From 40b40f1162999fd82d72b5c294cb525796e225e3 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Tue, 3 Feb 2009 14:44:51 -0800
Subject: [PATCH] .28 patches

---
 .../add-enable_ms-to-jsm-driver.patch         |  43 +++
 ...-config-on-some-powermacs-powerbooks.patch |  56 ++++
 ...mory-corruption-in-console-selection.patch |  41 +++
 ...ut-atkbd-samsung-nc10-key-repeat-fix.patch |  65 ++++
 .../iwlwifi-fix-rs_get_rate-warn_on.patch     | 105 +++++++
 ...-return-null-instead-of-link-failure.patch |  67 +++++
 ...lowest-supported-rate-index-is-not-0.patch |  70 +++++
 ...s-the-underlying-filesystem-on-lockt.patch |  86 ++++++
 ...nfsd4_lockt-if-a-stateowner-is-found.patch |  39 +++
 .../p54-fix-lm87-checksum-endianness.patch    |  54 ++++
 ..._read_eeprom-to-cope-with-tx_hdr_len.patch |  61 ++++
 ...-make-use-of-usb_anchor-s-facilities.patch | 282 ++++++++++++++++++
 ...patch-for-intel-tigerpoint-deviceids.patch |  40 +++
 queue-2.6.28/sata_nv-fix-mcp5x-reset.patch    | 105 +++++++
 queue-2.6.28/series                           |  14 +
 15 files changed, 1128 insertions(+)
 create mode 100644 queue-2.6.28/add-enable_ms-to-jsm-driver.patch
 create mode 100644 queue-2.6.28/fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
 create mode 100644 queue-2.6.28/fix-memory-corruption-in-console-selection.patch
 create mode 100644 queue-2.6.28/input-atkbd-samsung-nc10-key-repeat-fix.patch
 create mode 100644 queue-2.6.28/iwlwifi-fix-rs_get_rate-warn_on.patch
 create mode 100644 queue-2.6.28/kmalloc-return-null-instead-of-link-failure.patch
 create mode 100644 queue-2.6.28/minstrel-fix-warning-if-lowest-supported-rate-index-is-not-0.patch
 create mode 100644 queue-2.6.28/nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
 create mode 100644 queue-2.6.28/nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
 create mode 100644 queue-2.6.28/p54-fix-lm87-checksum-endianness.patch
 create mode 100644 queue-2.6.28/p54-fix-p54_read_eeprom-to-cope-with-tx_hdr_len.patch
 create mode 100644 queue-2.6.28/p54usb-rewriting-rx-tx-routines-to-make-use-of-usb_anchor-s-facilities.patch
 create mode 100644 queue-2.6.28/pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
 create mode 100644 queue-2.6.28/sata_nv-fix-mcp5x-reset.patch

diff --git a/queue-2.6.28/add-enable_ms-to-jsm-driver.patch b/queue-2.6.28/add-enable_ms-to-jsm-driver.patch
new file mode 100644
index 00000000000..0bad659b424
--- /dev/null
+++ b/queue-2.6.28/add-enable_ms-to-jsm-driver.patch
@@ -0,0 +1,43 @@
+From 0461ec5bc7745b89a8ab67ba0ea497abd58a6301 Mon Sep 17 00:00:00 2001
+From: Paul Larson <pl@linux.vnet.ibm.com>
+Date: Fri, 30 Jan 2009 10:21:49 -0600
+Subject: Add enable_ms to jsm driver
+
+From: Paul Larson <pl@linux.vnet.ibm.com>
+
+commit 0461ec5bc7745b89a8ab67ba0ea497abd58a6301 upstream.
+
+This fixes a crash observed when non-existant enable_ms function is
+called for jsm driver.
+
+Signed-off-by: Scott Kilau <Scott.Kilau@digi.com>
+Signed-off-by: Paul Larson <pl@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/jsm/jsm_tty.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/serial/jsm/jsm_tty.c
++++ b/drivers/serial/jsm/jsm_tty.c
+@@ -161,6 +161,11 @@ static void jsm_tty_stop_rx(struct uart_
+ 	channel->ch_bd->bd_ops->disable_receiver(channel);
+ }
+ 
++static void jsm_tty_enable_ms(struct uart_port *port)
++{
++	/* Nothing needed */
++}
++
+ static void jsm_tty_break(struct uart_port *port, int break_state)
+ {
+ 	unsigned long lock_flags;
+@@ -345,6 +350,7 @@ static struct uart_ops jsm_ops = {
+ 	.start_tx	= jsm_tty_start_tx,
+ 	.send_xchar	= jsm_tty_send_xchar,
+ 	.stop_rx	= jsm_tty_stop_rx,
++	.enable_ms	= jsm_tty_enable_ms,
+ 	.break_ctl	= jsm_tty_break,
+ 	.startup	= jsm_tty_open,
+ 	.shutdown	= jsm_tty_close,
diff --git a/queue-2.6.28/fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch b/queue-2.6.28/fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
new file mode 100644
index 00000000000..e57781b548c
--- /dev/null
+++ b/queue-2.6.28/fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
@@ -0,0 +1,56 @@
+From 7fbb7cadd062baf299fd8b26a80ea99da0c3fe01 Mon Sep 17 00:00:00 2001
+From: Risto Suominen <Risto.Suominen@gmail.com>
+Date: Tue, 13 Jan 2009 20:09:30 +0000
+Subject: fbdev/atyfb: Fix DSP config on some PowerMacs & PowerBooks
+
+From: Risto Suominen <Risto.Suominen@gmail.com>
+
+commit 7fbb7cadd062baf299fd8b26a80ea99da0c3fe01 upstream.
+
+Since the complete re-write in 2.6.10, some PowerMacs (At least PowerMac 5500
+and PowerMac G3 Beige rev A) with ATI Mach64 chip have suffered from unstable
+columns in their framebuffer image. This seems to depend on a value (4) read
+from PLL_EXT_CNTL register, which leads to incorrect DSP config parameters to
+be written to the chip. This patch uses a value calculated by aty_init_pll_ct
+instead, as a starting point.
+
+There are questions as to whether this should be extended to other platforms
+or maybe made dependent on specific chip types, but in the meantime, this has
+been tested on various powermacs and works for them so let's commit it.
