--- /dev/null
+From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007
+Message-Id: <20070221013048.473359260@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:27:59 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Robert Hancock <hancockr@shaw.ca>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 01/21] V4L: cx88: Fix lockup on suspend
+Content-Disposition: inline; filename=V4L-cx88-Fix-lockup-on-suspend.patch
+Content-Length: 1264
+Lines: 39
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+Suspending with the cx88xx module loaded causes the system to lock up
+because the cx88_audio_thread kthread was missing a try_to_freeze()
+call, which caused it to go into a tight loop and result in softlockup
+when suspending. Fix that.
+
+(cherry picked from commit a96afb3e9428f2e7463344f12dbc85faf08e2e09)
+
+Signed-off-by: Robert Hancock <hancockr@shaw.ca>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx88/cx88-tvaudio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.19.4.orig/drivers/media/video/cx88/cx88-tvaudio.c
++++ linux-2.6.19.4/drivers/media/video/cx88/cx88-tvaudio.c
+@@ -38,6 +38,7 @@
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+ #include <linux/errno.h>
++#include <linux/freezer.h>
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/mm.h>
+@@ -974,6 +975,7 @@ int cx88_audio_thread(void *data)
+ msleep_interruptible(1000);
+ if (kthread_should_stop())
+ break;
++ try_to_freeze();
+
+ /* just monitor the audio status for now ... */
+ memset(&t, 0, sizeof(t));
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007
+Message-Id: <20070221013048.597676142@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:00 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Grant Likely <grant.likely@secretlab.ca>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 02/21] V4L: Fix quickcam communicator driver for big endian architectures
+Content-Disposition: inline; filename=V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch
+Content-Length: 1309
+Lines: 52
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+Host endianess does not affect the order that pixel rgb data comes
+in from the quickcam (the values are bytes, not words or longs). The
+driver is erroniously swapping the order of rgb values for big endian
+machines. This patch is needed get the Quickcam communicator working
+on big endian machines (tested on powerpc)
+
+(cherry picked from commit c6d704c8c4453f05717ba88792f70f8babf95268)
+
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/usbvideo/quickcam_messenger.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/media/video/usbvideo/quickcam_messenger.h
++++ linux-2.6.19.4/drivers/media/video/usbvideo/quickcam_messenger.h
+@@ -35,27 +35,13 @@ struct rgb {
+ };
+
+ struct bayL0 {
+-#ifdef __BIG_ENDIAN
+- u8 r;
+- u8 g;
+-#elif __LITTLE_ENDIAN
+ u8 g;
+ u8 r;
+-#else
+-#error not byte order defined
+-#endif
+ };
+
+ struct bayL1 {
+-#ifdef __BIG_ENDIAN
+- u8 g;
+- u8 b;
+-#elif __LITTLE_ENDIAN
+ u8 b;
+ u8 g;
+-#else
+-#error not byte order defined
+-#endif
+ };
+
+ struct cam_size {
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007
+Message-Id: <20070221013048.720648161@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:01 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Martin Samuelsson <sam@home.se>,
+ Andrew Morton <akpm@osdl.org>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 03/21] V4L: fix ks0127 status flags
+Content-Disposition: inline; filename=V4L-fix-ks0127-status-flags.patch
+Content-Length: 1350
+Lines: 39
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+Or status flags together in DECODER_GET_STATUS instead of and-zapping them.
+
+(cherry picked from commit 55d5440d4587454628a850ce26703639885af678)
+
+Signed-off-by: Martin Samuelsson <sam@home.se>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/ks0127.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/media/video/ks0127.c
++++ linux-2.6.19.4/drivers/media/video/ks0127.c
+@@ -712,13 +712,13 @@ static int ks0127_command(struct i2c_cli
+ *iarg = 0;
+ status = ks0127_read(ks, KS_STAT);
+ if (!(status & 0x20)) /* NOVID not set */
+- *iarg = (*iarg & DECODER_STATUS_GOOD);
++ *iarg = (*iarg | DECODER_STATUS_GOOD);
+ if ((status & 0x01)) /* CLOCK set */
+- *iarg = (*iarg & DECODER_STATUS_COLOR);
++ *iarg = (*iarg | DECODER_STATUS_COLOR);
+ if ((status & 0x08)) /* PALDET set */
+- *iarg = (*iarg & DECODER_STATUS_PAL);
++ *iarg = (*iarg | DECODER_STATUS_PAL);
+ else
+- *iarg = (*iarg & DECODER_STATUS_NTSC);
++ *iarg = (*iarg | DECODER_STATUS_NTSC);
+ break;
+
+ //Catch any unknown command
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007
+Message-Id: <20070221013048.845502542@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:02 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 04/21] V4L: tveeprom: autodetect LG TAPC G701D as tuner type 37
+Content-Disposition: inline; filename=V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch
+Content-Length: 1056
+Lines: 31
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+Autodetect LG TAPC G701D as tuner type 37, fixing
+mis-detected tuners in some Hauppauge tv tuner cards.
+
+Thanks to Adonis Papas, for pointing this out.
+
+(cherry picked from commit 1323fbda1343f50f198bc8bd6d1d59c8b7fc45bf)
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/tveeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.19.4.orig/drivers/media/video/tveeprom.c
++++ linux-2.6.19.4/drivers/media/video/tveeprom.c
+@@ -184,7 +184,7 @@ hauppauge_tuner[] =
+ { TUNER_ABSENT, "Thompson DTT757"},
+ /* 80-89 */
+ { TUNER_ABSENT, "Philips FQ1216LME MK3"},
+- { TUNER_ABSENT, "LG TAPC G701D"},
++ { TUNER_LG_PAL_NEW_TAPC, "LG TAPC G701D"},
+ { TUNER_LG_NTSC_NEW_TAPC, "LG TAPC H791F"},
+ { TUNER_LG_PAL_NEW_TAPC, "TCL 2002MB 3"},
+ { TUNER_LG_PAL_NEW_TAPC, "TCL 2002MI 3"},
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007
+Message-Id: <20070221013048.972005177@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:03 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oleg Nesterov <oleg@tv-sign.ru>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 05/21] V4L: buf_qbuf: fix videobuf_queue->stream corruption and lockup
+Content-Disposition: inline; filename=V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch
+Content-Length: 980
+Lines: 29
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+We are doing ->buf_prepare(buf) before adding buf to q->stream list. This
+means that videobuf_qbuf() should not try to re-add a STATE_PREPARED buffer.
+
+(cherry picked from commit 419dd8378dfa32985672ab7927b4bc827f33b332)
+
+Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/video-buf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.19.4.orig/drivers/media/video/video-buf.c
++++ linux-2.6.19.4/drivers/media/video/video-buf.c
+@@ -700,6 +700,7 @@ videobuf_qbuf(struct videobuf_queue *q,
+ goto done;
+ }
+ if (buf->state == STATE_QUEUED ||
++ buf->state == STATE_PREPARED ||
+ buf->state == STATE_ACTIVE) {
+ dprintk(1,"qbuf: buffer is already queued or active.\n");
+ goto done;
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007
+Message-Id: <20070221013049.097641221@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:04 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ jacmet@sunsite.dk,
+ jeff@garzik.org
+Subject: [patch 06/21] net/smc911x: match up spin lock/unlock
+Content-Disposition: inline; filename=net-smc911x-match-up-spin-lock-unlock.patch
+Content-Length: 1276
+Lines: 43
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Peter Korsgaard <jacmet@sunsite.dk>
+
+smc911x_phy_configure's error handling unconditionally unlocks the
+spinlock even if it wasn't locked. Patch fixes it.
