+++ /dev/null
-# core kernel changes
-lockdep-fix-mismatched-lockdep_depth-curr_chain_hash.patch
-locks-fix-possible-infinite-loop-in-posix-deadlock-detection.patch
-remove-broken-ptrace-special-case-code-from-file-mapping.patch
-param_sysfs_builtin-memchr-argument-fix.patch
-howto-update-ja_jp-howto-with-latest-changes.patch
-slub-fix-memory-leak-by-not-reusing-cpu_slab.patch
-writeback-don-t-propagate-aop_writepage_activate.patch
-splice-fix-double-kunmap-in-vmsplice-copy-path.patch
-fix-the-softlockup-watchdog-to-actually-work.patch
-sched-keep-utime-stime-monotonic.patch
-fix-compat-futex-hangs.patch
-fix-tmpfs-bug-and-aop_writepage_activate.patch
-block-fix-bad-sharing-of-tag-busy-list-on-queues-with-shared-tag-maps.patch
-
-
-# arch only patches
-fix-sparc64-niagara-optimized-raid-xor-asm.patch
-fix-sparc64-map_fixed-handling-of-framebuffer-mmaps.patch
-mips-mt-fix-bug-in-multithreaded-kernels.patch
-mips-r1-fix-hazard-barriers-to-make-kernels-work-on-r2-also.patch
-powerpc-fix-handling-of-stfiwx-math-emulation.patch
-powerpc-fix-platinumfb-framebuffer.patch
-powerpc-make-sure-to-of_node_get-the-result-of-pci_device_to_of_node.patch
-uml-stop-using-libc-asm-page.h.patch
-uml-fix-kernel-vs-libc-symbols-clash.patch
-uml-stop-using-libc-asm-user.h.patch
-uml-kill-subprocesses-on-exit.patch
-xen-multicall-callbacks.patch
-xen-handle-lazy-cr3-on-unpin.patch
-xen-fix-register_vcpu_info.patch
-xen-xfs-unmap.patch
-x86-fix-global_flush_tlb-bug.patch
-x86-setup-handle-boot-loaders-which-set-up-the-stack-incorrectly.patch
-x86-setup-sizeof-is-unsigned-unbreak-comparisons.patch
-x86-fix-tsc-clock-source-calibration-error.patch
-revert-x86_64-allocate-sparsemem-memmap-above-4g.patch
-
-# network core
-mac80211-filter-locally-originated-multicast-frames.patch
-mac80211-improve-sanity-checks-on-injected-packets.patch
-add-get_unaligned-to-ieee80211_get_radiotap_len.patch
-fix-advertised-packet-scheduler-timer-resolution.patch
-fix-9p-protocol-build.patch
-fix-skb_with_overhead-calculations.patch
-fix-kernel_accept-return-handling.patch
-softmac-fix-wext-mlme-request-reason-code-endianness.patch
-fix-error-returns-in-sys_socketpair.patch
-fix-teql-oops.patch
-fix-endianness-bug-in-u32-classifier.patch
-fix-vlan-address-syncing.patch
-fix-set_vlan_ingress_priority_cmd-error-return.patch
-fix-crypto_alloc_comp-error-checking.patch
-fix-netlink-timeouts.patch
-netfilter-nf_conntrack_tcp-fix-connection-reopening.patch
-ieee80211-fix-tkip-qos-bug.patch
-mac80211-reorder-association-debug-output.patch
-mac80211-store-channel-info-in-sta_bss_list.patch
-mac80211-store-ssid-in-sta_bss_list.patch
-mac80211-honor-iw_scan_this_essid-in-siwscan-ioctl.patch
-mac80211-only-honor-iw_scan_this_essid-in-sta-ibss-and-ap-modes.patch
-mac80211-make-ieee802_11_parse_elems-return-void.patch
-
-
-# network drivers
-libertas-more-endianness-breakage.patch
-libertas-fix-endianness-breakage.patch
-ehea-64k-page-kernel-support-fix.patch
-forcedeth-msi-bugfix.patch
-forcedeth-add-mcp77-device-ids.patch
-tg3-fix-performance-regression-on-5705.patch
-fix-l2tp-oopses.patch
-skge-ram-buffer-fix.patch
-skge-xm-phy-poll.patch
-sky2-status-race.patch
-sky2-ethdump.patch
-sky2-phy-power.patch
-zd1201-avoid-null-ptr-access-of-skb-dev.patch
-ipw2100-send-wext-scan-events.patch
-rtl8187-fix-more-frag-bit-checking-rts-duration-calc.patch
-zd1211rw-fix-oops-when-ejecting-install-media.patch
-
-# other drivers
-i915-fix-vbl-swap-allocation-size.patch
-hwmon-w83627hf-fix-setting-fan-min-right-after-driver-load.patch
-hwmon-w83627hf-don-t-assume-bank-0.patch
-hwmon-lm87-fix-a-division-by-zero.patch
-hwmon-lm87-disable-vid-when-it-should-be.patch
-ib-uverbs-fix-checking-of-userspace-object-ownership.patch
-ib-mthca-use-mmiowb-to-avoid-firmware-commands-getting-jumbled-up.patch
-alsa-hda-codec-avoid-zero-nid-in-line_out_pins-of-stac-codecs.patch
-alsa-fix-selector-unit-bug-affecting-some-usb-speakerphones.patch
-alsa-fix-build-error-without-config_has_dma.patch
-alsa-emu10k1-fix-memory-corruption.patch
-alsa-hdsp-fix-zero-division.patch
-libata-sync-ncq-blacklist-with-upstream.patch
-dm-delay-fix-status.patch
-dm-fix-thaw_bdev.patch
-md-fix-an-unsigned-compare-to-allow-creation-of-bitmaps-with-v1.0-metadata.patch
-md-raid5-not-raid6-fix-clearing-of-biofill-operations.patch
-msi-use-correct-data-offset-for-32-bit-msi-in-read_msi_msg.patch
-usb-remove-usb_quirk_no_autosuspend.patch
-usb-gadget-ether-prevent-oops-caused-by-error-interrupt-race.patch
-usb-mutual-exclusion-for-ehci-init-and-port-resets.patch
-usb-add-urb_free_buffer-to-permissible-flags.patch
-usb-usbserial-fix-potential-deadlock-between-write-and-irq.patch
-alsa-hda-codec-add-array-terminator-for-dmic-in-stac-codec.patch
-i4l-fix-random-hard-freeze-with-avm-c4-card.patch
-i4l-fix-random-freezes-with-avm-b1-drivers.patch
-ide-fix-serverworks.c-udma-regression.patch
-ide-add-ide_get_paired_drive-helper.patch
-ide-fix-siimage-driver-accessing-beyond-array-boundary.patch
-ide-fix-cs5535-driver-accessing-beyond-array-boundary.patch
-hptiop-avoid-buffer-overflow-when-returning-sense-data.patch
-char-rocket-fix-dynamic_dev-tty.patch
-char-moxa-fix-and-optimise-empty-timer.patch
-radeon-set-the-address-to-access-the-gart-table-on-the-cpu-side-correctly.patch
-libata-add-hts542525k9sa00-to-ncq-blacklist.patch
-libata-backport-ata_flag_no_srst-and-ata_flag_assume_ata.patch
-libata-backport-ata_flag_no_srst-and-ata_flag_assume_ata-part-2.patch
-acpi-sleep-fix-gpe-suspend-cleanup.patch
-acpi-suspend-wrong-order-of-gpe-restore.patch
-
-# file systems
-minixfs-limit-minixfs-printks-on-corrupted-dir-i_size.patch
-ocfs2-fix-write-performance-regression.patch
-nfs-fix-a-writeback-race.patch
-
--- /dev/null
+ Documentation/ja_JP/HOWTO | 84 ++++++++++++++++++++++++----------------------
+ block/ll_rw_blk.c | 8 +---
+ fs/locks.c | 11 ++++++
+ fs/proc/array.c | 6 ++-
+ fs/splice.c | 2 -
+ include/linux/blkdev.h | 2 -
+ include/linux/sched.h | 1
+ kernel/fork.c | 2 +
+ kernel/futex_compat.c | 27 ++++++++++----
+ kernel/lockdep.c | 10 ++---
+ kernel/params.c | 8 +++-
+ kernel/softlockup.c | 7 ++-
+ mm/filemap.c | 13 +------
+ mm/page-writeback.c | 4 +-
+ mm/shmem.c | 15 ++++++++
+ mm/slub.c | 22 ------------
+ 16 files changed, 125 insertions(+), 97 deletions(-)
--- /dev/null
+From gregkh@mini.kroah.org Wed Nov 14 21:31:20 2007
+Message-Id: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/13] 2.6.23-stable review, core kernel changes
+Status: RO
+Content-Length: 1639
+Lines: 42
+
+This is the start of the stable review cycle for the 2.6.23.X release.
+There are 13 patches in this series, all will be posted as a response
+to this one. If anyone has any issues with these being applied, please
+let us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the
+Cc: line. If you wish to be a reviewer, please email stable@kernel.org
+to add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday 00:00:00 UTC. Anything received
+after that time might be too late.
+
+This set of patches focuses on only the core kernel. Other sets of
+patches will follow if you are interested in those instead.
+
+The diffstat of this review series is included below.
+
+thanks,
+
+greg k-h
+
+---------------
+
+ Documentation/ja_JP/HOWTO | 84 ++++++++++++++++++++++++----------------------
+ block/ll_rw_blk.c | 8 +---
+ fs/locks.c | 11 ++++++
+ fs/proc/array.c | 6 ++-
+ fs/splice.c | 2 -
+ include/linux/blkdev.h | 2 -
+ include/linux/sched.h | 1
+ kernel/fork.c | 2 +
+ kernel/futex_compat.c | 27 ++++++++++----
+ kernel/lockdep.c | 10 ++---
+ kernel/params.c | 8 +++-
+ kernel/softlockup.c | 7 ++-
+ mm/filemap.c | 13 +------
+ mm/page-writeback.c | 4 +-
+ mm/shmem.c | 15 ++++++++
+ mm/slub.c | 22 ------------
+ 16 files changed, 125 insertions(+), 97 deletions(-)
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:21 2007
+Message-Id: <20071115053120.905058538@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "George G. Davis" <gdavis@mvista.com>,
+ linux-fsdevel@vger.kernel.org,
+ "J. Bruce Fields" <bfields@citi.umich.edu>,
+ Alan Cox <alan@redhat.com>
+Subject: [patch 02/13] locks: fix possible infinite loop in posix deadlock detection
+Content-Disposition: inline; filename=locks-fix-possible-infinite-loop-in-posix-deadlock-detection.patch
+Status: RO
+Content-Length: 2089
+Lines: 63
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+patch 97855b49b6bac0bd25f16b017883634d13591d00 in mainline.
+
+It's currently possible to send posix_locks_deadlock() into an infinite
+loop (under the BKL).
+
+For now, fix this just by bailing out after a few iterations. We may
+want to fix this in a way that better clarifies the semantics of
+deadlock detection. But that will take more time, and this minimal fix
+is probably adequate for any realistic scenario, and is simple enough to
+be appropriate for applying to stable kernels now.
+
+Thanks to George Davis for reporting the problem.
+
+Cc: "George G. Davis" <gdavis@mvista.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Acked-by: Alan Cox <alan@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/locks.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -694,11 +694,20 @@ EXPORT_SYMBOL(posix_test_lock);
+ * Note: the above assumption may not be true when handling lock requests
+ * from a broken NFS client. But broken NFS clients have a lot more to
+ * worry about than proper deadlock detection anyway... --okir
++ *
++ * However, the failure of this assumption (also possible in the case of
++ * multiple tasks sharing the same open file table) also means there's no
++ * guarantee that the loop below will terminate. As a hack, we give up
++ * after a few iterations.
+ */
++
++#define MAX_DEADLK_ITERATIONS 10
++
+ static int posix_locks_deadlock(struct file_lock *caller_fl,
+ struct file_lock *block_fl)
+ {
+ struct list_head *tmp;
++ int i = 0;
+
+ next_task:
+ if (posix_same_owner(caller_fl, block_fl))
+@@ -706,6 +715,8 @@ next_task:
+ list_for_each(tmp, &blocked_list) {
+ struct file_lock *fl = list_entry(tmp, struct file_lock, fl_link);
+ if (posix_same_owner(fl, block_fl)) {
++ if (i++ > MAX_DEADLK_ITERATIONS)
++ return 0;
+ fl = fl->fl_next;
+ block_fl = fl;
+ goto next_task;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:21 2007
+Message-Id: <20071115053121.077518146@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Duane Griffin <duaneg@dghda.com>,
+ Nick Piggin <npiggin@suse.de>
+Subject: [patch 03/13] Remove broken ptrace() special-case code from file mapping
+Content-Disposition: inline; filename=remove-broken-ptrace-special-case-code-from-file-mapping.patch
+Status: RO
+Content-Length: 2128
+Lines: 70
+
+
+stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+The kernel has for random historical reasons allowed ptrace() accesses
+to access (and insert) pages into the page cache above the size of the
+file.
+
+However, Nick broke that by mistake when doing the new fault handling in
+commit 54cb8821de07f2ffcd28c380ce9b93d5784b40d7 ("mm: merge populate and
+nopage into fault (fixes nonlinear)". The breakage caused a hang with
+gdb when trying to access the invalid page.
+
+The ptrace "feature" really isn't worth resurrecting, since it really is
+wrong both from a portability _and_ from an internal page cache validity
+standpoint. So this removes those old broken remnants, and fixes the
+ptrace() hang in the process.
+
+Noticed and bisected by Duane Griffin, who also supplied a test-case
+(quoth Nick: "Well that's probably the best bug report I've ever had,
+thanks Duane!").
+
+Cc: Duane Griffin <duaneg@dghda.com>
+Acked-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/filemap.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1312,7 +1312,7 @@ int filemap_fault(struct vm_area_struct
+
+ size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+ if (vmf->pgoff >= size)
+- goto outside_data_content;
++ return VM_FAULT_SIGBUS;
+
+ /* If we don't want any read-ahead, don't bother */
+ if (VM_RandomReadHint(vma))
+@@ -1389,7 +1389,7 @@ retry_find:
+ if (unlikely(vmf->pgoff >= size)) {
+ unlock_page(page);
+ page_cache_release(page);
+- goto outside_data_content;
++ return VM_FAULT_SIGBUS;
+ }
+
+ /*
+@@ -1400,15 +1400,6 @@ retry_find:
+ vmf->page = page;
+ return ret | VM_FAULT_LOCKED;
+
+-outside_data_content:
+- /*
+- * An external ptracer can access pages that normally aren't
+- * accessible..
+- */
+- if (vma->vm_mm == current->mm)
+- return VM_FAULT_SIGBUS;
+-
+- /* Fall through to the non-read-ahead case */
+ no_cached_page:
+ /*
+ * We're only likely to ever get here if MADV_RANDOM is in
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:21 2007
+Message-Id: <20071115053121.283363997@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Young <hidave.darkstar@gmail.com>,
+ Greg KH <greg@kroah.com>
+Subject: [patch 04/13] param_sysfs_builtin memchr argument fix
+Content-Disposition: inline; filename=param_sysfs_builtin-memchr-argument-fix.patch
+Status: RO
+Content-Length: 3032
+Lines: 88
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dave Young <hidave.darkstar@gmail.com>
+
+patch faf8c714f4508207a9c81cc94dafc76ed6680b44 in mainline.
+
+If memchr argument is longer than strlen(kp->name), there will be some
+weird result.
+
+It will casuse duplicate filenames in sysfs for the "nousb". kernel
+warning messages are as bellow:
+
+sysfs: duplicate filename 'usbcore' can not be created
+WARNING: at fs/sysfs/dir.c:416 sysfs_add_one()
+ [<c01c4750>] sysfs_add_one+0xa0/0xe0
+ [<c01c4ab8>] create_dir+0x48/0xb0
+ [<c01c4b69>] sysfs_create_dir+0x29/0x50
+ [<c024e0fb>] create_dir+0x1b/0x50
+ [<c024e3b6>] kobject_add+0x46/0x150
+ [<c024e2da>] kobject_init+0x3a/0x80
+ [<c053b880>] kernel_param_sysfs_setup+0x50/0xb0
+ [<c053b9ce>] param_sysfs_builtin+0xee/0x130
+ [<c053ba33>] param_sysfs_init+0x23/0x60
+ [<c024d062>] __next_cpu+0x12/0x20
+ [<c052aa30>] kernel_init+0x0/0xb0
+ [<c052aa30>] kernel_init+0x0/0xb0
+ [<c052a856>] do_initcalls+0x46/0x1e0
+ [<c01bdb12>] create_proc_entry+0x52/0x90
+ [<c0158d4c>] register_irq_proc+0x9c/0xc0
+ [<c01bda94>] proc_mkdir_mode+0x34/0x50
+ [<c052aa30>] kernel_init+0x0/0xb0
+ [<c052aa92>] kernel_init+0x62/0xb0
+ [<c0104f83>] kernel_thread_helper+0x7/0x14
+ =======================
+kobject_add failed for usbcore with -EEXIST, don't try to register things with the same name in the same directory.
+ [<c024e466>] kobject_add+0xf6/0x150
+ [<c053b880>] kernel_param_sysfs_setup+0x50/0xb0
+ [<c053b9ce>] param_sysfs_builtin+0xee/0x130
+ [<c053ba33>] param_sysfs_init+0x23/0x60
+ [<c024d062>] __next_cpu+0x12/0x20
+ [<c052aa30>] kernel_init+0x0/0xb0
+ [<c052aa30>] kernel_init+0x0/0xb0
+ [<c052a856>] do_initcalls+0x46/0x1e0
+ [<c01bdb12>] create_proc_entry+0x52/0x90
+ [<c0158d4c>] register_irq_proc+0x9c/0xc0
+ [<c01bda94>] proc_mkdir_mode+0x34/0x50
+ [<c052aa30>] kernel_init+0x0/0xb0
+ [<c052aa92>] kernel_init+0x62/0xb0
+ [<c0104f83>] kernel_thread_helper+0x7/0x14
+ =======================
+Module 'usbcore' failed to be added to sysfs, error number -17
+The system will be unstable now.
+
+Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
+Cc: Greg KH <greg@kroah.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/params.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/kernel/params.c
++++ b/kernel/params.c
+@@ -595,11 +595,17 @@ static void __init param_sysfs_builtin(v
+
+ for (i=0; i < __stop___param - __start___param; i++) {
+ char *dot;
++ size_t kplen;
+
+ kp = &__start___param[i];
++ kplen = strlen(kp->name);
+
+ /* We do not handle args without periods. */
+- dot = memchr(kp->name, '.', MAX_KBUILD_MODNAME);
++ if (kplen > MAX_KBUILD_MODNAME) {
++ DEBUGP("kernel parameter name is too long: %s\n", kp->name);
++ continue;
++ }
++ dot = memchr(kp->name, '.', kplen);
+ if (!dot) {
+ DEBUGP("couldn't find period in %s\n", kp->name);
+ continue;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:21 2007
+Message-Id: <20071115053121.467042081@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tsugikazu Shibata <tshibata@ab.jp.nec.com>
+Subject: [patch 05/13] HOWTO: update ja_JP/HOWTO with latest changes
+Content-Disposition: inline; filename=howto-update-ja_jp-howto-with-latest-changes.patch
+Status: RO
+Content-Length: 17768
+Lines: 288
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tsugikazu Shibata <tshibata@ab.jp.nec.co>
+
+patch 3b6662f192fc521b9657f63e68d20ec99979dae6 upstream.
+
+Here is another sync patch of Documentation/ja_JP/HOWTO
+
+Japanese developer sent me some cosmetic changes and also follow
+changes of HOWTO
+ Cross reference URL (sosdg.org/qiyong/lxr)
+ known_regression explanations on kernel dev. process
+
+Signed-off-by: Tsugikazu Shibata <tshibata@ab.jp.nec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/ja_JP/HOWTO | 84 ++++++++++++++++++++++++----------------------
+ 1 file changed, 45 insertions(+), 39 deletions(-)
+
+--- a/Documentation/ja_JP/HOWTO
++++ b/Documentation/ja_JP/HOWTO
+@@ -1,4 +1,4 @@
+-NOTE:
++NOTE:
+ This is a version of Documentation/HOWTO translated into Japanese.
+ This document is maintained by Tsugikazu Shibata <tshibata@ab.jp.nec.com>
+ and the JF Project team <www.linux.or.jp/JF>.
+@@ -11,14 +11,14 @@ for non English (read: Japanese) speaker
+ fork. So if you have any comments or updates for this file, please try
+ to update the original English file first.