+
+Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com>
+Tested-by: Michael Pettersson <mike@it.uu.se>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/aty/mach64_ct.c |   11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/video/aty/mach64_ct.c
++++ b/drivers/video/aty/mach64_ct.c
+@@ -8,6 +8,9 @@
+ #include <asm/io.h>
+ #include <video/mach64.h>
+ #include "atyfb.h"
++#ifdef CONFIG_PPC
++#include <asm/machdep.h>
++#endif
+ 
+ #undef DEBUG
+ 
+@@ -536,6 +539,14 @@ static int __devinit aty_init_pll_ct(con
+ 	pll->ct.xclk_post_div_real = postdividers[xpost_div];
+ 	pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8;
+ 
++#ifdef CONFIG_PPC
++	if (machine_is(powermac)) {
++		/* Override PLL_EXT_CNTL & 0x07. */
++		pll->ct.xclk_post_div = xpost_div;
++		pll->ct.xclk_ref_div = 1;
++	}
++#endif
++
+ #ifdef DEBUG
+ 	pllmclk = (1000000 * pll->ct.mclk_fb_mult * pll->ct.mclk_fb_div) /
+ 			(par->ref_clk_per * pll->ct.pll_ref_div);
diff --git a/queue-2.6.28/fix-memory-corruption-in-console-selection.patch b/queue-2.6.28/fix-memory-corruption-in-console-selection.patch
new file mode 100644
index 00000000000..c21126de800
--- /dev/null
+++ b/queue-2.6.28/fix-memory-corruption-in-console-selection.patch
@@ -0,0 +1,41 @@
+From 878b8619f711280fd05845e21956434b5e588cc4 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 30 Jan 2009 15:27:14 -0500
+Subject: Fix memory corruption in console selection
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 878b8619f711280fd05845e21956434b5e588cc4 upstream.
+
+Fix an off-by-two memory error in console selection.
+
+The loop below goes from sel_start to sel_end (inclusive), so it writes
+one more character.  This one more character was added to the allocated
+size (+1), but it was not multiplied by an UTF-8 multiplier.
+
+This patch fixes a memory corruption when UTF-8 console is used and the
+user selects a few characters, all of them 3-byte in UTF-8 (for example
+a frame line).
+
+When memory redzones are enabled, a redzone corruption is reported.
+When they are not enabled, trashing of random memory occurs.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/selection.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/selection.c
++++ b/drivers/char/selection.c
+@@ -268,7 +268,7 @@ int set_selection(const struct tiocl_sel
+ 
+ 	/* Allocate a new buffer before freeing the old one ... */
+ 	multiplier = use_unicode ? 3 : 1;  /* chars can take up to 3 bytes */
+-	bp = kmalloc((sel_end-sel_start)/2*multiplier+1, GFP_KERNEL);
++	bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
+ 	if (!bp) {
+ 		printk(KERN_WARNING "selection: kmalloc() failed\n");
+ 		clear_selection();
diff --git a/queue-2.6.28/input-atkbd-samsung-nc10-key-repeat-fix.patch b/queue-2.6.28/input-atkbd-samsung-nc10-key-repeat-fix.patch
new file mode 100644
index 00000000000..c57b30f9217
--- /dev/null
+++ b/queue-2.6.28/input-atkbd-samsung-nc10-key-repeat-fix.patch
@@ -0,0 +1,65 @@
+From 4200844bd9dc511088258437d564a187f0ffc94e Mon Sep 17 00:00:00 2001
+From: Stuart Hopkins <stuart@dodgy-geeza.com>
+Date: Sat, 20 Dec 2008 04:12:33 -0500
+Subject: Input: atkbd - Samsung NC10 key repeat fix
+
+From: Stuart Hopkins <stuart@dodgy-geeza.com>
+
+commit 4200844bd9dc511088258437d564a187f0ffc94e upstream.
+
+This patch fixes the key repeat issue with the Fn+F? keys on the new
+Samsung NC10 Netbook, so that the keys can be defined and used within
+ACPID correctly, otherwise the keys repeat indefinately.
+
+This solves part of http://bugzilla.kernel.org/show_bug.cgi?id=12021
+
+Signed-off-by: Stuart Hopkins <stuart@dodgy-geeza.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/keyboard/atkbd.c |   25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -884,6 +884,22 @@ static void atkbd_inventec_keymap_fixup(
+ }
+ 
+ /*
++ * Samsung NC10 with Fn+F? key release not working
++ */
++static void atkbd_samsung_keymap_fixup(struct atkbd *atkbd)
++{
++	const unsigned int forced_release_keys[] = {
++		0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9,
++	};
++	int i;
++
++	if (atkbd->set == 2)
++		for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
++			__set_bit(forced_release_keys[i],
++				  atkbd->force_release_mask);
++}
++
++/*
+  * atkbd_set_keycode_table() initializes keyboard's keycode table
+  * according to the selected scancode set
+  */
+@@ -1493,6 +1509,15 @@ static struct dmi_system_id atkbd_dmi_qu
+ 		.callback = atkbd_setup_fixup,
+ 		.driver_data = atkbd_inventec_keymap_fixup,
+ 	},
++	{
++		.ident = "Samsung NC10",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
++		},
++		.callback = atkbd_setup_fixup,
++		.driver_data = atkbd_samsung_keymap_fixup,
++	},
+ 	{ }
+ };
+ 
diff --git a/queue-2.6.28/iwlwifi-fix-rs_get_rate-warn_on.patch b/queue-2.6.28/iwlwifi-fix-rs_get_rate-warn_on.patch
new file mode 100644
index 00000000000..2c07427fcf7
--- /dev/null
+++ b/queue-2.6.28/iwlwifi-fix-rs_get_rate-warn_on.patch
@@ -0,0 +1,105 @@
+From c338ba3ca5bef2df2082d9e8d336ff7b2880c326 Mon Sep 17 00:00:00 2001
+From: Abbas, Mohamed <mohamed.abbas@intel.com>
+Date: Wed, 21 Jan 2009 10:58:02 -0800
+Subject: iwlwifi: fix rs_get_rate WARN_ON()
+
+From: Abbas, Mohamed <mohamed.abbas@intel.com>
+
+commit c338ba3ca5bef2df2082d9e8d336ff7b2880c326 upstream.
+
+In ieee80211_sta structure there is u64 supp_rates[IEEE80211_NUM_BANDS]
+this is filled with all support rate from assoc_resp.  If we associate
+with G-band AP only supp_rates of G-band will be set the other band
+supp_rates will be set to 0. If the user type this command
+this will cause mac80211 to set to new channel, mac80211
+does not disassociate in setting new channel, so the active
+band is now A-band. then in handling the new essid mac80211 will
+kick in the assoc steps which involve sending disassociation frame.
+in this mac80211 will WARN_ON sta->supp_rates[A_BAND] == 0.