+
+Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
+Cc: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/smc911x.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/net/smc911x.c
++++ linux-2.6.19.4/drivers/net/smc911x.c
+@@ -965,11 +965,11 @@ static void smc911x_phy_configure(void *
+ * We should not be called if phy_type is zero.
+ */
+ if (lp->phy_type == 0)
+- goto smc911x_phy_configure_exit;
++ goto smc911x_phy_configure_exit_nolock;
+
+ if (smc911x_phy_reset(dev, phyaddr)) {
+ printk("%s: PHY reset timed out\n", dev->name);
+- goto smc911x_phy_configure_exit;
++ goto smc911x_phy_configure_exit_nolock;
+ }
+ spin_lock_irqsave(&lp->lock, flags);
+
+@@ -1038,6 +1038,7 @@ static void smc911x_phy_configure(void *
+
+ smc911x_phy_configure_exit:
+ spin_unlock_irqrestore(&lp->lock, flags);
++smc911x_phy_configure_exit_nolock:
+ lp->work_pending = 0;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007
+Message-Id: <20070221013049.219706422@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:05 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ akpm@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ jean-baptiste.maneyrol@teamlog.com,
+ a.zummo@towertech.it,
+ dbrownell@users.sourceforge.net,
+ Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Subject: [patch 07/21] rtc-pcf8563: detect polarity of century bit automatically
+Content-Disposition: inline; filename=rtc-pcf8563-detect-polarity-of-century-bit-automatically.patch
+Content-Length: 4901
+Lines: 142
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+
+The usage of the century bit was inverted on 2.6.19 following to PCF8563's
+description, but it was not match to usage suggested by RTC8564's
+datasheet. Anyway what MO_C=1 means can vary on each platform. This patch
+is to detect its polarity in get_datetime routine. The default value of
+c_polarity is 0 (MO_C=1 means 19xx) so that this patch does not change
+current behavior even if get_datetime was not called before set_datetime.
+
+Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Cc: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@teamlog.com>
+Cc: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-pcf8563.c | 40 ++++++++++++++++++++++++++++++++++------
+ 1 file changed, 34 insertions(+), 6 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/rtc/rtc-pcf8563.c
++++ linux-2.6.19.4/drivers/rtc/rtc-pcf8563.c
+@@ -53,6 +53,25 @@ I2C_CLIENT_INSMOD;
+ #define PCF8563_SC_LV 0x80 /* low voltage */
+ #define PCF8563_MO_C 0x80 /* century */
+
++struct pcf8563 {
++ struct i2c_client client;
++ /*
++ * The meaning of MO_C bit varies by the chip type.
++ * From PCF8563 datasheet: this bit is toggled when the years
++ * register overflows from 99 to 00
++ * 0 indicates the century is 20xx
++ * 1 indicates the century is 19xx
++ * From RTC8564 datasheet: this bit indicates change of
++ * century. When the year digit data overflows from 99 to 00,
++ * this bit is set. By presetting it to 0 while still in the
++ * 20th century, it will be set in year 2000, ...
++ * There seems no reliable way to know how the system use this
++ * bit. So let's do it heuristically, assuming we are live in
++ * 1970...2069.
++ */
++ int c_polarity; /* 0: MO_C=1 means 19xx, otherwise MO_C=1 means 20xx */
++};
++
+ static int pcf8563_probe(struct i2c_adapter *adapter, int address, int kind);
+ static int pcf8563_detach(struct i2c_client *client);
+
+@@ -62,6 +81,7 @@ static int pcf8563_detach(struct i2c_cli
+ */
+ static int pcf8563_get_datetime(struct i2c_client *client, struct rtc_time *tm)
+ {
++ struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client);
+ unsigned char buf[13] = { PCF8563_REG_ST1 };
+
+ struct i2c_msg msgs[] = {
+@@ -94,8 +114,12 @@ static int pcf8563_get_datetime(struct i
+ tm->tm_mday = BCD2BIN(buf[PCF8563_REG_DM] & 0x3F);
+ tm->tm_wday = buf[PCF8563_REG_DW] & 0x07;
+ tm->tm_mon = BCD2BIN(buf[PCF8563_REG_MO] & 0x1F) - 1; /* rtc mn 1-12 */
+- tm->tm_year = BCD2BIN(buf[PCF8563_REG_YR])
+- + (buf[PCF8563_REG_MO] & PCF8563_MO_C ? 0 : 100);
++ tm->tm_year = BCD2BIN(buf[PCF8563_REG_YR]);
++ if (tm->tm_year < 70)
++ tm->tm_year += 100; /* assume we are in 1970...2069 */
++ /* detect the polarity heuristically. see note above. */
++ pcf8563->c_polarity = (buf[PCF8563_REG_MO] & PCF8563_MO_C) ?
++ (tm->tm_year >= 100) : (tm->tm_year < 100);
+
+ dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d, "
+ "mday=%d, mon=%d, year=%d, wday=%d\n",
+@@ -114,6 +138,7 @@ static int pcf8563_get_datetime(struct i
+
+ static int pcf8563_set_datetime(struct i2c_client *client, struct rtc_time *tm)
+ {
++ struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client);
+ int i, err;
+ unsigned char buf[9];
+
+@@ -135,7 +160,7 @@ static int pcf8563_set_datetime(struct i
+
+ /* year and century */
+ buf[PCF8563_REG_YR] = BIN2BCD(tm->tm_year % 100);
+- if (tm->tm_year < 100)
++ if (pcf8563->c_polarity ? (tm->tm_year >= 100) : (tm->tm_year < 100))
+ buf[PCF8563_REG_MO] |= PCF8563_MO_C;
+
+ buf[PCF8563_REG_DW] = tm->tm_wday & 0x07;
+@@ -248,6 +273,7 @@ static struct i2c_driver pcf8563_driver
+
+ static int pcf8563_probe(struct i2c_adapter *adapter, int address, int kind)
+ {
++ struct pcf8563 *pcf8563;
+ struct i2c_client *client;
+ struct rtc_device *rtc;
+
+@@ -260,11 +286,12 @@ static int pcf8563_probe(struct i2c_adap
+ goto exit;
+ }
+
+- if (!(client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL))) {
++ if (!(pcf8563 = kzalloc(sizeof(struct pcf8563), GFP_KERNEL))) {
+ err = -ENOMEM;
+ goto exit;
+ }
+
++ client = &pcf8563->client;
+ client->addr = address;
+ client->driver = &pcf8563_driver;
+ client->adapter = adapter;
+@@ -301,7 +328,7 @@ exit_detach:
+ i2c_detach_client(client);
+
+ exit_kfree:
+- kfree(client);
++ kfree(pcf8563);
+
+ exit:
+ return err;
+@@ -309,6 +336,7 @@ exit:
+
+ static int pcf8563_detach(struct i2c_client *client)
+ {
++ struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client);
+ int err;
+ struct rtc_device *rtc = i2c_get_clientdata(client);
+
+@@ -318,7 +346,7 @@ static int pcf8563_detach(struct i2c_cli
+ if ((err = i2c_detach_client(client)))