+
+-Last Updated: 2007/07/18
++Last Updated: 2007/09/23
+ ==================================
+ これは、
+-linux-2.6.22/Documentation/HOWTO
++linux-2.6.23/Documentation/HOWTO
+ の和訳です。
+
+ 翻訳団体： JF プロジェクト < http://www.linux.or.jp/JF/ >
+-翻訳日： 2007/07/16
++翻訳日： 2007/09/19
+ 翻訳者： Tsugikazu Shibata <tshibata at ab dot jp dot nec dot com>
+ 校正者： 松倉さん <nbh--mats at nifty dot com>
+ 小林 雅典さん (Masanori Kobayasi) <zap03216 at nifty dot ne dot jp>
+@@ -27,6 +27,7 @@ linux-2.6.22/Documentation/HOWTO
+ 野口さん (Kenji Noguchi) <tokyo246 at gmail dot com>
+ 河内さん (Takayoshi Kochi) <t-kochi at bq dot jp dot nec dot com>
+ 岩本さん (iwamoto) <iwamoto.kn at ncos dot nec dot co dot jp>
++ 内田さん (Satoshi Uchida) <s-uchida at ap dot jp dot nec dot com>
+ ==================================
+
+ Linux カーネル開発のやり方
+@@ -40,7 +41,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«é\96\8bç\99ºã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã
+ 手助けになります。
+
+ もし、このドキュメントのどこかが古くなっていた場合には、このドキュメン
+-トの最後にリストしたメンテナーにパッチを送ってください。
++トの最後にリストしたメンテナにパッチを送ってください。
+
+ はじめに
+ ---------
+@@ -59,7 +60,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«é\96\8bç\99ºã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã
+ ネル開発者には必要です。アーキテクチャ向けの低レベル部分の開発をするの
+ でなければ、(どんなアーキテクチャでも)アセンブリ(訳注: 言語)は必要あり
+ ません。以下の本は、C 言語の十分な知識や何年もの経験に取って代わるもの
+-ではありませんが、少なくともリファレンスとしてはいい本です。
++ではありませんが、少なくともリファレンスとしては良い本です。
+ - "The C Programming Language" by Kernighan and Ritchie [Prentice Hall]
+ -『プログラミング言語Ｃ第2版』(B.W. カーニハン/D.M. リッチー著 石田晴久訳) [共立出版]
+ - "Practical C Programming" by Steve Oualline [O'Reilly]
+@@ -76,7 +77,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«é\96\8bç\99ºã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã
+ ときどき、カーネルがツールチェインや C 言語拡張に置いている前提がどう
+ なっているのかわかりにくいことがあり、また、残念なことに決定的なリファ
+ レンスは存在しません。情報を得るには、gcc の info ページ( info gcc )を
+-みてください。
++見てください。
+
+ あなたは既存の開発コミュニティと一緒に作業する方法を学ぼうとしているこ
+ とに留意してください。そのコミュニティは、コーディング、スタイル、
+@@ -92,7 +93,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«é\96\8bç\99ºã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã
+
+ Linux カーネルのソースコードは GPL ライセンスの下でリリースされていま
+ す。ライセンスの詳細については、ソースツリーのメインディレクトリに存在
+-する、COPYING のファイルをみてください。もしライセンスについてさらに質
++する、COPYING のファイルを見てください。もしライセンスについてさらに質
+ 問があれば、Linux Kernel メーリングリストに質問するのではなく、どうぞ
+ 法律家に相談してください。メーリングリストの人達は法律家ではなく、法的
+ 問題については彼らの声明はあてにするべきではありません。
+@@ -109,7 +110,8 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81¯å
+ 新しいドキュメントファイルも追加することを勧めます。
+ カーネルの変更が、カーネルがユーザ空間に公開しているインターフェイスの
+ 変更を引き起こす場合、その変更を説明するマニュアルページのパッチや情報
+-をマニュアルページのメンテナ mtk-manpages@gmx.net に送ることを勧めます。
++をマニュアルページのメンテナ mtk-manpages@gmx.net に送ることを勧めま
++す。
+
+ 以下はカーネルソースツリーに含まれている読んでおくべきファイルの一覧で
+ す-
+@@ -117,7 +119,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81¯å
+ README
+ このファイルは Linuxカーネルの簡単な背景とカーネルを設定(訳注
+ configure )し、生成(訳注 build )するために必要なことは何かが書かれ
+- ています。カーネルに関して初めての人はここからスタートするとよいで
++ ています。カーネルに関して初めての人はここからスタートすると良いで
+ しょう。
+
+ Documentation/Changes
+@@ -128,7 +130,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81¯å
+ Documentation/CodingStyle
+ これは Linux カーネルのコーディングスタイルと背景にある理由を記述
+ しています。全ての新しいコードはこのドキュメントにあるガイドライン
+- に従っていることを期待されています。大部分のメンテナーはこれらのルー
++ に従っていることを期待されています。大部分のメンテナはこれらのルー
+ ルに従っているものだけを受け付け、多くの人は正しいスタイルのコード
+ だけをレビューします。
+
+@@ -168,16 +170,16 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81¯å
+ 支援してください。
+
+ Documentation/ManagementStyle
+- このドキュメントは Linux カーネルのメンテナー達がどう行動するか、
++ このドキュメントは Linux カーネルのメンテナ達がどう行動するか、
+ 彼らの手法の背景にある共有されている精神について記述しています。こ
+ れはカーネル開発の初心者なら（もしくは、単に興味があるだけの人でも）
+- 重要です。なぜならこのドキュメントは、カーネルメンテナー達の独特な
++ 重要です。なぜならこのドキュメントは、カーネルメンテナ達の独特な
+ 行動についての多くの誤解や混乱を解消するからです。
+
+ Documentation/stable_kernel_rules.txt
+ このファイルはどのように stable カーネルのリリースが行われるかのルー
+ ルが記述されています。そしてこれらのリリースの中のどこかで変更を取
+- り入れてもらいたい場合に何をすればいいかが示されています。
++ り入れてもらいたい場合に何をすれば良いかが示されています。
+
+ Documentation/kernel-docs.txt
+ カーネル開発に付随する外部ドキュメントのリストです。もしあなたが
+@@ -218,9 +220,9 @@ web サイトには、コードの構成
+ ここには、また、カーネルのコンパイルのやり方やパッチの当て方などの間接
+ 的な基本情報も記述されています。
+
+-あなたがどこからスタートしてよいかわからないが、Linux カーネル開発コミュ
++あなたがどこからスタートして良いかわからないが、Linux カーネル開発コミュ
+ ニティに参加して何かすることをさがしている場合には、Linux kernel
+-Janitor's プロジェクトにいけばよいでしょう -
++Janitor's プロジェクトにいけば良いでしょう -
+ http://janitor.kernelnewbies.org/
+ ここはそのようなスタートをするのにうってつけの場所です。ここには、
+ Linux カーネルソースツリーの中に含まれる、きれいにし、修正しなければな
+@@ -243,7 +245,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81®ä
+ 自己参照方式で、索引がついた web 形式で、ソースコードを参照することが
+ できます。この最新の素晴しいカーネルコードのリポジトリは以下で見つかり
+ ます-
+- http://sosdg.org/~coywolf/lxr/
++ http://sosdg.org/~qiyong/lxr/
+
+ 開発プロセス
+ -----------------------
+@@ -265,9 +267,9 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\81®é\96\8bç\99ºã\83\97ã\83ã\82»ã\82¹ã
+ 以下のとおり-
+
+ - 新しいカーネルがリリースされた直後に、2週間の特別期間が設けられ、
+- この期間中に、メンテナー達は Linus に大きな差分を送ることができま
+- す。このような差分は通常 -mm カーネルに数週間含まれてきたパッチで
+- す。 大きな変更は git(カーネルのソース管理ツール、詳細は
++ この期間中に、メンテナ達は Linus に大きな差分を送ることができます。
++ このような差分は通常 -mm カーネルに数週間含まれてきたパッチです。
++ 大きな変更は git(カーネルのソース管理ツール、詳細は
+ http://git.or.cz/ 参照) を使って送るのが好ましいやり方ですが、パッ
+ チファイルの形式のまま送るのでも十分です。
+
+@@ -285,6 +287,10 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\81®é\96\8bç\99ºã\83\97ã\83ã\82»ã\82¹ã
+ に安定した状態にあると判断したときにリリースされます。目標は毎週新
+ しい -rc カーネルをリリースすることです。
+
++ - 以下の URL で各 -rc リリースに存在する既知の後戻り問題のリスト
++ が追跡されます-
++ http://kernelnewbies.org/known_regressions
++
+ - このプロセスはカーネルが 「準備ができた」と考えられるまで継続しま
+ す。このプロセスはだいたい 6週間継続します。
+
+@@ -331,8 +337,8 @@ Andrew は個別のサブシステムカ
+ linux-kernel メーリングリストで収集された多数のパッチと同時に一つにま
+ とめます。
+ このツリーは新機能とパッチが検証される場となります。ある期間の間パッチ
+-が -mm に入って価値を証明されたら、Andrew やサブシステムメンテナが、メ
+-インラインへ入れるように Linus にプッシュします。
++が -mm に入って価値を証明されたら、Andrew やサブシステムメンテナが、
++メインラインへ入れるように Linus にプッシュします。
+
+ メインカーネルツリーに含めるために Linus に送る前に、すべての新しいパッ
+ チが -mm ツリーでテストされることが強く推奨されます。
+@@ -460,7 +466,7 @@ MAINTAINERS ã\83\95ã\82¡ã\82¤ã\83«ã\81«ã\83ªã\82¹ã\83\88ã\81\8cã
+ せん-
+ 彼らはあなたのパッチの行毎にコメントを入れたいので、そのためにはそうす
+ るしかありません。あなたのメールプログラムが空白やタブを圧縮しないよう
+-に確認した方がいいです。最初の良いテストとしては、自分にメールを送って
++に確認した方が良いです。最初の良いテストとしては、自分にメールを送って
+ みて、そのパッチを自分で当ててみることです。もしそれがうまく行かないな
+ ら、あなたのメールプログラムを直してもらうか、正しく動くように変えるべ
+ きです。
+@@ -507,14 +513,14 @@ MAINTAINERS ã\83\95ã\82¡ã\82¤ã\83«ã\81«ã\83ªã\82¹ã\83\88ã\81\8cã
+ とも普通のことです。これはあなたのパッチが受け入れられないということで
+ は *ありません*、そしてあなた自身に反対することを意味するのでも *ありま
+ せん*。単に自分のパッチに対して指摘された問題を全て修正して再送すれば
+-いいのです。
++良いのです。
+
+
+ カーネルコミュニティと企業組織のちがい
+ -----------------------------------------------------------------
+
+ カーネルコミュニティは大部分の伝統的な会社の開発環境とは異ったやり方で
+-動いています。以下は問題を避けるためにできるとよいことののリストです-
++動いています。以下は問題を避けるためにできると良いことのリストです-
+
+ あなたの提案する変更について言うときのうまい言い方：
+
+@@ -525,7 +531,7 @@ MAINTAINERS ã\83\95ã\82¡ã\82¤ã\83«ã\81«ã\83ªã\82¹ã\83\88ã\81\8cã
+ - "以下は一連の小さなパッチ群ですが..."
+ - "これは典型的なマシンでの性能を向上させます.."
+
+- やめた方がいい悪い言い方：
++ やめた方が良い悪い言い方：
+
+ - このやり方で AIX/ptx/Solaris ではできたので、できるはずだ
+ - 私はこれを20年もの間やってきた、だから
+@@ -575,10 +581,10 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¯ã
+
+ 1) 小さいパッチはあなたのパッチが適用される見込みを大きくします、カー
+ ネルの人達はパッチが正しいかどうかを確認する時間や労力をかけないか
+- らです。5行のパッチはメンテナがたった1秒見るだけで適用できます。し
+- かし、500行のパッチは、正しいことをレビューするのに数時間かかるかも
+- しれません(時間はパッチのサイズなどにより指数関数に比例してかかりま
+- す)
++ らです。5行のパッチはメンテナがたった1秒見るだけで適用できます。
++ しかし、500行のパッチは、正しいことをレビューするのに数時間かかるか
++ もしれません(時間はパッチのサイズなどにより指数関数に比例してかかり
++ ます)
+
+ 小さいパッチは何かあったときにデバッグもとても簡単になります。パッ
+ チを1個1個取り除くのは、とても大きなパッチを当てた後に(かつ、何かお
+@@ -587,23 +593,23 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¯ã
+ 2) 小さいパッチを送るだけでなく、送るまえに、書き直して、シンプルにす
+ る(もしくは、単に順番を変えるだけでも)ことも、とても重要です。
+
+-以下はカーネル開発者の Al Viro のたとえ話しです：
++以下はカーネル開発者の Al Viro のたとえ話です：
+
+ "生徒の数学の宿題を採点する先生のことを考えてみてください、先
+- 生は生徒が解に到達するまでの試行錯誤をみたいとは思わないでしょ
+- う。先生は簡潔な最高の解をみたいのです。良い生徒はこれを知って
++ 生は生徒が解に到達するまでの試行錯誤を見たいとは思わないでしょ
++ う。先生は簡潔な最高の解を見たいのです。良い生徒はこれを知って
+ おり、そして最終解の前の中間作業を提出することは決してないので
+ す"
+
+- カーネル開発でもこれは同じです。メンテナー達とレビューア達は、
+- 問題を解決する解の背後になる思考プロセスをみたいとは思いません。
+- 彼らは単純であざやかな解決方法をみたいのです。
++ カーネル開発でもこれは同じです。メンテナ達とレビューア達は、
++ 問題を解決する解の背後になる思考プロセスを見たいとは思いません。
++ 彼らは単純であざやかな解決方法を見たいのです。
+
+ あざやかな解を説明するのと、コミュニティと共に仕事をし、未解決の仕事を
+ 議論することのバランスをキープするのは難しいかもしれません。
+ ですから、開発プロセスの早期段階で改善のためのフィードバックをもらうよ
+-うにするのもいいですが、変更点を小さい部分に分割して全体ではまだ完成し
+-ていない仕事を(部分的に)取り込んでもらえるようにすることもいいことです。
++うにするのも良いですが、変更点を小さい部分に分割して全体ではまだ完成し
++ていない仕事を(部分的に)取り込んでもらえるようにすることも良いことです。
+
+ また、でき上がっていないものや、"将来直す" ようなパッチを、本流に含め
+ てもらうように送っても、それは受け付けられないことを理解してください。
+@@ -629,7 +635,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¯ã
+ - テスト結果
+
+ これについて全てがどのようにあるべきかについての詳細は、以下のドキュメ
+-ントの ChangeLog セクションをみてください-
++ントの ChangeLog セクションを見てください-
+ "The Perfect Patch"
+ http://www.zip.com.au/~akpm/linux/patches/stuff/tpp.txt
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:21 2007
+Message-Id: <20071115053121.651024132@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Oliv=E9r=20Pint=E9r?= <oliver.pntr@gmail.com>,
+ Hugh Dickins <hugh@veritas.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Christoph Lameter <clameter@sgi.com>
+Subject: [patch 06/13] SLUB: Fix memory leak by not reusing cpu_slab
+Content-Disposition: inline; filename=slub-fix-memory-leak-by-not-reusing-cpu_slab.patch
+Status: RO
+Content-Length: 1907
+Lines: 61
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Christoph Lameter <clameter@sgi.com>
+
+patch 05aa345034de6ae9c77fb93f6a796013641d57d5 in mainline.
+
+SLUB: Fix memory leak by not reusing cpu_slab
+
+Fix the memory leak that may occur when we attempt to reuse a cpu_slab
+that was allocated while we reenabled interrupts in order to be able to
+grow a slab cache. The per cpu freelist may contain objects and in that
+situation we may overwrite the per cpu freelist pointer loosing objects.
+This only occurs if we find that the concurrently allocated slab fits
+our allocation needs.
+
+If we simply always deactivate the slab then the freelist will be properly
+reintegrated and the memory leak will go away.
+
+Signed-off-by: Christoph Lameter <clameter@sgi.com>
+Cc: Hugh Dickins <hugh@veritas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/slub.c | 22 +---------------------
+ 1 file changed, 1 insertion(+), 21 deletions(-)
+
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1501,28 +1501,8 @@ new_slab:
+ page = new_slab(s, gfpflags, node);
+ if (page) {
+ cpu = smp_processor_id();
+- if (s->cpu_slab[cpu]) {
+- /*
+- * Someone else populated the cpu_slab while we
+- * enabled interrupts, or we have gotten scheduled
+- * on another cpu. The page may not be on the
+- * requested node even if __GFP_THISNODE was
+- * specified. So we need to recheck.
+- */
+- if (node == -1 ||
+- page_to_nid(s->cpu_slab[cpu]) == node) {
+- /*
+- * Current cpuslab is acceptable and we
+- * want the current one since its cache hot
+- */
+- discard_slab(s, page);
+- page = s->cpu_slab[cpu];
+- slab_lock(page);
+- goto load_freelist;
+- }
+- /* New slab does not fit our expectations */
++ if (s->cpu_slab[cpu])
+ flush_slab(s, s->cpu_slab[cpu], cpu);
+- }
+ slab_lock(page);
+ SetSlabFrozen(page);
+ s->cpu_slab[cpu] = page;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:21 2007
+Message-Id: <20071115053121.819045284@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 07/13] writeback: dont propagate AOP_WRITEPAGE_ACTIVATE
+Content-Disposition: inline; filename=writeback-don-t-propagate-aop_writepage_activate.patch
+Status: RO
+Content-Length: 945
+Lines: 36
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+patch e423003028183df54f039dfda8b58c49e78c89d7 in mainline.
+
+This is a writeback-internal marker but we're propagating it all the way back
+to userspace!.
+
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ mm/page-writeback.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -672,8 +672,10 @@ retry:
+
+ ret = (*writepage)(page, wbc, data);
+
+- if (unlikely(ret == AOP_WRITEPAGE_ACTIVATE))
++ if (unlikely(ret == AOP_WRITEPAGE_ACTIVATE)) {
+ unlock_page(page);
++ ret = 0;
++ }
+ if (ret || (--(wbc->nr_to_write) <= 0))
+ done = 1;
+ if (wbc->nonblocking && bdi_write_congested(bdi)) {
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:22 2007
+Message-Id: <20071115053121.990354541@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [patch 08/13] splice: fix double kunmap() in vmsplice copy path
+Content-Disposition: inline; filename=splice-fix-double-kunmap-in-vmsplice-copy-path.patch
+Status: RO
+Content-Length: 2371
+Lines: 71
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jens Axboe <jens.axboe@oracle.com>
+
+patch 6866bef40d06f7c2baac3a855b1917a8ca75456c in mainline.
+
+The out label should not include the unmap, the only way to jump
+there already has unmapped the source.
+
+00002000
+ f7c21a00 00000000 00000000 c0489036 00018e32 00000002 00000000
+00001000
+Call Trace:
+ [<c0487dd9>] pipe_to_user+0xca/0xd3
+ [<c0488233>] __splice_from_pipe+0x53/0x1bd
+ [<c0454947>] ------------[ cut here ]------------
+filemap_fault+0x221/0x380
+ [<c0487d0f>] pipe_to_user+0x0/0xd3
+ [<c0489036>] sys_vmsplice+0x3b7/0x422
+ [<c045ec3f>] kernel BUG at mm/highmem.c:206!
+handle_mm_fault+0x4d5/0x8eb
+ [<c041ed5b>] kmap_atomic+0x1c/0x20
+ [<c045d33d>] unmap_vmas+0x3d1/0x584
+ [<c045f717>] free_pgtables+0x90/0xa0
+ [<c041d84b>] pgd_dtor+0x0/0x1
+ [<c044d665>] audit_syscall_exit+0x2aa/0x2c6
+ [<c0407817>] do_syscall_trace+0x124/0x169
+ [<c0404df2>] syscall_call+0x7/0xb
+ =======================
+Code: 2d 00 d0 5b 00 25 00 00 e0 ff 29 invalid opcode: 0000 [#1]
+c2 89 d0 c1 e8 0c 8b 14 85 a0 6c 7c c0 4a 85 d2 89 14 85 a0 6c 7c c0 74 07
+31 c9 4a 75 15 eb 04 <0f> 0b eb fe 31 c9 81 3d 78 38 6d c0 78 38 6d c0 0f
+95 c1 b0 01
+EIP: [<c045bbc3>] kunmap_high+0x51/0x8e SS:ESP 0068:f5960df0
+SMP
+Modules linked in: netconsole autofs4 hidp nfs lockd nfs_acl rfcomm l2cap
+bluetooth sunrpc ipv6 ib_iser rdma_cm ib_cm iw_cmib_sa ib_mad ib_core
+ib_addr iscsi_tcp libiscsi scsi_transport_iscsi dm_mirror dm_multipath
+dm_mod video output sbs batteryac parport_pc lp parport sg i2c_piix4
+i2c_core floppy cfi_probe gen_probe scb2_flash mtd chipreg tg3 e1000 button
+ide_cd serio_raw cdrom aic7xxx scsi_transport_spi sd_mod scsi_mod ext3 jbd
+ehci_hcd ohci_hcd uhci_hcd
+CPU: 3
+EIP: 0060:[<c045bbc3>] Not tainted VLI
+EFLAGS: 00010246 (2.6.23 #1)
+EIP is at kunmap_high+0x51/0x8e
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/splice.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1390,10 +1390,10 @@ static int pipe_to_user(struct pipe_inod
+ if (copy_to_user(sd->u.userptr, src + buf->offset, sd->len))
+ ret = -EFAULT;
+
++ buf->ops->unmap(pipe, buf, src);
+ out:
+ if (ret > 0)
+ sd->u.userptr += ret;
+- buf->ops->unmap(pipe, buf, src);
+ return ret;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:22 2007
+Message-Id: <20071115053122.165666072@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ mingo@elte.hu,
+ jeremy@goop.org
+Subject: [patch 09/13] fix the softlockup watchdog to actually work
+Content-Disposition: inline; filename=fix-the-softlockup-watchdog-to-actually-work.patch
+Status: RO
+Content-Length: 1671
+Lines: 57
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ingo Molnar <mingo@elte.hu>
+
+patch a115d5caca1a2905ba7a32b408a6042b20179aaa in mainline.
+
+this Xen related commit:
+
+ commit 966812dc98e6a7fcdf759cbfa0efab77500a8868
+ Author: Jeremy Fitzhardinge <jeremy@goop.org>
+ Date: Tue May 8 00:28:02 2007 -0700
+
+ Ignore stolen time in the softlockup watchdog
+
+broke the softlockup watchdog to never report any lockups. (!)
+
+print_timestamp defaults to 0, this makes the following condition
+always true:
+
+ if (print_timestamp < (touch_timestamp + 1) ||
+
+and we'll in essence never report soft lockups.
+
+apparently the functionality of the soft lockup watchdog was never
+actually tested with that patch applied ...
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/softlockup.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/kernel/softlockup.c
++++ b/kernel/softlockup.c
+@@ -80,10 +80,11 @@ void softlockup_tick(void)
+ print_timestamp = per_cpu(print_timestamp, this_cpu);
+
+ /* report at most once a second */
+- if (print_timestamp < (touch_timestamp + 1) ||
+- did_panic ||
+- !per_cpu(watchdog_task, this_cpu))
++ if ((print_timestamp >= touch_timestamp &&
++ print_timestamp < (touch_timestamp + 1)) ||
++ did_panic || !per_cpu(watchdog_task, this_cpu)) {
+ return;
++ }
+
+ /* do not print during early bootup: */
+ if (unlikely(system_state != SYSTEM_RUNNING)) {
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:22 2007
+Message-Id: <20071115053122.355661870@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Balbir Singh <balbir@linux.vnet.ibm.com>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Frans Pop <elendil@planet.nl>
+Subject: [patch 10/13] sched: keep utime/stime monotonic
+Content-Disposition: inline; filename=sched-keep-utime-stime-monotonic.patch
+Status: RO
+Content-Length: 2337
+Lines: 76
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Frans Pop <elendil@planet.nl>
+
+sched: keep utime/stime monotonic
+
+cpustats use utime/stime as a ratio against sum_exec_runtime, as a
+consequence it can happen - when the ratio changes faster than time
+accumulates - that either can be appear to go backwards.
+
+Combined backport for 2.6.23 of the following patches from mainline:
+commit 73a2bcb0edb9ffb0b007b3546b430e2c6e415eee
+Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
+ sched: keep utime/stime monotonic
+
+commit 9301899be75b464ef097f0b5af7af6d9bd8f68a7
+Author: Balbir Singh <balbir@linux.vnet.ibm.com>
+ sched: fix /proc/<PID>/stat stime/utime monotonicity, part 2
+
+Signed-off-by: Frans Pop <elendil@planet.nl>
+CC: Peter Zijlstra <a.p.zijlstra@chello.nl>
+CC: Balbir Singh <balbir@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/array.c | 6 ++++--
+ include/linux/sched.h | 1 +
+ kernel/fork.c | 2 ++
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -351,7 +351,8 @@ static cputime_t task_utime(struct task_
+ }
+ utime = (clock_t)temp;
+
+- return clock_t_to_cputime(utime);
++ p->prev_utime = max(p->prev_utime, clock_t_to_cputime(utime));
++ return p->prev_utime;
+ }
+
+ static cputime_t task_stime(struct task_struct *p)
+@@ -366,7 +367,8 @@ static cputime_t task_stime(struct task_
+ stime = nsec_to_clock_t(p->se.sum_exec_runtime) -
+ cputime_to_clock_t(task_utime(p));
+
+- return clock_t_to_cputime(stime);
++ p->prev_stime = max(p->prev_stime, clock_t_to_cputime(stime));
++ return p->prev_stime;
+ }
+ #endif
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1022,6 +1022,7 @@ struct task_struct {
+
+ unsigned int rt_priority;
+ cputime_t utime, stime;
++ cputime_t prev_utime, prev_stime;
+ unsigned long nvcsw, nivcsw; /* context switch counts */
+ struct timespec start_time; /* monotonic time */
+ struct timespec real_start_time; /* boot based time */
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1045,6 +1045,8 @@ static struct task_struct *copy_process(
+
+ p->utime = cputime_zero;
+ p->stime = cputime_zero;
++ p->prev_utime = cputime_zero;
++ p->prev_stime = cputime_zero;
+
+ #ifdef CONFIG_TASK_XACCT
+ p->rchar = 0; /* I/O counter: bytes read */
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:22 2007
+Message-Id: <20071115053122.529767871@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 11/13] Fix compat futex hangs.
+Content-Disposition: inline; filename=fix-compat-futex-hangs.patch
+Status: RO
+Content-Length: 3259
+Lines: 107
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Miller <davem@davemloft.net>
+
+[FUTEX]: Fix address computation in compat code.
+
+[ Upstream commit: 3c5fd9c77d609b51c0bab682c9d40cbb496ec6f1 ]
+
+compat_exit_robust_list() computes a pointer to the
+futex entry in userspace as follows:
+
+ (void __user *)entry + futex_offset
+
+'entry' is a 'struct robust_list __user *', and
+'futex_offset' is a 'compat_long_t' (typically a 's32').
+
+Things explode if the 32-bit sign bit is set in futex_offset.
+
+Type promotion sign extends futex_offset to a 64-bit value before
+adding it to 'entry'.
+
+This triggered a problem on sparc64 running 32-bit applications which
+would lock up a cpu looping forever in the fault handling for the
+userspace load in handle_futex_death().
+
+Compat userspace runs with address masking (wherein the cpu zeros out
+the top 32-bits of every effective address given to a memory operation
+instruction) so the sparc64 fault handler accounts for this by
+zero'ing out the top 32-bits of the fault address too.
+
+Since the kernel properly uses the compat_uptr interfaces, kernel side
+accesses to compat userspace work too since they will only use
+addresses with the top 32-bit clear.
+
+Because of this compat futex layer bug we get into the following loop
+when executing the get_user() load near the top of handle_futex_death():
+
+1) load from address '0xfffffffff7f16bd8', FAULT
+2) fault handler clears upper 32-bits, processes fault
+ for address '0xf7f16bd8' which succeeds
+3) goto #1
+
+I want to thank Bernd Zeimetz, Josip Rodin, and Fabio Massimo Di Nitto
+for their tireless efforts helping me track down this bug.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex_compat.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+--- a/kernel/futex_compat.c
++++ b/kernel/futex_compat.c
+@@ -29,6 +29,15 @@ fetch_robust_entry(compat_uptr_t *uentry
+ return 0;
+ }
+
++static void __user *futex_uaddr(struct robust_list *entry,
++ compat_long_t futex_offset)
++{
++ compat_uptr_t base = ptr_to_compat(entry);
++ void __user *uaddr = compat_ptr(base + futex_offset);
++
++ return uaddr;
++}
++
+ /*
+ * Walk curr->robust_list (very carefully, it's a userspace list!)