+
+This fixes:
+http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1822
+http://www.kerneloops.org/searchweek.php?search=rs_get_rate
+
+Signed-off-by: mohamed abbas <mohamed.abbas@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-3945-rs.c |   12 +++++++++---
+ drivers/net/wireless/iwlwifi/iwl-agn-rs.c  |   12 ++++++++++--
+ 2 files changed, 19 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+@@ -647,12 +647,16 @@ static void rs_get_rate(void *priv_r, st
+ 	s8 scale_action = 0;
+ 	unsigned long flags;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+-	u16 fc, rate_mask;
++	u16 fc;
++	u16 rate_mask = 0;
+ 	struct iwl3945_priv *priv = (struct iwl3945_priv *)priv_r;
+ 	DECLARE_MAC_BUF(mac);
+ 
+ 	IWL_DEBUG_RATE("enter\n");
+ 
++	if (sta)
++		rate_mask = sta->supp_rates[sband->band];
++
+ 	/* Send management frames and broadcast/multicast data using lowest
+ 	 * rate. */
+ 	fc = le16_to_cpu(hdr->frame_control);
+@@ -660,11 +664,13 @@ static void rs_get_rate(void *priv_r, st
+ 	    is_multicast_ether_addr(hdr->addr1) ||
+ 	    !sta || !priv_sta) {
+ 		IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
+-		sel->rate_idx = rate_lowest_index(sband, sta);
++		if (!rate_mask)
++			sel->rate_idx = rate_lowest_index(sband, NULL);
++		else
++			sel->rate_idx = rate_lowest_index(sband, sta);
+ 		return;
+ 	}
+ 
+-	rate_mask = sta->supp_rates[sband->band];
+ 	index = min(rs_sta->last_txrate_idx & 0xffff, IWL_RATE_COUNT - 1);
+ 
+ 	if (sband->band == IEEE80211_BAND_5GHZ)
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+@@ -951,7 +951,8 @@ static void rs_tx_status(void *priv_r, s
+ 	}
+ 
+ 	/* See if there's a better rate or modulation mode to try. */
+-	rs_rate_scale_perform(priv, hdr, sta, lq_sta);
++	if (sta && sta->supp_rates[sband->band])
++		rs_rate_scale_perform(priv, hdr, sta, lq_sta);
+ out:
+ 	return;
+ }
+@@ -2114,15 +2115,22 @@ static void rs_get_rate(void *priv_r, st
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	__le16 fc;
+ 	struct iwl_lq_sta *lq_sta;
++	u64 mask_bit = 0;
+ 
+ 	IWL_DEBUG_RATE_LIMIT("rate scale calculate new rate for skb\n");
+ 
++	if (sta)
++		mask_bit = sta->supp_rates[sband->band];
++
+ 	/* Send management frames and broadcast/multicast data using lowest
+ 	 * rate. */
+ 	fc = hdr->frame_control;
+ 	if (!ieee80211_is_data(fc) || is_multicast_ether_addr(hdr->addr1) ||
+ 	    !sta || !priv_sta) {
+-		sel->rate_idx = rate_lowest_index(sband, sta);
++		if (!mask_bit)
++			sel->rate_idx = rate_lowest_index(sband, NULL);
++		else
++			sel->rate_idx = rate_lowest_index(sband, sta);
+ 		return;
+ 	}
+ 
diff --git a/queue-2.6.28/kmalloc-return-null-instead-of-link-failure.patch b/queue-2.6.28/kmalloc-return-null-instead-of-link-failure.patch
new file mode 100644
index 00000000000..1986ca7b853
--- /dev/null
+++ b/queue-2.6.28/kmalloc-return-null-instead-of-link-failure.patch
@@ -0,0 +1,67 @@
+From 1cf3eb2ff6b0844c678f2f48d0053b9d12b7da67 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Tue, 27 Jan 2009 23:48:59 +0200
+Subject: kmalloc: return NULL instead of link failure
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit 1cf3eb2ff6b0844c678f2f48d0053b9d12b7da67 upstream.
+
+The SLAB kmalloc with a constant value isn't consistent with the other
+implementations because it bails out with __you_cannot_kmalloc_that_much
+rather than returning NULL and properly allowing the caller to fall back
+to vmalloc or take other action.  This doesn't happen with a non-constant
+value or with SLOB or SLUB.
+
+Starting with 2.6.28, I've been seeing build failures on s390x.  This is
+due to init_section_page_cgroup trying to allocate 2.5MB when the max size
+for a kmalloc on s390x is 2MB.
+
+It's failing because the value is constant.  The workarounds at the call
+size are ugly and the caller shouldn't have to change behavior depending
+on what the backend of the API is.
+
+So, this patch eliminates the link failure and returns NULL like the other
+implementations.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Cc: Pekka Enberg <penberg@cs.helsinki.fi>
+Cc: Matt Mackall <mpm@selenic.com>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/slab_def.h |   10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/include/linux/slab_def.h
++++ b/include/linux/slab_def.h
+@@ -43,10 +43,7 @@ static inline void *kmalloc(size_t size,
+ 			i++;
+ #include <linux/kmalloc_sizes.h>
+ #undef CACHE
+-		{
+-			extern void __you_cannot_kmalloc_that_much(void);
+-			__you_cannot_kmalloc_that_much();
+-		}
++		return NULL;
+ found:
+ #ifdef CONFIG_ZONE_DMA
+ 		if (flags & GFP_DMA)
+@@ -77,10 +74,7 @@ static inline void *kmalloc_node(size_t 
+ 			i++;
+ #include <linux/kmalloc_sizes.h>
+ #undef CACHE
+-		{
+-			extern void __you_cannot_kmalloc_that_much(void);
+-			__you_cannot_kmalloc_that_much();
+-		}
++		return NULL;
+ found:
+ #ifdef CONFIG_ZONE_DMA
+ 		if (flags & GFP_DMA)
diff --git a/queue-2.6.28/minstrel-fix-warning-if-lowest-supported-rate-index-is-not-0.patch b/queue-2.6.28/minstrel-fix-warning-if-lowest-supported-rate-index-is-not-0.patch
new file mode 100644
index 00000000000..0bdbf7e9c38
--- /dev/null
+++ b/queue-2.6.28/minstrel-fix-warning-if-lowest-supported-rate-index-is-not-0.patch
@@ -0,0 +1,70 @@
+From chunkeey@web.de  Tue Feb  3 14:34:41 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Sat, 24 Jan 2009 10:45:10 +0100
+Subject: minstrel: fix warning if lowest supported rate index is not 0
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, Larry.Finger@lwfinger.net, linville@tuxdriver.com, nbd@openwrt.org
+Message-ID: <200901241045.11055.chunkeey@web.de>
+Content-Disposition: inline
+
+From: Christian Lamparter <chunkeey@web.de>
+
+commit d57854bb1d78ba89ffbfdfd1c3e95b52ed7478ff upstream
+
+This patch fixes the following WARNING (caused by rix_to_ndx): "
+>WARNING: at net/mac80211/rc80211_minstrel.c:69 minstrel_rate_init+0xd2/0x33a [mac80211]()
+>[...]