+ return err;
+
+- kfree(client);
++ kfree(pcf8563);
+
+ return 0;
+ }
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007
+Message-Id: <20070221013049.347439939@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:06 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ suparna@in.ibm.com,
+ zach.brown@oracle.com,
+ jmoyer@redhat.com,
+ bcrl@kvack.org,
+ pbadari@us.ibm.com,
+ kenchen@google.com
+Subject: [patch 08/21] aio: fix buggy put_ioctx call in aio_complete - v2
+Content-Disposition: inline; filename=aio-fix-buggy-put_ioctx-call-in-aio_complete-v2.patch
+Content-Length: 4976
+Lines: 149
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: "Ken Chen" <kenchen@google.com>
+
+An AIO bug was reported that sleeping function is being called in softirq
+context:
+
+BUG: warning at kernel/mutex.c:132/__mutex_lock_common()
+Call Trace:
+ [<a000000100577b00>] __mutex_lock_slowpath+0x640/0x6c0
+ [<a000000100577ba0>] mutex_lock+0x20/0x40
+ [<a0000001000a25b0>] flush_workqueue+0xb0/0x1a0
+ [<a00000010018c0c0>] __put_ioctx+0xc0/0x240
+ [<a00000010018d470>] aio_complete+0x2f0/0x420
+ [<a00000010019cc80>] finished_one_bio+0x200/0x2a0
+ [<a00000010019d1c0>] dio_bio_complete+0x1c0/0x200
+ [<a00000010019d260>] dio_bio_end_aio+0x60/0x80
+ [<a00000010014acd0>] bio_endio+0x110/0x1c0
+ [<a0000001002770e0>] __end_that_request_first+0x180/0xba0
+ [<a000000100277b90>] end_that_request_chunk+0x30/0x60
+ [<a0000002073c0c70>] scsi_end_request+0x50/0x300 [scsi_mod]
+ [<a0000002073c1240>] scsi_io_completion+0x200/0x8a0 [scsi_mod]
+ [<a0000002074729b0>] sd_rw_intr+0x330/0x860 [sd_mod]
+ [<a0000002073b3ac0>] scsi_finish_command+0x100/0x1c0 [scsi_mod]
+ [<a0000002073c2910>] scsi_softirq_done+0x230/0x300 [scsi_mod]
+ [<a000000100277d20>] blk_done_softirq+0x160/0x1c0
+ [<a000000100083e00>] __do_softirq+0x200/0x240
+ [<a000000100083eb0>] do_softirq+0x70/0xc0
+
+See report: http://marc.theaimsgroup.com/?l=linux-kernel&m=116599593200888&w=2
+
+flush_workqueue() is not allowed to be called in the softirq context.
+However, aio_complete() called from I/O interrupt can potentially call
+put_ioctx with last ref count on ioctx and triggers bug. It is simply
+incorrect to perform ioctx freeing from aio_complete.
+
+The bug is trigger-able from a race between io_destroy() and aio_complete().
+A possible scenario:
+
+cpu0 cpu1
+io_destroy aio_complete
+ wait_for_all_aios { __aio_put_req
+ ... ctx->reqs_active--;
+ if (!ctx->reqs_active)
+ return;
+ }
+ ...
+ put_ioctx(ioctx)
+
+ put_ioctx(ctx);
+ __put_ioctx
+ bam! Bug trigger!
+
+The real problem is that the condition check of ctx->reqs_active in
+wait_for_all_aios() is incorrect that access to reqs_active is not
+being properly protected by spin lock.
+
+This patch adds that protective spin lock, and at the same time removes
+all duplicate ref counting for each kiocb as reqs_active is already used
+as a ref count for each active ioctx. This also ensures that buggy call
+to flush_workqueue() in softirq context is eliminated.
+
+Signed-off-by: "Ken Chen" <kenchen@google.com>
+Cc: Zach Brown <zach.brown@oracle.com>
+Cc: Suparna Bhattacharya <suparna@in.ibm.com>
+Cc: Benjamin LaHaise <bcrl@kvack.org>
+Cc: Badari Pulavarty <pbadari@us.ibm.com>
+Acked-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/aio.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- linux-2.6.19.4.orig/fs/aio.c
++++ linux-2.6.19.4/fs/aio.c
+@@ -298,17 +298,23 @@ static void wait_for_all_aios(struct kio
+ struct task_struct *tsk = current;
+ DECLARE_WAITQUEUE(wait, tsk);
+
++ spin_lock_irq(&ctx->ctx_lock);
+ if (!ctx->reqs_active)
+- return;
++ goto out;
+
+ add_wait_queue(&ctx->wait, &wait);
+ set_task_state(tsk, TASK_UNINTERRUPTIBLE);
+ while (ctx->reqs_active) {
++ spin_unlock_irq(&ctx->ctx_lock);
+ schedule();
+ set_task_state(tsk, TASK_UNINTERRUPTIBLE);
++ spin_lock_irq(&ctx->ctx_lock);
+ }
+ __set_task_state(tsk, TASK_RUNNING);
+ remove_wait_queue(&ctx->wait, &wait);
++
++out:
++ spin_unlock_irq(&ctx->ctx_lock);
+ }
+
+ /* wait_on_sync_kiocb:
+@@ -425,7 +431,6 @@ static struct kiocb fastcall *__aio_get_
+ ring = kmap_atomic(ctx->ring_info.ring_pages[0], KM_USER0);
+ if (ctx->reqs_active < aio_ring_avail(&ctx->ring_info, ring)) {
+ list_add(&req->ki_list, &ctx->active_reqs);
+- get_ioctx(ctx);
+ ctx->reqs_active++;
+ okay = 1;
+ }
+@@ -538,8 +543,6 @@ int fastcall aio_put_req(struct kiocb *r
+ spin_lock_irq(&ctx->ctx_lock);
+ ret = __aio_put_req(ctx, req);
+ spin_unlock_irq(&ctx->ctx_lock);
+- if (ret)
+- put_ioctx(ctx);
+ return ret;
+ }
+
+@@ -795,8 +798,7 @@ static int __aio_run_iocbs(struct kioctx
+ */
+ iocb->ki_users++; /* grab extra reference */
+ aio_run_iocb(iocb);
+- if (__aio_put_req(ctx, iocb)) /* drop extra ref */
+- put_ioctx(ctx);
++ __aio_put_req(ctx, iocb);
+ }
+ if (!list_empty(&ctx->run_list))
+ return 1;
+@@ -1014,14 +1016,10 @@ put_rq:
+ /* everything turned out well, dispose of the aiocb. */
+ ret = __aio_put_req(ctx, iocb);
+
+- spin_unlock_irqrestore(&ctx->ctx_lock, flags);
+-
+ if (waitqueue_active(&ctx->wait))
+ wake_up(&ctx->wait);
+
+- if (ret)
+- put_ioctx(ctx);
+-
++ spin_unlock_irqrestore(&ctx->ctx_lock, flags);
+ return ret;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007
+Message-Id: <20070221013049.469248403@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:07 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Andrew Morton <akpm@osdl.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Dike <jdike@addtoit.com>,
+ Andi Kleen <ak@suse.de>,
+ user-mode-linux-devel@lists.sourceforge.net,
+ Paolo Blaisorblade Giarrusso <blaisorblade@yahoo.it>
+Subject: [patch 09/21] x86_64: fix 2.6.18 regression - PTRACE_OLDSETOPTIONS should be accepted
+Content-Disposition: inline; filename=x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch
+Content-Length: 1385
+Lines: 45
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+Also PTRACE_OLDSETOPTIONS should be accepted, as done by kernel/ptrace.c and
+forced by binary compatibility. UML/32bit breaks because of this - since it is wise
+enough to use PTRACE_OLDSETOPTIONS to be binary compatible with 2.4 host
+kernels.