+ * and mark any locks found there dead, and notify any waiters.
+@@ -75,11 +84,13 @@ void compat_exit_robust_list(struct task
+ * A pending lock might already be on the list, so
+ * dont process it twice:
+ */
+- if (entry != pending)
+- if (handle_futex_death((void __user *)entry + futex_offset,
+- curr, pi))
+- return;
++ if (entry != pending) {
++ void __user *uaddr = futex_uaddr(entry,
++ futex_offset);
+
++ if (handle_futex_death(uaddr, curr, pi))
++ return;
++ }
+ if (rc)
+ return;
+ uentry = next_uentry;
+@@ -93,9 +104,11 @@ void compat_exit_robust_list(struct task
+
+ cond_resched();
+ }
+- if (pending)
+- handle_futex_death((void __user *)pending + futex_offset,
+- curr, pip);
++ if (pending) {
++ void __user *uaddr = futex_uaddr(pending, futex_offset);
++
++ handle_futex_death(uaddr, curr, pip);
++ }
+ }
+
+ asmlinkage long
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:22 2007
+Message-Id: <20071115053122.707163934@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ penberg@cs.helsinki.fi,
+ hugh@veritas.com,
+ ezk@cs.sunysb.edu
+Subject: [patch 12/13] fix tmpfs BUG and AOP_WRITEPAGE_ACTIVATE
+Content-Disposition: inline; filename=fix-tmpfs-bug-and-aop_writepage_activate.patch
+Status: RO
+Content-Length: 2545
+Lines: 64
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hugh Dickins <hugh@veritas.com>
+
+patch 487e9bf25cbae11b131d6a14bdbb3a6a77380837 in mainline.
+
+It's possible to provoke unionfs (not yet in mainline, though in mm and
+some distros) to hit shmem_writepage's BUG_ON(page_mapped(page)). I expect
+it's possible to provoke the 2.6.23 ecryptfs in the same way (but the
+2.6.24 ecryptfs no longer calls lower level's ->writepage).
+
+This came to light with the recent find that AOP_WRITEPAGE_ACTIVATE could
+leak from tmpfs via write_cache_pages and unionfs to userspace. There's
+already a fix (e423003028183df54f039dfda8b58c49e78c89d7 - writeback: don't
+propagate AOP_WRITEPAGE_ACTIVATE) in the tree for that, and it's okay so
+far as it goes; but insufficient because it doesn't address the underlying
+issue, that shmem_writepage expects to be called only by vmscan (relying on
+backing_dev_info capabilities to prevent the normal writeback path from
+ever approaching it).
+
+That's an increasingly fragile assumption, and ramdisk_writepage (the other
+source of AOP_WRITEPAGE_ACTIVATEs) is already careful to check
+wbc->for_reclaim before returning it. Make the same check in
+shmem_writepage, thereby sidestepping the page_mapped BUG also.
+
+Signed-off-by: Hugh Dickins <hugh@veritas.com>
+Cc: Erez Zadok <ezk@cs.sunysb.edu>
+Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/shmem.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -916,6 +916,21 @@ static int shmem_writepage(struct page *
+ struct inode *inode;
+
+ BUG_ON(!PageLocked(page));
++ /*
++ * shmem_backing_dev_info's capabilities prevent regular writeback or
++ * sync from ever calling shmem_writepage; but a stacking filesystem
++ * may use the ->writepage of its underlying filesystem, in which case
++ * we want to do nothing when that underlying filesystem is tmpfs
++ * (writing out to swap is useful as a response to memory pressure, but
++ * of no use to stabilize the data) - just redirty the page, unlock it
++ * and claim success in this case. AOP_WRITEPAGE_ACTIVATE, and the
++ * page_mapped check below, must be avoided unless we're in reclaim.
++ */
++ if (!wbc->for_reclaim) {
++ set_page_dirty(page);
++ unlock_page(page);
++ return 0;
++ }
+ BUG_ON(page_mapped(page));
+
+ mapping = page->mapping;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:23 2007
+Message-Id: <20071115053122.887869124@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [patch 13/13] BLOCK: Fix bad sharing of tag busy list on queues with shared tag maps
+Content-Disposition: inline; filename=block-fix-bad-sharing-of-tag-busy-list-on-queues-with-shared-tag-maps.patch
+Status: RO
+Content-Length: 3261
+Lines: 100
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jens Axboe <jens.axboe@oracle.com>
+
+patch 6eca9004dfcb274a502438a591df5b197690afb1 in mainline.
+
+For the locking to work, only the tag map and tag bit map may be shared
+(incidentally, I was just explaining this to Nick yesterday, but I
+apparently didn't review the code well enough myself). But we also share
+the busy list! The busy_list must be queue private, or we need a
+block_queue_tag covering lock as well.
+
+So we have to move the busy_list to the queue. This'll work fine, and
+it'll actually also fix a problem with blk_queue_invalidate_tags() which
+will invalidate tags across all shared queues. This is a bit confusing,
+the low level driver should call it for each queue seperately since
+otherwise you cannot kill tags on just a single queue for eg a hard
+drive that stops responding. Since the function has no callers
+currently, it's not an issue.
+
+This is fixed with commit 6eca9004dfcb274a502438a591df5b197690afb1 in
+Linus' tree.
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/ll_rw_blk.c | 8 +++-----
+ include/linux/blkdev.h | 2 +-
+ 2 files changed, 4 insertions(+), 6 deletions(-)
+
+--- a/block/ll_rw_blk.c
++++ b/block/ll_rw_blk.c
+@@ -819,7 +819,6 @@ static int __blk_free_tags(struct blk_qu
+ retval = atomic_dec_and_test(&bqt->refcnt);
+ if (retval) {
+ BUG_ON(bqt->busy);
+- BUG_ON(!list_empty(&bqt->busy_list));
+
+ kfree(bqt->tag_index);
+ bqt->tag_index = NULL;
+@@ -931,7 +930,6 @@ static struct blk_queue_tag *__blk_queue
+ if (init_tag_map(q, tags, depth))
+ goto fail;
+
+- INIT_LIST_HEAD(&tags->busy_list);
+ tags->busy = 0;
+ atomic_set(&tags->refcnt, 1);
+ return tags;
+@@ -982,6 +980,7 @@ int blk_queue_init_tags(struct request_q
+ */
+ q->queue_tags = tags;
+ q->queue_flags |= (1 << QUEUE_FLAG_QUEUED);
++ INIT_LIST_HEAD(&q->tag_busy_list);
+ return 0;
+ fail:
+ kfree(tags);
+@@ -1152,7 +1151,7 @@ int blk_queue_start_tag(struct request_q
+ rq->tag = tag;
+ bqt->tag_index[tag] = rq;
+ blkdev_dequeue_request(rq);
+- list_add(&rq->queuelist, &bqt->busy_list);
++ list_add(&rq->queuelist, &q->tag_busy_list);
+ bqt->busy++;
+ return 0;
+ }
+@@ -1173,11 +1172,10 @@ EXPORT_SYMBOL(blk_queue_start_tag);
+ **/
+ void blk_queue_invalidate_tags(struct request_queue *q)
+ {
+- struct blk_queue_tag *bqt = q->queue_tags;
+ struct list_head *tmp, *n;
+ struct request *rq;
+
+- list_for_each_safe(tmp, n, &bqt->busy_list) {
++ list_for_each_safe(tmp, n, &q->tag_busy_list) {
+ rq = list_entry_rq(tmp);
+
+ if (rq->tag == -1) {
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -356,7 +356,6 @@ enum blk_queue_state {
+ struct blk_queue_tag {
+ struct request **tag_index; /* map of busy tags */
+ unsigned long *tag_map; /* bit map of free/busy tags */
+- struct list_head busy_list; /* fifo list of busy tags */
+ int busy; /* current depth */
+ int max_depth; /* what we will send to device */
+ int real_max_depth; /* what the array can hold */
+@@ -451,6 +450,7 @@ struct request_queue
+ unsigned int dma_alignment;
+
+ struct blk_queue_tag *queue_tags;
++ struct list_head tag_busy_list;
+
+ unsigned int nr_sorted;
+ unsigned int in_flight;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:31:20 2007
+Message-Id: <20071115053120.718795061@mini.kroah.org>
+References: <20071115042610.731859958@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 20:26:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gregory Haskins <ghaskins@novell.com>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 01/13] lockdep: fix mismatched lockdep_depth/curr_chain_hash
+Content-Disposition: inline; filename=lockdep-fix-mismatched-lockdep_depth-curr_chain_hash.patch
+Status: RO
+Content-Length: 2177
+Lines: 71
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Gregory Haskins <ghaskins@novell.com>
+
+patch 3aa416b07f0adf01c090baab26fb70c35ec17623 in mainline.
+
+It is possible for the current->curr_chain_key to become inconsistent
+with the current index if the chain fails to validate. The end result
+is that future lock_acquire() operations may inadvertently fail to find
+a hit in the cache resulting in a new node being added to the graph for
+every acquire.
+
+
+Signed-off-by: Gregory Haskins <ghaskins@novell.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/lockdep.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/kernel/lockdep.c
++++ b/kernel/lockdep.c
+@@ -1521,7 +1521,7 @@ cache_hit:
+ }
+
+ static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
+- struct held_lock *hlock, int chain_head)
++ struct held_lock *hlock, int chain_head, u64 chain_key)
+ {
+ /*
+ * Trylock needs to maintain the stack of held locks, but it
+@@ -1534,7 +1534,7 @@ static int validate_chain(struct task_st
+ * graph_lock for us)
+ */
+ if (!hlock->trylock && (hlock->check == 2) &&
+- lookup_chain_cache(curr->curr_chain_key, hlock->class)) {
++ lookup_chain_cache(chain_key, hlock->class)) {
+ /*
+ * Check whether last held lock:
+ *
+@@ -1576,7 +1576,7 @@ static int validate_chain(struct task_st
+ #else
+ static inline int validate_chain(struct task_struct *curr,
+ struct lockdep_map *lock, struct held_lock *hlock,
+- int chain_head)
++ int chain_head, u64 chain_key)
+ {
+ return 1;
+ }
+@@ -2450,11 +2450,11 @@ static int __lock_acquire(struct lockdep
+ chain_head = 1;
+ }
+ chain_key = iterate_chain_key(chain_key, id);
+- curr->curr_chain_key = chain_key;
+
+- if (!validate_chain(curr, lock, hlock, chain_head))
++ if (!validate_chain(curr, lock, hlock, chain_head, chain_key))
+ return 0;
+
++ curr->curr_chain_key = chain_key;
+ curr->lockdep_depth++;
+ check_chain_key(curr);
+ #ifdef CONFIG_DEBUG_LOCKDEP
+
+--
+
--- /dev/null
+diff --git a/Documentation/ja_JP/HOWTO b/Documentation/ja_JP/HOWTO
+index 9f08dab..d9d832c 100644
+--- a/Documentation/ja_JP/HOWTO
++++ b/Documentation/ja_JP/HOWTO
+@@ -1,4 +1,4 @@
+-NOTE:
++NOTE:
+ This is a version of Documentation/HOWTO translated into Japanese.
+ This document is maintained by Tsugikazu Shibata <tshibata@ab.jp.nec.com>
+ and the JF Project team <www.linux.or.jp/JF>.
+@@ -11,14 +11,14 @@ for non English (read: Japanese) speakers and is not intended as a
+ fork. So if you have any comments or updates for this file, please try
+ to update the original English file first.
+
+-Last Updated: 2007/07/18
++Last Updated: 2007/09/23
+ ==================================
+ これは、
+-linux-2.6.22/Documentation/HOWTO
++linux-2.6.23/Documentation/HOWTO
+ の和訳です。
+
+ 翻訳団体： JF プロジェクト < http://www.linux.or.jp/JF/ >
+-翻訳日： 2007/07/16
++翻訳日： 2007/09/19
+ 翻訳者： Tsugikazu Shibata <tshibata at ab dot jp dot nec dot com>
+ 校正者： 松倉さん <nbh--mats at nifty dot com>
+ 小林 雅典さん (Masanori Kobayasi) <zap03216 at nifty dot ne dot jp>
+@@ -27,6 +27,7 @@ linux-2.6.22/Documentation/HOWTO
+ 野口さん (Kenji Noguchi) <tokyo246 at gmail dot com>
+ 河内さん (Takayoshi Kochi) <t-kochi at bq dot jp dot nec dot com>
+ 岩本さん (iwamoto) <iwamoto.kn at ncos dot nec dot co dot jp>
++ 内田さん (Satoshi Uchida) <s-uchida at ap dot jp dot nec dot com>
+ ==================================
+
+ Linux カーネル開発のやり方
+@@ -40,7 +41,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«é\96\8bç\99ºã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¨å\85±ã\81«æ´»å\8b\95ã\81\99ã\82\8bã\82\84ã\82\8aæ\96¹ã\82\92å¦ã\81
+ 手助けになります。
+
+ もし、このドキュメントのどこかが古くなっていた場合には、このドキュメン
+-トの最後にリストしたメンテナーにパッチを送ってください。
++トの最後にリストしたメンテナにパッチを送ってください。
+
+ はじめに
+ ---------
+@@ -59,7 +60,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«é\96\8bç\99ºã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¨å\85±ã\81«æ´»å\8b\95ã\81\99ã\82\8bã\82\84ã\82\8aæ\96¹ã\82\92å¦ã\81
+ ネル開発者には必要です。アーキテクチャ向けの低レベル部分の開発をするの
+ でなければ、(どんなアーキテクチャでも)アセンブリ(訳注: 言語)は必要あり
+ ません。以下の本は、C 言語の十分な知識や何年もの経験に取って代わるもの
+-ではありませんが、少なくともリファレンスとしてはいい本です。
++ではありませんが、少なくともリファレンスとしては良い本です。
+ - "The C Programming Language" by Kernighan and Ritchie [Prentice Hall]
+ -『プログラミング言語Ｃ第2版』(B.W. カーニハン/D.M. リッチー著 石田晴久訳) [共立出版]
+ - "Practical C Programming" by Steve Oualline [O'Reilly]
+@@ -76,7 +77,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«é\96\8bç\99ºã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¨å\85±ã\81«æ´»å\8b\95ã\81\99ã\82\8bã\82\84ã\82\8aæ\96¹ã\82\92å¦ã\81
+ ときどき、カーネルがツールチェインや C 言語拡張に置いている前提がどう
+ なっているのかわかりにくいことがあり、また、残念なことに決定的なリファ
+ レンスは存在しません。情報を得るには、gcc の info ページ( info gcc )を
+-みてください。
++見てください。
+
+ あなたは既存の開発コミュニティと一緒に作業する方法を学ぼうとしているこ
+ とに留意してください。そのコミュニティは、コーディング、スタイル、
+@@ -92,7 +93,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«é\96\8bç\99ºã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¨å\85±ã\81«æ´»å\8b\95ã\81\99ã\82\8bã\82\84ã\82\8aæ\96¹ã\82\92å¦ã\81
+
+ Linux カーネルのソースコードは GPL ライセンスの下でリリースされていま
+ す。ライセンスの詳細については、ソースツリーのメインディレクトリに存在
+-する、COPYING のファイルをみてください。もしライセンスについてさらに質
++する、COPYING のファイルを見てください。もしライセンスについてさらに質
+ 問があれば、Linux Kernel メーリングリストに質問するのではなく、どうぞ
+ 法律家に相談してください。メーリングリストの人達は法律家ではなく、法的
+ 問題については彼らの声明はあてにするべきではありません。
+@@ -109,7 +110,8 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81¯å¹\85åº\83ã\81\84ç¯\84å\9b²ã\81®ã\83\89ã\82ã\83¥ã\83¡ã\83³ã\83\88ã\82\92å\90
+ 新しいドキュメントファイルも追加することを勧めます。
+ カーネルの変更が、カーネルがユーザ空間に公開しているインターフェイスの
+ 変更を引き起こす場合、その変更を説明するマニュアルページのパッチや情報
+-をマニュアルページのメンテナ mtk-manpages@gmx.net に送ることを勧めます。
++をマニュアルページのメンテナ mtk-manpages@gmx.net に送ることを勧めま
++す。
+
+ 以下はカーネルソースツリーに含まれている読んでおくべきファイルの一覧で
+ す-
+@@ -117,7 +119,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81¯å¹\85åº\83ã\81\84ç¯\84å\9b²ã\81®ã\83\89ã\82ã\83¥ã\83¡ã\83³ã\83\88ã\82\92å\90
+ README
+ このファイルは Linuxカーネルの簡単な背景とカーネルを設定(訳注
+ configure )し、生成(訳注 build )するために必要なことは何かが書かれ
+- ています。カーネルに関して初めての人はここからスタートするとよいで
++ ています。カーネルに関して初めての人はここからスタートすると良いで
+ しょう。
+
+ Documentation/Changes
+@@ -128,7 +130,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81¯å¹\85åº\83ã\81\84ç¯\84å\9b²ã\81®ã\83\89ã\82ã\83¥ã\83¡ã\83³ã\83\88ã\82\92å\90
+ Documentation/CodingStyle
+ これは Linux カーネルのコーディングスタイルと背景にある理由を記述
+ しています。全ての新しいコードはこのドキュメントにあるガイドライン
+- に従っていることを期待されています。大部分のメンテナーはこれらのルー
++ に従っていることを期待されています。大部分のメンテナはこれらのルー
+ ルに従っているものだけを受け付け、多くの人は正しいスタイルのコード
+ だけをレビューします。
+
+@@ -168,16 +170,16 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81¯å¹\85åº\83ã\81\84ç¯\84å\9b²ã\81®ã\83\89ã\82ã\83¥ã\83¡ã\83³ã\83\88ã\82\92å\90
+ 支援してください。
+
+ Documentation/ManagementStyle
+- このドキュメントは Linux カーネルのメンテナー達がどう行動するか、
++ このドキュメントは Linux カーネルのメンテナ達がどう行動するか、
+ 彼らの手法の背景にある共有されている精神について記述しています。こ
+ れはカーネル開発の初心者なら（もしくは、単に興味があるだけの人でも）
+- 重要です。なぜならこのドキュメントは、カーネルメンテナー達の独特な
++ 重要です。なぜならこのドキュメントは、カーネルメンテナ達の独特な
+ 行動についての多くの誤解や混乱を解消するからです。
+
+ Documentation/stable_kernel_rules.txt
+ このファイルはどのように stable カーネルのリリースが行われるかのルー
+ ルが記述されています。そしてこれらのリリースの中のどこかで変更を取
+- り入れてもらいたい場合に何をすればいいかが示されています。
++ り入れてもらいたい場合に何をすれば良いかが示されています。
+
+ Documentation/kernel-docs.txt
+ カーネル開発に付随する外部ドキュメントのリストです。もしあなたが
+@@ -218,9 +220,9 @@ web ã\82µã\82¤ã\83\88ã\81«ã\81¯ã\80\81ã\82³ã\83¼ã\83\89ã\81®æ§\8bæ\88\90ã\80\81ã\82µã\83\96ã\82·ã\82¹ã\83\86ã\83 ã\80\81ç\8f¾å\9c¨å\98å\9c¨ã\81\99ã
+ ここには、また、カーネルのコンパイルのやり方やパッチの当て方などの間接
+ 的な基本情報も記述されています。
+
+-あなたがどこからスタートしてよいかわからないが、Linux カーネル開発コミュ
++あなたがどこからスタートして良いかわからないが、Linux カーネル開発コミュ
+ ニティに参加して何かすることをさがしている場合には、Linux kernel
+-Janitor's プロジェクトにいけばよいでしょう -
++Janitor's プロジェクトにいけば良いでしょう -
+ http://janitor.kernelnewbies.org/
+ ここはそのようなスタートをするのにうってつけの場所です。ここには、
+ Linux カーネルソースツリーの中に含まれる、きれいにし、修正しなければな
+@@ -243,7 +245,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82½ã\83¼ã\82¹ã\83\84ã\83ªã\83¼ã\81®ä¸ã\81«å\90«ã\81¾ã\82\8cã\82\8bã\80\81ã\81\8dã\82\8cã\81\84ã\81«ã\81\97ã\80\81ä¿
+ 自己参照方式で、索引がついた web 形式で、ソースコードを参照することが
+ できます。この最新の素晴しいカーネルコードのリポジトリは以下で見つかり
+ ます-
+- http://sosdg.org/~coywolf/lxr/
++ http://sosdg.org/~qiyong/lxr/
+
+ 開発プロセス
+ -----------------------
+@@ -265,9 +267,9 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\81®é\96\8bç\99ºã\83\97ã\83ã\82»ã\82¹ã\81¯ç\8f¾å\9c¨å¹¾ã\81¤ã\81\8bã\81®ç\95°ã\81ªã\82\8bã\83¡ã\82¤ã\83³ã\82
+ 以下のとおり-
+
+ - 新しいカーネルがリリースされた直後に、2週間の特別期間が設けられ、
+- この期間中に、メンテナー達は Linus に大きな差分を送ることができま
+- す。このような差分は通常 -mm カーネルに数週間含まれてきたパッチで
+- す。 大きな変更は git(カーネルのソース管理ツール、詳細は
++ この期間中に、メンテナ達は Linus に大きな差分を送ることができます。
++ このような差分は通常 -mm カーネルに数週間含まれてきたパッチです。
++ 大きな変更は git(カーネルのソース管理ツール、詳細は
+ http://git.or.cz/ 参照) を使って送るのが好ましいやり方ですが、パッ
+ チファイルの形式のまま送るのでも十分です。
+
+@@ -285,6 +287,10 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\81®é\96\8bç\99ºã\83\97ã\83ã\82»ã\82¹ã\81¯ç\8f¾å\9c¨å¹¾ã\81¤ã\81\8bã\81®ç\95°ã\81ªã\82\8bã\83¡ã\82¤ã\83³ã\82
+ に安定した状態にあると判断したときにリリースされます。目標は毎週新
+ しい -rc カーネルをリリースすることです。
+
++ - 以下の URL で各 -rc リリースに存在する既知の後戻り問題のリスト
++ が追跡されます-
++ http://kernelnewbies.org/known_regressions
++
+ - このプロセスはカーネルが 「準備ができた」と考えられるまで継続しま
+ す。このプロセスはだいたい 6週間継続します。
+
+@@ -331,8 +337,8 @@ Andrew ã\81¯å\80\8bå\88¥ã\81®ã\82µã\83\96ã\82·ã\82¹ã\83\86ã\83 ã\82«ã\83¼ã\83\8dã\83«ã\83\84ã\83ªã\83¼ã\81¨ã\83\91ã\83\83ã\83\81ã\82\92å\85¨ã\81¦é
+ linux-kernel メーリングリストで収集された多数のパッチと同時に一つにま
+ とめます。
+ このツリーは新機能とパッチが検証される場となります。ある期間の間パッチ
+-が -mm に入って価値を証明されたら、Andrew やサブシステムメンテナが、メ
+-インラインへ入れるように Linus にプッシュします。
++が -mm に入って価値を証明されたら、Andrew やサブシステムメンテナが、
++メインラインへ入れるように Linus にプッシュします。
+
+ メインカーネルツリーに含めるために Linus に送る前に、すべての新しいパッ
+ チが -mm ツリーでテストされることが強く推奨されます。
+@@ -460,7 +466,7 @@ MAINTAINERS ã\83\95ã\82¡ã\82¤ã\83«ã\81«ã\83ªã\82¹ã\83\88ã\81\8cã\81\82ã\82\8aã\81¾ã\81\99ã\81®ã\81§å\8f\82ç\85§ã\81\97ã\81¦ã\81\8fã\81 ã\81\95ã\81
+ せん-
+ 彼らはあなたのパッチの行毎にコメントを入れたいので、そのためにはそうす
+ るしかありません。あなたのメールプログラムが空白やタブを圧縮しないよう
+-に確認した方がいいです。最初の良いテストとしては、自分にメールを送って
++に確認した方が良いです。最初の良いテストとしては、自分にメールを送って
+ みて、そのパッチを自分で当ててみることです。もしそれがうまく行かないな
+ ら、あなたのメールプログラムを直してもらうか、正しく動くように変えるべ
+ きです。
+@@ -507,14 +513,14 @@ MAINTAINERS ã\83\95ã\82¡ã\82¤ã\83«ã\81«ã\83ªã\82¹ã\83\88ã\81\8cã\81\82ã\82\8aã\81¾ã\81\99ã\81®ã\81§å\8f\82ç\85§ã\81\97ã\81¦ã\81\8fã\81 ã\81\95ã\81
+ とも普通のことです。これはあなたのパッチが受け入れられないということで
+ は *ありません*、そしてあなた自身に反対することを意味するのでも *ありま
+ せん*。単に自分のパッチに対して指摘された問題を全て修正して再送すれば
+-いいのです。
++良いのです。
+
+
+ カーネルコミュニティと企業組織のちがい
+ -----------------------------------------------------------------
+
+ カーネルコミュニティは大部分の伝統的な会社の開発環境とは異ったやり方で
+-動いています。以下は問題を避けるためにできるとよいことののリストです-
++動いています。以下は問題を避けるためにできると良いことのリストです-
+
+ あなたの提案する変更について言うときのうまい言い方：
+
+@@ -525,7 +531,7 @@ MAINTAINERS ã\83\95ã\82¡ã\82¤ã\83«ã\81«ã\83ªã\82¹ã\83\88ã\81\8cã\81\82ã\82\8aã\81¾ã\81\99ã\81®ã\81§å\8f\82ç\85§ã\81\97ã\81¦ã\81\8fã\81 ã\81\95ã\81
+ - "以下は一連の小さなパッチ群ですが..."