+>Call Trace:
+> warn_on_slowpath+0x51/0x75
+> _format_mac_addr+0x4c/0x88
+> minstrel_rate_init+0xd2/0x33a [mac80211]
+> print_mac+0x16/0x1b
+> schedule_hrtimeout_range+0xdc/0x107
+> ieee80211_add_station+0x158/0x1bd [mac80211]
+> nl80211_new_station+0x1b3/0x20b [cfg80211]
+
+The reason is that I'm experimenting with "g" only mode on a 802.11 b/g card.
+
+Therefore rate_lowest_index returns 4 (= 6Mbit, instead of usual 0 = 1Mbit).
+Since mi->r array is initialized with zeros in minstrel_alloc_sta,
+rix_to_ndx has a hard time to find the 6Mbit entry and will trigged the WARNING.
+
+Signed-off-by: Christian Lamparter <chunkeey@web.de>
+Acked-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/rc80211_minstrel.c |   10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -389,13 +389,15 @@ minstrel_rate_init(void *priv, struct ie
+ {
+ 	struct minstrel_sta_info *mi = priv_sta;
+ 	struct minstrel_priv *mp = priv;
+-	struct minstrel_rate *mr_ctl;
++	struct ieee80211_local *local = hw_to_local(mp->hw);
++	struct ieee80211_rate *ctl_rate;
+ 	unsigned int i, n = 0;
+ 	unsigned int t_slot = 9; /* FIXME: get real slot time */
+ 
+ 	mi->lowest_rix = rate_lowest_index(sband, sta);
+-	mr_ctl = &mi->r[rix_to_ndx(mi, mi->lowest_rix)];
+-	mi->sp_ack_dur = mr_ctl->ack_time;
++	ctl_rate = &sband->bitrates[mi->lowest_rix];
++	mi->sp_ack_dur = ieee80211_frame_duration(local, 10, ctl_rate->bitrate,
++				!!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
+ 
+ 	for (i = 0; i < sband->n_bitrates; i++) {
+ 		struct minstrel_rate *mr = &mi->r[n];
+@@ -410,7 +412,7 @@ minstrel_rate_init(void *priv, struct ie
+ 
+ 		mr->rix = i;
+ 		mr->bitrate = sband->bitrates[i].bitrate / 5;
+-		calc_rate_durations(mi, hw_to_local(mp->hw), mr,
++		calc_rate_durations(mi, local, mr,
+ 				&sband->bitrates[i]);
+ 
+ 		/* calculate maximum number of retransmissions before
diff --git a/queue-2.6.28/nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch b/queue-2.6.28/nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
new file mode 100644
index 00000000000..e39cf9d0aa5
--- /dev/null
+++ b/queue-2.6.28/nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
@@ -0,0 +1,86 @@
+From 55ef1274dddd4de387c54d110e354ffbb6cdc706 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Sat, 20 Dec 2008 11:58:38 -0800
+Subject: nfsd: Ensure nfsv4 calls the underlying filesystem on LOCKT
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 55ef1274dddd4de387c54d110e354ffbb6cdc706 upstream.
+
+Since nfsv4 allows LOCKT without an open, but the ->lock() method is a
+file method, we fake up a struct file in the nfsv4 code with just the
+fields we need initialized.  But we forgot to initialize the file
+operations, with the result that LOCKT never results in a call to the
+filesystem's ->lock() method (if it exists).
+
+We could just add that one more initialization.  But this hack of faking
+up a struct file with only some fields initialized seems the kind of
+thing that might cause more problems in the future.  We should either do
+an open and get a real struct file, or make lock-testing an inode (not a
+file) method.
+
+This patch does the former.
+
+Reported-by: Marc Eshel <eshel@almaden.ibm.com>
+Tested-by: Marc Eshel <eshel@almaden.ibm.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4state.c |   30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -2769,6 +2769,25 @@ out:
+ }
+ 
+ /*
++ * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
++ * so we do a temporary open here just to get an open file to pass to
++ * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
++ * inode operation.)
++ */
++static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
++{
++	struct file *file;
++	int err;
++
++	err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
++	if (err)
++		return err;
++	err = vfs_test_lock(file, lock);
++	nfsd_close(file);
++	return err;
++}
++
++/*
+  * LOCKT operation
+  */
+ __be32
+@@ -2776,7 +2795,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ 	    struct nfsd4_lockt *lockt)
+ {
+ 	struct inode *inode;
+-	struct file file;
+ 	struct file_lock file_lock;
+ 	int error;
+ 	__be32 status;
+@@ -2833,16 +2851,8 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ 
+ 	nfs4_transform_lock_offset(&file_lock);
+ 
+-	/* vfs_test_lock uses the struct file _only_ to resolve the inode.
+-	 * since LOCKT doesn't require an OPEN, and therefore a struct
+-	 * file may not exist, pass vfs_test_lock a struct file with
+-	 * only the dentry:inode set.
+-	 */
+-	memset(&file, 0, sizeof (struct file));
+-	file.f_path.dentry = cstate->current_fh.fh_dentry;
+-
+ 	status = nfs_ok;
+-	error = vfs_test_lock(&file, &file_lock);
++	error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+ 	if (error) {
+ 		status = nfserrno(error);
+ 		goto out;
diff --git a/queue-2.6.28/nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch b/queue-2.6.28/nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
new file mode 100644
index 00000000000..e9e2f7b8ef6
--- /dev/null
+++ b/queue-2.6.28/nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
@@ -0,0 +1,39 @@
+From fa82a491275a613b15489aab4b99acecb00958d3 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Thu, 22 Jan 2009 14:16:04 -0500
+Subject: nfsd: only set file_lock.fl_lmops in nfsd4_lockt if a stateowner is found
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit fa82a491275a613b15489aab4b99acecb00958d3 upstream.
+
+nfsd4_lockt does a search for a lockstateowner when building the lock
+struct to test. If one is found, it'll set fl_owner to it. Regardless of
+whether that happens, it'll also set fl_lmops. Given that this lock is
+basically a "lightweight" lock that's just used for checking conflicts,
+setting fl_lmops is probably not appropriate for it.