+
+Until 2.6.17 (commit f0f2d6536e3515b5b1b7ae97dc8f176860c8c2ce) we had:
+
+ default:
+ return sys_ptrace(request, pid, addr, data);
+
+Instead here we have:
+ case PTRACE_GET_THREAD_AREA:
+ case ...:
+ return sys_ptrace(request, pid, addr, data);
+
+ default:
+ return -EINVAL;
+
+This change was a style change - when a case is added, it must be explicitly
+tested this way. In this case, not enough testing was done.
+
+Cc: Andi Kleen <ak@suse.de>
+Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86_64/ia32/ptrace32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.19.4.orig/arch/x86_64/ia32/ptrace32.c
++++ linux-2.6.19.4/arch/x86_64/ia32/ptrace32.c
+@@ -243,6 +243,7 @@ asmlinkage long sys32_ptrace(long reques
+ case PTRACE_SINGLESTEP:
+ case PTRACE_DETACH:
+ case PTRACE_SYSCALL:
++ case PTRACE_OLDSETOPTIONS:
+ case PTRACE_SETOPTIONS:
+ case PTRACE_SET_THREAD_AREA:
+ case PTRACE_GET_THREAD_AREA:
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007
+Message-Id: <20070221013049.596896154@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:08 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Alan <alan@lxorguk.ukuu.org.uk>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ linux-ide@vger.kernel.org,
+ bzolnier@gmail.com,
+ Tejun Heo <htejun@gmail.com>
+Subject: [patch 10/21] ide: fix drive side 80c cable check
+Content-Disposition: inline; filename=ide-fix-drive-side-80c-cable-check.patch
+Content-Length: 895
+Lines: 31
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+eighty_ninty_three() had word 93 validitity check but not the 80c bit
+test itself (bit 12). This increases the chance of incorrect wire
+detection especially because host side cable detection is often
+unreliable and we sometimes soley depend on drive side cable
+detection. Fix it.
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Acked-by: Alan <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/ide-iops.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.19.4.orig/drivers/ide/ide-iops.c
++++ linux-2.6.19.4/drivers/ide/ide-iops.c
+@@ -607,6 +607,8 @@ u8 eighty_ninty_three (ide_drive_t *driv
+ if(!(drive->id->hw_config & 0x4000))
+ return 0;
+ #endif /* CONFIG_IDEDMA_IVB */
++ if (!(drive->id->hw_config & 0x2000))
++ return 0;
+ return 1;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007
+Message-Id: <20070221013049.726348046@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:09 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Jeff Garzik <jeff@garzik.org>,
+ Alan Cox <alan@lxorguk.ukuu.org.uk>,
+ linux-ide@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ Tejun Heo <htejun@gmail.com>
+Subject: [patch 11/21] pata_amd: fix an obvious bug in cable detection
+Content-Disposition: inline; filename=pata_amd-fix-an-obvious-bug-in-cable-detection.patch
+Content-Length: 1087
+Lines: 36
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+80c test mask is at bits 18 and 19 of EIDE Controller Configuration
+not 22 and 23. Fix it.
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
+
+---
+ drivers/ata/pata_amd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/ata/pata_amd.c
++++ linux-2.6.19.4/drivers/ata/pata_amd.c
+@@ -128,7 +128,7 @@ static void timing_setup(struct ata_port
+
+ static int amd_pre_reset(struct ata_port *ap)
+ {
+- static const u32 bitmask[2] = {0x03, 0xC0};
++ static const u32 bitmask[2] = {0x03, 0x0C};
+ static const struct pci_bits amd_enable_bits[] = {
+ { 0x40, 1, 0x02, 0x02 },
+ { 0x40, 1, 0x01, 0x01 }
+@@ -247,7 +247,7 @@ static void amd133_set_dmamode(struct at
+ */
+
+ static int nv_pre_reset(struct ata_port *ap) {
+- static const u8 bitmask[2] = {0x03, 0xC0};
++ static const u8 bitmask[2] = {0x03, 0x0C};
+ static const struct pci_bits nv_enable_bits[] = {
+ { 0x50, 1, 0x02, 0x02 },
+ { 0x50, 1, 0x01, 0x01 }
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007
+Message-Id: <20070221013049.856120090@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:10 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>
+Subject: [patch 12/21] bcm43xx: Fix for oops on resume
+Content-Disposition: inline; filename=bcm43xx-fix-for-oops-on-resume.patch
+Status: RO
+Content-Length: 731
+Lines: 26
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop.
+
+Signed-off-by: Larry Finger<Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx.h
++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx.h
+@@ -21,7 +21,7 @@
+ #define PFX KBUILD_MODNAME ": "
+
+ #define BCM43xx_SWITCH_CORE_MAX_RETRIES 50
+-#define BCM43xx_IRQWAIT_MAX_RETRIES 50
++#define BCM43xx_IRQWAIT_MAX_RETRIES 100
+
+ #define BCM43xx_IO_SIZE 8192
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007
+Message-Id: <20070221013049.984195829@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:11 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ Larry Finger <Larry.Finger@lwfinger.net>
+Subject: [patch 13/21] bcm43xx: Fix for oops on ampdu status
+Content-Disposition: inline; filename=bcm43xx-fix-for-oops-on-ampdu-status.patch
+Content-Length: 2023
+Lines: 57
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Buesch <mb@bu3sch.de>
+
+If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The
+ampdu and intermediate status bits are properly named.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 +++-----
+ drivers/net/wireless/bcm43xx/bcm43xx_xmit.h | 10 ++--------
+ 2 files changed, 5 insertions(+), 13 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+@@ -1449,12 +1449,10 @@ static void handle_irq_transmit_status(s
+
+ bcm43xx_debugfs_log_txstat(bcm, &stat);
+
+- if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE)
++ if (stat.flags & BCM43xx_TXSTAT_FLAG_AMPDU)
++ continue;
++ if (stat.flags & BCM43xx_TXSTAT_FLAG_INTER)
+ continue;
+- if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) {
+- //TODO: packet was not acked (was lost)
+- }
+- //TODO: There are more (unknown) flags to test. see bcm43xx_main.h
+
+ if (bcm43xx_using_pio(bcm))
+ bcm43xx_pio_handle_xmitstatus(bcm, &stat);
+--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
+@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus {
+ u16 unknown; //FIXME
+ };
+
+-#define BCM43xx_TXSTAT_FLAG_ACK 0x01
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10
+-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80
++#define BCM43xx_TXSTAT_FLAG_AMPDU 0x10
++#define BCM43xx_TXSTAT_FLAG_INTER 0x20
+
+ u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate);
+ u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate);
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007
+Message-Id: <20070221013050.110445917@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:12 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Jaroslav Kysela <perex@suse.cz>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 14/21] usb-audio: work around wrong frequency in CM6501 descriptors
+Content-Disposition: inline; filename=usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch
+Content-Length: 1328
+Lines: 37
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+[PATCH] usb-audio: work around wrong frequency in CM6501 descriptors
+
+The C-Media CM6501 chip's descriptors say that altsetting 5 supports
+48 kHz, but it actually plays at 96 kHz.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Jaroslav Kysela <perex@suse.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- linux-2.6.19.4.orig/sound/usb/usbaudio.c
++++ linux-2.6.19.4/sound/usb/usbaudio.c
+@@ -2471,7 +2471,13 @@ static int parse_audio_format_rates(stru
+ fp->nr_rates = nr_rates;
+ fp->rate_min = fp->rate_max = combine_triple(&fmt[8]);
+ for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) {
+- unsigned int rate = fp->rate_table[r] = combine_triple(&fmt[idx]);
++ unsigned int rate = combine_triple(&fmt[idx]);
++ /* C-Media CM6501 mislabels its 96 kHz altsetting */
++ if (rate == 48000 && nr_rates == 1 &&
++ chip->usb_id == USB_ID(0x0d8c, 0x0201) &&
++ fp->altsetting == 5 && fp->maxpacksize == 392)
++ rate = 96000;
++ fp->rate_table[r] = rate;
+ if (rate < fp->rate_min)
+ fp->rate_min = rate;
+ else if (rate > fp->rate_max)
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007
+Message-Id: <20070221013050.234786825@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:13 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gregor Jasny <gjasny@web.de>,
+ Takashi Iwai <tiwai@suse.de>,
+ Jaroslav Kysela <perex@suse.cz>
+Subject: [patch 15/21] usbaudio - Fix Oops with broken usb descriptors
+Content-Disposition: inline; filename=usbaudio-fix-oops-with-broken-usb-descriptors.patch
+Content-Length: 1524
+Lines: 48
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+[PATCH] usbaudio - Fix Oops with broken usb descriptors
+
+This is a patch for ALSA Bug #2724. Some webcams provide bogus
+settings with no valid rates. With this patch those are skipped.