+ - "これは典型的なマシンでの性能を向上させます.."
+
+- やめた方がいい悪い言い方：
++ やめた方が良い悪い言い方：
+
+ - このやり方で AIX/ptx/Solaris ではできたので、できるはずだ
+ - 私はこれを20年もの間やってきた、だから
+@@ -575,10 +581,10 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¯ã\80\81ä¸\80度ã\81«å¤§é\87\8fã\81®ã\82³ã\83¼ã\83\89ã\81®å¡\8aã\82\92å\96
+
+ 1) 小さいパッチはあなたのパッチが適用される見込みを大きくします、カー
+ ネルの人達はパッチが正しいかどうかを確認する時間や労力をかけないか
+- らです。5行のパッチはメンテナがたった1秒見るだけで適用できます。し
+- かし、500行のパッチは、正しいことをレビューするのに数時間かかるかも
+- しれません(時間はパッチのサイズなどにより指数関数に比例してかかりま
+- す)
++ らです。5行のパッチはメンテナがたった1秒見るだけで適用できます。
++ しかし、500行のパッチは、正しいことをレビューするのに数時間かかるか
++ もしれません(時間はパッチのサイズなどにより指数関数に比例してかかり
++ ます)
+
+ 小さいパッチは何かあったときにデバッグもとても簡単になります。パッ
+ チを1個1個取り除くのは、とても大きなパッチを当てた後に(かつ、何かお
+@@ -587,23 +593,23 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¯ã\80\81ä¸\80度ã\81«å¤§é\87\8fã\81®ã\82³ã\83¼ã\83\89ã\81®å¡\8aã\82\92å\96
+ 2) 小さいパッチを送るだけでなく、送るまえに、書き直して、シンプルにす
+ る(もしくは、単に順番を変えるだけでも)ことも、とても重要です。
+
+-以下はカーネル開発者の Al Viro のたとえ話しです：
++以下はカーネル開発者の Al Viro のたとえ話です：
+
+ "生徒の数学の宿題を採点する先生のことを考えてみてください、先
+- 生は生徒が解に到達するまでの試行錯誤をみたいとは思わないでしょ
+- う。先生は簡潔な最高の解をみたいのです。良い生徒はこれを知って
++ 生は生徒が解に到達するまでの試行錯誤を見たいとは思わないでしょ
++ う。先生は簡潔な最高の解を見たいのです。良い生徒はこれを知って
+ おり、そして最終解の前の中間作業を提出することは決してないので
+ す"
+
+- カーネル開発でもこれは同じです。メンテナー達とレビューア達は、
+- 問題を解決する解の背後になる思考プロセスをみたいとは思いません。
+- 彼らは単純であざやかな解決方法をみたいのです。
++ カーネル開発でもこれは同じです。メンテナ達とレビューア達は、
++ 問題を解決する解の背後になる思考プロセスを見たいとは思いません。
++ 彼らは単純であざやかな解決方法を見たいのです。
+
+ あざやかな解を説明するのと、コミュニティと共に仕事をし、未解決の仕事を
+ 議論することのバランスをキープするのは難しいかもしれません。
+ ですから、開発プロセスの早期段階で改善のためのフィードバックをもらうよ
+-うにするのもいいですが、変更点を小さい部分に分割して全体ではまだ完成し
+-ていない仕事を(部分的に)取り込んでもらえるようにすることもいいことです。
++うにするのも良いですが、変更点を小さい部分に分割して全体ではまだ完成し
++ていない仕事を(部分的に)取り込んでもらえるようにすることも良いことです。
+
+ また、でき上がっていないものや、"将来直す" ようなパッチを、本流に含め
+ てもらうように送っても、それは受け付けられないことを理解してください。
+@@ -629,7 +635,7 @@ Linux ã\82«ã\83¼ã\83\8dã\83«ã\82³ã\83\9fã\83¥ã\83\8bã\83\86ã\82£ã\81¯ã\80\81ä¸\80度ã\81«å¤§é\87\8fã\81®ã\82³ã\83¼ã\83\89ã\81®å¡\8aã\82\92å\96
+ - テスト結果
+
+ これについて全てがどのようにあるべきかについての詳細は、以下のドキュメ
+-ントの ChangeLog セクションをみてください-
++ントの ChangeLog セクションを見てください-
+ "The Perfect Patch"
+ http://www.zip.com.au/~akpm/linux/patches/stuff/tpp.txt
+
+diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
+index ed39313..026cf24 100644
+--- a/block/ll_rw_blk.c
++++ b/block/ll_rw_blk.c
+@@ -819,7 +819,6 @@ static int __blk_free_tags(struct blk_queue_tag *bqt)
+ retval = atomic_dec_and_test(&bqt->refcnt);
+ if (retval) {
+ BUG_ON(bqt->busy);
+- BUG_ON(!list_empty(&bqt->busy_list));
+
+ kfree(bqt->tag_index);
+ bqt->tag_index = NULL;
+@@ -931,7 +930,6 @@ static struct blk_queue_tag *__blk_queue_init_tags(struct request_queue *q,
+ if (init_tag_map(q, tags, depth))
+ goto fail;
+
+- INIT_LIST_HEAD(&tags->busy_list);
+ tags->busy = 0;
+ atomic_set(&tags->refcnt, 1);
+ return tags;
+@@ -982,6 +980,7 @@ int blk_queue_init_tags(struct request_queue *q, int depth,
+ */
+ q->queue_tags = tags;
+ q->queue_flags |= (1 << QUEUE_FLAG_QUEUED);
++ INIT_LIST_HEAD(&q->tag_busy_list);
+ return 0;
+ fail:
+ kfree(tags);
+@@ -1152,7 +1151,7 @@ int blk_queue_start_tag(struct request_queue *q, struct request *rq)
+ rq->tag = tag;
+ bqt->tag_index[tag] = rq;
+ blkdev_dequeue_request(rq);
+- list_add(&rq->queuelist, &bqt->busy_list);
++ list_add(&rq->queuelist, &q->tag_busy_list);
+ bqt->busy++;
+ return 0;
+ }
+@@ -1173,11 +1172,10 @@ EXPORT_SYMBOL(blk_queue_start_tag);
+ **/
+ void blk_queue_invalidate_tags(struct request_queue *q)
+ {
+- struct blk_queue_tag *bqt = q->queue_tags;
+ struct list_head *tmp, *n;
+ struct request *rq;
+
+- list_for_each_safe(tmp, n, &bqt->busy_list) {
++ list_for_each_safe(tmp, n, &q->tag_busy_list) {
+ rq = list_entry_rq(tmp);
+
+ if (rq->tag == -1) {
+diff --git a/fs/locks.c b/fs/locks.c
+index c795eaa..494f250 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -694,11 +694,20 @@ EXPORT_SYMBOL(posix_test_lock);
+ * Note: the above assumption may not be true when handling lock requests
+ * from a broken NFS client. But broken NFS clients have a lot more to
+ * worry about than proper deadlock detection anyway... --okir
++ *
++ * However, the failure of this assumption (also possible in the case of
++ * multiple tasks sharing the same open file table) also means there's no
++ * guarantee that the loop below will terminate. As a hack, we give up
++ * after a few iterations.
+ */
++
++#define MAX_DEADLK_ITERATIONS 10
++
+ static int posix_locks_deadlock(struct file_lock *caller_fl,
+ struct file_lock *block_fl)
+ {
+ struct list_head *tmp;
++ int i = 0;
+
+ next_task:
+ if (posix_same_owner(caller_fl, block_fl))
+@@ -706,6 +715,8 @@ next_task:
+ list_for_each(tmp, &blocked_list) {
+ struct file_lock *fl = list_entry(tmp, struct file_lock, fl_link);
+ if (posix_same_owner(fl, block_fl)) {
++ if (i++ > MAX_DEADLK_ITERATIONS)
++ return 0;
+ fl = fl->fl_next;
+ block_fl = fl;
+ goto next_task;
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index ee4814d..20d7ae4 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -351,7 +351,8 @@ static cputime_t task_utime(struct task_struct *p)
+ }
+ utime = (clock_t)temp;
+
+- return clock_t_to_cputime(utime);
++ p->prev_utime = max(p->prev_utime, clock_t_to_cputime(utime));
++ return p->prev_utime;
+ }
+
+ static cputime_t task_stime(struct task_struct *p)
+@@ -366,7 +367,8 @@ static cputime_t task_stime(struct task_struct *p)
+ stime = nsec_to_clock_t(p->se.sum_exec_runtime) -
+ cputime_to_clock_t(task_utime(p));
+
+- return clock_t_to_cputime(stime);
++ p->prev_stime = max(p->prev_stime, clock_t_to_cputime(stime));
++ return p->prev_stime;
+ }
+ #endif
+
+diff --git a/fs/splice.c b/fs/splice.c
+index e95a362..02c39ae 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1390,10 +1390,10 @@ static int pipe_to_user(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
+ if (copy_to_user(sd->u.userptr, src + buf->offset, sd->len))
+ ret = -EFAULT;
+
++ buf->ops->unmap(pipe, buf, src);
+ out:
+ if (ret > 0)
+ sd->u.userptr += ret;
+- buf->ops->unmap(pipe, buf, src);
+ return ret;
+ }
+
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index b126c6f..d26bbb0 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -356,7 +356,6 @@ enum blk_queue_state {
+ struct blk_queue_tag {
+ struct request **tag_index; /* map of busy tags */
+ unsigned long *tag_map; /* bit map of free/busy tags */
+- struct list_head busy_list; /* fifo list of busy tags */
+ int busy; /* current depth */
+ int max_depth; /* what we will send to device */
+ int real_max_depth; /* what the array can hold */
+@@ -451,6 +450,7 @@ struct request_queue
+ unsigned int dma_alignment;
+
+ struct blk_queue_tag *queue_tags;
++ struct list_head tag_busy_list;
+
+ unsigned int nr_sorted;
+ unsigned int in_flight;
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 313c6b6..f509fbd 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1022,6 +1022,7 @@ struct task_struct {
+
+ unsigned int rt_priority;
+ cputime_t utime, stime;
++ cputime_t prev_utime, prev_stime;
+ unsigned long nvcsw, nivcsw; /* context switch counts */
+ struct timespec start_time; /* monotonic time */
+ struct timespec real_start_time; /* boot based time */
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 33f12f4..f299d45 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1045,6 +1045,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+
+ p->utime = cputime_zero;
+ p->stime = cputime_zero;
++ p->prev_utime = cputime_zero;
++ p->prev_stime = cputime_zero;
+
+ #ifdef CONFIG_TASK_XACCT
+ p->rchar = 0; /* I/O counter: bytes read */
+diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
+index 2c2e295..f938c23 100644
+--- a/kernel/futex_compat.c
++++ b/kernel/futex_compat.c
+@@ -29,6 +29,15 @@ fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
+ return 0;
+ }
+
++static void __user *futex_uaddr(struct robust_list *entry,
++ compat_long_t futex_offset)
++{
++ compat_uptr_t base = ptr_to_compat(entry);
++ void __user *uaddr = compat_ptr(base + futex_offset);
++
++ return uaddr;
++}
++
+ /*
+ * Walk curr->robust_list (very carefully, it's a userspace list!)
+ * and mark any locks found there dead, and notify any waiters.
+@@ -75,11 +84,13 @@ void compat_exit_robust_list(struct task_struct *curr)
+ * A pending lock might already be on the list, so
+ * dont process it twice:
+ */
+- if (entry != pending)
+- if (handle_futex_death((void __user *)entry + futex_offset,
+- curr, pi))
+- return;
++ if (entry != pending) {
++ void __user *uaddr = futex_uaddr(entry,
++ futex_offset);
+
++ if (handle_futex_death(uaddr, curr, pi))
++ return;
++ }
+ if (rc)
+ return;
+ uentry = next_uentry;
+@@ -93,9 +104,11 @@ void compat_exit_robust_list(struct task_struct *curr)
+
+ cond_resched();
+ }
+- if (pending)
+- handle_futex_death((void __user *)pending + futex_offset,
+- curr, pip);
++ if (pending) {
++ void __user *uaddr = futex_uaddr(pending, futex_offset);
++
++ handle_futex_death(uaddr, curr, pip);
++ }
+ }
+
+ asmlinkage long
+diff --git a/kernel/lockdep.c b/kernel/lockdep.c
+index 734da57..42ae4a5 100644
+--- a/kernel/lockdep.c
++++ b/kernel/lockdep.c
+@@ -1521,7 +1521,7 @@ cache_hit:
+ }
+
+ static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
+- struct held_lock *hlock, int chain_head)
++ struct held_lock *hlock, int chain_head, u64 chain_key)
+ {
+ /*
+ * Trylock needs to maintain the stack of held locks, but it
+@@ -1534,7 +1534,7 @@ static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
+ * graph_lock for us)
+ */
+ if (!hlock->trylock && (hlock->check == 2) &&
+- lookup_chain_cache(curr->curr_chain_key, hlock->class)) {
++ lookup_chain_cache(chain_key, hlock->class)) {
+ /*
+ * Check whether last held lock:
+ *
+@@ -1576,7 +1576,7 @@ static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
+ #else
+ static inline int validate_chain(struct task_struct *curr,
+ struct lockdep_map *lock, struct held_lock *hlock,
+- int chain_head)
++ int chain_head, u64 chain_key)
+ {
+ return 1;
+ }
+@@ -2450,11 +2450,11 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
+ chain_head = 1;
+ }
+ chain_key = iterate_chain_key(chain_key, id);
+- curr->curr_chain_key = chain_key;
+
+- if (!validate_chain(curr, lock, hlock, chain_head))
++ if (!validate_chain(curr, lock, hlock, chain_head, chain_key))
+ return 0;
+
++ curr->curr_chain_key = chain_key;
+ curr->lockdep_depth++;
+ check_chain_key(curr);
+ #ifdef CONFIG_DEBUG_LOCKDEP
+diff --git a/kernel/params.c b/kernel/params.c
+index 4e57732..e6101d7 100644
+--- a/kernel/params.c
++++ b/kernel/params.c
+@@ -595,11 +595,17 @@ static void __init param_sysfs_builtin(void)
+
+ for (i=0; i < __stop___param - __start___param; i++) {
+ char *dot;
++ size_t kplen;
+
+ kp = &__start___param[i];
++ kplen = strlen(kp->name);
+
+ /* We do not handle args without periods. */
+- dot = memchr(kp->name, '.', MAX_KBUILD_MODNAME);
++ if (kplen > MAX_KBUILD_MODNAME) {
++ DEBUGP("kernel parameter name is too long: %s\n", kp->name);
++ continue;
++ }
++ dot = memchr(kp->name, '.', kplen);
+ if (!dot) {
+ DEBUGP("couldn't find period in %s\n", kp->name);
+ continue;
+diff --git a/kernel/softlockup.c b/kernel/softlockup.c
+index 708d488..e557c44 100644
+--- a/kernel/softlockup.c
++++ b/kernel/softlockup.c
+@@ -80,10 +80,11 @@ void softlockup_tick(void)
+ print_timestamp = per_cpu(print_timestamp, this_cpu);
+
+ /* report at most once a second */
+- if (print_timestamp < (touch_timestamp + 1) ||
+- did_panic ||
+- !per_cpu(watchdog_task, this_cpu))
++ if ((print_timestamp >= touch_timestamp &&
++ print_timestamp < (touch_timestamp + 1)) ||
++ did_panic || !per_cpu(watchdog_task, this_cpu)) {
+ return;
++ }
+
+ /* do not print during early bootup: */
+ if (unlikely(system_state != SYSTEM_RUNNING)) {
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 15c8413..14ca63f 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1312,7 +1312,7 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+
+ size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+ if (vmf->pgoff >= size)
+- goto outside_data_content;
++ return VM_FAULT_SIGBUS;
+
+ /* If we don't want any read-ahead, don't bother */
+ if (VM_RandomReadHint(vma))
+@@ -1389,7 +1389,7 @@ retry_find:
+ if (unlikely(vmf->pgoff >= size)) {
+ unlock_page(page);
+ page_cache_release(page);
+- goto outside_data_content;
++ return VM_FAULT_SIGBUS;
+ }
+
+ /*
+@@ -1400,15 +1400,6 @@ retry_find:
+ vmf->page = page;
+ return ret | VM_FAULT_LOCKED;
+
+-outside_data_content:
+- /*
+- * An external ptracer can access pages that normally aren't
+- * accessible..
+- */
+- if (vma->vm_mm == current->mm)
+- return VM_FAULT_SIGBUS;
+-
+- /* Fall through to the non-read-ahead case */
+ no_cached_page:
+ /*
+ * We're only likely to ever get here if MADV_RANDOM is in
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 4472036..97ddc58 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -672,8 +672,10 @@ retry:
+
+ ret = (*writepage)(page, wbc, data);
+
+- if (unlikely(ret == AOP_WRITEPAGE_ACTIVATE))
++ if (unlikely(ret == AOP_WRITEPAGE_ACTIVATE)) {
+ unlock_page(page);
++ ret = 0;
++ }
+ if (ret || (--(wbc->nr_to_write) <= 0))
+ done = 1;
+ if (wbc->nonblocking && bdi_write_congested(bdi)) {
+diff --git a/mm/shmem.c b/mm/shmem.c
+index fcd19d3..95558e4 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -916,6 +916,21 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
+ struct inode *inode;
+
+ BUG_ON(!PageLocked(page));
++ /*
++ * shmem_backing_dev_info's capabilities prevent regular writeback or
++ * sync from ever calling shmem_writepage; but a stacking filesystem
++ * may use the ->writepage of its underlying filesystem, in which case
++ * we want to do nothing when that underlying filesystem is tmpfs
++ * (writing out to swap is useful as a response to memory pressure, but
++ * of no use to stabilize the data) - just redirty the page, unlock it
++ * and claim success in this case. AOP_WRITEPAGE_ACTIVATE, and the
++ * page_mapped check below, must be avoided unless we're in reclaim.
++ */
++ if (!wbc->for_reclaim) {
++ set_page_dirty(page);
++ unlock_page(page);
++ return 0;
++ }
+ BUG_ON(page_mapped(page));
+
+ mapping = page->mapping;
+diff --git a/mm/slub.c b/mm/slub.c
+index addb20a..c1f2fda 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1501,28 +1501,8 @@ new_slab:
+ page = new_slab(s, gfpflags, node);
+ if (page) {
+ cpu = smp_processor_id();
+- if (s->cpu_slab[cpu]) {
+- /*
+- * Someone else populated the cpu_slab while we
+- * enabled interrupts, or we have gotten scheduled
+- * on another cpu. The page may not be on the
+- * requested node even if __GFP_THISNODE was
+- * specified. So we need to recheck.
+- */
+- if (node == -1 ||
+- page_to_nid(s->cpu_slab[cpu]) == node) {
+- /*
+- * Current cpuslab is acceptable and we
+- * want the current one since its cache hot
+- */
+- discard_slab(s, page);
+- page = s->cpu_slab[cpu];
+- slab_lock(page);
+- goto load_freelist;
+- }
+- /* New slab does not fit our expectations */
++ if (s->cpu_slab[cpu])
+ flush_slab(s, s->cpu_slab[cpu], cpu);
+- }
+ slab_lock(page);
+ SetSlabFrozen(page);
+ s->cpu_slab[cpu] = page;
--- /dev/null
+# core kernel changes
+lockdep-fix-mismatched-lockdep_depth-curr_chain_hash.patch
+locks-fix-possible-infinite-loop-in-posix-deadlock-detection.patch
+remove-broken-ptrace-special-case-code-from-file-mapping.patch
+param_sysfs_builtin-memchr-argument-fix.patch
+howto-update-ja_jp-howto-with-latest-changes.patch
+slub-fix-memory-leak-by-not-reusing-cpu_slab.patch
+writeback-don-t-propagate-aop_writepage_activate.patch
+splice-fix-double-kunmap-in-vmsplice-copy-path.patch
+fix-the-softlockup-watchdog-to-actually-work.patch
+sched-keep-utime-stime-monotonic.patch
+fix-compat-futex-hangs.patch
+fix-tmpfs-bug-and-aop_writepage_activate.patch
+block-fix-bad-sharing-of-tag-busy-list-on-queues-with-shared-tag-maps.patch
+
--- /dev/null
+ arch/i386/boot/boot.h | 8 ++--
+ arch/i386/boot/header.S | 62 +++++++++++++++++++++++----------
+ arch/i386/boot/video-bios.c | 2 -
+ arch/i386/boot/video-vesa.c | 2 -
+ arch/i386/boot/video.c | 2 -
+ arch/i386/kernel/tsc.c | 5 +-
+ arch/i386/xen/enlighten.c | 57 ++++++++++++++++++++----------
+ arch/i386/xen/mmu.c | 29 +++++++++++++--
+ arch/i386/xen/multicalls.c | 29 +++++++++++++--
+ arch/i386/xen/multicalls.h | 3 +
+ arch/i386/xen/xen-ops.h | 1
+ arch/mips/mm/c-r4k.c | 21 +++++++++--
+ arch/powerpc/math-emu/math.c | 13 ++++--
+ arch/powerpc/platforms/cell/axon_msi.c | 4 +-
+ arch/sparc64/kernel/sys_sparc.c | 2 -
+ arch/sparc64/lib/xor.S | 12 +++---
+ arch/um/Makefile | 3 +
+ arch/um/include/common-offsets.h | 1
+ arch/um/include/sysdep-i386/stub.h | 3 -
+ arch/um/kernel/skas/clone.c | 1
+ arch/um/os-Linux/main.c | 1
+ arch/um/os-Linux/skas/mem.c | 1
+ arch/um/os-Linux/skas/process.c | 2 -
+ arch/um/os-Linux/start_up.c | 1
+ arch/um/os-Linux/tt.c | 1
+ arch/um/os-Linux/util.c | 38 ++++++++++++++++++++
+ arch/um/sys-i386/user-offsets.c | 6 +--
+ arch/um/sys-x86_64/user-offsets.c | 9 ----
+ arch/x86_64/mm/init.c | 6 ---
+ arch/x86_64/mm/pageattr.c | 9 +++-
+ fs/xfs/linux-2.6/xfs_buf.c | 13 ++++++
+ include/asm-mips/hazards.h | 54 ++++++++++++++++++++++++++++
+ include/linux/bootmem.h | 1
+ include/xen/interface/vcpu.h | 5 +-
+ mm/sparse.c | 11 -----
+ 35 files changed, 307 insertions(+), 111 deletions(-)
--- /dev/null
+From gregkh@mini.kroah.org Wed Nov 14 21:50:57 2007
+Message-Id: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/19] 2.6.23-stable review, arch specific stuff
+
+This is the start of the stable review cycle for the 2.6.23.X release.
+There are 19 patches in this series, all will be posted as a response
+to this one. If anyone has any issues with these being applied, please
+let us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the
+Cc: line. If you wish to be a reviewer, please email stable@kernel.org
+to add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday 00:00:00 UTC. Anything received
+after that time might be too late.
+
+This set of patches focuses on arch specific changes.
+
+The diffstat of this review series is included below.
