filemap_attr = kzalloc(
+- (((num_pages*4/8)+sizeof(unsigned long)-1)
+- /sizeof(unsigned long))
+- *sizeof(unsigned long),
++ roundup( DIV_ROUND_UP(num_pages*4, 8), sizeof(unsigned long)),
+ GFP_KERNEL);
+ if (!bitmap->filemap_attr)
+ goto out;
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007
+Message-Id: <20070411224443.854393702@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Francois Romieu <romieu@fr.zoreil.com>,
+ Ben Greear <greearb@candelatech.com>
+Subject: [patch 12/31] 8139too: RTNL and flush_scheduled_work deadlock
+Content-Disposition: inline; filename=8139too-rtnl-and-flush_scheduled_work-deadlock.patch
+Content-Length: 2811
+Lines: 108
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Francois Romieu <romieu@fr.zoreil.com>
+
+Your usual dont-flush_scheduled_work-with-RTNL-held stuff.
+
+It is a bit different here since the thread runs permanently
+or is only occasionally kicked for recovery depending on the
+hardware revision.
+
+Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Cc: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/8139too.c | 40 +++++++++++++++++-----------------------
+ 1 file changed, 17 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/8139too.c
++++ b/drivers/net/8139too.c
+@@ -1109,6 +1109,8 @@ static void __devexit rtl8139_remove_one
+
+ assert (dev != NULL);
+
++ flush_scheduled_work();
++
+ unregister_netdev (dev);
+
+ __rtl8139_cleanup_dev (dev);
+@@ -1603,18 +1605,21 @@ static void rtl8139_thread (struct work_
+ struct net_device *dev = tp->mii.dev;
+ unsigned long thr_delay = next_tick;
+
++ rtnl_lock();
++
++ if (!netif_running(dev))
++ goto out_unlock;
++
+ if (tp->watchdog_fired) {
+ tp->watchdog_fired = 0;
+ rtl8139_tx_timeout_task(work);
+- } else if (rtnl_trylock()) {
+- rtl8139_thread_iter (dev, tp, tp->mmio_addr);
+- rtnl_unlock ();
+- } else {
+- /* unlikely race. mitigate with fast poll. */
+- thr_delay = HZ / 2;
+- }
++ } else
++ rtl8139_thread_iter(dev, tp, tp->mmio_addr);
+
+- schedule_delayed_work(&tp->thread, thr_delay);
++ if (tp->have_thread)
++ schedule_delayed_work(&tp->thread, thr_delay);
++out_unlock:
++ rtnl_unlock ();
+ }
+
+ static void rtl8139_start_thread(struct rtl8139_private *tp)
+@@ -1626,19 +1631,11 @@ static void rtl8139_start_thread(struct
+ return;
+
+ tp->have_thread = 1;
++ tp->watchdog_fired = 0;
+
+ schedule_delayed_work(&tp->thread, next_tick);
+ }
+
+-static void rtl8139_stop_thread(struct rtl8139_private *tp)
+-{
+- if (tp->have_thread) {
+- cancel_rearming_delayed_work(&tp->thread);
+- tp->have_thread = 0;
+- } else
+- flush_scheduled_work();
+-}
+-
+ static inline void rtl8139_tx_clear (struct rtl8139_private *tp)
+ {
+ tp->cur_tx = 0;
+@@ -1696,12 +1693,11 @@ static void rtl8139_tx_timeout (struct n
+ {
+ struct rtl8139_private *tp = netdev_priv(dev);
+
++ tp->watchdog_fired = 1;
+ if (!tp->have_thread) {
+- INIT_DELAYED_WORK(&tp->thread, rtl8139_tx_timeout_task);
++ INIT_DELAYED_WORK(&tp->thread, rtl8139_thread);
+ schedule_delayed_work(&tp->thread, next_tick);
+- } else
+- tp->watchdog_fired = 1;
+-
++ }
+ }
+
+ static int rtl8139_start_xmit (struct sk_buff *skb, struct net_device *dev)
+@@ -2233,8 +2229,6 @@ static int rtl8139_close (struct net_dev
+
+ netif_stop_queue (dev);
+
+- rtl8139_stop_thread(tp);
+-
+ if (netif_msg_ifdown(tp))
+ printk(KERN_DEBUG "%s: Shutting down ethercard, status was 0x%4.4x.\n",
+ dev->name, RTL_R16 (IntrStatus));
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007
+Message-Id: <20070411224444.038639150@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>,
+ "David S. Miller" <davem@davemloft.net>,
+ Jaroslav Kysela <perex@suse.cz>,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 13/31] NETFILTER: ipt_CLUSTERIP: fix oops in checkentry function
+Content-Disposition: inline; filename=netfilter-ipt_clusterip-fix-oops-in-checkentry-function.patch
+Content-Length: 1253
+Lines: 40
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+[NETFILTER]: ipt_CLUSTERIP: fix oops in checkentry function
+
+The clusterip_config_find_get() already increases entries reference
+counter, so there is no reason to do it twice in checkentry() callback.
+
+This causes the config to be freed before it is removed from the list,
+resulting in a crash when adding the next rule.
+
+Signed-off-by: Jaroslav Kysela <perex@suse.cz>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+@@ -409,12 +409,10 @@ checkentry(const char *tablename,
+ "has invalid config pointer!\n");
+ return 0;
+ }
+- clusterip_config_entry_get(cipinfo->config);
+ } else {
+ /* Case B: This is a new rule referring to an existing
+ * clusterip config. */
+ cipinfo->config = config;
+- clusterip_config_entry_get(cipinfo->config);
+ }
+ } else {
+ /* Case C: This is a completely new clusterip config */
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007
+Message-Id: <20070411224444.111797391@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@stusta.de,
+ Patrick McHardy <kaber@trash.net>,
+ Jamal Hadi Salim <hadi@cyberus.ca>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 14/31] Fix IFB net driver input device crashes
+Content-Disposition: inline; filename=fix-ifb-net-driver-input-device-crashes.patch
+Content-Length: 4653
+Lines: 174
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+[IFB]: Fix crash on input device removal
+
+The input_device pointer is not refcounted, which means the device may
+disappear while packets are queued, causing a crash when ifb passes packets
+with a stale skb->dev pointer to netif_rx().