+
+Signed-off-by: Gregor Jasny <gjasny@web.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- linux-2.6.19.4.orig/sound/usb/usbaudio.c
++++ linux-2.6.19.4/sound/usb/usbaudio.c
+@@ -2456,6 +2456,7 @@ static int parse_audio_format_rates(stru
+ * build the rate table and bitmap flags
+ */
+ int r, idx, c;
++ unsigned int nonzero_rates = 0;
+ /* this table corresponds to the SNDRV_PCM_RATE_XXX bit */
+ static unsigned int conv_rates[] = {
+ 5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000,
+@@ -2478,6 +2479,7 @@ static int parse_audio_format_rates(stru
+ fp->altsetting == 5 && fp->maxpacksize == 392)
+ rate = 96000;
+ fp->rate_table[r] = rate;
++ nonzero_rates |= rate;
+ if (rate < fp->rate_min)
+ fp->rate_min = rate;
+ else if (rate > fp->rate_max)
+@@ -2493,6 +2495,10 @@ static int parse_audio_format_rates(stru
+ if (!found)
+ fp->needs_knot = 1;
+ }
++ if (!nonzero_rates) {
++ hwc_debug("All rates were zero. Skipping format!\n");
++ return -1;
++ }
+ if (fp->needs_knot)
+ fp->rates |= SNDRV_PCM_RATE_KNOT;
+ } else {
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007
+Message-Id: <20070221013050.359869448@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:14 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 16/21] usbaudio - Fix Oops with unconventional sample rates
+Content-Disposition: inline; filename=usbaudio-fix-oops-with-unconventional-sample-rates.patch
+Content-Length: 2578
+Lines: 90
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+[PATCH] usbaudio - Fix Oops with unconventional sample rates
+
+The patch fixes the memory corruption by the support of unconventional
+sample rates. Also, it avoids the too restrictive constraints if
+any of usb descriptions contain continuous rates.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 43 +++++++++++++++++++++++++------------------
+ 1 file changed, 25 insertions(+), 18 deletions(-)
+
+--- linux-2.6.19.4.orig/sound/usb/usbaudio.c
++++ linux-2.6.19.4/sound/usb/usbaudio.c
+@@ -186,6 +186,7 @@ struct snd_usb_substream {
+ u64 formats; /* format bitmasks (all or'ed) */
+ unsigned int num_formats; /* number of supported audio formats (list) */
+ struct list_head fmt_list; /* format list */
++ struct snd_pcm_hw_constraint_list rate_list; /* limited rates */
+ spinlock_t lock;
+
+ struct snd_urb_ops ops; /* callbacks (must be filled at init) */
+@@ -1810,28 +1811,33 @@ static int check_hw_params_convention(st
+ static int snd_usb_pcm_check_knot(struct snd_pcm_runtime *runtime,
+ struct snd_usb_substream *subs)
+ {
+- struct list_head *p;
+- struct snd_pcm_hw_constraint_list constraints_rates;
++ struct audioformat *fp;
++ int count = 0, needs_knot = 0;
+ int err;
+
+- list_for_each(p, &subs->fmt_list) {
+- struct audioformat *fp;
+- fp = list_entry(p, struct audioformat, list);
+-
+- if (!fp->needs_knot)
+- continue;
+-
+- constraints_rates.count = fp->nr_rates;
+- constraints_rates.list = fp->rate_table;
+- constraints_rates.mask = 0;
+-
+- err = snd_pcm_hw_constraint_list(runtime, 0,
+- SNDRV_PCM_HW_PARAM_RATE,
+- &constraints_rates);
++ list_for_each_entry(fp, &subs->fmt_list, list) {
++ if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS)
++ return 0;
++ count += fp->nr_rates;
++ if (fp->needs_knot)
++ needs_knot = 1;
++ }
++ if (!needs_knot)
++ return 0;
+
+- if (err < 0)
+- return err;
++ subs->rate_list.count = count;
++ subs->rate_list.list = kmalloc(sizeof(int) * count, GFP_KERNEL);
++ subs->rate_list.mask = 0;
++ count = 0;
++ list_for_each_entry(fp, &subs->fmt_list, list) {
++ int i;
++ for (i = 0; i < fp->nr_rates; i++)
++ subs->rate_list.list[count++] = fp->rate_table[i];
+ }
++ err = snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_RATE,
++ &subs->rate_list);
++ if (err < 0)
++ return err;
+
+ return 0;
+ }
+@@ -2231,6 +2237,7 @@ static void free_substream(struct snd_us
+ kfree(fp->rate_table);
+ kfree(fp);
+ }
++ kfree(subs->rate_list.list);
+ }
+
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007
+Message-Id: <20070221013050.503870949@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:15 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@suse.de>
+Subject: [patch 17/21] Use different constraint for gcc < 4.1 in bitops.
+Content-Disposition: inline; filename=use-different-constraint-for-gcc-4.1-in-bitops.patch
+Content-Length: 3504
+Lines: 154
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+Use different constraint for gcc < 4.1 in bitops.h
+
++m is really correct for a RMW instruction, but some older gccs
+error out. I finally gave in and ifdefed it.
+
+This fixes compilation errors with some compiler version.