+
+thanks,
+
+greg k-h
+
+-----
+
+ arch/i386/boot/boot.h | 8 ++--
+ arch/i386/boot/header.S | 62 +++++++++++++++++++++++----------
+ arch/i386/boot/video-bios.c | 2 -
+ arch/i386/boot/video-vesa.c | 2 -
+ arch/i386/boot/video.c | 2 -
+ arch/i386/kernel/tsc.c | 5 +-
+ arch/i386/xen/enlighten.c | 57 ++++++++++++++++++++----------
+ arch/i386/xen/mmu.c | 29 +++++++++++++--
+ arch/i386/xen/multicalls.c | 29 +++++++++++++--
+ arch/i386/xen/multicalls.h | 3 +
+ arch/i386/xen/xen-ops.h | 1
+ arch/mips/mm/c-r4k.c | 21 +++++++++--
+ arch/powerpc/math-emu/math.c | 13 ++++--
+ arch/powerpc/platforms/cell/axon_msi.c | 4 +-
+ arch/sparc64/kernel/sys_sparc.c | 2 -
+ arch/sparc64/lib/xor.S | 12 +++---
+ arch/um/Makefile | 3 +
+ arch/um/include/common-offsets.h | 1
+ arch/um/include/sysdep-i386/stub.h | 3 -
+ arch/um/kernel/skas/clone.c | 1
+ arch/um/os-Linux/main.c | 1
+ arch/um/os-Linux/skas/mem.c | 1
+ arch/um/os-Linux/skas/process.c | 2 -
+ arch/um/os-Linux/start_up.c | 1
+ arch/um/os-Linux/tt.c | 1
+ arch/um/os-Linux/util.c | 38 ++++++++++++++++++++
+ arch/um/sys-i386/user-offsets.c | 6 +--
+ arch/um/sys-x86_64/user-offsets.c | 9 ----
+ arch/x86_64/mm/init.c | 6 ---
+ arch/x86_64/mm/pageattr.c | 9 +++-
+ fs/xfs/linux-2.6/xfs_buf.c | 13 ++++++
+ include/asm-mips/hazards.h | 54 ++++++++++++++++++++++++++++
+ include/linux/bootmem.h | 1
+ include/xen/interface/vcpu.h | 5 +-
+ mm/sparse.c | 11 -----
+ 35 files changed, 307 insertions(+), 111 deletions(-)
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:57 2007
+Message-Id: <20071115055057.528347793@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 01/19] Fix sparc64 niagara optimized RAID xor asm
+Content-Disposition: inline; filename=fix-sparc64-niagara-optimized-raid-xor-asm.patch
+Content-Length: 2472
+Lines: 70
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Miller <davem@davemloft.net>
+
+patch d060db63fd38a8a75f666576ef9999c28cdc31cf in mainline.
+
+[SPARC64]: Fix register usage in xor_raid_4().
+
+Some typos led to using %i6/%i7 instead of %l6/%l7 in loads which is
+really really bad because those are the frame pointer and return PC.
+
+Based upon a raid5 crash report by Bertrand Joel.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/lib/xor.S | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/sparc64/lib/xor.S
++++ b/arch/sparc64/lib/xor.S
+@@ -491,12 +491,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest,
+ ldda [%i1 + 0x10] %asi, %i2 /* %i2/%i3 = src1 + 0x10 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x10] %asi, %i4 /* %i4/%i5 = src2 + 0x10 */
++ ldda [%l7 + 0x10] %asi, %i4 /* %i4/%i5 = src2 + 0x10 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x00] %asi
+ stxa %l1, [%i0 + 0x08] %asi
+- ldda [%i6 + 0x10] %asi, %g2 /* %g2/%g3 = src3 + 0x10 */
++ ldda [%l6 + 0x10] %asi, %g2 /* %g2/%g3 = src3 + 0x10 */
+ ldda [%i0 + 0x10] %asi, %l0 /* %l0/%l1 = dest + 0x10 */
+
+ xor %i4, %i2, %i4
+@@ -504,12 +504,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest,
+ ldda [%i1 + 0x20] %asi, %i2 /* %i2/%i3 = src1 + 0x20 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x20] %asi, %i4 /* %i4/%i5 = src2 + 0x20 */
++ ldda [%l7 + 0x20] %asi, %i4 /* %i4/%i5 = src2 + 0x20 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x10] %asi
+ stxa %l1, [%i0 + 0x18] %asi
+- ldda [%i6 + 0x20] %asi, %g2 /* %g2/%g3 = src3 + 0x20 */
++ ldda [%l6 + 0x20] %asi, %g2 /* %g2/%g3 = src3 + 0x20 */
+ ldda [%i0 + 0x20] %asi, %l0 /* %l0/%l1 = dest + 0x20 */
+
+ xor %i4, %i2, %i4
+@@ -517,12 +517,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest,
+ ldda [%i1 + 0x30] %asi, %i2 /* %i2/%i3 = src1 + 0x30 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x30] %asi, %i4 /* %i4/%i5 = src2 + 0x30 */
++ ldda [%l7 + 0x30] %asi, %i4 /* %i4/%i5 = src2 + 0x30 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x20] %asi
+ stxa %l1, [%i0 + 0x28] %asi
+- ldda [%i6 + 0x30] %asi, %g2 /* %g2/%g3 = src3 + 0x30 */
++ ldda [%l6 + 0x30] %asi, %g2 /* %g2/%g3 = src3 + 0x30 */
+ ldda [%i0 + 0x30] %asi, %l0 /* %l0/%l1 = dest + 0x30 */
+
+ prefetch [%i1 + 0x40], #one_read
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:57 2007
+Message-Id: <20071115055057.690321254@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Chris Wright <chrisw@sous-sol.org>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 02/19] Fix sparc64 MAP_FIXED handling of framebuffer mmaps
+Content-Disposition: inline; filename=fix-sparc64-map_fixed-handling-of-framebuffer-mmaps.patch
+Content-Length: 1178
+Lines: 36
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Chris Wright <chrisw@sous-sol.org>
+
+patch d58aa8c7b1cc0add7b03e26bdb8988d98d2f4cd1 in mainline.
+
+From: Chris Wright <chrisw@sous-sol.org>
+Date: Tue, 23 Oct 2007 20:36:14 -0700
+Subject: [patch 02/19] [PATCH] [SPARC64]: pass correct addr in get_fb_unmapped_area(MAP_FIXED)
+
+Looks like the MAP_FIXED case is using the wrong address hint. I'd
+expect the comment "don't mess with it" means pass the request
+straight on through, not change the address requested to -ENOMEM.
+
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/sys_sparc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc64/kernel/sys_sparc.c
++++ b/arch/sparc64/kernel/sys_sparc.c
+@@ -319,7 +319,7 @@ unsigned long get_fb_unmapped_area(struc
+
+ if (flags & MAP_FIXED) {
+ /* Ok, don't mess with it. */
+- return get_unmapped_area(NULL, addr, len, pgoff, flags);
++ return get_unmapped_area(NULL, orig_addr, len, pgoff, flags);
+ }
+ flags &= ~MAP_SHARED;
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:57 2007
+Message-Id: <20071115055057.841547764@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ralf Baechle <ralf@linux-mips.org>
+Subject: [patch 03/19] MIPS: MT: Fix bug in multithreaded kernels.
+Content-Disposition: inline; filename=mips-mt-fix-bug-in-multithreaded-kernels.patch
+Content-Length: 3180
+Lines: 101
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ralf Baechle <ralf@linux-mips.org>
+
+patch a76ab5c10d99bdf458067cb495e72c0ee5f09909 in mainline.
+
+When GDB writes a breakpoint into address area of inferior process the
+kernel needs to invalidate the modified memory in the inferior which
+is done by calling flush_cache_page which in turns calls
+r4k_flush_cache_page and local_r4k_flush_cache_page for VSMP or SMTC
+kernel via r4k_on_each_cpu().
+
+As the VSMP and SMTC SMP kernels for 34K are running on a single shared
+caches it is possible to get away without interprocessor function calls.
+This optimization is implemented in r4k_on_each_cpu, so
+local_r4k_flush_cache_page is only ever called on the local CPU.
+
+This is where the following code in local_r4k_flush_cache_page() strikes:
+
+ /*
+ * If ownes no valid ASID yet, cannot possibly have gotten
+ * this page into the cache.
+ */
+ if (cpu_context(smp_processor_id(), mm) == 0)
+ return;
+
+On VSMP and SMTC had a function of cpu_context() for each CPU(TC).
+
+So in case another CPU than the CPU executing local_r4k_cache_flush_page
+has not accessed the mm but one of the other CPUs has there may be data
+to be flushed in the cache yet local_r4k_cache_flush_page will falsely
+return leaving the I-cache inconsistent for the breakpoint.
+
+While the issue was discovered with GDB it also exists in
+local_r4k_flush_cache_range() and local_r4k_flush_cache().
+
+Fixed by introducing a new function has_valid_asid which on MT kernels
+returns true if a mm is active on any processor in the system.
+
+This is relativly expensive since for memory acccesses in that loop
+cache misses have to be assumed but it seems the most viable solution
+for 2.6.23 and older -stable kernels.
+
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/mips/mm/c-r4k.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -360,11 +360,26 @@ static void r4k___flush_cache_all(void)
+ r4k_on_each_cpu(local_r4k___flush_cache_all, NULL, 1, 1);
+ }
+
++static inline int has_valid_asid(const struct mm_struct *mm)
++{
++#if defined(CONFIG_MIPS_MT_SMP) || defined(CONFIG_MIPS_MT_SMTC)
++ int i;
++
++ for_each_online_cpu(i)
++ if (cpu_context(i, mm))
++ return 1;
++
++ return 0;
++#else
++ return cpu_context(smp_processor_id(), mm);
++#endif
++}
++
+ static inline void local_r4k_flush_cache_range(void * args)
+ {
+ struct vm_area_struct *vma = args;
+
+- if (!(cpu_context(smp_processor_id(), vma->vm_mm)))
++ if (!(has_valid_asid(vma->vm_mm)))
+ return;
+
+ r4k_blast_dcache();
+@@ -383,7 +398,7 @@ static inline void local_r4k_flush_cache
+ {
+ struct mm_struct *mm = args;
+
+- if (!cpu_context(smp_processor_id(), mm))
++ if (!has_valid_asid(mm))
+ return;
+
+ /*
+@@ -434,7 +449,7 @@ static inline void local_r4k_flush_cache
+ * If ownes no valid ASID yet, cannot possibly have gotten
+ * this page into the cache.
+ */
+- if (cpu_context(smp_processor_id(), mm) == 0)
++ if (!has_valid_asid(mm))
+ return;
+
+ addr &= PAGE_MASK;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:58 2007
+Message-Id: <20071115055058.008207143@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ralf Baechle <ralf@linux-mips.org>
+Subject: [patch 04/19] MIPS: R1: Fix hazard barriers to make kernels work on R2 also.
+Content-Disposition: inline; filename=mips-r1-fix-hazard-barriers-to-make-kernels-work-on-r2-also.patch
+Content-Length: 2513
+Lines: 94
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ralf Baechle <ralf@linux-mips.org>
+
+patch 572afc248c33c902760f6f24a72c180f0e4f1719 in mainline.
+
+Tested with Malta; inflates malta_defconfig by 3932 bytes. Ideally there
+should be additional configuration to allow getting rid of this overhead
+but that would be too much complexity at this stage of the release cycle.
+
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-mips/hazards.h | 54 ++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 53 insertions(+), 1 deletion(-)
+
+--- a/include/asm-mips/hazards.h
++++ b/include/asm-mips/hazards.h
+@@ -10,11 +10,12 @@
+ #ifndef _ASM_HAZARDS_H
+ #define _ASM_HAZARDS_H
+
+-
+ #ifdef __ASSEMBLY__
+ #define ASMMACRO(name, code...) .macro name; code; .endm
+ #else
+
++#include <asm/cpu-features.h>
++
+ #define ASMMACRO(name, code...) \
+ __asm__(".macro " #name "; " #code "; .endm"); \
+ \
+@@ -86,6 +87,57 @@ do { \
+ : "=r" (tmp)); \
+ } while (0)
+
++#elif defined(CONFIG_CPU_MIPSR1)
++
++/*
++ * These are slightly complicated by the fact that we guarantee R1 kernels to
++ * run fine on R2 processors.
++ */
++ASMMACRO(mtc0_tlbw_hazard,
++ _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(tlbw_use_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(tlb_probe_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(irq_enable_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(irq_disable_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(back_to_back_c0_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++/*
++ * gcc has a tradition of misscompiling the previous construct using the
++ * address of a label as argument to inline assembler. Gas otoh has the
++ * annoying difference between la and dla which are only usable for 32-bit
++ * rsp. 64-bit code, so can't be used without conditional compilation.
++ * The alterantive is switching the assembler to 64-bit code which happens
++ * to work right even for 32-bit code ...
++ */
++#define __instruction_hazard() \
++do { \
++ unsigned long tmp; \
++ \
++ __asm__ __volatile__( \
++ " .set mips64r2 \n" \
++ " dla %0, 1f \n" \
++ " jr.hb %0 \n" \
++ " .set mips0 \n" \
++ "1: \n" \
++ : "=r" (tmp)); \
++} while (0)
++
++#define instruction_hazard() \
++do { \
++ if (cpu_has_mips_r2) \
++ __instruction_hazard(); \
++} while (0)
++
+ #elif defined(CONFIG_CPU_R10000)
+
+ /*
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:58 2007
+Message-Id: <20071115055058.164212815@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kumar Gala <galak@kernel.crashing.org>
+Subject: [patch 05/19] POWERPC: Fix handling of stfiwx math emulation
+Content-Disposition: inline; filename=powerpc-fix-handling-of-stfiwx-math-emulation.patch
+Content-Length: 1252
+Lines: 46
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kumar Gala <galak@kernel.crashing.org>
+
+patch ba02946a903015840ef672ccc9dc8620a7e83de6 in mainline
+
+Its legal for the stfiwx instruction to have RA = 0 as part of its
+effective address calculation. This is illegal for all other XE
+form instructions.
+
+Add code to compute the proper effective address for stfiwx if
+RA = 0 rather than treating it as illegal.
+
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/math-emu/math.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/math-emu/math.c
++++ b/arch/powerpc/math-emu/math.c
+@@ -407,11 +407,16 @@ do_mathemu(struct pt_regs *regs)
+
+ case XE:
+ idx = (insn >> 16) & 0x1f;
+- if (!idx)
+- goto illegal;
+-
+ op0 = (void *)¤t->thread.fpr[(insn >> 21) & 0x1f];
+- op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
++ if (!idx) {
++ if (((insn >> 1) & 0x3ff) == STFIWX)
++ op1 = (void *)(regs->gpr[(insn >> 11) & 0x1f]);
++ else
++ goto illegal;
++ } else {
++ op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
++ }
++
+ break;
+
+ case XEU:
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:58 2007
+Message-Id: <20071115055058.319711201@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Ellerman <michael@ellerman.id.au>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Paul Mackerras <paulus@samba.org>
+Subject: [patch 06/19] POWERPC: Make sure to of_node_get() the result of pci_device_to_OF_node()
+Content-Disposition: inline; filename=powerpc-make-sure-to-of_node_get-the-result-of-pci_device_to_of_node.patch
+Content-Length: 1310
+Lines: 41
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Ellerman <michael@ellerman.id.au>
+
+patch db220b234da9f183b127b9c3077c253b94756e35 in mainline.
+
+pci_device_to_OF_node() returns the device node attached to a PCI device,
+but doesn't actually grab a reference - we need to do it ourselves.
+
+Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
+Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/platforms/cell/axon_msi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/platforms/cell/axon_msi.c
++++ b/arch/powerpc/platforms/cell/axon_msi.c
+@@ -126,7 +126,7 @@ static struct axon_msic *find_msi_transl
+ const phandle *ph;
+ struct axon_msic *msic = NULL;
+
+- dn = pci_device_to_OF_node(dev);
++ dn = of_node_get(pci_device_to_OF_node(dev));
+ if (!dn) {
+ dev_dbg(&dev->dev, "axon_msi: no pci_dn found\n");
+ return NULL;
+@@ -183,7 +183,7 @@ static int setup_msi_msg_address(struct
+ int len;
+ const u32 *prop;
+
+- dn = pci_device_to_OF_node(dev);
++ dn = of_node_get(pci_device_to_OF_node(dev));
+ if (!dn) {
+ dev_dbg(&dev->dev, "axon_msi: no pci_dn found\n");
+ return -ENODEV;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:58 2007
+Message-Id: <20071115055058.473985479@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ uml-devel <user-mode-linux-devel@lists.sourceforge.net>,
+ Jeff Dike <jdike@linux.intel.com>
+Subject: [patch 07/19] UML - Stop using libc asm/page.h
+Content-Disposition: inline; filename=uml-stop-using-libc-asm-page.h.patch
+Content-Length: 3241
+Lines: 113
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeff Dike <jdike@addtoit.com>
+
+commit 71f926f2ea61994470a53c9e11d3ef993197cada in mainline.
+
+uml: stop using libc asm/page.h
+
+Remove includes of asm/page.h from libc code. This header seems to be
+disappearing, and UML doesn't make much use of it anyway.
+
+The one use, PAGE_SHIFT in stub.h, is handled by copying the constant from the
+kernel side of the house in common_offsets.h.
+
+[ jdike - added arch/um/kernel/skas/clone.c for -stable ]
+
+Signed-off-by: Jeff Dike <jdike@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/include/common-offsets.h | 1 +
+ arch/um/include/sysdep-i386/stub.h | 3 +--
+ arch/um/kernel/skas/clone.c | 1 -
+ arch/um/os-Linux/main.c | 1 -
+ arch/um/os-Linux/skas/mem.c | 1 -
+ arch/um/os-Linux/start_up.c | 1 -
+ arch/um/os-Linux/tt.c | 1 -
+ 7 files changed, 2 insertions(+), 7 deletions(-)
+
+--- a/arch/um/include/common-offsets.h
++++ b/arch/um/include/common-offsets.h
+@@ -10,6 +10,7 @@ OFFSET(HOST_TASK_PID, task_struct, pid);
+
+ DEFINE(UM_KERN_PAGE_SIZE, PAGE_SIZE);
+ DEFINE(UM_KERN_PAGE_MASK, PAGE_MASK);
++DEFINE(UM_KERN_PAGE_SHIFT, PAGE_SHIFT);
+ DEFINE(UM_NSEC_PER_SEC, NSEC_PER_SEC);
+
+ DEFINE_STR(UM_KERN_EMERG, KERN_EMERG);
+--- a/arch/um/include/sysdep-i386/stub.h
++++ b/arch/um/include/sysdep-i386/stub.h
+@@ -9,7 +9,6 @@
+ #include <sys/mman.h>
+ #include <asm/ptrace.h>
+ #include <asm/unistd.h>
+-#include <asm/page.h>
+ #include "stub-data.h"
+ #include "kern_constants.h"
+ #include "uml-config.h"
+@@ -19,7 +18,7 @@ extern void stub_clone_handler(void);
+
+ #define STUB_SYSCALL_RET EAX
+ #define STUB_MMAP_NR __NR_mmap2
+-#define MMAP_OFFSET(o) ((o) >> PAGE_SHIFT)
++#define MMAP_OFFSET(o) ((o) >> UM_KERN_PAGE_SHIFT)
+
+ static inline long stub_syscall0(long syscall)
+ {
+--- a/arch/um/kernel/skas/clone.c
++++ b/arch/um/kernel/skas/clone.c
+@@ -3,7 +3,6 @@
+ #include <sys/mman.h>
+ #include <sys/time.h>
+ #include <asm/unistd.h>
+-#include <asm/page.h>
+ #include "ptrace_user.h"
+ #include "skas.h"
+ #include "stub-data.h"
+--- a/arch/um/os-Linux/main.c
++++ b/arch/um/os-Linux/main.c
+@@ -12,7 +12,6 @@
+ #include <sys/resource.h>
+ #include <sys/mman.h>
+ #include <sys/user.h>
+-#include <asm/page.h>
+ #include "kern_util.h"
+ #include "as-layout.h"
+ #include "mem_user.h"
+--- a/arch/um/os-Linux/skas/mem.c
++++ b/arch/um/os-Linux/skas/mem.c
+@@ -9,7 +9,6 @@
+ #include <unistd.h>
+ #include <sys/mman.h>
+ #include <sys/wait.h>
+-#include <asm/page.h>
+ #include <asm/unistd.h>
+ #include "mem_user.h"
+ #include "mem.h"
+--- a/arch/um/os-Linux/start_up.c
++++ b/arch/um/os-Linux/start_up.c
+@@ -19,7 +19,6 @@
+ #include <sys/mman.h>
+ #include <sys/resource.h>
+ #include <asm/unistd.h>
+-#include <asm/page.h>
+ #include <sys/types.h>
+ #include "kern_util.h"
+ #include "user.h"
+--- a/arch/um/os-Linux/tt.c
++++ b/arch/um/os-Linux/tt.c
+@@ -17,7 +17,6 @@
+ #include <sys/mman.h>
+ #include <asm/ptrace.h>
+ #include <asm/unistd.h>
+-#include <asm/page.h>
+ #include "kern_util.h"
+ #include "user.h"
+ #include "signal_kern.h"
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:58 2007
+Message-Id: <20071115055058.633275903@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ uml-devel <user-mode-linux-devel@lists.sourceforge.net>,
+ Jeff Dike <jdike@linux.intel.com>
+Subject: [patch 08/19] UML - Fix kernel vs libc symbols clash
+Content-Disposition: inline; filename=uml-fix-kernel-vs-libc-symbols-clash.patch
+Content-Length: 1153
+Lines: 39
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeff Dike <jdike@addtoit.com>
+
+commit 818f6ef407b448cef63294b9d0f6f8a2af9cb817 in mainline.
+
+uml: fix an IPV6 libc vs kernel symbol clash
+
+On some systems, with IPV6 configured, there is a clash between the kernel's
+in6addr_any and the one in libc.
+
+This is handled in the usual (gross) way of defining the kernel symbol out of
+the way on the gcc command line.
+
+Signed-off-by: Jeff Dike <jdike@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/um/Makefile
++++ b/arch/um/Makefile
+@@ -60,7 +60,8 @@ SYS_DIR := $(ARCH_DIR)/include/sysdep-$
+
+ CFLAGS += $(CFLAGS-y) -D__arch_um__ -DSUBARCH=\"$(SUBARCH)\" \
+ $(ARCH_INCLUDE) $(MODE_INCLUDE) -Dvmap=kernel_vmap \
+- -Din6addr_loopback=kernel_in6addr_loopback
++ -Din6addr_loopback=kernel_in6addr_loopback \
++ -Din6addr_any=kernel_in6addr_any
+
+ AFLAGS += $(ARCH_INCLUDE)
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:58 2007
+Message-Id: <20071115055058.785586272@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ uml-devel <user-mode-linux-devel@lists.sourceforge.net>,
+ Jeff Dike <jdike@linux.intel.com>
+Subject: [patch 09/19] UML - stop using libc asm/user.h
+Content-Disposition: inline; filename=uml-stop-using-libc-asm-user.h.patch
+Content-Length: 2429
+Lines: 74
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeff Dike <jdike@addtoit.com>
+
+commit 189872f968def833727b6bfef83ebd7440c538e6 in mainline.
+
+uml: don't use glibc asm/user.h
+
+Stop including asm/user.h from libc - it seems to be disappearing from
+distros. It's replaced with sys/user.h which defines user_fpregs_struct and
+user_fpxregs_struct instead of user_i387_struct and struct user_fxsr_struct on
+i386.
+
+As a bonus, on x86_64, I get to dump some stupid typedefs which were needed in
+order to get asm/user.h to compile.