+
+Fix by storing the interface index instead and do a lookup where neccessary.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/ifb.c | 35 +++++++++++++----------------------
+ include/linux/skbuff.h | 5 +++--
+ include/net/pkt_cls.h | 7 +++++--
+ net/core/dev.c | 8 ++++----
+ net/core/skbuff.c | 2 +-
+ net/sched/act_mirred.c | 2 +-
+ 6 files changed, 27 insertions(+), 32 deletions(-)
+
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -96,17 +96,24 @@ static void ri_tasklet(unsigned long dev
+ skb->tc_verd = SET_TC_NCLS(skb->tc_verd);
+ stats->tx_packets++;
+ stats->tx_bytes +=skb->len;
++
++ skb->dev = __dev_get_by_index(skb->iif);
++ if (!skb->dev) {
++ dev_kfree_skb(skb);
++ stats->tx_dropped++;
++ break;
++ }
++ skb->iif = _dev->ifindex;
++
+ if (from & AT_EGRESS) {
+ dp->st_rx_frm_egr++;
+ dev_queue_xmit(skb);
+ } else if (from & AT_INGRESS) {
+-
+ dp->st_rx_frm_ing++;
++ skb_pull(skb, skb->dev->hard_header_len);
+ netif_rx(skb);
+- } else {
+- dev_kfree_skb(skb);
+- stats->tx_dropped++;
+- }
++ } else
++ BUG();
+ }
+
+ if (netif_tx_trylock(_dev)) {
+@@ -157,26 +164,10 @@ static int ifb_xmit(struct sk_buff *skb,
+ stats->rx_packets++;
+ stats->rx_bytes+=skb->len;
+
+- if (!from || !skb->input_dev) {
+-dropped:
++ if (!(from & (AT_INGRESS|AT_EGRESS)) || !skb->iif) {
+ dev_kfree_skb(skb);
+ stats->rx_dropped++;
+ return ret;
+- } else {
+- /*
+- * note we could be going
+- * ingress -> egress or
+- * egress -> ingress
+- */
+- skb->dev = skb->input_dev;
+- skb->input_dev = dev;
+- if (from & AT_INGRESS) {
+- skb_pull(skb, skb->dev->hard_header_len);
+- } else {
+- if (!(from & AT_EGRESS)) {
+- goto dropped;
+- }
+- }
+ }
+
+ if (skb_queue_len(&dp->rq) >= dev->tx_queue_len) {
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -188,7 +188,7 @@ enum {
+ * @sk: Socket we are owned by
+ * @tstamp: Time we arrived
+ * @dev: Device we arrived on/are leaving by
+- * @input_dev: Device we arrived on
++ * @iif: ifindex of device we arrived on
+ * @h: Transport layer header
+ * @nh: Network layer header
+ * @mac: Link layer header
+@@ -235,7 +235,8 @@ struct sk_buff {
+ struct sock *sk;
+ struct skb_timeval tstamp;
+ struct net_device *dev;
+- struct net_device *input_dev;
++ int iif;
++ /* 4 byte hole on 64 bit*/
+
+ union {
+ struct tcphdr *th;
+--- a/include/net/pkt_cls.h
++++ b/include/net/pkt_cls.h
+@@ -352,10 +352,13 @@ tcf_change_indev(struct tcf_proto *tp, c
+ static inline int
+ tcf_match_indev(struct sk_buff *skb, char *indev)
+ {
++ struct net_device *dev;
++
+ if (indev[0]) {
+- if (!skb->input_dev)
++ if (!skb->iif)
+ return 0;
+- if (strcmp(indev, skb->input_dev->name))
++ dev = __dev_get_by_index(skb->iif);
++ if (!dev || strcmp(indev, dev->name))
+ return 0;
+ }
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1741,8 +1741,8 @@ static int ing_filter(struct sk_buff *sk
+ if (dev->qdisc_ingress) {
+ __u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd);
+ if (MAX_RED_LOOP < ttl++) {
+- printk(KERN_WARNING "Redir loop detected Dropping packet (%s->%s)\n",
+- skb->input_dev->name, skb->dev->name);
++ printk(KERN_WARNING "Redir loop detected Dropping packet (%d->%d)\n",
++ skb->iif, skb->dev->ifindex);
+ return TC_ACT_SHOT;
+ }
+
+@@ -1775,8 +1775,8 @@ int netif_receive_skb(struct sk_buff *sk
+ if (!skb->tstamp.off_sec)
+ net_timestamp(skb);
+
+- if (!skb->input_dev)
+- skb->input_dev = skb->dev;
++ if (!skb->iif)
++ skb->iif = skb->dev->ifindex;
+
+ orig_dev = skb_bond(skb);
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -497,7 +497,7 @@ struct sk_buff *skb_clone(struct sk_buff
+ n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
+ n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
+ n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
+- C(input_dev);
++ C(iif);
+ #endif
+ skb_copy_secmark(n, skb);
+ #endif
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -199,7 +199,7 @@ bad_mirred:
+ skb2->tc_verd = SET_TC_FROM(skb2->tc_verd, at);
+
+ skb2->dev = dev;
+- skb2->input_dev = skb->dev;
++ skb2->iif = skb->dev->ifindex;
+ dev_queue_xmit(skb2);
+ spin_unlock(&m->tcf_lock);
+ return m->tcf_action;
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007
+Message-Id: <20070411224444.246228016@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@stusta.de,
+ YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>,
+ Sridhar Samudrala <sri@us.ibm.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 15/31] Fix length validation in rawv6_sendmsg()
+Content-Disposition: inline; filename=fix-length-validation-in-rawv6_sendmsg.patch
+Content-Length: 2073
+Lines: 67
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+
+[IPv6]: Fix incorrect length check in rawv6_sendmsg()
+
+In article <20070329.142644.70222545.davem@davemloft.net> (at Thu, 29 Mar 2007 14:26:44 -0700 (PDT)), David Miller <davem@davemloft.net> says:
+
+> From: Sridhar Samudrala <sri@us.ibm.com>
+> Date: Thu, 29 Mar 2007 14:17:28 -0700
+>
+> > The check for length in rawv6_sendmsg() is incorrect.
+> > As len is an unsigned int, (len < 0) will never be TRUE.
+> > I think checking for IPV6_MAXPLEN(65535) is better.
+> >
+> > Is it possible to send ipv6 jumbo packets using raw
+> > sockets? If so, we can remove this check.
+>
+> I don't see why such a limitation against jumbo would exist,
+> does anyone else?
+>
+> Thanks for catching this Sridhar. A good compiler should simply
+> fail to compile "if (x < 0)" when 'x' is an unsigned type, don't
+> you think :-)
+
+Dave, we use "int" for returning value,
+so we should fix this anyway, IMHO;
+we should not allow len > INT_MAX.
+
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Acked-by: Sridhar Samudrala <sri@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/raw.c | 4 ++--
+ net/ipv6/udp.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -688,9 +688,9 @@ static int rawv6_sendmsg(struct kiocb *i
+ int err;
+
+ /* Rough check on arithmetic overflow,
+- better check is made in ip6_build_xmit
++ better check is made in ip6_append_data().
+ */
+- if (len < 0)
++ if (len > INT_MAX)
+ return -EMSGSIZE;
+
+ /* Mirror BSD error message compatibility */
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -616,7 +616,7 @@ do_udp_sendmsg:
+ return udp_sendmsg(iocb, sk, msg, len);
+
+ /* Rough check on arithmetic overflow,
+- better check is made in ip6_build_xmit
++ better check is made in ip6_append_data().