+
+This behavior exposed a bug in DLM's GETLK implementation where it
+wasn't clearing out the fields in the file_lock before filling in
+conflicting lock info. While we were able to fix this in DLM, it
+still seems pointless and dangerous to set the fl_lmops this way
+when we may have a NULL lockstateowner.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@pig.fieldses.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4state.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -2824,7 +2824,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ 		file_lock.fl_owner = (fl_owner_t)lockt->lt_stateowner;
+ 	file_lock.fl_pid = current->tgid;
+ 	file_lock.fl_flags = FL_POSIX;
+-	file_lock.fl_lmops = &nfsd_posix_mng_ops;
+ 
+ 	file_lock.fl_start = lockt->lt_offset;
+ 	if ((lockt->lt_length == ~(u64)0) || LOFF_OVERFLOW(lockt->lt_offset, lockt->lt_length))
diff --git a/queue-2.6.28/p54-fix-lm87-checksum-endianness.patch b/queue-2.6.28/p54-fix-lm87-checksum-endianness.patch
new file mode 100644
index 00000000000..46c8efcd348
--- /dev/null
+++ b/queue-2.6.28/p54-fix-lm87-checksum-endianness.patch
@@ -0,0 +1,54 @@
+From chunkeey@web.de  Tue Feb  3 14:30:26 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Sat, 24 Jan 2009 10:44:26 +0100
+Subject: p54: fix lm87 checksum endianness
+To: Greg KH <greg@kroah.com>
+Cc: Johannes Berg <johannes@sipsolutions.net>, stable@kernel.org, linville@tuxdriver.com, Larry.Finger@lwfinger.net
+Message-ID: <200901241044.26478.chunkeey@web.de>
+Content-Disposition: inline
+
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit c91276592695e13d1b52eab572551017cbf96ee7 upstream
+
+This fixes the checksum calculation for lm87 firmwares
+on big endian platforms, the device treats the data as
+an array of 32-bit little endian values so the driver
+needs to do that as well.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Acked-by: Christian Lamparter <chunkeey@web.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+---
+ drivers/net/wireless/p54/p54usb.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -222,13 +222,13 @@ static void p54u_tx_3887(struct ieee8021
+ 	usb_submit_urb(data_urb, GFP_ATOMIC);
+ }
+ 
+-static __le32 p54u_lm87_chksum(const u32 *data, size_t length)
++static __le32 p54u_lm87_chksum(const __le32 *data, size_t length)
+ {
+ 	u32 chk = 0;
+ 
+ 	length >>= 2;
+ 	while (length--) {
+-		chk ^= *data++;
++		chk ^= le32_to_cpu(*data++);
+ 		chk = (chk >> 5) ^ (chk << 3);
+ 	}
+ 
+@@ -247,7 +247,7 @@ static void p54u_tx_lm87(struct ieee8021
+ 	if (!data_urb)
+ 		return;
+ 
+-	hdr->chksum = p54u_lm87_chksum((u32 *)data, len);
++	hdr->chksum = p54u_lm87_chksum((__le32 *) data, len);
+ 	hdr->device_addr = data->req_id;
+ 
+ 	usb_fill_bulk_urb(data_urb, priv->udev,
diff --git a/queue-2.6.28/p54-fix-p54_read_eeprom-to-cope-with-tx_hdr_len.patch b/queue-2.6.28/p54-fix-p54_read_eeprom-to-cope-with-tx_hdr_len.patch
new file mode 100644
index 00000000000..99291385b1a
--- /dev/null
+++ b/queue-2.6.28/p54-fix-p54_read_eeprom-to-cope-with-tx_hdr_len.patch
@@ -0,0 +1,61 @@
+From chunkeey@web.de  Tue Feb  3 14:31:42 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Sat, 24 Jan 2009 10:44:40 +0100
+Subject: p54: fix p54_read_eeprom to cope with tx_hdr_len
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, Larry.Finger@lwfinger.net, linville@tuxdriver.com
+Message-ID: <200901241044.40580.chunkeey@web.de>
+Content-Disposition: inline
+
+From: Christian Lamparter <chunkeey@web.de>
+
+commit b92f30d65aeb0502e2ed8beb80c8465578b40002 upstream
+
+This patch fixes a regression in "p54: move eeprom code into common library"
+7cb770729ba895f73253dfcd46c3fcba45d896f9
+
+Some of p54usb's devices need a little headroom for the transportation and
+this was forgotten in the eeprom change.
+
+Signed-off-by: Christian Lamparter <chunkeey@web.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54common.c |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54common.c
++++ b/drivers/net/wireless/p54/p54common.c
+@@ -741,17 +741,19 @@ static void p54_assign_address(struct ie
+ int p54_read_eeprom(struct ieee80211_hw *dev)
+ {
+ 	struct p54_common *priv = dev->priv;
+-	struct p54_control_hdr *hdr = NULL;
++	struct p54_control_hdr *hdr = NULL, *org_hdr;
+ 	struct p54_eeprom_lm86 *eeprom_hdr;
+ 	size_t eeprom_size = 0x2020, offset = 0, blocksize;
+ 	int ret = -ENOMEM;
+ 	void *eeprom = NULL;
+ 
+-	hdr = (struct p54_control_hdr *)kzalloc(sizeof(*hdr) +
+-		sizeof(*eeprom_hdr) + EEPROM_READBACK_LEN, GFP_KERNEL);
+-	if (!hdr)
++	org_hdr = kzalloc(priv->tx_hdr_len + sizeof(*hdr) +
++			  sizeof(*eeprom_hdr) + EEPROM_READBACK_LEN,
++			  GFP_KERNEL);
++	if (!org_hdr)
+ 		goto free;
+ 
++	hdr = (void *) org_hdr + priv->tx_hdr_len;
+ 	priv->eeprom = kzalloc(EEPROM_READBACK_LEN, GFP_KERNEL);
+ 	if (!priv->eeprom)
+ 		goto free;
+@@ -790,7 +792,7 @@ int p54_read_eeprom(struct ieee80211_hw 
+ free:
+ 	kfree(priv->eeprom);
+ 	priv->eeprom = NULL;
+-	kfree(hdr);
++	kfree(org_hdr);
+ 	kfree(eeprom);
+ 
+ 	return ret;
diff --git a/queue-2.6.28/p54usb-rewriting-rx-tx-routines-to-make-use-of-usb_anchor-s-facilities.patch b/queue-2.6.28/p54usb-rewriting-rx-tx-routines-to-make-use-of-usb_anchor-s-facilities.patch
new file mode 100644
index 00000000000..e1ae136dc7d
--- /dev/null
+++ b/queue-2.6.28/p54usb-rewriting-rx-tx-routines-to-make-use-of-usb_anchor-s-facilities.patch
@@ -0,0 +1,282 @@
+From chunkeey@web.de  Tue Feb  3 14:33:39 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Sat, 24 Jan 2009 10:44:53 +0100
+Subject: p54usb: rewriting rx/tx routines to make use of usb_anchor's facilities
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, linville@tuxdriver.com, Larry.Finger@lwfinger.net
+Message-ID: <200901241044.54196.chunkeey@web.de>
+Content-Disposition: inline
+
+From: Christian Lamparter <chunkeey@web.de>
+
+commit dd397dc9dddfa2149a1bbc9e52ac7d5630737cec upstream
+
+Alan Stern found several flaws in p54usb's implementation and annotated:
+"usb_kill_urb() and similar routines do not expect an URB's completion
+routine to deallocate it.  This is almost obvious -- if the URB is deallocated
+before the completion routine returns then there's no way for usb_kill_urb
+to detect when the URB actually is complete."