+
+Signed-off-by: Jeff Dike <jdike@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/sys-i386/user-offsets.c | 6 +++---
+ arch/um/sys-x86_64/user-offsets.c | 9 +--------
+ 2 files changed, 4 insertions(+), 11 deletions(-)
+
+--- a/arch/um/sys-i386/user-offsets.c
++++ b/arch/um/sys-i386/user-offsets.c
+@@ -2,9 +2,9 @@
+ #include <stddef.h>
+ #include <signal.h>
+ #include <sys/poll.h>
++#include <sys/user.h>
+ #include <sys/mman.h>
+ #include <asm/ptrace.h>
+-#include <asm/user.h>
+
+ #define DEFINE(sym, val) \
+ asm volatile("\n->" #sym " %0 " #val : : "i" (val))
+@@ -48,8 +48,8 @@ void foo(void)
+ OFFSET(HOST_SC_FP_ST, _fpstate, _st);
+ OFFSET(HOST_SC_FXSR_ENV, _fpstate, _fxsr_env);
+
+- DEFINE_LONGS(HOST_FP_SIZE, sizeof(struct user_i387_struct));
+- DEFINE_LONGS(HOST_XFP_SIZE, sizeof(struct user_fxsr_struct));
++ DEFINE_LONGS(HOST_FP_SIZE, sizeof(struct user_fpregs_struct));
++ DEFINE_LONGS(HOST_XFP_SIZE, sizeof(struct user_fpxregs_struct));
+
+ DEFINE(HOST_IP, EIP);
+ DEFINE(HOST_SP, UESP);
+--- a/arch/um/sys-x86_64/user-offsets.c
++++ b/arch/um/sys-x86_64/user-offsets.c
+@@ -3,17 +3,10 @@
+ #include <signal.h>
+ #include <sys/poll.h>
+ #include <sys/mman.h>
++#include <sys/user.h>
+ #define __FRAME_OFFSETS
+ #include <asm/ptrace.h>
+ #include <asm/types.h>
+-/* For some reason, x86_64 defines u64 and u32 only in <pci/types.h>, which I
+- * refuse to include here, even though they're used throughout the headers.
+- * These are used in asm/user.h, and that include can't be avoided because of
+- * the sizeof(struct user_regs_struct) below.
+- */
+-typedef __u64 u64;
+-typedef __u32 u32;
+-#include <asm/user.h>
+
+ #define DEFINE(sym, val) \
+ asm volatile("\n->" #sym " %0 " #val : : "i" (val))
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:59 2007
+Message-Id: <20071115055058.952103446@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ uml-devel <user-mode-linux-devel@lists.sourceforge.net>,
+ Lepton Wu <ytht.net@gmail.com>,
+ Jeff Dike <jdike@linux.intel.com>
+Subject: [patch 10/19] UML - kill subprocesses on exit
+Content-Disposition: inline; filename=uml-kill-subprocesses-on-exit.patch
+Content-Length: 3056
+Lines: 91
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Lepton Wu <ytht.net@gmail.com>
+
+commit a24864a1d52a97e345a6bd4862a057f98364d098
+
+uml: definitively kill subprocesses on panic
+
+In a stock 2.6.22.6 kernel, poweroff a user mode linux guest (2.6.22.6 running
+in skas0 mode) will halt the host linux. I think the reason is the kernel
+thread abort because of a bug. Then the sys_reboot in process of user mode
+linux guest is not trapped by the user mode linux kernel and is executed by
+host. I think it is better to make sure all of our children process to quit
+when user mode linux kernel abort.
+
+[ jdike - the kernel process needs to ignore SIGTERM, plus the waitpid/kill
+loop is needed to make sure that all of our children are dead before the
+kernel exits ]
+
+Signed-off-by: Lepton Wu <ytht.net@gmail.com>
+Signed-off-by: Jeff Dike <jdike@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/os-Linux/skas/process.c | 2 +-
+ arch/um/os-Linux/util.c | 38 ++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 39 insertions(+), 1 deletion(-)
+
+--- a/arch/um/os-Linux/skas/process.c
++++ b/arch/um/os-Linux/skas/process.c
+@@ -182,7 +182,7 @@ static int userspace_tramp(void *stack)
+
+ ptrace(PTRACE_TRACEME, 0, 0, 0);
+
+- init_new_thread_signals();
++ signal(SIGTERM, SIG_DFL);
+ err = set_interval(1);
+ if(err)
+ panic("userspace_tramp - setting timer failed, errno = %d\n",
+--- a/arch/um/os-Linux/util.c
++++ b/arch/um/os-Linux/util.c
+@@ -105,6 +105,44 @@ int setjmp_wrapper(void (*proc)(void *,
+
+ void os_dump_core(void)
+ {
++ int pid;
++
+ signal(SIGSEGV, SIG_DFL);
++
++ /*
++ * We are about to SIGTERM this entire process group to ensure that
++ * nothing is around to run after the kernel exits. The
++ * kernel wants to abort, not die through SIGTERM, so we
++ * ignore it here.
++ */
++
++ signal(SIGTERM, SIG_IGN);
++ kill(0, SIGTERM);
++ /*
++ * Most of the other processes associated with this UML are
++ * likely sTopped, so give them a SIGCONT so they see the
++ * SIGTERM.
++ */
++ kill(0, SIGCONT);
++
++ /*
++ * Now, having sent signals to everyone but us, make sure they
++ * die by ptrace. Processes can survive what's been done to
++ * them so far - the mechanism I understand is receiving a
++ * SIGSEGV and segfaulting immediately upon return. There is
++ * always a SIGSEGV pending, and (I'm guessing) signals are
++ * processed in numeric order so the SIGTERM (signal 15 vs
++ * SIGSEGV being signal 11) is never handled.
++ *
++ * Run a waitpid loop until we get some kind of error.
++ * Hopefully, it's ECHILD, but there's not a lot we can do if
++ * it's something else. Tell os_kill_ptraced_process not to
++ * wait for the child to report its death because there's
++ * nothing reasonable to do if that fails.
++ */
++
++ while ((pid = waitpid(-1, NULL, WNOHANG)) > 0)
++ os_kill_ptraced_process(pid, 0);
++
+ abort();
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:59 2007
+Message-Id: <20071115055059.107843078@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ xen-devel@lists.xensource.com,
+ virtualization@lists.osdl.org,
+ Chris Wright <chrisw@sous-sol.org>,
+ Andi Kleen <ak@muc.de>,
+ Keir Fraser <keir@xensource.com>,
+ Jeremy Fitzhardinge <jeremy@xensource.com>
+Subject: [patch 11/19] xen: add batch completion callbacks
+Content-Disposition: inline; filename=xen-multicall-callbacks.patch
+Content-Length: 2330
+Lines: 94
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+
+patch 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1 in mainline.
+
+This adds a mechanism to register a callback function to be called once
+a batch of hypercalls has been issued. This is typically used to unlock
+things which must remain locked until the hypercall has taken place.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/xen/multicalls.c | 29 ++++++++++++++++++++++++++---
+ arch/i386/xen/multicalls.h | 3 +++
+ 2 files changed, 29 insertions(+), 3 deletions(-)
+
+--- a/arch/i386/xen/multicalls.c
++++ b/arch/i386/xen/multicalls.c
+@@ -32,7 +32,11 @@
+ struct mc_buffer {
+ struct multicall_entry entries[MC_BATCH];
+ u64 args[MC_ARGS];
+- unsigned mcidx, argidx;
++ struct callback {
++ void (*fn)(void *);
++ void *data;
++ } callbacks[MC_BATCH];
++ unsigned mcidx, argidx, cbidx;
+ };
+
+ static DEFINE_PER_CPU(struct mc_buffer, mc_buffer);
+@@ -43,6 +47,7 @@ void xen_mc_flush(void)
+ struct mc_buffer *b = &__get_cpu_var(mc_buffer);
+ int ret = 0;
+ unsigned long flags;
++ int i;
+
+ BUG_ON(preemptible());
+
+@@ -51,8 +56,6 @@ void xen_mc_flush(void)
+ local_irq_save(flags);
+
+ if (b->mcidx) {
+- int i;
+-
+ if (HYPERVISOR_multicall(b->entries, b->mcidx) != 0)
+ BUG();
+ for (i = 0; i < b->mcidx; i++)
+@@ -65,6 +68,13 @@ void xen_mc_flush(void)
+
+ local_irq_restore(flags);
+
++ for(i = 0; i < b->cbidx; i++) {
++ struct callback *cb = &b->callbacks[i];
++
++ (*cb->fn)(cb->data);
++ }
++ b->cbidx = 0;
++
+ BUG_ON(ret);
+ }
+
+@@ -88,3 +98,16 @@ struct multicall_space __xen_mc_entry(si
+
+ return ret;
+ }
++
++void xen_mc_callback(void (*fn)(void *), void *data)
++{
++ struct mc_buffer *b = &__get_cpu_var(mc_buffer);
++ struct callback *cb;
++
++ if (b->cbidx == MC_BATCH)
++ xen_mc_flush();
++
++ cb = &b->callbacks[b->cbidx++];
++ cb->fn = fn;
++ cb->data = data;
++}
+--- a/arch/i386/xen/multicalls.h
++++ b/arch/i386/xen/multicalls.h
+@@ -42,4 +42,7 @@ static inline void xen_mc_issue(unsigned
+ local_irq_restore(x86_read_percpu(xen_mc_irq_flags));
+ }
+
++/* Set up a callback to be called when the current batch is flushed */
++void xen_mc_callback(void (*fn)(void *), void *data);
++
+ #endif /* _XEN_MULTICALLS_H */
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:59 2007
+Message-Id: <20071115055059.265207729@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ xen-devel@lists.xensource.com,
+ virtualization@lists.osdl.org,
+ Chris Wright <chrisw@sous-sol.org>,
+ Andi Kleen <ak@muc.de>,
+ Keir Fraser <keir@xensource.com>,
+ Jeremy Fitzhardinge <jeremy@xensource.com>
+Subject: [patch 12/19] xen: deal with stale cr3 values when unpinning pagetables
+Content-Disposition: inline; filename=xen-handle-lazy-cr3-on-unpin.patch
+Content-Length: 5898
+Lines: 178
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+
+patch 9f79991d4186089e228274196413572cc000143b in mainline.
+
+When a pagetable is no longer in use, it must be unpinned so that its
+pages can be freed. However, this is only possible if there are no
+stray uses of the pagetable. The code currently deals with all the
+usual cases, but there's a rare case where a vcpu is changing cr3, but
+is doing so lazily, and the change hasn't actually happened by the time
+the pagetable is unpinned, even though it appears to have been completed.
+
+This change adds a second per-cpu cr3 variable - xen_current_cr3 -
+which tracks the actual state of the vcpu cr3. It is only updated once
+the actual hypercall to set cr3 has been completed. Other processors
+wishing to unpin a pagetable can check other vcpu's xen_current_cr3
+values to see if any cross-cpu IPIs are needed to clean things up.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/xen/enlighten.c | 55 +++++++++++++++++++++++++++++++---------------
+ arch/i386/xen/mmu.c | 29 +++++++++++++++++++++---
+ arch/i386/xen/xen-ops.h | 1
+ 3 files changed, 65 insertions(+), 20 deletions(-)
+
+--- a/arch/i386/xen/enlighten.c
++++ b/arch/i386/xen/enlighten.c
+@@ -56,7 +56,23 @@ DEFINE_PER_CPU(enum paravirt_lazy_mode,
+
+ DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
+ DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
+-DEFINE_PER_CPU(unsigned long, xen_cr3);
++
++/*
++ * Note about cr3 (pagetable base) values:
++ *
++ * xen_cr3 contains the current logical cr3 value; it contains the
++ * last set cr3. This may not be the current effective cr3, because
++ * its update may be being lazily deferred. However, a vcpu looking
++ * at its own cr3 can use this value knowing that it everything will
++ * be self-consistent.
++ *
++ * xen_current_cr3 contains the actual vcpu cr3; it is set once the
++ * hypercall to set the vcpu cr3 is complete (so it may be a little
++ * out of date, but it will never be set early). If one vcpu is
++ * looking at another vcpu's cr3 value, it should use this variable.
++ */
++DEFINE_PER_CPU(unsigned long, xen_cr3); /* cr3 stored as physaddr */
++DEFINE_PER_CPU(unsigned long, xen_current_cr3); /* actual vcpu cr3 */
+
+ struct start_info *xen_start_info;
+ EXPORT_SYMBOL_GPL(xen_start_info);
+@@ -632,32 +648,36 @@ static unsigned long xen_read_cr3(void)
+ return x86_read_percpu(xen_cr3);
+ }
+
++static void set_current_cr3(void *v)
++{
++ x86_write_percpu(xen_current_cr3, (unsigned long)v);
++}
++
+ static void xen_write_cr3(unsigned long cr3)
+ {
++ struct mmuext_op *op;
++ struct multicall_space mcs;
++ unsigned long mfn = pfn_to_mfn(PFN_DOWN(cr3));
++
+ BUG_ON(preemptible());
+
+- if (cr3 == x86_read_percpu(xen_cr3)) {
+- /* just a simple tlb flush */
+- xen_flush_tlb();
+- return;
+- }
++ mcs = xen_mc_entry(sizeof(*op)); /* disables interrupts */
+
++ /* Update while interrupts are disabled, so its atomic with
++ respect to ipis */
+ x86_write_percpu(xen_cr3, cr3);
+
++ op = mcs.args;
++ op->cmd = MMUEXT_NEW_BASEPTR;
++ op->arg1.mfn = mfn;
+
+- {
+- struct mmuext_op *op;
+- struct multicall_space mcs = xen_mc_entry(sizeof(*op));
+- unsigned long mfn = pfn_to_mfn(PFN_DOWN(cr3));
+-
+- op = mcs.args;
+- op->cmd = MMUEXT_NEW_BASEPTR;
+- op->arg1.mfn = mfn;
++ MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
+
+- MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
++ /* Update xen_update_cr3 once the batch has actually
++ been submitted. */
++ xen_mc_callback(set_current_cr3, (void *)cr3);
+
+- xen_mc_issue(PARAVIRT_LAZY_CPU);
+- }
++ xen_mc_issue(PARAVIRT_LAZY_CPU); /* interrupts restored */
+ }
+
+ /* Early in boot, while setting up the initial pagetable, assume
+@@ -1113,6 +1133,7 @@ asmlinkage void __init xen_start_kernel(
+ /* keep using Xen gdt for now; no urgent need to change it */
+
+ x86_write_percpu(xen_cr3, __pa(pgd));
++ x86_write_percpu(xen_current_cr3, __pa(pgd));
+
+ #ifdef CONFIG_SMP
+ /* Don't do the full vcpu_info placement stuff until we have a
+--- a/arch/i386/xen/mmu.c
++++ b/arch/i386/xen/mmu.c
+@@ -515,20 +515,43 @@ static void drop_other_mm_ref(void *info
+
+ if (__get_cpu_var(cpu_tlbstate).active_mm == mm)
+ leave_mm(smp_processor_id());
++
++ /* If this cpu still has a stale cr3 reference, then make sure
++ it has been flushed. */
++ if (x86_read_percpu(xen_current_cr3) == __pa(mm->pgd)) {
++ load_cr3(swapper_pg_dir);
++ arch_flush_lazy_cpu_mode();
++ }
+ }
+
+ static void drop_mm_ref(struct mm_struct *mm)
+ {
++ cpumask_t mask;
++ unsigned cpu;
++
+ if (current->active_mm == mm) {
+ if (current->mm == mm)
+ load_cr3(swapper_pg_dir);
+ else
+ leave_mm(smp_processor_id());
++ arch_flush_lazy_cpu_mode();
++ }
++
++ /* Get the "official" set of cpus referring to our pagetable. */
++ mask = mm->cpu_vm_mask;
++
++ /* It's possible that a vcpu may have a stale reference to our
++ cr3, because its in lazy mode, and it hasn't yet flushed
++ its set of pending hypercalls yet. In this case, we can
++ look at its actual current cr3 value, and force it to flush
++ if needed. */
++ for_each_online_cpu(cpu) {
++ if (per_cpu(xen_current_cr3, cpu) == __pa(mm->pgd))
++ cpu_set(cpu, mask);
+ }
+
+- if (!cpus_empty(mm->cpu_vm_mask))
+- xen_smp_call_function_mask(mm->cpu_vm_mask, drop_other_mm_ref,
+- mm, 1);
++ if (!cpus_empty(mask))
++ xen_smp_call_function_mask(mask, drop_other_mm_ref, mm, 1);
+ }
+ #else
+ static void drop_mm_ref(struct mm_struct *mm)
+--- a/arch/i386/xen/xen-ops.h
++++ b/arch/i386/xen/xen-ops.h
+@@ -11,6 +11,7 @@ void xen_copy_trap_info(struct trap_info
+
+ DECLARE_PER_CPU(struct vcpu_info *, xen_vcpu);
+ DECLARE_PER_CPU(unsigned long, xen_cr3);
++DECLARE_PER_CPU(unsigned long, xen_current_cr3);
+
+ extern struct start_info *xen_start_info;
+ extern struct shared_info *HYPERVISOR_shared_info;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:59 2007
+Message-Id: <20071115055059.436140660@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ xen-devel@lists.xensource.com,
+ virtualization@lists.osdl.org,
+ Mark Williamson <mark.williamson@cl.cam.ac.uk>,
+ =?ISO-8859-15?q?Morten=20B=F8geskov?= <xen-users@morten.bogeskov.dk>,
+ Chris Wright <chrisw@sous-sol.org>,
+ Andi Kleen <ak@muc.de>,
+ Keir Fraser <keir@xensource.com>,
+ Jeremy Fitzhardinge <jeremy@xensource.com>
+Subject: [patch 13/19] xen: fix incorrect vcpu_register_vcpu_info hypercall argument
+Content-Disposition: inline; filename=xen-fix-register_vcpu_info.patch
+Content-Length: 1824
+Lines: 49
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+
+patch e3d2697669abbe26c08dc9b95e2a71c634d096ed in mainline.
+
+The kernel's copy of struct vcpu_register_vcpu_info was out of date,
+at best causing the hypercall to fail and the guest kernel to fall
+back to the old mechanism, or worse, causing random memory corruption.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com>
+Cc: Stable Kernel <stable@kernel.org>
+Cc: Morten =?utf-8?q?B=C3=B8geskov?= <xen-users@morten.bogeskov.dk>
+Cc: Mark Williamson <mark.williamson@cl.cam.ac.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/xen/enlighten.c | 2 +-
+ include/xen/interface/vcpu.h | 5 +++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/i386/xen/enlighten.c
++++ b/arch/i386/xen/enlighten.c
+@@ -116,7 +116,7 @@ static void __init xen_vcpu_setup(int cp
+ info.mfn = virt_to_mfn(vcpup);
+ info.offset = offset_in_page(vcpup);
+
+- printk(KERN_DEBUG "trying to map vcpu_info %d at %p, mfn %x, offset %d\n",
++ printk(KERN_DEBUG "trying to map vcpu_info %d at %p, mfn %llx, offset %d\n",
+ cpu, vcpup, info.mfn, info.offset);
+
+ /* Check to see if the hypervisor will put the vcpu_info
+--- a/include/xen/interface/vcpu.h
++++ b/include/xen/interface/vcpu.h
+@@ -160,8 +160,9 @@ struct vcpu_set_singleshot_timer {
+ */
+ #define VCPUOP_register_vcpu_info 10 /* arg == struct vcpu_info */
+ struct vcpu_register_vcpu_info {
+- uint32_t mfn; /* mfn of page to place vcpu_info */
+- uint32_t offset; /* offset within page */
++ uint64_t mfn; /* mfn of page to place vcpu_info */
++ uint32_t offset; /* offset within page */
++ uint32_t rsvd; /* unused */
+ };
+
+ #endif /* __XEN_PUBLIC_VCPU_H__ */
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:59 2007
+Message-Id: <20071115055059.585631585@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ xen-devel@lists.xensource.com,
+ virtualization@lists.osdl.org,
+ Mark Williamson <mark.williamson@cl.cam.ac.uk>,
+ XFS masters <xfs-masters@oss.sgi.com>,
+ Chris Wright <chrisw@sous-sol.org>,
+ Andi Kleen <ak@muc.de>,
+ =?ISO-8859-15?q?Morten=20B=F8geskov?= <xen-users@morten.bogeskov.dk>,
+ Keir Fraser <keir@xensource.com>,
+ Jeremy Fitzhardinge <jeremy@xensource.com>
+Subject: [patch 14/19] xfs: eagerly remove vmap mappings to avoid upsetting Xen
+Content-Disposition: inline; filename=xen-xfs-unmap.patch
+Content-Length: 1667
+Lines: 54
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+
+patch ace2e92e193126711cb3a83a3752b2c5b8396950 in mainline.
+
+XFS leaves stray mappings around when it vmaps memory to make it
+virtually contigious. This upsets Xen if one of those pages is being
+recycled into a pagetable, since it finds an extra writable mapping of
+the page.
+
+This patch solves the problem in a brute force way, by making XFS
+always eagerly unmap its mappings.
+
+[ Stable: This works around a bug in 2.6.23. We may come up with a
+better solution for mainline, but this seems like a low-impact fix for
+the stable kernel. ]
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com>
+Cc: XFS masters <xfs-masters@oss.sgi.com>
+Cc: Morten =?utf-8?q?B=C3=B8geskov?= <xen-users@morten.bogeskov.dk>
+Cc: Mark Williamson <mark.williamson@cl.cam.ac.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ fs/xfs/linux-2.6/xfs_buf.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/fs/xfs/linux-2.6/xfs_buf.c
++++ b/fs/xfs/linux-2.6/xfs_buf.c
+@@ -187,6 +187,19 @@ free_address(
+ {
+ a_list_t *aentry;
+
++#ifdef CONFIG_XEN
++ /*
++ * Xen needs to be able to make sure it can get an exclusive
++ * RO mapping of pages it wants to turn into a pagetable. If
++ * a newly allocated page is also still being vmap()ed by xfs,
++ * it will cause pagetable construction to fail. This is a
++ * quick workaround to always eagerly unmap pages so that Xen
++ * is happy.
++ */
++ vunmap(addr);
++ return;
++#endif
++
+ aentry = kmalloc(sizeof(a_list_t), GFP_NOWAIT);
+ if (likely(aentry)) {
+ spin_lock(&as_lock);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:50:59 2007
+Message-Id: <20071115055059.747106839@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Andi Kleen <ak@suse.de>
+Subject: [patch 15/19] x86: fix global_flush_tlb() bug
+Content-Disposition: inline; filename=x86-fix-global_flush_tlb-bug.patch
+Content-Length: 2180
+Lines: 70
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ingo Molnar <mingo@elte.hu>
+
+patch 9a24d04a3c26c223f22493492c5c9085b8773d4a upstream
+
+While we were reviewing pageattr_32/64.c for unification,
+Thomas Gleixner noticed the following serious SMP bug in
+global_flush_tlb():
+
+ down_read(&init_mm.mmap_sem);
+ list_replace_init(&deferred_pages, &l);
+ up_read(&init_mm.mmap_sem);
+
+this is SMP-unsafe because list_replace_init() done on two CPUs in
+parallel can corrupt the list.
+
+This bug has been introduced about a year ago in the 64-bit tree:
+
+ commit ea7322decb974a4a3e804f96a0201e893ff88ce3
+ Author: Andi Kleen <ak@suse.de>
+ Date: Thu Dec 7 02:14:05 2006 +0100
+
+ [PATCH] x86-64: Speed and clean up cache flushing in change_page_attr
+
+ down_read(&init_mm.mmap_sem);
+ - dpage = xchg(&deferred_pages, NULL);
+ + list_replace_init(&deferred_pages, &l);
+ up_read(&init_mm.mmap_sem);
+
+the xchg() based version was SMP-safe, but list_replace_init() is not.
+So this "cleanup" introduced a nasty bug.
+
+why this bug never become prominent is a mystery - it can probably be
+explained with the (still) relative obscurity of the x86_64 architecture.
+
+the safe fix for now is to write-lock init_mm.mmap_sem.
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Andi Kleen <ak@suse.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86_64/mm/pageattr.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/x86_64/mm/pageattr.c
++++ b/arch/x86_64/mm/pageattr.c
+@@ -229,9 +229,14 @@ void global_flush_tlb(void)
+ struct page *pg, *next;
+ struct list_head l;
+
+- down_read(&init_mm.mmap_sem);
++ /*
++ * Write-protect the semaphore, to exclude two contexts
++ * doing a list_replace_init() call in parallel and to
++ * exclude new additions to the deferred_pages list:
++ */
++ down_write(&init_mm.mmap_sem);
+ list_replace_init(&deferred_pages, &l);
+- up_read(&init_mm.mmap_sem);
++ up_write(&init_mm.mmap_sem);
+
+ flush_map(&l);
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:51:00 2007
+Message-Id: <20071115055059.900563159@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 16/19] x86 setup: handle boot loaders which set up the stack incorrectly
+Content-Disposition: inline; filename=x86-setup-handle-boot-loaders-which-set-up-the-stack-incorrectly.patch
+Content-Length: 3526
+Lines: 124
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: H. Peter Anvin <hpa@zytor.com>
+
+patch 6b6815c6d5d1dc209701d1661a7a0e09a295db2f in mainline.