+ */
+ if (len > INT_MAX - sizeof(struct udphdr))
+ return -EMSGSIZE;
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007
+Message-Id: <20070411224444.399845095@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@stusta.de,
+ "David S. Miller" <davem@davemloft.net>,
+ Christoph Hellwig <hch@lst.de>
+Subject: [patch 16/31] Fix scsi sense handling
+Content-Disposition: inline; filename=fix-scsi-sense-handling.patch
+Content-Length: 1950
+Lines: 59
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Miller <davem@davemloft.net>
+
+[SCSI]: Fix scsi_send_eh_cmnd scatterlist handling
+
+This fixes a regression caused by commit:
+
+2dc611de5a3fd955cd0298c50691d4c05046db97
+
+The sense buffer code in scsi_send_eh_cmnd was changed to use
+alloc_page() and a scatter list, but the sense data copy was not
+updated to match so what we actually get in the sense buffer is total
+grabage starting with the kernel address of the struct page we got.
+Basically the stack frame of scsi_send_eh_cmd() is what ends up
+in the sense buffer.
+
+Depending upon how pointers look on a given platform, you can
+end up getting sr_ioctl.c errors when you mount a cdrom. If
+the CDROM gives a check condition for GPCMD_GET_CONFIGURATION issued
+by drivers/cdrom/cdrom.c:cdrom_mmc_profile(), sr_ioctl will
+spit out this error message in sr_do_ioctl() with the way pointers
+are on sparc64:
+
+ default:
+ printk(KERN_ERR "%s: CDROM (ioctl) error, command: ", cd->cdi.name);
+ __scsi_print_command(cgc->cmd);
+ scsi_print_sense_hdr("sr", &sshdr);
+ err = -EIO;
+
+This is the error Tom Callaway reported in:
+
+http://marc.info/?l=linux-sparc&m=117407453208101&w=2
+
+Anyways, fix this by using page_address(sgl.page) which is OK
+because we know this is low-mem due to GFP_ATOMIC.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_error.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -595,7 +595,7 @@ static int scsi_send_eh_cmnd(struct scsi
+ */
+ if (copy_sense) {
+ if (!SCSI_SENSE_VALID(scmd)) {
+- memcpy(scmd->sense_buffer, scmd->request_buffer,
++ memcpy(scmd->sense_buffer, page_address(sgl.page),
+ sizeof(scmd->sense_buffer));
+ }
+ __free_page(sgl.page);
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007
+Message-Id: <20070411224444.514282403@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@stusta.de,
+ John Heffner <jheffner@psc.edu>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 17/31] Fix TCP receiver side SWS handling.
+Content-Disposition: inline; filename=fix-tcp-receiver-side-sws-handling.patch
+Content-Length: 766
+Lines: 29
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: John Heffner <jheffner@psc.edu>
+
+[TCP]: Do receiver-side SWS avoidance for rcvbuf < MSS.
+
+Signed-off-by: John Heffner <jheffner@psc.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1607,6 +1607,9 @@ u32 __tcp_select_window(struct sock *sk)
+ */
+ if (window <= free_space - mss || window > free_space)
+ window = (free_space/mss)*mss;
++ else if (mss == full_space &&
++ free_space > window + full_space/2)
++ window = free_space;
+ }
+
+ return window;
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007
+Message-Id: <20070411224444.646502258@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@stusta.de,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 18/31] Fix IPSEC replay window handling
+Content-Disposition: inline; filename=fix-ipsec-replay-window-handling.patch
+Content-Length: 1101
+Lines: 36
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[IPSEC]: Reject packets within replay window but outside the bit mask
+
+Up until this point we've accepted replay window settings greater than
+32 but our bit mask can only accomodate 32 packets. Thus any packet
+with a sequence number within the window but outside the bit mask would
+be accepted.
+
+This patch causes those packets to be rejected instead.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/xfrm/xfrm_state.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -1220,7 +1220,8 @@ int xfrm_replay_check(struct xfrm_state
+ return 0;
+
+ diff = x->replay.seq - seq;
+- if (diff >= x->props.replay_window) {
++ if (diff >= min_t(unsigned int, x->props.replay_window,
++ sizeof(x->replay.bitmap) * 8)) {
+ x->stats.replay_window++;
+ return -EINVAL;
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007
+Message-Id: <20070411224444.785571226@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@stusta.de,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 19/31] Fix tcindex classifier ABI borkage...
+Content-Disposition: inline; filename=fix-tcindex-classifier-abi-borkage.patch
+Content-Length: 1107
+Lines: 37
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+[NET_SCHED]: cls_tcindex: fix compatibility breakage
+
+Userspace uses an integer for TCA_TCINDEX_SHIFT, the kernel was changed
+to expect and use a u16 value in 2.6.11, which broke compatibility on
+big endian machines. Change back to use int.
+
+Reported by Ole Reinartz <ole.reinartz@gmx.de>
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/cls_tcindex.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -245,9 +245,9 @@ tcindex_set_parms(struct tcf_proto *tp,
+ }
+
+ if (tb[TCA_TCINDEX_SHIFT-1]) {
+- if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(u16))
++ if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(int))
+ goto errout;
+- cp.shift = *(u16 *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]);
++ cp.shift = *(int *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]);
+ }
+
+ err = -EBUSY;
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007
+Message-Id: <20070411224444.913292430@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@stusta.de,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 20/31] Fix TCP slow_start_after_idle sysctl
+Content-Disposition: inline; filename=fix-tcp-slow_start_after_idle-sysctl.patch
+Content-Length: 1299
+Lines: 40
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Miller <davem@davemloft.net>
+
+[TCP]: slow_start_after_idle should influence cwnd validation too
+
+For the cases that slow_start_after_idle are meant to deal
+with, it is almost a certainty that the congestion window
+tests will think the connection is application limited and
+we'll thus decrease the cwnd there too. This defeats the
+whole point of setting slow_start_after_idle to zero.
+
+So test it there too.
+
+We do not cancel out the entire tcp_cwnd_validate() function
+so that if the sysctl is changed we still have the validation
+state maintained.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -943,7 +943,8 @@ static void tcp_cwnd_validate(struct soc
+ if (tp->packets_out > tp->snd_cwnd_used)
+ tp->snd_cwnd_used = tp->packets_out;
+
+- if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
++ if (sysctl_tcp_slow_start_after_idle &&
++ (s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
+ tcp_cwnd_application_limited(sk);
+ }
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007
+Message-Id: <20070411224445.056776232@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Suleiman Souhlal <suleiman@google.com>,
+ Alan Cox <alan@redhat.com>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Subject: [patch 21/31] ide: use correct IDE error recovery
+Content-Disposition: inline; filename=ide-use-correct-ide-error-recovery.patch
+Content-Length: 4000
+Lines: 114
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Suleiman Souhlal <suleiman@google.com>
+
+ide: use correct IDE error recovery
+
+IDE error recovery is using IDLE IMMEDIATE if the drive is busy or has DRQ set.