+
+This patch addresses all known limitations in the old implementation and fixes
+khub's "use-after-freed" hang, when SLUB debug's poisoning option is enabled.
+
+Signed-off-by: Christian Lamparter <chunkeey@web.de>
+Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c |  143 +++++++++++++++++++++++---------------
+ drivers/net/wireless/p54/p54usb.h |    1 
+ 2 files changed, 89 insertions(+), 55 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -85,13 +85,13 @@ static void p54u_rx_cb(struct urb *urb)
+ 	struct ieee80211_hw *dev = info->dev;
+ 	struct p54u_priv *priv = dev->priv;
+ 
++	skb_unlink(skb, &priv->rx_queue);
++
+ 	if (unlikely(urb->status)) {
+-		info->urb = NULL;
+-		usb_free_urb(urb);
++		dev_kfree_skb_irq(skb);
+ 		return;
+ 	}
+ 
+-	skb_unlink(skb, &priv->rx_queue);
+ 	skb_put(skb, urb->actual_length);
+ 
+ 	if (priv->hw_type == P54U_NET2280)
+@@ -104,7 +104,6 @@ static void p54u_rx_cb(struct urb *urb)
+ 	if (p54_rx(dev, skb)) {
+ 		skb = dev_alloc_skb(priv->common.rx_mtu + 32);
+ 		if (unlikely(!skb)) {
+-			usb_free_urb(urb);
+ 			/* TODO check rx queue length and refill *somewhere* */
+ 			return;
+ 		}
+@@ -114,7 +113,6 @@ static void p54u_rx_cb(struct urb *urb)
+ 		info->dev = dev;
+ 		urb->transfer_buffer = skb_tail_pointer(skb);
+ 		urb->context = skb;
+-		skb_queue_tail(&priv->rx_queue, skb);
+ 	} else {
+ 		if (priv->hw_type == P54U_NET2280)
+ 			skb_push(skb, priv->common.tx_hdr_len);
+@@ -129,22 +127,23 @@ static void p54u_rx_cb(struct urb *urb)
+ 			WARN_ON(1);
+ 			urb->transfer_buffer = skb_tail_pointer(skb);
+ 		}
+-
+-		skb_queue_tail(&priv->rx_queue, skb);
+ 	}
+ 
+-	usb_submit_urb(urb, GFP_ATOMIC);
++	usb_anchor_urb(urb, &priv->submitted);
++	if (usb_submit_urb(urb, GFP_ATOMIC)) {
++		usb_unanchor_urb(urb);
++		dev_kfree_skb_irq(skb);
++	} else
++		skb_queue_tail(&priv->rx_queue, skb);
+ }
+ 
+-static void p54u_tx_cb(struct urb *urb)
+-{
+-	usb_free_urb(urb);
+-}
++static void p54u_tx_cb(struct urb *urb) { }
+ 
+-static void p54u_tx_free_cb(struct urb *urb)
++static void p54u_free_urbs(struct ieee80211_hw *dev)
+ {
+-	kfree(urb->transfer_buffer);
+-	usb_free_urb(urb);
++	struct p54u_priv *priv = dev->priv;
++
++	usb_kill_anchored_urbs(&priv->submitted);
+ }
+ 
+ static int p54u_init_urbs(struct ieee80211_hw *dev)
+@@ -153,15 +152,18 @@ static int p54u_init_urbs(struct ieee802
+ 	struct urb *entry;
+ 	struct sk_buff *skb;
+ 	struct p54u_rx_info *info;
++	int ret = 0;
+ 
+ 	while (skb_queue_len(&priv->rx_queue) < 32) {
+ 		skb = __dev_alloc_skb(priv->common.rx_mtu + 32, GFP_KERNEL);
+-		if (!skb)
+-			break;
++		if (!skb) {
++			ret = -ENOMEM;
++			goto err;
++		}
+ 		entry = usb_alloc_urb(0, GFP_KERNEL);
+ 		if (!entry) {
+-			kfree_skb(skb);
+-			break;
++			ret = -ENOMEM;
++			goto err;
+ 		}
+ 		usb_fill_bulk_urb(entry, priv->udev,
+ 				  usb_rcvbulkpipe(priv->udev, P54U_PIPE_DATA),
+@@ -171,26 +173,25 @@ static int p54u_init_urbs(struct ieee802
+ 		info->urb = entry;
+ 		info->dev = dev;
+ 		skb_queue_tail(&priv->rx_queue, skb);
+-		usb_submit_urb(entry, GFP_KERNEL);
++
++		usb_anchor_urb(entry, &priv->submitted);
++		ret = usb_submit_urb(entry, GFP_KERNEL);
++		if (ret) {
++			skb_unlink(skb, &priv->rx_queue);
++			usb_unanchor_urb(entry);
++			goto err;
++		}
++		usb_free_urb(entry);
++		entry = NULL;
+ 	}
+ 
+ 	return 0;
+-}
+-
+-static void p54u_free_urbs(struct ieee80211_hw *dev)
+-{
+-	struct p54u_priv *priv = dev->priv;
+-	struct p54u_rx_info *info;
+-	struct sk_buff *skb;
+ 
+-	while ((skb = skb_dequeue(&priv->rx_queue))) {
+-		info = (struct p54u_rx_info *) skb->cb;
+-		if (!info->urb)
+-			continue;
+-
+-		usb_kill_urb(info->urb);
+-		kfree_skb(skb);
+-	}
++err:
++	usb_free_urb(entry);
++	kfree_skb(skb);
++	p54u_free_urbs(dev);
++	return ret;
+ }
+ 
+ static void p54u_tx_3887(struct ieee80211_hw *dev, struct p54_control_hdr *data,
+@@ -210,16 +211,29 @@ static void p54u_tx_3887(struct ieee8021
+ 	}
+ 
+ 	usb_fill_bulk_urb(addr_urb, priv->udev,
+-		usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), &data->req_id,
+-		sizeof(data->req_id), p54u_tx_cb, dev);
++			  usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
++			  &data->req_id, sizeof(data->req_id), p54u_tx_cb,
++			  dev);
+ 	usb_fill_bulk_urb(data_urb, priv->udev,