+
+Apparently some specific versions of LILO enter the kernel with a
+stack pointer that doesn't match the rest of the segments. Make our
+best attempt at untangling the resulting mess.
+
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/boot/boot.h | 4 +--
+ arch/i386/boot/header.S | 62 ++++++++++++++++++++++++++++++++++--------------
+ 2 files changed, 46 insertions(+), 20 deletions(-)
+
+--- a/arch/i386/boot/boot.h
++++ b/arch/i386/boot/boot.h
+@@ -17,6 +17,8 @@
+ #ifndef BOOT_BOOT_H
+ #define BOOT_BOOT_H
+
++#define STACK_SIZE 512 /* Minimum number of bytes for stack */
++
+ #ifndef __ASSEMBLY__
+
+ #include <stdarg.h>
+@@ -198,8 +200,6 @@ static inline int isdigit(int ch)
+ }
+
+ /* Heap -- available for dynamic lists. */
+-#define STACK_SIZE 512 /* Minimum number of bytes for stack */
+-
+ extern char _end[];
+ extern char *HEAP;
+ extern char *heap_end;
+--- a/arch/i386/boot/header.S
++++ b/arch/i386/boot/header.S
+@@ -173,7 +173,8 @@ ramdisk_size: .long 0 # its size in byt
+ bootsect_kludge:
+ .long 0 # obsolete
+
+-heap_end_ptr: .word _end+1024 # (Header version 0x0201 or later)
++heap_end_ptr: .word _end+STACK_SIZE-512
++ # (Header version 0x0201 or later)
+ # space from here (exclusive) down to
+ # end of setup code can be used by setup
+ # for local heap purposes.
+@@ -225,28 +226,53 @@ start_of_setup:
+ int $0x13
+ #endif
+
+-# We will have entered with %cs = %ds+0x20, normalize %cs so
+-# it is on par with the other segments.
+- pushw %ds
+- pushw $setup2
+- lretw
+-
+-setup2:
+ # Force %es = %ds
+ movw %ds, %ax
+ movw %ax, %es
+ cld
+
+-# Stack paranoia: align the stack and make sure it is good
+-# for both 16- and 32-bit references. In particular, if we
+-# were meant to have been using the full 16-bit segment, the
+-# caller might have set %sp to zero, which breaks %esp-based
+-# references.
+- andw $~3, %sp # dword align (might as well...)
+- jnz 1f
+- movw $0xfffc, %sp # Make sure we're not zero
+-1: movzwl %sp, %esp # Clear upper half of %esp
+- sti
++# Apparently some ancient versions of LILO invoked the kernel
++# with %ss != %ds, which happened to work by accident for the
++# old code. If the CAN_USE_HEAP flag is set in loadflags, or
++# %ss != %ds, then adjust the stack pointer.
++
++ # Smallest possible stack we can tolerate
++ movw $(_end+STACK_SIZE), %cx
++
++ movw heap_end_ptr, %dx
++ addw $512, %dx
++ jnc 1f
++ xorw %dx, %dx # Wraparound - whole segment available
++1: testb $CAN_USE_HEAP, loadflags
++ jnz 2f
++
++ # No CAN_USE_HEAP
++ movw %ss, %dx
++ cmpw %ax, %dx # %ds == %ss?
++ movw %sp, %dx
++ # If so, assume %sp is reasonably set, otherwise use
++ # the smallest possible stack.
++ jne 4f # -> Smallest possible stack...
++
++ # Make sure the stack is at least minimum size. Take a value
++ # of zero to mean "full segment."
++2:
++ andw $~3, %dx # dword align (might as well...)
++ jnz 3f
++ movw $0xfffc, %dx # Make sure we're not zero
++3: cmpw %cx, %dx
++ jnb 5f
++4: movw %cx, %dx # Minimum value we can possibly use
++5: movw %ax, %ss
++ movzwl %dx, %esp # Clear upper half of %esp
++ sti # Now we should have a working stack
++
++# We will have entered with %cs = %ds+0x20, normalize %cs so
++# it is on par with the other segments.
++ pushw %ds
++ pushw $6f
++ lretw
++6:
+
+ # Check signature at end of setup
+ cmpl $0x5a5aaa55, setup_sig
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:51:00 2007
+Message-Id: <20071115055100.056467835@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 17/19] x86 setup: sizeof() is unsigned, unbreak comparisons
+Content-Disposition: inline; filename=x86-setup-sizeof-is-unsigned-unbreak-comparisons.patch
+Content-Length: 2267
+Lines: 72
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: H. Peter Anvin <hpa@zytor.com>
+
+patch e6e1ace9904b72478f0c5a5aa7bd174cb6f62561 in mainline.
+
+
+We use signed values for limit checking since the values can go
+negative under certain circumstances. However, sizeof() is unsigned
+and forces the comparison to be unsigned, so move the comparison into
+the heap_free() macros so we can ensure it is a signed comparison.
+
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/boot/boot.h | 4 ++--
+ arch/i386/boot/video-bios.c | 2 +-
+ arch/i386/boot/video-vesa.c | 2 +-
+ arch/i386/boot/video.c | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/i386/boot/boot.h
++++ b/arch/i386/boot/boot.h
+@@ -216,9 +216,9 @@ static inline char *__get_heap(size_t s,
+ #define GET_HEAP(type, n) \
+ ((type *)__get_heap(sizeof(type),__alignof__(type),(n)))
+
+-static inline int heap_free(void)
++static inline bool heap_free(size_t n)
+ {
+- return heap_end-HEAP;
++ return (int)(heap_end-HEAP) >= (int)n;
+ }
+
+ /* copy.S */
+--- a/arch/i386/boot/video-bios.c
++++ b/arch/i386/boot/video-bios.c
+@@ -79,7 +79,7 @@ static int bios_probe(void)
+ video_bios.modes = GET_HEAP(struct mode_info, 0);
+
+ for (mode = 0x14; mode <= 0x7f; mode++) {
+- if (heap_free() < sizeof(struct mode_info))
++ if (!heap_free(sizeof(struct mode_info)))
+ break;
+
+ if (mode_defined(VIDEO_FIRST_BIOS+mode))
+--- a/arch/i386/boot/video-vesa.c
++++ b/arch/i386/boot/video-vesa.c
+@@ -57,7 +57,7 @@ static int vesa_probe(void)
+ while ((mode = rdfs16(mode_ptr)) != 0xffff) {
+ mode_ptr += 2;
+
+- if (heap_free() < sizeof(struct mode_info))
++ if (!heap_free(sizeof(struct mode_info)))
+ break; /* Heap full, can't save mode info */
+
+ if (mode & ~0x1ff)
+--- a/arch/i386/boot/video.c
++++ b/arch/i386/boot/video.c
+@@ -371,7 +371,7 @@ static void save_screen(void)
+ saved.curx = boot_params.screen_info.orig_x;
+ saved.cury = boot_params.screen_info.orig_y;
+
+- if (heap_free() < saved.x*saved.y*sizeof(u16)+512)
++ if (!heap_free(saved.x*saved.y*sizeof(u16)+512))
+ return; /* Not enough heap to save the screen */
+
+ saved.data = GET_HEAP(u16, saved.x*saved.y);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:51:00 2007
+Message-Id: <20071115055100.208606314@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Johnson <djohnson@sw.starentnetworks.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 18/19] x86: fix TSC clock source calibration error
+Content-Disposition: inline; filename=x86-fix-tsc-clock-source-calibration-error.patch
+Content-Length: 3436
+Lines: 103
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dave Johnson <djohnson@sw.starentnetworks.com>
+
+patch edaf420fdc122e7a42326fe39274c8b8c9b19d41 in mainline.
+
+I ran into this problem on a system that was unable to obtain NTP sync
+because the clock was running very slow (over 10000ppm slow). ntpd had
+declared all of its peers 'reject' with 'peer_dist' reason.
+
+On investigation, the tsc_khz variable was significantly incorrect
+causing xtime to run slow. After a reboot tsc_khz was correct so I
+did a reboot test to see how often the problem occurred:
+
+Test was done on a 2000 Mhz Xeon system. Of 689 reboots, 8 of them
+had unacceptable tsc_khz values (>500ppm):
+
+ range of tsc_khz # of boots % of boots
+ ---------------- ---------- ----------
+ < 1999750 0 0.000%
+1999750 - 1999800 21 3.048%
+1999800 - 1999850 166 24.128%
+1999850 - 1999900 241 35.029%
+1999900 - 1999950 211 30.669%
+1999950 - 2000000 42 6.105%
+2000000 - 2000000 0 0.000%
+2000050 - 2000100 0 0.000%
+ [...]
+2000100 - 2015000 1 0.145% << BAD
+2015000 - 2030000 6 0.872% << BAD
+2030000 - 2045000 1 0.145% << BAD
+2045000 < 0 0.000%
+
+The worst boot was 2032.577 Mhz, over 1.5% off!
+
+It appears that on rare occasions, mach_countup() is taking longer to
+complete than necessary.
+
+I suspect that this is caused by the CPU taking a periodic SMI
+interrupt right at the end of the 30ms calibration loop. This would
+cause the loop to delay while the SMI BIOS hander runs. The resulting
+TSC value is beyond what it actually should be resulting in a higher
+tsc_khz.
+
+The below patch makes native_calculate_cpu_khz() take the best
+(shortest duration, lowest khz) run of it's 3 calibration loops. If a
+SMI goes off causing a bad result (long duration, higher khz) it will
+be discarded.
+
+With the patch applied, 300 boots of the same system produce good
+results:
+
+ range of tsc_khz # of boots % of boots
+ ---------------- ---------- ----------
+ < 1999750 0 0.000%
+1999750 - 1999800 30 10.000%
+1999800 - 1999850 166 55.333%
+1999850 - 1999900 89 29.667%
+1999900 - 1999950 15 5.000%
+1999950 < 0 0.000%
+
+Problem was found and tested against 2.6.18. Patch is against 2.6.22.
+
+Signed-off-by: Dave Johnson <djohnson@sw.starentnetworks.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/kernel/tsc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/i386/kernel/tsc.c
++++ b/arch/i386/kernel/tsc.c
+@@ -137,7 +137,7 @@ unsigned long native_calculate_cpu_khz(v
+ {
+ unsigned long long start, end;
+ unsigned long count;
+- u64 delta64;
++ u64 delta64 = (u64)ULLONG_MAX;
+ int i;
+ unsigned long flags;
+
+@@ -149,6 +149,7 @@ unsigned long native_calculate_cpu_khz(v
+ rdtscll(start);
+ mach_countup(&count);
+ rdtscll(end);
++ delta64 = min(delta64, (end - start));
+ }
+ /*
+ * Error: ECTCNEVERSET
+@@ -159,8 +160,6 @@ unsigned long native_calculate_cpu_khz(v
+ if (count <= 1)
+ goto err;
+
+- delta64 = end - start;
+-
+ /* cpu freq too fast: */
+ if (delta64 > (1ULL<<32))
+ goto err;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:51:00 2007
+Message-Id: <20071115055100.370500989@mini.kroah.org>
+References: <20071115054813.977066477@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:48:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zou Nan hai <nanhai.zou@intel.com>,
+ Suresh Siddha <suresh.b.siddha@intel.com>,
+ Andy Whitcroft <apw@shadowen.org>
+Subject: [patch 19/19] revert "x86_64: allocate sparsemem memmap above 4G"
+Content-Disposition: inline; filename=revert-x86_64-allocate-sparsemem-memmap-above-4g.patch
+Content-Length: 3108
+Lines: 97
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+Reverted upstream by commit 6a22c57b8d2a62dea7280a6b2ac807a539ef0716
+
+Revert this commit:
+
+ commit 2e1c49db4c640b35df13889b86b9d62215ade4b6
+ Author: Zou Nan hai <nanhai.zou@intel.com>
+ Date: Fri Jun 1 00:46:28 2007 -0700
+
+ x86_64: allocate sparsemem memmap above 4G
+
+This reverts commit 2e1c49db4c640b35df13889b86b9d62215ade4b6.
+
+First off, testing in Fedora has shown it to cause boot failures,
+bisected down by Martin Ebourne, and reported by Dave Jobes. So the
+commit will likely be reverted in the 2.6.23 stable kernels.
+
+Secondly, in the 2.6.24 model, x86-64 has now grown support for
+SPARSEMEM_VMEMMAP, which disables the relevant code anyway, so while the
+bug is not visible any more, it's become invisible due to the code just
+being irrelevant and no longer enabled on the only architecture that
+this ever affected.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Tested-by: Martin Ebourne <fedora@ebourne.me.uk>
+Cc: Zou Nan hai <nanhai.zou@intel.com>
+Cc: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Andy Whitcroft <apw@shadowen.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86_64/mm/init.c | 6 ------
+ include/linux/bootmem.h | 1 -
+ mm/sparse.c | 11 -----------
+ 3 files changed, 18 deletions(-)
+
+--- a/arch/x86_64/mm/init.c
++++ b/arch/x86_64/mm/init.c
+@@ -734,12 +734,6 @@ int in_gate_area_no_task(unsigned long a
+ return (addr >= VSYSCALL_START) && (addr < VSYSCALL_END);
+ }
+
+-void * __init alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+-{
+- return __alloc_bootmem_core(pgdat->bdata, size,
+- SMP_CACHE_BYTES, (4UL*1024*1024*1024), 0);
+-}
+-
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+ if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
+--- a/include/linux/bootmem.h
++++ b/include/linux/bootmem.h
+@@ -59,7 +59,6 @@ extern void *__alloc_bootmem_core(struct
+ unsigned long align,
+ unsigned long goal,
+ unsigned long limit);
+-extern void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size);
+
+ #ifndef CONFIG_HAVE_ARCH_BOOTMEM_NODE
+ extern void reserve_bootmem(unsigned long addr, unsigned long size);
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -215,12 +215,6 @@ static int __meminit sparse_init_one_sec
+ return 1;
+ }
+
+-__attribute__((weak)) __init
+-void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+-{
+- return NULL;
+-}
+-
+ static struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
+ {
+ struct page *map;
+@@ -231,11 +225,6 @@ static struct page __init *sparse_early_
+ if (map)
+ return map;
+
+- map = alloc_bootmem_high_node(NODE_DATA(nid),
+- sizeof(struct page) * PAGES_PER_SECTION);
+- if (map)
+- return map;
+-
+ map = alloc_bootmem_node(NODE_DATA(nid),
+ sizeof(struct page) * PAGES_PER_SECTION);
+ if (map)
+
+--
+
--- /dev/null
+diff --git a/arch/i386/boot/boot.h b/arch/i386/boot/boot.h
+index 20bab94..3eeb9e5 100644
+--- a/arch/i386/boot/boot.h
++++ b/arch/i386/boot/boot.h
+@@ -17,6 +17,8 @@
+ #ifndef BOOT_BOOT_H
+ #define BOOT_BOOT_H
+
++#define STACK_SIZE 512 /* Minimum number of bytes for stack */
++
+ #ifndef __ASSEMBLY__
+
+ #include <stdarg.h>
+@@ -198,8 +200,6 @@ static inline int isdigit(int ch)
+ }
+
+ /* Heap -- available for dynamic lists. */
+-#define STACK_SIZE 512 /* Minimum number of bytes for stack */
+-
+ extern char _end[];
+ extern char *HEAP;
+ extern char *heap_end;
+@@ -216,9 +216,9 @@ static inline char *__get_heap(size_t s, size_t a, size_t n)
+ #define GET_HEAP(type, n) \
+ ((type *)__get_heap(sizeof(type),__alignof__(type),(n)))
+
+-static inline int heap_free(void)
++static inline bool heap_free(size_t n)
+ {
+- return heap_end-HEAP;
++ return (int)(heap_end-HEAP) >= (int)n;
+ }
+
+ /* copy.S */
+diff --git a/arch/i386/boot/header.S b/arch/i386/boot/header.S
+index f3140e5..fff7059 100644
+--- a/arch/i386/boot/header.S
++++ b/arch/i386/boot/header.S
+@@ -173,7 +173,8 @@ ramdisk_size: .long 0 # its size in bytes
+ bootsect_kludge:
+ .long 0 # obsolete
+
+-heap_end_ptr: .word _end+1024 # (Header version 0x0201 or later)
++heap_end_ptr: .word _end+STACK_SIZE-512
++ # (Header version 0x0201 or later)
+ # space from here (exclusive) down to
+ # end of setup code can be used by setup
+ # for local heap purposes.
+@@ -225,28 +226,53 @@ start_of_setup:
+ int $0x13
+ #endif
+
+-# We will have entered with %cs = %ds+0x20, normalize %cs so
+-# it is on par with the other segments.
+- pushw %ds
+- pushw $setup2
+- lretw
+-
+-setup2:
+ # Force %es = %ds
+ movw %ds, %ax
+ movw %ax, %es
+ cld
+
+-# Stack paranoia: align the stack and make sure it is good
+-# for both 16- and 32-bit references. In particular, if we
+-# were meant to have been using the full 16-bit segment, the
+-# caller might have set %sp to zero, which breaks %esp-based
+-# references.
+- andw $~3, %sp # dword align (might as well...)
+- jnz 1f
+- movw $0xfffc, %sp # Make sure we're not zero
+-1: movzwl %sp, %esp # Clear upper half of %esp
+- sti
++# Apparently some ancient versions of LILO invoked the kernel
++# with %ss != %ds, which happened to work by accident for the
++# old code. If the CAN_USE_HEAP flag is set in loadflags, or
++# %ss != %ds, then adjust the stack pointer.
++
++ # Smallest possible stack we can tolerate
++ movw $(_end+STACK_SIZE), %cx
++
++ movw heap_end_ptr, %dx
++ addw $512, %dx
++ jnc 1f
++ xorw %dx, %dx # Wraparound - whole segment available
++1: testb $CAN_USE_HEAP, loadflags
++ jnz 2f
++
++ # No CAN_USE_HEAP
++ movw %ss, %dx
++ cmpw %ax, %dx # %ds == %ss?
++ movw %sp, %dx
++ # If so, assume %sp is reasonably set, otherwise use
++ # the smallest possible stack.
++ jne 4f # -> Smallest possible stack...
++
++ # Make sure the stack is at least minimum size. Take a value
++ # of zero to mean "full segment."
++2:
++ andw $~3, %dx # dword align (might as well...)
++ jnz 3f
++ movw $0xfffc, %dx # Make sure we're not zero
++3: cmpw %cx, %dx
++ jnb 5f
++4: movw %cx, %dx # Minimum value we can possibly use
++5: movw %ax, %ss
++ movzwl %dx, %esp # Clear upper half of %esp
++ sti # Now we should have a working stack
++
++# We will have entered with %cs = %ds+0x20, normalize %cs so
++# it is on par with the other segments.
++ pushw %ds
++ pushw $6f
++ lretw
++6:
+
+ # Check signature at end of setup
+ cmpl $0x5a5aaa55, setup_sig
+diff --git a/arch/i386/boot/video-bios.c b/arch/i386/boot/video-bios.c
+index 68e65d9..ed0672a 100644
+--- a/arch/i386/boot/video-bios.c
++++ b/arch/i386/boot/video-bios.c
+@@ -79,7 +79,7 @@ static int bios_probe(void)
+ video_bios.modes = GET_HEAP(struct mode_info, 0);
+
+ for (mode = 0x14; mode <= 0x7f; mode++) {
+- if (heap_free() < sizeof(struct mode_info))
++ if (!heap_free(sizeof(struct mode_info)))
+ break;
+
+ if (mode_defined(VIDEO_FIRST_BIOS+mode))
+diff --git a/arch/i386/boot/video-vesa.c b/arch/i386/boot/video-vesa.c
+index 1921907..4716b9a 100644
+--- a/arch/i386/boot/video-vesa.c
++++ b/arch/i386/boot/video-vesa.c
+@@ -57,7 +57,7 @@ static int vesa_probe(void)
+ while ((mode = rdfs16(mode_ptr)) != 0xffff) {
+ mode_ptr += 2;
+
+- if (heap_free() < sizeof(struct mode_info))
++ if (!heap_free(sizeof(struct mode_info)))
+ break; /* Heap full, can't save mode info */
+
+ if (mode & ~0x1ff)
+diff --git a/arch/i386/boot/video.c b/arch/i386/boot/video.c
+index e4ba897..ad9712f 100644
+--- a/arch/i386/boot/video.c
++++ b/arch/i386/boot/video.c
+@@ -371,7 +371,7 @@ static void save_screen(void)
+ saved.curx = boot_params.screen_info.orig_x;
+ saved.cury = boot_params.screen_info.orig_y;
+
+- if (heap_free() < saved.x*saved.y*sizeof(u16)+512)
++ if (!heap_free(saved.x*saved.y*sizeof(u16)+512))
+ return; /* Not enough heap to save the screen */
+
+ saved.data = GET_HEAP(u16, saved.x*saved.y);
+diff --git a/arch/i386/kernel/tsc.c b/arch/i386/kernel/tsc.c
+index a39280b..7f6add1 100644
+--- a/arch/i386/kernel/tsc.c
++++ b/arch/i386/kernel/tsc.c
+@@ -137,7 +137,7 @@ unsigned long native_calculate_cpu_khz(void)
+ {
+ unsigned long long start, end;
+ unsigned long count;
+- u64 delta64;
++ u64 delta64 = (u64)ULLONG_MAX;
+ int i;
+ unsigned long flags;
+
+@@ -149,6 +149,7 @@ unsigned long native_calculate_cpu_khz(void)
+ rdtscll(start);
+ mach_countup(&count);
+ rdtscll(end);
++ delta64 = min(delta64, (end - start));
+ }
+ /*
+ * Error: ECTCNEVERSET
+@@ -159,8 +160,6 @@ unsigned long native_calculate_cpu_khz(void)
+ if (count <= 1)
+ goto err;
+
+- delta64 = end - start;
+-
+ /* cpu freq too fast: */
+ if (delta64 > (1ULL<<32))
+ goto err;
+diff --git a/arch/i386/xen/enlighten.c b/arch/i386/xen/enlighten.c
+index f01bfcd..1ba2408 100644
+--- a/arch/i386/xen/enlighten.c
++++ b/arch/i386/xen/enlighten.c
+@@ -56,7 +56,23 @@ DEFINE_PER_CPU(enum paravirt_lazy_mode, xen_lazy_mode);
+
+ DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
+ DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
+-DEFINE_PER_CPU(unsigned long, xen_cr3);
++
++/*
++ * Note about cr3 (pagetable base) values:
++ *
++ * xen_cr3 contains the current logical cr3 value; it contains the
++ * last set cr3. This may not be the current effective cr3, because
++ * its update may be being lazily deferred. However, a vcpu looking
++ * at its own cr3 can use this value knowing that it everything will
++ * be self-consistent.
++ *
++ * xen_current_cr3 contains the actual vcpu cr3; it is set once the
++ * hypercall to set the vcpu cr3 is complete (so it may be a little
++ * out of date, but it will never be set early). If one vcpu is
++ * looking at another vcpu's cr3 value, it should use this variable.