+This violates the ATA spec (can only send IDLEÂ IMMEDIATE when drive is not
+busy) and really hoses up some drives (modern drives will not be able to
+recover using this error handling). The correct thing to do is issue a SRST
+followed by a SET FEATURES command. This is what Western Digital recommends
+for error recovery and what Western Digital says Windows does.  It also does
+not violate the ATA spec as far as I can tell.
+
+Bart:
+* port the patch over the current tree
+* undo the recalibration code removal
+* send SET FEATURES command after checking for good drive status
+* don't check whether the current request is of REQ_TYPE_ATA_{CMD,TASK}
+ type because we need to send SET FEATURES before handling any requests
+* some pre-ATA4 drives require INITIALIZE DEVICE PARAMETERS command before
+ other commands (except IDENTIFY) so send SET FEATURES only if there are
+ no pending drive->special requests
+* update comments and patch description
+* any bugs introduced by this patch are mine and not Suleiman's :-)
+
+Signed-off-by: Suleiman Souhlal <suleiman@google.com>
+Acked-by: Alan Cox <alan@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+
+---
+ drivers/ide/ide-io.c | 32 +++++++++++++++++++++-----------
+ drivers/ide/ide-iops.c | 3 +++
+ include/linux/ide.h | 1 +
+ 3 files changed, 25 insertions(+), 11 deletions(-)
+
+--- a/drivers/ide/ide-io.c
++++ b/drivers/ide/ide-io.c
+@@ -519,21 +519,24 @@ static ide_startstop_t ide_ata_error(ide
+ if ((stat & DRQ_STAT) && rq_data_dir(rq) == READ && hwif->err_stops_fifo == 0)
+ try_to_flush_leftover_data(drive);
+
++ if (rq->errors >= ERROR_MAX || blk_noretry_request(rq)) {
++ ide_kill_rq(drive, rq);
++ return ide_stopped;
++ }
++
+ if (hwif->INB(IDE_STATUS_REG) & (BUSY_STAT|DRQ_STAT))
+- /* force an abort */
+- hwif->OUTB(WIN_IDLEIMMEDIATE, IDE_COMMAND_REG);
++ rq->errors |= ERROR_RESET;
+
+- if (rq->errors >= ERROR_MAX || blk_noretry_request(rq))
+- ide_kill_rq(drive, rq);
+- else {
+- if ((rq->errors & ERROR_RESET) == ERROR_RESET) {
+- ++rq->errors;
+- return ide_do_reset(drive);
+- }
+- if ((rq->errors & ERROR_RECAL) == ERROR_RECAL)
+- drive->special.b.recalibrate = 1;
++ if ((rq->errors & ERROR_RESET) == ERROR_RESET) {
+ ++rq->errors;
++ return ide_do_reset(drive);
+ }
++
++ if ((rq->errors & ERROR_RECAL) == ERROR_RECAL)
++ drive->special.b.recalibrate = 1;
++
++ ++rq->errors;
++
+ return ide_stopped;
+ }
+
+@@ -1025,6 +1028,13 @@ static ide_startstop_t start_request (id
+ if (!drive->special.all) {
+ ide_driver_t *drv;
+
++ /*
++ * We reset the drive so we need to issue a SETFEATURES.
++ * Do it _after_ do_special() restored device parameters.
++ */
++ if (drive->current_speed == 0xff)
++ ide_config_drive_speed(drive, drive->desired_speed);
++
+ if (rq->cmd_type == REQ_TYPE_ATA_CMD ||
+ rq->cmd_type == REQ_TYPE_ATA_TASK ||
+ rq->cmd_type == REQ_TYPE_ATA_TASKFILE)
+--- a/drivers/ide/ide-iops.c
++++ b/drivers/ide/ide-iops.c
+@@ -1123,6 +1123,9 @@ static void pre_reset(ide_drive_t *drive
+ if (HWIF(drive)->pre_reset != NULL)
+ HWIF(drive)->pre_reset(drive);
+
++ if (drive->current_speed != 0xff)
++ drive->desired_speed = drive->current_speed;
++ drive->current_speed = 0xff;
+ }
+
+ /*
+--- a/include/linux/ide.h
++++ b/include/linux/ide.h
+@@ -607,6 +607,7 @@ typedef struct ide_drive_s {
+ u8 init_speed; /* transfer rate set at boot */
+ u8 pio_speed; /* unused by core, used by some drivers for fallback from DMA */
+ u8 current_speed; /* current transfer rate set */
++ u8 desired_speed; /* desired transfer rate set */
+ u8 dn; /* now wide spread use */
+ u8 wcache; /* status of write cache */
+ u8 acoustic; /* acoustic management */
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007
+Message-Id: <20070411224445.238678482@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:51 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Neil Brown <neilb@suse.de>
+Subject: [patch 22/31] knfsd: allow nfsd READDIR to return 64bit cookies
+Content-Disposition: inline; filename=knfsd-allow-nfsd-readdir-to-return-64bit-cookies.patch
+Content-Length: 1600
+Lines: 46
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Neil Brown <neilb@suse.de>
+
+[PATCH] knfsd: allow nfsd READDIR to return 64bit cookies
+
+->readdir passes lofft_t offsets (used as nfs cookies) to
+nfs3svc_encode_entry{,_plus}, but when they pass it on to encode_entry it
+becomes an 'off_t', which isn't good.
+
+So filesystems that returned 64bit offsets would lose.
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfsd/nfs3xdr.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/nfsd/nfs3xdr.c
++++ b/fs/nfsd/nfs3xdr.c
+@@ -844,8 +844,8 @@ compose_entry_fh(struct nfsd3_readdirres
+ #define NFS3_ENTRY_BAGGAGE (2 + 1 + 2 + 1)
+ #define NFS3_ENTRYPLUS_BAGGAGE (1 + 21 + 1 + (NFS3_FHSIZE >> 2))
+ static int
+-encode_entry(struct readdir_cd *ccd, const char *name,
+- int namlen, off_t offset, ino_t ino, unsigned int d_type, int plus)
++encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
++ loff_t offset, ino_t ino, unsigned int d_type, int plus)
+ {
+ struct nfsd3_readdirres *cd = container_of(ccd, struct nfsd3_readdirres,
+ common);
+@@ -865,7 +865,7 @@ encode_entry(struct readdir_cd *ccd, con
+ *cd->offset1 = htonl(offset64 & 0xffffffff);
+ cd->offset1 = NULL;
+ } else {
+- xdr_encode_hyper(cd->offset, (u64) offset);
++ xdr_encode_hyper(cd->offset, offset64);
+ }
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007
+Message-Id: <20070411224445.324833413@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:52 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 23/31] softmac: avoid assert in ieee80211softmac_wx_get_rate
+Content-Disposition: inline; filename=softmac-avoid-assert-in-ieee80211softmac_wx_get_rate.patch
+Content-Length: 1251
+Lines: 44
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: John W. Linville <linville@tuxdriver.com>
+
+[PATCH] softmac: avoid assert in ieee80211softmac_wx_get_rate
+
+Unconfigured bcm43xx device can hit an assert() during wx_get_rate
+queries. This is because bcm43xx calls ieee80211softmac_start late
+(i.e. during open instead of probe).