+
+Signed-off-by: Andi Kleen <ak@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-x86_64/bitops.h | 34 ++++++++++++++++++++--------------
+ 1 file changed, 20 insertions(+), 14 deletions(-)
+
+--- linux-2.6.19.4.orig/include/asm-x86_64/bitops.h
++++ linux-2.6.19.4/include/asm-x86_64/bitops.h
+@@ -7,7 +7,13 @@
+
+ #include <asm/alternative.h>
+
+-#define ADDR (*(volatile long *) addr)
++#if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 1)
++/* Technically wrong, but this avoids compilation errors on some gcc
++ versions. */
++#define ADDR "=m" (*(volatile long *) addr)
++#else
++#define ADDR "+m" (*(volatile long *) addr)
++#endif
+
+ /**
+ * set_bit - Atomically set a bit in memory
+@@ -23,7 +29,7 @@ static __inline__ void set_bit(int nr, v
+ {
+ __asm__ __volatile__( LOCK_PREFIX
+ "btsl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr) : "memory");
+ }
+
+@@ -40,7 +46,7 @@ static __inline__ void __set_bit(int nr,
+ {
+ __asm__ volatile(
+ "btsl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr) : "memory");
+ }
+
+@@ -58,7 +64,7 @@ static __inline__ void clear_bit(int nr,
+ {
+ __asm__ __volatile__( LOCK_PREFIX
+ "btrl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr));
+ }
+
+@@ -66,7 +72,7 @@ static __inline__ void __clear_bit(int n
+ {
+ __asm__ __volatile__(
+ "btrl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr));
+ }
+
+@@ -86,7 +92,7 @@ static __inline__ void __change_bit(int
+ {
+ __asm__ __volatile__(
+ "btcl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr));
+ }
+
+@@ -103,7 +109,7 @@ static __inline__ void change_bit(int nr
+ {
+ __asm__ __volatile__( LOCK_PREFIX
+ "btcl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr));
+ }
+
+@@ -121,7 +127,7 @@ static __inline__ int test_and_set_bit(i
+
+ __asm__ __volatile__( LOCK_PREFIX
+ "btsl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr) : "memory");
+ return oldbit;
+ }
+@@ -141,7 +147,7 @@ static __inline__ int __test_and_set_bit
+
+ __asm__(
+ "btsl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr));
+ return oldbit;
+ }
+@@ -160,7 +166,7 @@ static __inline__ int test_and_clear_bit
+
+ __asm__ __volatile__( LOCK_PREFIX
+ "btrl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr) : "memory");
+ return oldbit;
+ }
+@@ -180,7 +186,7 @@ static __inline__ int __test_and_clear_b
+
+ __asm__(
+ "btrl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr));
+ return oldbit;
+ }
+@@ -192,7 +198,7 @@ static __inline__ int __test_and_change_
+
+ __asm__ __volatile__(
+ "btcl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr) : "memory");
+ return oldbit;
+ }
+@@ -211,7 +217,7 @@ static __inline__ int test_and_change_bi
+
+ __asm__ __volatile__( LOCK_PREFIX
+ "btcl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr) : "memory");
+ return oldbit;
+ }
+@@ -237,7 +243,7 @@ static __inline__ int variable_test_bit(
+ __asm__ __volatile__(
+ "btl %2,%1\n\tsbbl %0,%0"
+ :"=r" (oldbit)
+- :"m" (ADDR),"dIr" (nr));
++ :"m" (*(volatile long *)addr),"dIr" (nr));
+ return oldbit;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007
+Message-Id: <20070221013050.604642667@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:16 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dan Williams <dcbw@redhat.com>
+Subject: [patch 18/21] prism54: correct assignment of DOT1XENABLE in WE-19 codepaths
+Content-Disposition: inline; filename=prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch
+Content-Length: 1576
+Lines: 52
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+Correct assignment of DOT1XENABLE in WE-19 codepaths.
+RX_UNENCRYPTED_EAPOL = 1 really means setting DOT1XENABLE _off_, and
+vice versa. The original WE-19 patch erroneously reversed that. This
+patch fixes association with unencrypted and WEP networks when using
+wpa_supplicant.
+
+It also adds two missing break statements that, left out, could result
+in incorrect card configuration.
+
+Applies to (I think) 2.6.19 and later.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/prism54/isl_ioctl.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- linux-2.6.19.4.orig/drivers/net/wireless/prism54/isl_ioctl.c
++++ linux-2.6.19.4/drivers/net/wireless/prism54/isl_ioctl.c
+@@ -1395,11 +1395,16 @@ static int prism54_set_auth(struct net_d
+ break;
+
+ case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+- dot1x = param->value ? 1 : 0;
++ /* dot1x should be the opposite of RX_UNENCRYPTED_EAPOL;
++ * turn off dot1x when allowing recepit of unencrypted eapol
++ * frames, turn on dot1x when we disallow receipt
++ */
++ dot1x = param->value ? 0x00 : 0x01;
+ break;
+
+ case IW_AUTH_PRIVACY_INVOKED:
+ privinvoked = param->value ? 1 : 0;
++ break;
+
+ case IW_AUTH_DROP_UNENCRYPTED:
+ exunencrypt = param->value ? 1 : 0;
+@@ -1589,6 +1594,7 @@ static int prism54_set_encodeext(struct
+ }
+ key.type = DOT11_PRIV_TKIP;
+ key.length = KEY_SIZE_TKIP;
++ break;
+ default:
+ return -EINVAL;
+ }
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007
+Message-Id: <20070221013050.727275537@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:17 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Garzik <jeff@garzik.org>,
+ Ingo Molnar <mingo@elte.hu>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Linus Torvalds <torvalds@osdl.org>
+Subject: [patch 19/21] net, 8139too.c: fix netpoll deadlock
+Content-Disposition: inline; filename=net-8139too.c-fix-netpoll-deadlock.patch
+Content-Length: 3364
+Lines: 98
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ingo Molnar <mingo@elte.hu>
+
+[PATCH] net, 8139too.c: fix netpoll deadlock
+
+fix deadlock in the 8139too driver: poll handlers should never forcibly
+enable local interrupts, because they might be used by netpoll/printk
+from IRQ context.
+
+ =================================
+ [ INFO: inconsistent lock state ]
+ 2.6.19 #11
+ ---------------------------------
+ inconsistent {softirq-on-W} -> {in-softirq-W} usage.
+ swapper/1 [HC0[0]:SC1[1]:HE1:SE0] takes:
+ (&npinfo->poll_lock){-+..}, at: [<c0350a41>] net_rx_action+0x64/0x1de
+ {softirq-on-W} state was registered at:
+ [<c0134c86>] mark_lock+0x5b/0x39c
+ [<c0135012>] mark_held_locks+0x4b/0x68
+ [<c01351e9>] trace_hardirqs_on+0x115/0x139
+ [<c02879e6>] rtl8139_poll+0x3d7/0x3f4
+ [<c035c85d>] netpoll_poll+0x82/0x32f
+ [<c035c775>] netpoll_send_skb+0xc9/0x12f
+ [<c035cdcc>] netpoll_send_udp+0x253/0x25b
+ [<c0288463>] write_msg+0x40/0x65
+ [<c011cead>] __call_console_drivers+0x45/0x51
+ [<c011cf16>] _call_console_drivers+0x5d/0x61
+ [<c011d4fb>] release_console_sem+0x11f/0x1d8
+ [<c011d7d7>] register_console+0x1ac/0x1b3
+ [<c02883f8>] init_netconsole+0x55/0x67
+ [<c010040c>] init+0x9a/0x24e
+ [<c01049cf>] kernel_thread_helper+0x7/0x10
+ [<ffffffff>] 0xffffffff
+ irq event stamp: 819992
+ hardirqs last enabled at (819992): [<c0350a16>] net_rx_action+0x39/0x1de
+ hardirqs last disabled at (819991): [<c0350b1e>] net_rx_action+0x141/0x1de
+ softirqs last enabled at (817552): [<c01214e4>] __do_softirq+0xa3/0xa8
+ softirqs last disabled at (819987): [<c0106051>] do_softirq+0x5b/0xc9
+
+ other info that might help us debug this:
+ no locks held by swapper/1.