+-		usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), data, len,
+-		free_on_tx ? p54u_tx_free_cb : p54u_tx_cb, dev);
++			  usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
++			  data, len, p54u_tx_cb, dev);
+ 	addr_urb->transfer_flags |= URB_ZERO_PACKET;
+-	data_urb->transfer_flags |= URB_ZERO_PACKET;
++	data_urb->transfer_flags |= URB_ZERO_PACKET |
++				    (free_on_tx ? URB_FREE_BUFFER : 0);
+ 
+-	usb_submit_urb(addr_urb, GFP_ATOMIC);
+-	usb_submit_urb(data_urb, GFP_ATOMIC);
++	usb_anchor_urb(addr_urb, &priv->submitted);
++	if (usb_submit_urb(addr_urb, GFP_ATOMIC)) {
++		usb_unanchor_urb(addr_urb);
++		goto out;
++	}
++
++	usb_anchor_urb(data_urb, &priv->submitted);
++	if (usb_submit_urb(data_urb, GFP_ATOMIC))
++		usb_unanchor_urb(data_urb);
++
++out:
++	usb_free_urb(addr_urb);
++	usb_free_urb(data_urb);
+ }
+ 
+ static __le32 p54u_lm87_chksum(const __le32 *data, size_t length)
+@@ -251,12 +265,16 @@ static void p54u_tx_lm87(struct ieee8021
+ 	hdr->device_addr = data->req_id;
+ 
+ 	usb_fill_bulk_urb(data_urb, priv->udev,
+-		usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
+-		len + sizeof(*hdr), free_on_tx ? p54u_tx_free_cb : p54u_tx_cb,
+-		dev);
+-	data_urb->transfer_flags |= URB_ZERO_PACKET;
++			  usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
++			  len + sizeof(*hdr), p54u_tx_cb, dev);
++	data_urb->transfer_flags |= URB_ZERO_PACKET |
++				    (free_on_tx ? URB_FREE_BUFFER : 0);
++
++	usb_anchor_urb(data_urb, &priv->submitted);
++	if (usb_submit_urb(data_urb, GFP_ATOMIC))
++		usb_unanchor_urb(data_urb);
+ 
+-	usb_submit_urb(data_urb, GFP_ATOMIC);
++	usb_free_urb(data_urb);
+ }
+ 
+ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct p54_control_hdr *data,
+@@ -295,16 +313,30 @@ static void p54u_tx_net2280(struct ieee8
+ 	hdr->len = cpu_to_le16(len);
+ 
+ 	usb_fill_bulk_urb(int_urb, priv->udev,
+-		usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV), reg, sizeof(*reg),
+-		p54u_tx_free_cb, dev);
+-	int_urb->transfer_flags |= URB_ZERO_PACKET;
+-	usb_submit_urb(int_urb, GFP_ATOMIC);
++			  usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV),
++			  reg, sizeof(*reg), p54u_tx_cb, dev);
++	int_urb->transfer_flags |= URB_ZERO_PACKET | URB_FREE_BUFFER;
++	usb_anchor_urb(int_urb, &priv->submitted);
++	if (usb_submit_urb(int_urb, GFP_ATOMIC)) {
++		usb_unanchor_urb(int_urb);
++		goto out;
++	}
+ 
+ 	usb_fill_bulk_urb(data_urb, priv->udev,
+-		usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr, len + sizeof(*hdr),
+-		free_on_tx ? p54u_tx_free_cb : p54u_tx_cb, dev);
+-	data_urb->transfer_flags |= URB_ZERO_PACKET;
+-	usb_submit_urb(data_urb, GFP_ATOMIC);
++			  usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
++			  len + sizeof(*hdr), p54u_tx_cb, dev);
++	data_urb->transfer_flags |= URB_ZERO_PACKET |
++				    (free_on_tx ? URB_FREE_BUFFER : 0);
++
++	usb_anchor_urb(int_urb, &priv->submitted);
++	if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
++		usb_unanchor_urb(data_urb);
++		goto out;
++	}
++
++out:
++	usb_free_urb(int_urb);
++	usb_free_urb(data_urb);
+ }
+ 
+ static int p54u_write(struct p54u_priv *priv,
+@@ -805,6 +837,7 @@ static int __devinit p54u_probe(struct u
+ 	SET_IEEE80211_DEV(dev, &intf->dev);
+ 	usb_set_intfdata(intf, dev);
+ 	priv->udev = udev;
++	init_usb_anchor(&priv->submitted);
+ 
+ 	usb_get_dev(udev);
+ 
+--- a/drivers/net/wireless/p54/p54usb.h
++++ b/drivers/net/wireless/p54/p54usb.h
+@@ -133,6 +133,7 @@ struct p54u_priv {
+ 
+ 	spinlock_t lock;
+ 	struct sk_buff_head rx_queue;
++	struct usb_anchor submitted;
+ };
+ 
+ #endif /* P54USB_H */
diff --git a/queue-2.6.28/pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch b/queue-2.6.28/pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
new file mode 100644
index 00000000000..b9a919becf8
--- /dev/null
+++ b/queue-2.6.28/pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
@@ -0,0 +1,40 @@
+From 57064d213d2e44654d4f13c66df135b5e7389a26 Mon Sep 17 00:00:00 2001
+From: Seth Heasley <seth.heasley@intel.com>
+Date: Fri, 23 Jan 2009 12:43:38 -0800
+Subject: PCI: irq and pci_ids patch for Intel Tigerpoint DeviceIDs
+
+From: Seth Heasley <seth.heasley@intel.com>
+
+commit 57064d213d2e44654d4f13c66df135b5e7389a26 upstream.
+
+This patch adds the Intel Tigerpoint LPC Controller DeviceIDs.