+
+ bcm43xx_net_open ->
+ bcm43xx_init_board ->
+ bcm43xx_select_wireless_core ->
+ ieee80211softmac_start
+
+Fix is to check that device is running before completing
+ieee80211softmac_wx_get_rate.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ieee80211/softmac/ieee80211softmac_wx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
++++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
+@@ -265,6 +265,12 @@ ieee80211softmac_wx_get_rate(struct net_
+ int err = -EINVAL;
+
+ spin_lock_irqsave(&mac->lock, flags);
++
++ if (unlikely(!mac->running)) {
++ err = -ENODEV;
++ goto out_unlock;
++ }
++
+ switch (mac->txrates.default_rate) {
+ case IEEE80211_CCK_RATE_1MB:
+ data->bitrate.value = 1000000;
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007
+Message-Id: <20070411224445.451781002@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark Lord <mlord@pobox.com>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 24/31] libata bugfix: preserve LBA bit for HDIO_DRIVE_TASK
+Content-Disposition: inline; filename=libata-bugfix-preserve-lba-bit-for-hdio_drive_task.patch
+Content-Length: 877
+Lines: 31
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mark Lord <mlord@pobox.com>
+
+libata bugfix: preserve LBA bit for HDIO_DRIVE_TASK
+
+Preserve the LBA bit in the DevSel/Head register for HDIO_DRIVE_TASK.
+
+Signed-off-by: Mark Lord <mlord@pobox.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-scsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -295,7 +295,7 @@ int ata_task_ioctl(struct scsi_device *s
+ scsi_cmd[8] = args[3];
+ scsi_cmd[10] = args[4];
+ scsi_cmd[12] = args[5];
+- scsi_cmd[13] = args[6] & 0x0f;
++ scsi_cmd[13] = args[6] & 0x4f;
+ scsi_cmd[14] = args[0];
+
+ /* Good values for timeout and retries? Values below
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007
+Message-Id: <20070411224445.582624050@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Conke Hu <conke.hu@amd.com>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 25/31] ahci.c: walkaround for SB600 SATA internal error issue
+Content-Disposition: inline; filename=ahci.c-walkaround-for-sb600-sata-internal-error-issue.patch
+Content-Length: 3611
+Lines: 105
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Conke Hu <conke.hu@gmail.com>
+
+ahci.c: walkaround for SB600 SATA internal error issue
+
+ There is a HW issue in ATI SB600 SATA that PxSERR.E should not be
+set on some conditions, for example, when there is no media in SATA
+CD/DVD drive or media is not ready, AHCI controller fails to execute
+ATAPI commands and reports PORT_IRQ_TF_ERR, but ATI SB600 SATA
+controller sets PxSERR.E at the
+same time, which is not necessary.
+ This patch is just to ignore the INTERNAL ERROR in such case.
+Without this patch, ahci error handler will report many errors as
+below:
+ ----------- cut from dmesg -----------
+ata9: soft resetting port
+ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
+ata9.00: configured for UDMA/33
+ata9: EH complete
+ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2
+ata9.00: (irq_stat 0x40000001)
+ata9.00: cmd a0/00:00:00:00:20/00:00:00:00:00/a0 tag 0 cdb 0x0 data 0
+ res 51/24:03:00:00:20/00:00:00:00:00/a0 Emask 0x40 (internal error)
+ata9: soft resetting port
+ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
+ata9.00: configured for UDMA/33
+ata9: EH complete
+ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2
+ata9.00: (irq_stat 0x40000001)
+ata9.00: cmd a0/01:00:00:00:00/00:00:00:00:00/a0 tag 0 cdb 0x43 data 12 in
+ res 51/24:03:00:00:00/00:00:00:00:00/a0 Emask 0x40 (internal error)
+ -------- end cut ---------
+
+Signed-off-by: Conke Hu <conke.hu@amd.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -82,6 +82,7 @@ enum {
+ board_ahci_pi = 1,
+ board_ahci_vt8251 = 2,
+ board_ahci_ign_iferr = 3,
++ board_ahci_sb600 = 4,
+
+ /* global controller registers */
+ HOST_CAP = 0x00, /* host capabilities */
+@@ -173,6 +174,7 @@ enum {
+ AHCI_FLAG_NO_NCQ = (1 << 24),
+ AHCI_FLAG_IGN_IRQ_IF_ERR = (1 << 25), /* ignore IRQ_IF_ERR */
+ AHCI_FLAG_HONOR_PI = (1 << 26), /* honor PORTS_IMPL */
++ AHCI_FLAG_IGN_SERR_INTERNAL = (1 << 27), /* ignore SERR_INTERNAL */
+ };
+
+ struct ahci_cmd_hdr {
+@@ -365,6 +367,18 @@ static const struct ata_port_info ahci_p
+ .udma_mask = 0x7f, /* udma0-6 ; FIXME */
+ .port_ops = &ahci_ops,
+ },
++ /* board_ahci_sb600 */
++ {
++ .sht = &ahci_sht,
++ .flags = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
++ ATA_FLAG_MMIO | ATA_FLAG_PIO_DMA |
++ ATA_FLAG_SKIP_D2H_BSY |
++ AHCI_FLAG_IGN_SERR_INTERNAL,
++ .pio_mask = 0x1f, /* pio0-4 */
++ .udma_mask = 0x7f, /* udma0-6 ; FIXME */
++ .port_ops = &ahci_ops,
++ },
++
+ };
+
+ static const struct pci_device_id ahci_pci_tbl[] = {
+@@ -404,7 +418,7 @@ static const struct pci_device_id ahci_p
+ { PCI_VDEVICE(JMICRON, 0x2366), board_ahci_ign_iferr }, /* JMB366 */
+
+ /* ATI */
+- { PCI_VDEVICE(ATI, 0x4380), board_ahci }, /* ATI SB600 non-raid */
++ { PCI_VDEVICE(ATI, 0x4380), board_ahci_sb600 }, /* ATI SB600 non-raid */
+ { PCI_VDEVICE(ATI, 0x4381), board_ahci }, /* ATI SB600 raid */
+
+ /* VIA */
+@@ -1076,8 +1090,11 @@ static void ahci_error_intr(struct ata_p
+ if (ap->flags & AHCI_FLAG_IGN_IRQ_IF_ERR)
+ irq_stat &= ~PORT_IRQ_IF_ERR;
+
+- if (irq_stat & PORT_IRQ_TF_ERR)
++ if (irq_stat & PORT_IRQ_TF_ERR) {
+ err_mask |= AC_ERR_DEV;
++ if (ap->flags & AHCI_FLAG_IGN_SERR_INTERNAL)
++ serror &= ~SERR_INTERNAL;
++ }
+
+ if (irq_stat & (PORT_IRQ_HBUS_ERR | PORT_IRQ_HBUS_DATA_ERR)) {
+ err_mask |= AC_ERR_HOST_BUS;
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007
+Message-Id: <20070411224445.715519736@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark Lord <mlord@pobox.com>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 26/31] fix lba48 bug in libata fill_result_tf()
+Content-Disposition: inline; filename=fix-lba48-bug-in-libata-fill_result_tf.patch
+Content-Length: 1736
+Lines: 65
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mark Lord <liml@rtr.ca>
+
+2.6.21 fix lba48 bug in libata fill_result_tf()
+
+Current 2.6.21 libata does the following:
+
+void ata_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
+{
+ struct ata_ioports *ioaddr = &ap->ioaddr;
+
+ tf->command = ata_check_status(ap);
+ ...