+
+ stack backtrace:
+ [<c0104d88>] dump_trace+0x63/0x1e8
+ [<c0104f26>] show_trace_log_lvl+0x19/0x2e
+ [<c010532d>] show_trace+0x12/0x14
+ [<c0105343>] dump_stack+0x14/0x16
+ [<c0134980>] print_usage_bug+0x23c/0x246
+ [<c0134d33>] mark_lock+0x108/0x39c
+ [<c01356a7>] __lock_acquire+0x361/0x9ed
+ [<c0136018>] lock_acquire+0x56/0x72
+ [<c03aff1f>] _spin_lock+0x35/0x42
+ [<c0350a41>] net_rx_action+0x64/0x1de
+ [<c0121493>] __do_softirq+0x52/0xa8
+ [<c0106051>] do_softirq+0x5b/0xc9
+ [<c0121338>] irq_exit+0x3c/0x48
+ [<c0106163>] do_IRQ+0xa4/0xbd
+ [<c01047c6>] common_interrupt+0x2e/0x34
+ [<c011db92>] vprintk+0x2c0/0x309
+ [<c011dbf6>] printk+0x1b/0x1d
+ [<c01003f2>] init+0x80/0x24e
+ [<c01049cf>] kernel_thread_helper+0x7/0x10
+ =======================
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Acked-by: Jeff Garzik <jeff@garzik.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/8139too.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/net/8139too.c
++++ linux-2.6.19.4/drivers/net/8139too.c
+@@ -2129,14 +2129,15 @@ static int rtl8139_poll(struct net_devic
+ }
+
+ if (done) {
++ unsigned long flags;
+ /*
+ * Order is important since data can get interrupted
+ * again when we think we are done.
+ */
+- local_irq_disable();
++ local_irq_save(flags);
+ RTL_W16_F(IntrMask, rtl8139_intr_mask);
+ __netif_rx_complete(dev);
+- local_irq_enable();
++ local_irq_restore(flags);
+ }
+ spin_unlock(&tp->rx_lock);
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007
+Message-Id: <20070221013050.850761309@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:18 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Howells <dhowells@redhat.com>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [patch 20/21] Keys: Fix key serial number collision handling
+Content-Disposition: inline; filename=keys-fix-key-serial-number-collision-handling.patch
+Content-Length: 2910
+Lines: 96
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Howells <dhowells@redhat.com>
+
+[PATCH] Keys: Fix key serial number collision handling
+
+Fix the key serial number collision avoidance code in key_alloc_serial().
+
+This didn't use to be so much of a problem as the key serial numbers were
+allocated from a simple incremental counter, and it would have to go through
+two billion keys before it could possibly encounter a collision. However, now
+that random numbers are used instead, collisions are much more likely.
+
+This is fixed by finding a hole in the rbtree where the next unused serial
+number ought to be and using that by going almost back to the top of the
+insertion routine and redoing the insertion with the new serial number rather
+than trying to be clever and attempting to work out the insertion point
+pointer directly.
+
+This fixes kernel BZ #7727.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/keys/key.c | 33 ++++++++++++++-------------------
+ 1 file changed, 14 insertions(+), 19 deletions(-)
+
+--- linux-2.6.19.4.orig/security/keys/key.c
++++ linux-2.6.19.4/security/keys/key.c
+@@ -188,6 +188,7 @@ static inline void key_alloc_serial(stru
+
+ spin_lock(&key_serial_lock);
+
++attempt_insertion:
+ parent = NULL;
+ p = &key_serial_tree.rb_node;
+
+@@ -202,39 +203,33 @@ static inline void key_alloc_serial(stru
+ else
+ goto serial_exists;
+ }
+- goto insert_here;
++
++ /* we've found a suitable hole - arrange for this key to occupy it */
++ rb_link_node(&key->serial_node, parent, p);
++ rb_insert_color(&key->serial_node, &key_serial_tree);
++
++ spin_unlock(&key_serial_lock);
++ return;
+
+ /* we found a key with the proposed serial number - walk the tree from
+ * that point looking for the next unused serial number */
+ serial_exists:
+ for (;;) {
+ key->serial++;
+- if (key->serial < 2)
+- key->serial = 2;
+-
+- if (!rb_parent(parent))
+- p = &key_serial_tree.rb_node;
+- else if (rb_parent(parent)->rb_left == parent)
+- p = &(rb_parent(parent)->rb_left);
+- else
+- p = &(rb_parent(parent)->rb_right);
++ if (key->serial < 3) {
++ key->serial = 3;
++ goto attempt_insertion;
++ }
+
+ parent = rb_next(parent);
+ if (!parent)
+- break;
++ goto attempt_insertion;
+
+ xkey = rb_entry(parent, struct key, serial_node);
+ if (key->serial < xkey->serial)
+- goto insert_here;
++ goto attempt_insertion;
+ }
+
+- /* we've found a suitable hole - arrange for this key to occupy it */
+-insert_here:
+- rb_link_node(&key->serial_node, parent, p);
+- rb_insert_color(&key->serial_node, &key_serial_tree);
+-
+- spin_unlock(&key_serial_lock);
+-
+ } /* end key_alloc_serial() */
+
+ /*****************************************************************************/
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:51 2007
+Message-Id: <20070221013050.975051931@mini.kroah.org>
+References: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:28:19 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Andrew Morton <akpm@osdl.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ nfs@lists.sourceforge.net,
+ Neil Brown <neilb@suse.de>
+Subject: [patch 21/21] knfsd: Fix a race in closing NFSd connections.
+Content-Disposition: inline; filename=knfsd-fix-a-race-in-closing-nfsd-connections.patch
+Content-Length: 6523
+Lines: 204
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+If you lose this race, it can iput a socket inode twice and you
+get a BUG in fs/inode.c
+
+When I added the option for user-space to close a socket,
+I added some cruft to svc_delete_socket so that I could call
+that function when closing a socket per user-space request.
+
+This was the wrong thing to do. I should have just set SK_CLOSE
+and let normal mechanisms do the work.
+
+Not only wrong, but buggy. The locking is all wrong and it openned
+up a race where-by a socket could be closed twice.
+
+So this patch:
+ Introduces svc_close_socket which sets SK_CLOSE then either leave
+ the close up to a thread, or calls svc_delete_socket if it can
+ get SK_BUSY.
+
+ Adds a bias to sk_busy which is removed when SK_DEAD is set,
+ This avoid races around shutting down the socket.
+
+ Changes several 'spin_lock' to 'spin_lock_bh' where the _bh
+ was missing.
+
+Bugzilla-url: http://bugzilla.kernel.org/show_bug.cgi?id=7916
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ include/linux/sunrpc/svcsock.h | 2 -
+ net/sunrpc/svc.c | 4 +--
+ net/sunrpc/svcsock.c | 52 +++++++++++++++++++++++++++++------------
+ 3 files changed, 41 insertions(+), 17 deletions(-)
+
+--- linux-2.6.19.4.orig/include/linux/sunrpc/svcsock.h
++++ linux-2.6.19.4/include/linux/sunrpc/svcsock.h
+@@ -63,7 +63,7 @@ struct svc_sock {
+ * Function prototypes.