+
+Signed-off-by: Seth Heasley <seth.heasley@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/irq.c      |    1 +
+ include/linux/pci_ids.h |    1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/x86/pci/irq.c
++++ b/arch/x86/pci/irq.c
+@@ -573,6 +573,7 @@ static __init int intel_router_probe(str
+ 	case PCI_DEVICE_ID_INTEL_ICH7_1:
+ 	case PCI_DEVICE_ID_INTEL_ICH7_30:
+ 	case PCI_DEVICE_ID_INTEL_ICH7_31:
++	case PCI_DEVICE_ID_INTEL_TGP_LPC:
+ 	case PCI_DEVICE_ID_INTEL_ESB2_0:
+ 	case PCI_DEVICE_ID_INTEL_ICH8_0:
+ 	case PCI_DEVICE_ID_INTEL_ICH8_1:
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2418,6 +2418,7 @@
+ #define PCI_DEVICE_ID_INTEL_ICH7_0	0x27b8
+ #define PCI_DEVICE_ID_INTEL_ICH7_1	0x27b9
+ #define PCI_DEVICE_ID_INTEL_ICH7_30	0x27b0
++#define PCI_DEVICE_ID_INTEL_TGP_LPC	0x27bc
+ #define PCI_DEVICE_ID_INTEL_ICH7_31	0x27bd
+ #define PCI_DEVICE_ID_INTEL_ICH7_17	0x27da
+ #define PCI_DEVICE_ID_INTEL_ICH7_19	0x27dd
diff --git a/queue-2.6.28/sata_nv-fix-mcp5x-reset.patch b/queue-2.6.28/sata_nv-fix-mcp5x-reset.patch
new file mode 100644
index 00000000000..e6ff9801bf5
--- /dev/null
+++ b/queue-2.6.28/sata_nv-fix-mcp5x-reset.patch
@@ -0,0 +1,105 @@
+From 2d775708bc6613f1be47f1e720781343341ecc94 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Sun, 25 Jan 2009 11:29:38 +0900
+Subject: sata_nv: fix MCP5x reset
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 2d775708bc6613f1be47f1e720781343341ecc94 upstream.
+
+MCP5x family of controllers seem to share much more with nf2's as far
+as reset protocol is concerned.  It requires heardreset to get the PHY
+going and classfication code report after hardreset is unreliable.
+Create a new board type MCP5x and use noclassify hardreset.  SWNCQ is
+modified to inherit from this new type.
+
+This fixes hotplug regression reported in kernel bz#12351.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_nv.c |   42 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 29 insertions(+), 13 deletions(-)
+
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -352,6 +352,7 @@ enum nv_host_type
+ 	NFORCE3 = NFORCE2,	/* NF2 == NF3 as far as sata_nv is concerned */
+ 	CK804,
+ 	ADMA,
++	MCP5x,
+ 	SWNCQ,
+ };
+ 
+@@ -363,10 +364,10 @@ static const struct pci_device_id nv_pci
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA2), CK804 },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA), CK804 },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA2), CK804 },
+-	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), SWNCQ },
+-	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), SWNCQ },
+-	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), SWNCQ },
+-	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), SWNCQ },
++	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), MCP5x },
++	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), MCP5x },
++	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), MCP5x },
++	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), MCP5x },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), GENERIC },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), GENERIC },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), GENERIC },
+@@ -467,8 +468,19 @@ static struct ata_port_operations nv_adm
+ 	.host_stop		= nv_adma_host_stop,
+ };
+ 
++/* Kernel bz#12351 reports that when SWNCQ is enabled, for hotplug to
++ * work, hardreset should be used and hardreset can't report proper
++ * signature, which suggests that mcp5x is closer to nf2 as long as
++ * reset quirkiness is concerned.  Define separate ops for mcp5x with
++ * nv_noclassify_hardreset().
++ */
++static struct ata_port_operations nv_mcp5x_ops = {
++	.inherits		= &nv_common_ops,
++	.hardreset		= nv_noclassify_hardreset,
++};
++
+ static struct ata_port_operations nv_swncq_ops = {
+-	.inherits		= &nv_generic_ops,
++	.inherits		= &nv_mcp5x_ops,
+ 
+ 	.qc_defer		= ata_std_qc_defer,
+ 	.qc_prep		= nv_swncq_qc_prep,
+@@ -531,6 +543,15 @@ static const struct ata_port_info nv_por
+ 		.port_ops	= &nv_adma_ops,
+ 		.private_data	= NV_PI_PRIV(nv_adma_interrupt, &nv_adma_sht),
+ 	},
++	/* MCP5x */
++	{
++		.flags		= ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY,
++		.pio_mask	= NV_PIO_MASK,
++		.mwdma_mask	= NV_MWDMA_MASK,
++		.udma_mask	= NV_UDMA_MASK,
++		.port_ops	= &nv_mcp5x_ops,
++		.private_data	= NV_PI_PRIV(nv_generic_interrupt, &nv_sht),
++	},
+ 	/* SWNCQ */
+ 	{
+ 		.flags	        = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+@@ -2355,14 +2376,9 @@ static int nv_init_one(struct pci_dev *p
+ 	if (type == CK804 && adma_enabled) {
+ 		dev_printk(KERN_NOTICE, &pdev->dev, "Using ADMA mode\n");
+ 		type = ADMA;
+-	}
+-
+-	if (type == SWNCQ) {
+-		if (swncq_enabled)
+-			dev_printk(KERN_NOTICE, &pdev->dev,
+-				   "Using SWNCQ mode\n");
+-		else
+-			type = GENERIC;
++	} else if (type == MCP5x && swncq_enabled) {
++		dev_printk(KERN_NOTICE, &pdev->dev, "Using SWNCQ mode\n");
++		type = SWNCQ;
+ 	}
+ 
+ 	ppi[0] = &nv_port_info[type];
diff --git a/queue-2.6.28/series b/queue-2.6.28/series
index a910a79db21..2d41a5ba642 100644
--- a/queue-2.6.28/series
+++ b/queue-2.6.28/series
@@ -7,3 +7,17 @@ x86-use-early-clobbers-in-usercopy-.c.patch
 cifs-make-sure-we-allocate-enough-storage-for-socket-address.patch
 netfilter-ctnetlink-fix-scheduling-while-atomic.patch
 orinoco-move-kmalloc-outside-spinlock-in-orinoco_ioctl_set_genie.patch
+fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
+kmalloc-return-null-instead-of-link-failure.patch
+sata_nv-fix-mcp5x-reset.patch
+fix-memory-corruption-in-console-selection.patch
+add-enable_ms-to-jsm-driver.patch
+input-atkbd-samsung-nc10-key-repeat-fix.patch
+nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
+nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
+iwlwifi-fix-rs_get_rate-warn_on.patch
+p54-fix-lm87-checksum-endianness.patch
+p54-fix-p54_read_eeprom-to-cope-with-tx_hdr_len.patch
+p54usb-rewriting-rx-tx-routines-to-make-use-of-usb_anchor-s-facilities.patch
+minstrel-fix-warning-if-lowest-supported-rate-index-is-not-0.patch
+pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
-- 
2.47.3