+ if (tf->flags & ATA_TFLAG_LBA48) {
+ iowrite8(tf->ctl | ATA_HOB, ioaddr->ctl_addr);
+ tf->hob_feature = ioread8(ioaddr->error_addr);
+ ...
+ }
+}
+...
+static void fill_result_tf(struct ata_queued_cmd *qc)
+{
+ struct ata_port *ap = qc->ap;
+
+ ap->ops->tf_read(ap, &qc->result_tf);
+ qc->result_tf.flags = qc->tf.flags;
+}
+
+Based on this, those last two statements fill_result_tf()
+appear to me to be in the wrong order, in that the tf->flags
+are uninitialized at the point where tf_read() is invoked.
+So for lba48 commands, tf_read() won't be reading back the
+full lba48 register contents..
+
+Correct?
+
+This patch corrects fill_result_tf() so that the flags
+get copied to result_tf before they are used by tf_read().
+
+Signed-off-by: Mark Lord <mlord@pobox.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+---
+ drivers/ata/libata-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4742,8 +4742,8 @@ static void fill_result_tf(struct ata_qu
+ {
+ struct ata_port *ap = qc->ap;
+
+- ap->ops->tf_read(ap, &qc->result_tf);
+ qc->result_tf.flags = qc->tf.flags;
++ ap->ops->tf_read(ap, &qc->result_tf);
+ }
+
+ /**
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007
+Message-Id: <20070411224445.861070984@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Albert Lee <albertcc@tw.ibm.com>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 27/31] libata: Clear tf before doing request sense (take 3)
+Content-Disposition: inline; filename=libata-clear-tf-before-doing-request-sense.patch
+Content-Length: 2155
+Lines: 73
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Albert Lee <albertcc@tw.ibm.com>
+
+libata: Clear tf before doing request sense (take 3)
+
+patch 2/4:
+ Clear tf before doing request sense.
+
+This fixes the AOpen 56X/AKH timeout problem.
+(http://bugzilla.kernel.org/show_bug.cgi?id=8244)
+
+Signed-off-by: Albert Lee <albertcc@tw.ibm.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-eh.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -954,26 +954,27 @@ static int ata_eh_read_log_10h(struct at
+ * RETURNS:
+ * 0 on success, AC_ERR_* mask on failure
+ */
+-static unsigned int atapi_eh_request_sense(struct ata_device *dev,
+- unsigned char *sense_buf)
++static unsigned int atapi_eh_request_sense(struct ata_queued_cmd *qc)
+ {
++ struct ata_device *dev = qc->dev;
++ unsigned char *sense_buf = qc->scsicmd->sense_buffer;
+ struct ata_port *ap = dev->ap;
+ struct ata_taskfile tf;
+ u8 cdb[ATAPI_CDB_LEN];
+
+ DPRINTK("ATAPI request sense\n");
+
+- ata_tf_init(dev, &tf);
+-
+ /* FIXME: is this needed? */
+ memset(sense_buf, 0, SCSI_SENSE_BUFFERSIZE);
+
+- /* XXX: why tf_read here? */
+- ap->ops->tf_read(ap, &tf);
+-
+- /* fill these in, for the case where they are -not- overwritten */
++ /* initialize sense_buf with the error register,
++ * for the case where they are -not- overwritten
++ */
+ sense_buf[0] = 0x70;
+- sense_buf[2] = tf.feature >> 4;
++ sense_buf[2] = qc->result_tf.feature >> 4;
++
++ /* some devices time out if garbage left in tf */
++ ata_tf_init(dev, &tf);
+
+ memset(cdb, 0, ATAPI_CDB_LEN);
+ cdb[0] = REQUEST_SENSE;
+@@ -1137,8 +1138,7 @@ static unsigned int ata_eh_analyze_tf(st
+
+ case ATA_DEV_ATAPI:
+ if (!(qc->ap->pflags & ATA_PFLAG_FROZEN)) {
+- tmp = atapi_eh_request_sense(qc->dev,
+- qc->scsicmd->sense_buffer);
++ tmp = atapi_eh_request_sense(qc);
+ if (!tmp) {
+ /* ATA_QCFLAG_SENSE_VALID is used to
+ * tell atapi_qc_complete() that sense
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:46 2007
+Message-Id: <20070411224446.003103662@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ dev@openvz.org,
+ kenneth.w.chen@intel.com,
+ saw@sw.ru,
+ dmonakhov@openvz.org,
+ linux-ext4@vger.kernel.org,
+ mingo@elte.hu
+Subject: [patch 28/31] revert "retries in ext3_prepare_write() violate ordering requirements"
+Content-Disposition: inline; filename=revert-retries-in-ext3_prepare_write-violate-ordering-requirements.patch
+Content-Length: 5111
+Lines: 170
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+Revert e92a4d595b464c4aae64be39ca61a9ffe9c8b278.
+
+Dmitry points out
+
+"When we block_prepare_write() failed while ext3_prepare_write() we jump to
+ "failure" label and call ext3_prepare_failure() witch search last mapped bh
+ and invoke commit_write untill it. This is wrong!! because some bh from
+ begining to the last mapped bh may be not uptodate. As a result we commit to
+ disk not uptodate page content witch contains garbage from previous usage."
+
+and
+
+"Unexpected file size increasing."
+
+ Call trace the same as it was in first issue but result is different.
+ For example we have file with i_size is zero. we want write two blocks ,
+ but fs has only one free block.
+
+ ->ext3_prepare_write(...from == 0, to == 2048)
+ retry:
+ ->block_prepare_write() == -ENOSPC# we failed but allocated one block here.
+ ->ext3_prepare_failure()
+ ->commit_write( from == 0, to == 1024) # after this i_size becomes 1024 :)
+ if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
+ goto retry;
+
+ Finally when all retries will be spended ext3_prepare_failure return
+ -ENOSPC, but i_size was increased and later block trimm procedures can't
+ help here.