+ */
+ int svc_makesock(struct svc_serv *, int, unsigned short);
+-void svc_delete_socket(struct svc_sock *);
++void svc_close_socket(struct svc_sock *);
+ int svc_recv(struct svc_rqst *, long);
+ int svc_send(struct svc_rqst *);
+ void svc_drop(struct svc_rqst *);
+--- linux-2.6.19.4.orig/net/sunrpc/svc.c
++++ linux-2.6.19.4/net/sunrpc/svc.c
+@@ -387,7 +387,7 @@ svc_destroy(struct svc_serv *serv)
+ svsk = list_entry(serv->sv_tempsocks.next,
+ struct svc_sock,
+ sk_list);
+- svc_delete_socket(svsk);
++ svc_close_socket(svsk);
+ }
+ if (serv->sv_shutdown)
+ serv->sv_shutdown(serv);
+@@ -396,7 +396,7 @@ svc_destroy(struct svc_serv *serv)
+ svsk = list_entry(serv->sv_permsocks.next,
+ struct svc_sock,
+ sk_list);
+- svc_delete_socket(svsk);
++ svc_close_socket(svsk);
+ }
+
+ cache_clean_deferred(serv);
+--- linux-2.6.19.4.orig/net/sunrpc/svcsock.c
++++ linux-2.6.19.4/net/sunrpc/svcsock.c
+@@ -61,6 +61,12 @@
+ * after a clear, the socket must be read/accepted
+ * if this succeeds, it must be set again.
+ * SK_CLOSE can set at any time. It is never cleared.
++ * sk_inuse contains a bias of '1' until SK_DEAD is set.
++ * so when sk_inuse hits zero, we know the socket is dead
++ * and no-one is using it.
++ * SK_DEAD can only be set while SK_BUSY is held which ensures
++ * no other thread will be using the socket or will try to
++ * set SK_DEAD.
+ *
+ */
+
+@@ -69,6 +75,7 @@
+
+ static struct svc_sock *svc_setup_socket(struct svc_serv *, struct socket *,
+ int *errp, int pmap_reg);
++static void svc_delete_socket(struct svc_sock *svsk);
+ static void svc_udp_data_ready(struct sock *, int);
+ static int svc_udp_recvfrom(struct svc_rqst *);
+ static int svc_udp_sendto(struct svc_rqst *);
+@@ -299,8 +306,9 @@ void svc_reserve(struct svc_rqst *rqstp,
+ static inline void
+ svc_sock_put(struct svc_sock *svsk)
+ {
+- if (atomic_dec_and_test(&svsk->sk_inuse) &&
+- test_bit(SK_DEAD, &svsk->sk_flags)) {
++ if (atomic_dec_and_test(&svsk->sk_inuse)) {
++ BUG_ON(! test_bit(SK_DEAD, &svsk->sk_flags));
++
+ dprintk("svc: releasing dead socket\n");
+ if (svsk->sk_sock->file)
+ sockfd_put(svsk->sk_sock);
+@@ -490,7 +498,7 @@ svc_sock_names(char *buf, struct svc_ser
+
+ if (!serv)
+ return 0;
+- spin_lock(&serv->sv_lock);
++ spin_lock_bh(&serv->sv_lock);
+ list_for_each_entry(svsk, &serv->sv_permsocks, sk_list) {
+ int onelen = one_sock_name(buf+len, svsk);
+ if (toclose && strcmp(toclose, buf+len) == 0)
+@@ -498,12 +506,12 @@ svc_sock_names(char *buf, struct svc_ser
+ else
+ len += onelen;
+ }
+- spin_unlock(&serv->sv_lock);
++ spin_unlock_bh(&serv->sv_lock);
+ if (closesk)
+ /* Should unregister with portmap, but you cannot
+ * unregister just one protocol...
+ */
+- svc_delete_socket(closesk);
++ svc_close_socket(closesk);
+ else if (toclose)
+ return -ENOENT;
+ return len;
+@@ -653,6 +661,11 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
+ return svc_deferred_recv(rqstp);
+ }
+
++ if (test_bit(SK_CLOSE, &svsk->sk_flags)) {
++ svc_delete_socket(svsk);
++ return 0;
++ }
++
+ clear_bit(SK_DATA, &svsk->sk_flags);
+ while ((skb = skb_recv_datagram(svsk->sk_sk, 0, 1, &err)) == NULL) {
+ if (err == -EAGAIN) {
+@@ -1142,7 +1155,8 @@ svc_tcp_sendto(struct svc_rqst *rqstp)
+ rqstp->rq_sock->sk_server->sv_name,
+ (sent<0)?"got error":"sent only",
+ sent, xbufp->len);
+- svc_delete_socket(rqstp->rq_sock);
++ set_bit(SK_CLOSE, &rqstp->rq_sock->sk_flags);
++ svc_sock_enqueue(rqstp->rq_sock);
+ sent = -EAGAIN;
+ }
+ return sent;
+@@ -1461,7 +1475,7 @@ svc_setup_socket(struct svc_serv *serv,
+ svsk->sk_odata = inet->sk_data_ready;
+ svsk->sk_owspace = inet->sk_write_space;
+ svsk->sk_server = serv;
+- atomic_set(&svsk->sk_inuse, 0);
++ atomic_set(&svsk->sk_inuse, 1);
+ svsk->sk_lastrecv = get_seconds();
+ spin_lock_init(&svsk->sk_defer_lock);
+ INIT_LIST_HEAD(&svsk->sk_deferred);
+@@ -1582,7 +1596,7 @@ bummer:
+ /*
+ * Remove a dead socket
+ */
+-void
++static void
+ svc_delete_socket(struct svc_sock *svsk)
+ {
+ struct svc_serv *serv;
+@@ -1608,16 +1622,26 @@ svc_delete_socket(struct svc_sock *svsk)
+ * while still attached to a queue, the queue itself
+ * is about to be destroyed (in svc_destroy).
+ */
+- if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags))
++ if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags)) {
++ BUG_ON(atomic_read(&svsk->sk_inuse)<2);
++ atomic_dec(&svsk->sk_inuse);
+ if (test_bit(SK_TEMP, &svsk->sk_flags))
+ serv->sv_tmpcnt--;
++ }
+
+- /* This atomic_inc should be needed - svc_delete_socket
+- * should have the semantic of dropping a reference.
+- * But it doesn't yet....
+- */
+- atomic_inc(&svsk->sk_inuse);
+ spin_unlock_bh(&serv->sv_lock);
++}
++
++void svc_close_socket(struct svc_sock *svsk)
++{
++ set_bit(SK_CLOSE, &svsk->sk_flags);
++ if (test_and_set_bit(SK_BUSY, &svsk->sk_flags))
++ /* someone else will have to effect the close */
++ return;
++
++ atomic_inc(&svsk->sk_inuse);
++ svc_delete_socket(svsk);
++ clear_bit(SK_BUSY, &svsk->sk_flags);
+ svc_sock_put(svsk);
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007
+Message-Id: <20070221012758.925122216@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:27:58 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/21] 2.6.19-stable review
+Status: RO
+Content-Length: 998
+Lines: 25
+
+This is the start of the stable review cycle for the 2.6.19.5 release.
+
+This will probably be the last release of the 2.6.19-stable series, so
+if there are patches that you feel should be applied to that tree,
+please let me know.
+
+There are 21 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday February 23 00:00 UTC. Anything
+received after that time might be too late.
+
+The whole patch set can be downloaded at:
+ kernel.org/pub/linux/kernel/v2.6/testing/patch-2.6.19.5-rc1.gz
+
+thanks,
+
+the -stable release team
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