+
+We don't appear to have the horsepower to fix these issues, so let's put
+things back the way they were for now.
+
+Cc: Kirill Korotaev <dev@openvz.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Ken Chen <kenneth.w.chen@intel.com>
+Cc: Andrey Savochkin <saw@sw.ru>
+Cc: <linux-ext4@vger.kernel.org>
+Cc: Dmitriy Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ fs/ext3/inode.c | 85 ++++++--------------------------------------------------
+ 1 file changed, 10 insertions(+), 75 deletions(-)
+
+--- a/fs/ext3/inode.c
++++ b/fs/ext3/inode.c
+@@ -1148,102 +1148,37 @@ static int do_journal_get_write_access(h
+ return ext3_journal_get_write_access(handle, bh);
+ }
+
+-/*
+- * The idea of this helper function is following:
+- * if prepare_write has allocated some blocks, but not all of them, the
+- * transaction must include the content of the newly allocated blocks.
+- * This content is expected to be set to zeroes by block_prepare_write().
+- * 2006/10/14 SAW
+- */
+-static int ext3_prepare_failure(struct file *file, struct page *page,
+- unsigned from, unsigned to)
+-{
+- struct address_space *mapping;
+- struct buffer_head *bh, *head, *next;
+- unsigned block_start, block_end;
+- unsigned blocksize;
+- int ret;
+- handle_t *handle = ext3_journal_current_handle();
+-
+- mapping = page->mapping;
+- if (ext3_should_writeback_data(mapping->host)) {
+- /* optimization: no constraints about data */
+-skip:
+- return ext3_journal_stop(handle);
+- }
+-
+- head = page_buffers(page);
+- blocksize = head->b_size;
+- for ( bh = head, block_start = 0;
+- bh != head || !block_start;
+- block_start = block_end, bh = next)
+- {
+- next = bh->b_this_page;
+- block_end = block_start + blocksize;
+- if (block_end <= from)
+- continue;
+- if (block_start >= to) {
+- block_start = to;
+- break;
+- }
+- if (!buffer_mapped(bh))
+- /* prepare_write failed on this bh */
+- break;
+- if (ext3_should_journal_data(mapping->host)) {
+- ret = do_journal_get_write_access(handle, bh);
+- if (ret) {
+- ext3_journal_stop(handle);
+- return ret;
+- }
+- }
+- /*
+- * block_start here becomes the first block where the current iteration
+- * of prepare_write failed.
+- */
+- }
+- if (block_start <= from)
+- goto skip;
+-
+- /* commit allocated and zeroed buffers */
+- return mapping->a_ops->commit_write(file, page, from, block_start);
+-}
+-
+ static int ext3_prepare_write(struct file *file, struct page *page,
+ unsigned from, unsigned to)
+ {
+ struct inode *inode = page->mapping->host;
+- int ret, ret2;
+- int needed_blocks = ext3_writepage_trans_blocks(inode);
++ int ret, needed_blocks = ext3_writepage_trans_blocks(inode);
+ handle_t *handle;
+ int retries = 0;
+
+ retry:
+ handle = ext3_journal_start(inode, needed_blocks);
+- if (IS_ERR(handle))
+- return PTR_ERR(handle);
++ if (IS_ERR(handle)) {
++ ret = PTR_ERR(handle);
++ goto out;
++ }
+ if (test_opt(inode->i_sb, NOBH) && ext3_should_writeback_data(inode))
+ ret = nobh_prepare_write(page, from, to, ext3_get_block);
+ else
+ ret = block_prepare_write(page, from, to, ext3_get_block);
+ if (ret)
+- goto failure;
++ goto prepare_write_failed;
+
+ if (ext3_should_journal_data(inode)) {
+ ret = walk_page_buffers(handle, page_buffers(page),
+ from, to, NULL, do_journal_get_write_access);
+- if (ret)
+- /* fatal error, just put the handle and return */
+- journal_stop(handle);
+ }
+- return ret;
+-
+-failure:
+- ret2 = ext3_prepare_failure(file, page, from, to);
+- if (ret2 < 0)
+- return ret2;
++prepare_write_failed:
++ if (ret)
++ ext3_journal_stop(handle);
+ if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
+ goto retry;
+- /* retry number exceeded, or other error like -EDQUOT */
++out:
+ return ret;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:46 2007
+Message-Id: <20070411224446.133153537@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ dev@openvz.org,
+ kenneth.w.chen@intel.com,
+ saw@sw.ru,
+ dmonakhov@openvz.org,
+ linux-ext4@vger.kernel.org,
+ mingo@elte.hu
+Subject: [patch 29/31] revert "retries in ext4_prepare_write() violate ordering requirements"
+Content-Disposition: inline; filename=revert-retries-in-ext4_prepare_write-violate-ordering-requirements.patch
+Content-Length: 3885
+Lines: 138
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+Revert b46be05004abb419e303e66e143eed9f8a6e9f3f. Same reasoning as for ext3.
+
+Cc: Kirill Korotaev <dev@openvz.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Ken Chen <kenneth.w.chen@intel.com>
+Cc: Andrey Savochkin <saw@sw.ru>
+Cc: <linux-ext4@vger.kernel.org>
+Cc: Dmitriy Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext4/inode.c | 85 ++++++--------------------------------------------------
+ 1 file changed, 10 insertions(+), 75 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1147,102 +1147,37 @@ static int do_journal_get_write_access(h
+ return ext4_journal_get_write_access(handle, bh);
+ }
+
+-/*
+- * The idea of this helper function is following:
+- * if prepare_write has allocated some blocks, but not all of them, the
+- * transaction must include the content of the newly allocated blocks.
+- * This content is expected to be set to zeroes by block_prepare_write().
+- * 2006/10/14 SAW
+- */
+-static int ext4_prepare_failure(struct file *file, struct page *page,
+- unsigned from, unsigned to)
+-{
+- struct address_space *mapping;
+- struct buffer_head *bh, *head, *next;
+- unsigned block_start, block_end;
+- unsigned blocksize;
+- int ret;
+- handle_t *handle = ext4_journal_current_handle();
+-
+- mapping = page->mapping;
+- if (ext4_should_writeback_data(mapping->host)) {
+- /* optimization: no constraints about data */
+-skip:
+- return ext4_journal_stop(handle);
+- }
+-
+- head = page_buffers(page);
+- blocksize = head->b_size;
+- for ( bh = head, block_start = 0;
+- bh != head || !block_start;
+- block_start = block_end, bh = next)
+- {
+- next = bh->b_this_page;
+- block_end = block_start + blocksize;
+- if (block_end <= from)
+- continue;
+- if (block_start >= to) {
+- block_start = to;
+- break;
+- }
+- if (!buffer_mapped(bh))
+- /* prepare_write failed on this bh */
+- break;
+- if (ext4_should_journal_data(mapping->host)) {
+- ret = do_journal_get_write_access(handle, bh);
+- if (ret) {
+- ext4_journal_stop(handle);
+- return ret;
+- }
+- }
+- /*
+- * block_start here becomes the first block where the current iteration
+- * of prepare_write failed.
+- */
+- }
+- if (block_start <= from)
+- goto skip;
+-
+- /* commit allocated and zeroed buffers */
+- return mapping->a_ops->commit_write(file, page, from, block_start);
+-}
+-
+ static int ext4_prepare_write(struct file *file, struct page *page,
+ unsigned from, unsigned to)
+ {
+ struct inode *inode = page->mapping->host;
+- int ret, ret2;
+- int needed_blocks = ext4_writepage_trans_blocks(inode);
++ int ret, needed_blocks = ext4_writepage_trans_blocks(inode);
+ handle_t *handle;
+ int retries = 0;
+
+ retry:
+ handle = ext4_journal_start(inode, needed_blocks);
+- if (IS_ERR(handle))
+- return PTR_ERR(handle);
++ if (IS_ERR(handle)) {
++ ret = PTR_ERR(handle);
++ goto out;
++ }
+ if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode))
+ ret = nobh_prepare_write(page, from, to, ext4_get_block);
+ else
+ ret = block_prepare_write(page, from, to, ext4_get_block);
+ if (ret)
+- goto failure;
++ goto prepare_write_failed;
+
+ if (ext4_should_journal_data(inode)) {
+ ret = walk_page_buffers(handle, page_buffers(page),
+ from, to, NULL, do_journal_get_write_access);
+- if (ret)
+- /* fatal error, just put the handle and return */
+- ext4_journal_stop(handle);
+ }
+- return ret;
+-
+-failure:
+- ret2 = ext4_prepare_failure(file, page, from, to);
+- if (ret2 < 0)
+- return ret2;
++prepare_write_failed:
++ if (ret)
++ ext4_journal_stop(handle);
+ if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
+ goto retry;
+- /* retry number exceeded, or other error like -EDQUOT */
++out:
+ return ret;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:46 2007
+Message-Id: <20070411224446.270725842@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:43:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ nickpiggin@yahoo.com.au,
+ bapper@mvista.com,
+ bapper@piratehaven.org,
+ dhowells@redhat.com,
+ hugh@veritas.com
+Subject: [patch 30/31] fix page leak during core dump
+Content-Disposition: inline; filename=fix-page-leak-during-core-dump.patch
+Content-Length: 1473
+Lines: 51
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Brian Pomerantz <bapper@piratehaven.org>
+
+When the dump cannot occur most likely because of a full file system and
+the page to be written is the zero page, the call to page_cache_release()
+is missed.
+
+Signed-off-by: Brian Pomerantz <bapper@mvista.com>
+Cc: Hugh Dickins <hugh@veritas.com>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Cc: David Howells <dhowells@redhat.com>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_elf.c | 5 ++++-
+ fs/binfmt_elf_fdpic.c | 2 +-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1704,7 +1704,10 @@ static int elf_core_dump(long signr, str
+ DUMP_SEEK(PAGE_SIZE);
+ } else {
+ if (page == ZERO_PAGE(addr)) {
+- DUMP_SEEK(PAGE_SIZE);
++ if (!dump_seek(file, PAGE_SIZE)) {
++ page_cache_release(page);
++ goto end_coredump;
++ }
+ } else {
+ void *kaddr;
+ flush_cache_page(vma, addr,
+--- a/fs/binfmt_elf_fdpic.c
++++ b/fs/binfmt_elf_fdpic.c
+@@ -1473,8 +1473,8 @@ static int elf_fdpic_dump_segments(struc
+ DUMP_SEEK(file->f_pos + PAGE_SIZE);
+ }
+ else if (page == ZERO_PAGE(addr)) {
+- DUMP_SEEK(file->f_pos + PAGE_SIZE);
+ page_cache_release(page);
++ DUMP_SEEK(file->f_pos + PAGE_SIZE);
+ }
+ else {
+ void *kaddr;
+
+--
+
+From gregkh@mini.kroah.org Wed Apr 11 15:44:46 2007
+Message-Id: <20070411224446.438697978@mini.kroah.org>
+References: <20070411224329.866978349@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 11 Apr 2007 15:44:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 31/31] Update libata drive blacklist to the latest from 2.6.21
+Content-Disposition: inline; filename=update-libata-drive-blacklist-to-the-latest-from-2.6.21.patch
+Content-Length: 1926
+Lines: 48
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+Update libata drive blacklist to the latest from 2.6.21
+
+Removes one duplicate entry from blacklist table, adds several
+entries for drives with broken NCQ.
+
+[diff between 2.6.20 and 2.6.21-rc6, with one entry removed
+ that required new libata features]
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3316,7 +3316,6 @@ static const struct ata_blacklist_entry
+ { "WPI CDD-820", NULL, ATA_HORKAGE_NODMA },
+ { "SAMSUNG CD-ROM SC-148C", NULL, ATA_HORKAGE_NODMA },
+ { "SAMSUNG CD-ROM SC", NULL, ATA_HORKAGE_NODMA },
+- { "SanDisk SDP3B-64", NULL, ATA_HORKAGE_NODMA },
+ { "ATAPI CD-ROM DRIVE 40X MAXIMUM",NULL,ATA_HORKAGE_NODMA },
+ { "_NEC DV5800A", NULL, ATA_HORKAGE_NODMA },
+ { "SAMSUNG CD-ROM SN-124","N001", ATA_HORKAGE_NODMA },
+@@ -3326,6 +3325,17 @@ static const struct ata_blacklist_entry
+ /* Devices where NCQ should be avoided */
+ /* NCQ is slow */
+ { "WDC WD740ADFD-00", NULL, ATA_HORKAGE_NONCQ },
++ /* http://thread.gmane.org/gmane.linux.ide/14907 */
++ { "FUJITSU MHT2060BH", NULL, ATA_HORKAGE_NONCQ },
++ /* NCQ is broken */
++ { "Maxtor 6L250S0", "BANC1G10", ATA_HORKAGE_NONCQ },
++ /* NCQ hard hangs device under heavier load, needs hard power cycle */
++ { "Maxtor 6B250S0", "BANC1B70", ATA_HORKAGE_NONCQ },
++ /* Blacklist entries taken from Silicon Image 3124/3132
++ Windows driver .inf file - also several Linux problem reports */
++ { "HTS541060G9SA00", "MB3OC60D", ATA_HORKAGE_NONCQ, },
++ { "HTS541080G9SA00", "MB4OC60D", ATA_HORKAGE_NONCQ, },
++ { "HTS541010G9SA00", "MBZOC60D", ATA_HORKAGE_NONCQ, },
+
+ /* Devices with NCQ limits */
+
+
+--
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