++ */
++DEFINE_PER_CPU(unsigned long, xen_cr3); /* cr3 stored as physaddr */
++DEFINE_PER_CPU(unsigned long, xen_current_cr3); /* actual vcpu cr3 */
+
+ struct start_info *xen_start_info;
+ EXPORT_SYMBOL_GPL(xen_start_info);
+@@ -100,7 +116,7 @@ static void __init xen_vcpu_setup(int cpu)
+ info.mfn = virt_to_mfn(vcpup);
+ info.offset = offset_in_page(vcpup);
+
+- printk(KERN_DEBUG "trying to map vcpu_info %d at %p, mfn %x, offset %d\n",
++ printk(KERN_DEBUG "trying to map vcpu_info %d at %p, mfn %llx, offset %d\n",
+ cpu, vcpup, info.mfn, info.offset);
+
+ /* Check to see if the hypervisor will put the vcpu_info
+@@ -632,32 +648,36 @@ static unsigned long xen_read_cr3(void)
+ return x86_read_percpu(xen_cr3);
+ }
+
++static void set_current_cr3(void *v)
++{
++ x86_write_percpu(xen_current_cr3, (unsigned long)v);
++}
++
+ static void xen_write_cr3(unsigned long cr3)
+ {
++ struct mmuext_op *op;
++ struct multicall_space mcs;
++ unsigned long mfn = pfn_to_mfn(PFN_DOWN(cr3));
++
+ BUG_ON(preemptible());
+
+- if (cr3 == x86_read_percpu(xen_cr3)) {
+- /* just a simple tlb flush */
+- xen_flush_tlb();
+- return;
+- }
++ mcs = xen_mc_entry(sizeof(*op)); /* disables interrupts */
+
++ /* Update while interrupts are disabled, so its atomic with
++ respect to ipis */
+ x86_write_percpu(xen_cr3, cr3);
+
++ op = mcs.args;
++ op->cmd = MMUEXT_NEW_BASEPTR;
++ op->arg1.mfn = mfn;
+
+- {
+- struct mmuext_op *op;
+- struct multicall_space mcs = xen_mc_entry(sizeof(*op));
+- unsigned long mfn = pfn_to_mfn(PFN_DOWN(cr3));
+-
+- op = mcs.args;
+- op->cmd = MMUEXT_NEW_BASEPTR;
+- op->arg1.mfn = mfn;
++ MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
+
+- MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
++ /* Update xen_update_cr3 once the batch has actually
++ been submitted. */
++ xen_mc_callback(set_current_cr3, (void *)cr3);
+
+- xen_mc_issue(PARAVIRT_LAZY_CPU);
+- }
++ xen_mc_issue(PARAVIRT_LAZY_CPU); /* interrupts restored */
+ }
+
+ /* Early in boot, while setting up the initial pagetable, assume
+@@ -1113,6 +1133,7 @@ asmlinkage void __init xen_start_kernel(void)
+ /* keep using Xen gdt for now; no urgent need to change it */
+
+ x86_write_percpu(xen_cr3, __pa(pgd));
++ x86_write_percpu(xen_current_cr3, __pa(pgd));
+
+ #ifdef CONFIG_SMP
+ /* Don't do the full vcpu_info placement stuff until we have a
+diff --git a/arch/i386/xen/mmu.c b/arch/i386/xen/mmu.c
+index 874db0c..c476dfa 100644
+--- a/arch/i386/xen/mmu.c
++++ b/arch/i386/xen/mmu.c
+@@ -515,20 +515,43 @@ static void drop_other_mm_ref(void *info)
+
+ if (__get_cpu_var(cpu_tlbstate).active_mm == mm)
+ leave_mm(smp_processor_id());
++
++ /* If this cpu still has a stale cr3 reference, then make sure
++ it has been flushed. */
++ if (x86_read_percpu(xen_current_cr3) == __pa(mm->pgd)) {
++ load_cr3(swapper_pg_dir);
++ arch_flush_lazy_cpu_mode();
++ }
+ }
+
+ static void drop_mm_ref(struct mm_struct *mm)
+ {
++ cpumask_t mask;
++ unsigned cpu;
++
+ if (current->active_mm == mm) {
+ if (current->mm == mm)
+ load_cr3(swapper_pg_dir);
+ else
+ leave_mm(smp_processor_id());
++ arch_flush_lazy_cpu_mode();
++ }
++
++ /* Get the "official" set of cpus referring to our pagetable. */
++ mask = mm->cpu_vm_mask;
++
++ /* It's possible that a vcpu may have a stale reference to our
++ cr3, because its in lazy mode, and it hasn't yet flushed
++ its set of pending hypercalls yet. In this case, we can
++ look at its actual current cr3 value, and force it to flush
++ if needed. */
++ for_each_online_cpu(cpu) {
++ if (per_cpu(xen_current_cr3, cpu) == __pa(mm->pgd))
++ cpu_set(cpu, mask);
+ }
+
+- if (!cpus_empty(mm->cpu_vm_mask))
+- xen_smp_call_function_mask(mm->cpu_vm_mask, drop_other_mm_ref,
+- mm, 1);
++ if (!cpus_empty(mask))
++ xen_smp_call_function_mask(mask, drop_other_mm_ref, mm, 1);
+ }
+ #else
+ static void drop_mm_ref(struct mm_struct *mm)
+diff --git a/arch/i386/xen/multicalls.c b/arch/i386/xen/multicalls.c
+index c837e8e..ce9c4b4 100644
+--- a/arch/i386/xen/multicalls.c
++++ b/arch/i386/xen/multicalls.c
+@@ -32,7 +32,11 @@
+ struct mc_buffer {
+ struct multicall_entry entries[MC_BATCH];
+ u64 args[MC_ARGS];
+- unsigned mcidx, argidx;
++ struct callback {
++ void (*fn)(void *);
++ void *data;
++ } callbacks[MC_BATCH];
++ unsigned mcidx, argidx, cbidx;
+ };
+
+ static DEFINE_PER_CPU(struct mc_buffer, mc_buffer);
+@@ -43,6 +47,7 @@ void xen_mc_flush(void)
+ struct mc_buffer *b = &__get_cpu_var(mc_buffer);
+ int ret = 0;
+ unsigned long flags;
++ int i;
+
+ BUG_ON(preemptible());
+
+@@ -51,8 +56,6 @@ void xen_mc_flush(void)
+ local_irq_save(flags);
+
+ if (b->mcidx) {
+- int i;
+-
+ if (HYPERVISOR_multicall(b->entries, b->mcidx) != 0)
+ BUG();
+ for (i = 0; i < b->mcidx; i++)
+@@ -65,6 +68,13 @@ void xen_mc_flush(void)
+
+ local_irq_restore(flags);
+
++ for(i = 0; i < b->cbidx; i++) {
++ struct callback *cb = &b->callbacks[i];
++
++ (*cb->fn)(cb->data);
++ }
++ b->cbidx = 0;
++
+ BUG_ON(ret);
+ }
+
+@@ -88,3 +98,16 @@ struct multicall_space __xen_mc_entry(size_t args)
+
+ return ret;
+ }
++
++void xen_mc_callback(void (*fn)(void *), void *data)
++{
++ struct mc_buffer *b = &__get_cpu_var(mc_buffer);
++ struct callback *cb;
++
++ if (b->cbidx == MC_BATCH)
++ xen_mc_flush();
++
++ cb = &b->callbacks[b->cbidx++];
++ cb->fn = fn;
++ cb->data = data;
++}
+diff --git a/arch/i386/xen/multicalls.h b/arch/i386/xen/multicalls.h
+index e6f7530..e3ed9c8 100644
+--- a/arch/i386/xen/multicalls.h
++++ b/arch/i386/xen/multicalls.h
+@@ -42,4 +42,7 @@ static inline void xen_mc_issue(unsigned mode)
+ local_irq_restore(x86_read_percpu(xen_mc_irq_flags));
+ }
+
++/* Set up a callback to be called when the current batch is flushed */
++void xen_mc_callback(void (*fn)(void *), void *data);
++
+ #endif /* _XEN_MULTICALLS_H */
+diff --git a/arch/i386/xen/xen-ops.h b/arch/i386/xen/xen-ops.h
+index b9aaea4..c69708b 100644
+--- a/arch/i386/xen/xen-ops.h
++++ b/arch/i386/xen/xen-ops.h
+@@ -11,6 +11,7 @@ void xen_copy_trap_info(struct trap_info *traps);
+
+ DECLARE_PER_CPU(struct vcpu_info *, xen_vcpu);
+ DECLARE_PER_CPU(unsigned long, xen_cr3);
++DECLARE_PER_CPU(unsigned long, xen_current_cr3);
+
+ extern struct start_info *xen_start_info;
+ extern struct shared_info *HYPERVISOR_shared_info;
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index bad5719..9da2a42 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -360,11 +360,26 @@ static void r4k___flush_cache_all(void)
+ r4k_on_each_cpu(local_r4k___flush_cache_all, NULL, 1, 1);
+ }
+
++static inline int has_valid_asid(const struct mm_struct *mm)
++{
++#if defined(CONFIG_MIPS_MT_SMP) || defined(CONFIG_MIPS_MT_SMTC)
++ int i;
++
++ for_each_online_cpu(i)
++ if (cpu_context(i, mm))
++ return 1;
++
++ return 0;
++#else
++ return cpu_context(smp_processor_id(), mm);
++#endif
++}
++
+ static inline void local_r4k_flush_cache_range(void * args)
+ {
+ struct vm_area_struct *vma = args;
+
+- if (!(cpu_context(smp_processor_id(), vma->vm_mm)))
++ if (!(has_valid_asid(vma->vm_mm)))
+ return;
+
+ r4k_blast_dcache();
+@@ -383,7 +398,7 @@ static inline void local_r4k_flush_cache_mm(void * args)
+ {
+ struct mm_struct *mm = args;
+
+- if (!cpu_context(smp_processor_id(), mm))
++ if (!has_valid_asid(mm))
+ return;
+
+ /*
+@@ -434,7 +449,7 @@ static inline void local_r4k_flush_cache_page(void *args)
+ * If ownes no valid ASID yet, cannot possibly have gotten
+ * this page into the cache.
+ */
+- if (cpu_context(smp_processor_id(), mm) == 0)
++ if (!has_valid_asid(mm))
+ return;
+
+ addr &= PAGE_MASK;
+diff --git a/arch/powerpc/math-emu/math.c b/arch/powerpc/math-emu/math.c
+index 69058b2..381306b 100644
+--- a/arch/powerpc/math-emu/math.c
++++ b/arch/powerpc/math-emu/math.c
+@@ -407,11 +407,16 @@ do_mathemu(struct pt_regs *regs)
+
+ case XE:
+ idx = (insn >> 16) & 0x1f;
+- if (!idx)
+- goto illegal;
+-
+ op0 = (void *)¤t->thread.fpr[(insn >> 21) & 0x1f];
+- op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
++ if (!idx) {
++ if (((insn >> 1) & 0x3ff) == STFIWX)
++ op1 = (void *)(regs->gpr[(insn >> 11) & 0x1f]);
++ else
++ goto illegal;
++ } else {
++ op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
++ }
++
+ break;
+
+ case XEU:
+diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c
+index 4c9ab5b..c767065 100644
+--- a/arch/powerpc/platforms/cell/axon_msi.c
++++ b/arch/powerpc/platforms/cell/axon_msi.c
+@@ -126,7 +126,7 @@ static struct axon_msic *find_msi_translator(struct pci_dev *dev)
+ const phandle *ph;
+ struct axon_msic *msic = NULL;
+
+- dn = pci_device_to_OF_node(dev);
++ dn = of_node_get(pci_device_to_OF_node(dev));
+ if (!dn) {
+ dev_dbg(&dev->dev, "axon_msi: no pci_dn found\n");
+ return NULL;
+@@ -183,7 +183,7 @@ static int setup_msi_msg_address(struct pci_dev *dev, struct msi_msg *msg)
+ int len;
+ const u32 *prop;
+
+- dn = pci_device_to_OF_node(dev);
++ dn = of_node_get(pci_device_to_OF_node(dev));
+ if (!dn) {
+ dev_dbg(&dev->dev, "axon_msi: no pci_dn found\n");
+ return -ENODEV;
+diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
+index d108eeb..6bf7bcd 100644
+--- a/arch/sparc64/kernel/sys_sparc.c
++++ b/arch/sparc64/kernel/sys_sparc.c
+@@ -319,7 +319,7 @@ unsigned long get_fb_unmapped_area(struct file *filp, unsigned long orig_addr, u
+
+ if (flags & MAP_FIXED) {
+ /* Ok, don't mess with it. */
+- return get_unmapped_area(NULL, addr, len, pgoff, flags);
++ return get_unmapped_area(NULL, orig_addr, len, pgoff, flags);
+ }
+ flags &= ~MAP_SHARED;
+
+diff --git a/arch/sparc64/lib/xor.S b/arch/sparc64/lib/xor.S
+index a79c888..f44f58f 100644
+--- a/arch/sparc64/lib/xor.S
++++ b/arch/sparc64/lib/xor.S
+@@ -491,12 +491,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest, %o2=src1, %o3=src2, %o4=src3 */
+ ldda [%i1 + 0x10] %asi, %i2 /* %i2/%i3 = src1 + 0x10 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x10] %asi, %i4 /* %i4/%i5 = src2 + 0x10 */
++ ldda [%l7 + 0x10] %asi, %i4 /* %i4/%i5 = src2 + 0x10 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x00] %asi
+ stxa %l1, [%i0 + 0x08] %asi
+- ldda [%i6 + 0x10] %asi, %g2 /* %g2/%g3 = src3 + 0x10 */
++ ldda [%l6 + 0x10] %asi, %g2 /* %g2/%g3 = src3 + 0x10 */
+ ldda [%i0 + 0x10] %asi, %l0 /* %l0/%l1 = dest + 0x10 */
+
+ xor %i4, %i2, %i4
+@@ -504,12 +504,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest, %o2=src1, %o3=src2, %o4=src3 */
+ ldda [%i1 + 0x20] %asi, %i2 /* %i2/%i3 = src1 + 0x20 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x20] %asi, %i4 /* %i4/%i5 = src2 + 0x20 */
++ ldda [%l7 + 0x20] %asi, %i4 /* %i4/%i5 = src2 + 0x20 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x10] %asi
+ stxa %l1, [%i0 + 0x18] %asi
+- ldda [%i6 + 0x20] %asi, %g2 /* %g2/%g3 = src3 + 0x20 */
++ ldda [%l6 + 0x20] %asi, %g2 /* %g2/%g3 = src3 + 0x20 */
+ ldda [%i0 + 0x20] %asi, %l0 /* %l0/%l1 = dest + 0x20 */
+
+ xor %i4, %i2, %i4
+@@ -517,12 +517,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest, %o2=src1, %o3=src2, %o4=src3 */
+ ldda [%i1 + 0x30] %asi, %i2 /* %i2/%i3 = src1 + 0x30 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x30] %asi, %i4 /* %i4/%i5 = src2 + 0x30 */
++ ldda [%l7 + 0x30] %asi, %i4 /* %i4/%i5 = src2 + 0x30 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x20] %asi
+ stxa %l1, [%i0 + 0x28] %asi
+- ldda [%i6 + 0x30] %asi, %g2 /* %g2/%g3 = src3 + 0x30 */
++ ldda [%l6 + 0x30] %asi, %g2 /* %g2/%g3 = src3 + 0x30 */
+ ldda [%i0 + 0x30] %asi, %l0 /* %l0/%l1 = dest + 0x30 */
+
+ prefetch [%i1 + 0x40], #one_read
+diff --git a/arch/um/Makefile b/arch/um/Makefile
+index 989224f..c3a399e 100644
+--- a/arch/um/Makefile
++++ b/arch/um/Makefile
+@@ -60,7 +60,8 @@ SYS_DIR := $(ARCH_DIR)/include/sysdep-$(SUBARCH)
+
+ CFLAGS += $(CFLAGS-y) -D__arch_um__ -DSUBARCH=\"$(SUBARCH)\" \
+ $(ARCH_INCLUDE) $(MODE_INCLUDE) -Dvmap=kernel_vmap \
+- -Din6addr_loopback=kernel_in6addr_loopback
++ -Din6addr_loopback=kernel_in6addr_loopback \
++ -Din6addr_any=kernel_in6addr_any
+
+ AFLAGS += $(ARCH_INCLUDE)
+
+diff --git a/arch/um/include/common-offsets.h b/arch/um/include/common-offsets.h
+index 6eee343..2378ff4 100644
+--- a/arch/um/include/common-offsets.h
++++ b/arch/um/include/common-offsets.h
+@@ -10,6 +10,7 @@ OFFSET(HOST_TASK_PID, task_struct, pid);
+
+ DEFINE(UM_KERN_PAGE_SIZE, PAGE_SIZE);
+ DEFINE(UM_KERN_PAGE_MASK, PAGE_MASK);
++DEFINE(UM_KERN_PAGE_SHIFT, PAGE_SHIFT);
+ DEFINE(UM_NSEC_PER_SEC, NSEC_PER_SEC);
+
+ DEFINE_STR(UM_KERN_EMERG, KERN_EMERG);
+diff --git a/arch/um/include/sysdep-i386/stub.h b/arch/um/include/sysdep-i386/stub.h
+index 4fffae7..19c85f3 100644
+--- a/arch/um/include/sysdep-i386/stub.h
++++ b/arch/um/include/sysdep-i386/stub.h
+@@ -9,7 +9,6 @@
+ #include <sys/mman.h>
+ #include <asm/ptrace.h>
+ #include <asm/unistd.h>
+-#include <asm/page.h>
+ #include "stub-data.h"
+ #include "kern_constants.h"
+ #include "uml-config.h"
+@@ -19,7 +18,7 @@ extern void stub_clone_handler(void);
+
+ #define STUB_SYSCALL_RET EAX
+ #define STUB_MMAP_NR __NR_mmap2
+-#define MMAP_OFFSET(o) ((o) >> PAGE_SHIFT)
++#define MMAP_OFFSET(o) ((o) >> UM_KERN_PAGE_SHIFT)
+
+ static inline long stub_syscall0(long syscall)
+ {
+diff --git a/arch/um/kernel/skas/clone.c b/arch/um/kernel/skas/clone.c
+index 47b812b..885a125 100644
+--- a/arch/um/kernel/skas/clone.c
++++ b/arch/um/kernel/skas/clone.c
+@@ -3,7 +3,6 @@
+ #include <sys/mman.h>
+ #include <sys/time.h>
+ #include <asm/unistd.h>
+-#include <asm/page.h>
+ #include "ptrace_user.h"
+ #include "skas.h"
+ #include "stub-data.h"
+diff --git a/arch/um/os-Linux/main.c b/arch/um/os-Linux/main.c
+index e85f499..919c25b 100644
+--- a/arch/um/os-Linux/main.c
++++ b/arch/um/os-Linux/main.c
+@@ -12,7 +12,6 @@
+ #include <sys/resource.h>
+ #include <sys/mman.h>
+ #include <sys/user.h>
+-#include <asm/page.h>
+ #include "kern_util.h"
+ #include "as-layout.h"
+ #include "mem_user.h"
+diff --git a/arch/um/os-Linux/skas/mem.c b/arch/um/os-Linux/skas/mem.c
+index 0f7df4e..9fbf210 100644
+--- a/arch/um/os-Linux/skas/mem.c
++++ b/arch/um/os-Linux/skas/mem.c
+@@ -9,7 +9,6 @@
+ #include <unistd.h>
+ #include <sys/mman.h>
+ #include <sys/wait.h>
+-#include <asm/page.h>
+ #include <asm/unistd.h>
+ #include "mem_user.h"
+ #include "mem.h"
+diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
+index ba9af8d..607d2b8 100644
+--- a/arch/um/os-Linux/skas/process.c
++++ b/arch/um/os-Linux/skas/process.c
+@@ -182,7 +182,7 @@ static int userspace_tramp(void *stack)
+
+ ptrace(PTRACE_TRACEME, 0, 0, 0);
+
+- init_new_thread_signals();
++ signal(SIGTERM, SIG_DFL);
+ err = set_interval(1);
+ if(err)
+ panic("userspace_tramp - setting timer failed, errno = %d\n",
+diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
+index 46f6139..f4f2981 100644
+--- a/arch/um/os-Linux/start_up.c
++++ b/arch/um/os-Linux/start_up.c
+@@ -19,7 +19,6 @@
+ #include <sys/mman.h>
+ #include <sys/resource.h>
+ #include <asm/unistd.h>
+-#include <asm/page.h>
+ #include <sys/types.h>
+ #include "kern_util.h"
+ #include "user.h"
+diff --git a/arch/um/os-Linux/tt.c b/arch/um/os-Linux/tt.c
+index bcf9359..5dc113d 100644
+--- a/arch/um/os-Linux/tt.c
++++ b/arch/um/os-Linux/tt.c
+@@ -17,7 +17,6 @@
+ #include <sys/mman.h>
+ #include <asm/ptrace.h>
+ #include <asm/unistd.h>
+-#include <asm/page.h>
+ #include "kern_util.h"
+ #include "user.h"
+ #include "signal_kern.h"
+diff --git a/arch/um/os-Linux/util.c b/arch/um/os-Linux/util.c
+index 7cbcf48..ef09543 100644
+--- a/arch/um/os-Linux/util.c
++++ b/arch/um/os-Linux/util.c
+@@ -105,6 +105,44 @@ int setjmp_wrapper(void (*proc)(void *, void *), ...)
+
+ void os_dump_core(void)
+ {
++ int pid;
++
+ signal(SIGSEGV, SIG_DFL);
++
++ /*
++ * We are about to SIGTERM this entire process group to ensure that
++ * nothing is around to run after the kernel exits. The
++ * kernel wants to abort, not die through SIGTERM, so we
++ * ignore it here.
++ */
++
++ signal(SIGTERM, SIG_IGN);
++ kill(0, SIGTERM);
++ /*
++ * Most of the other processes associated with this UML are
++ * likely sTopped, so give them a SIGCONT so they see the
++ * SIGTERM.
++ */
++ kill(0, SIGCONT);
++
++ /*
++ * Now, having sent signals to everyone but us, make sure they
++ * die by ptrace. Processes can survive what's been done to
++ * them so far - the mechanism I understand is receiving a
++ * SIGSEGV and segfaulting immediately upon return. There is
++ * always a SIGSEGV pending, and (I'm guessing) signals are
++ * processed in numeric order so the SIGTERM (signal 15 vs
++ * SIGSEGV being signal 11) is never handled.
++ *
++ * Run a waitpid loop until we get some kind of error.
++ * Hopefully, it's ECHILD, but there's not a lot we can do if
++ * it's something else. Tell os_kill_ptraced_process not to
++ * wait for the child to report its death because there's
++ * nothing reasonable to do if that fails.
++ */
++
++ while ((pid = waitpid(-1, NULL, WNOHANG)) > 0)
++ os_kill_ptraced_process(pid, 0);
++
+ abort();
+ }
+diff --git a/arch/um/sys-i386/user-offsets.c b/arch/um/sys-i386/user-offsets.c
+index 29118cf..5142415 100644
+--- a/arch/um/sys-i386/user-offsets.c
++++ b/arch/um/sys-i386/user-offsets.c
+@@ -2,9 +2,9 @@
+ #include <stddef.h>
+ #include <signal.h>
+ #include <sys/poll.h>
++#include <sys/user.h>
+ #include <sys/mman.h>
+ #include <asm/ptrace.h>
+-#include <asm/user.h>
+
+ #define DEFINE(sym, val) \
+ asm volatile("\n->" #sym " %0 " #val : : "i" (val))
+@@ -48,8 +48,8 @@ void foo(void)
+ OFFSET(HOST_SC_FP_ST, _fpstate, _st);
+ OFFSET(HOST_SC_FXSR_ENV, _fpstate, _fxsr_env);
+
+- DEFINE_LONGS(HOST_FP_SIZE, sizeof(struct user_i387_struct));
+- DEFINE_LONGS(HOST_XFP_SIZE, sizeof(struct user_fxsr_struct));
++ DEFINE_LONGS(HOST_FP_SIZE, sizeof(struct user_fpregs_struct));
++ DEFINE_LONGS(HOST_XFP_SIZE, sizeof(struct user_fpxregs_struct));
+
+ DEFINE(HOST_IP, EIP);
+ DEFINE(HOST_SP, UESP);
+diff --git a/arch/um/sys-x86_64/user-offsets.c b/arch/um/sys-x86_64/user-offsets.c
+index 0d5fd76..f1ef2a8 100644
+--- a/arch/um/sys-x86_64/user-offsets.c
++++ b/arch/um/sys-x86_64/user-offsets.c
+@@ -3,17 +3,10 @@
+ #include <signal.h>
+ #include <sys/poll.h>
+ #include <sys/mman.h>
++#include <sys/user.h>
+ #define __FRAME_OFFSETS
+ #include <asm/ptrace.h>
+ #include <asm/types.h>
+-/* For some reason, x86_64 defines u64 and u32 only in <pci/types.h>, which I
+- * refuse to include here, even though they're used throughout the headers.
+- * These are used in asm/user.h, and that include can't be avoided because of
+- * the sizeof(struct user_regs_struct) below.
+- */
+-typedef __u64 u64;
+-typedef __u32 u32;
+-#include <asm/user.h>
+
+ #define DEFINE(sym, val) \
+ asm volatile("\n->" #sym " %0 " #val : : "i" (val))
+diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
+index 458893b..e2d6bad 100644
+--- a/arch/x86_64/mm/init.c
++++ b/arch/x86_64/mm/init.c
+@@ -734,12 +734,6 @@ int in_gate_area_no_task(unsigned long addr)
+ return (addr >= VSYSCALL_START) && (addr < VSYSCALL_END);
+ }
+
+-void * __init alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+-{
+- return __alloc_bootmem_core(pgdat->bdata, size,
+- SMP_CACHE_BYTES, (4UL*1024*1024*1024), 0);
+-}
+-
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+ if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
+diff --git a/arch/x86_64/mm/pageattr.c b/arch/x86_64/mm/pageattr.c
+index 10b9809..0416ffb 100644
+--- a/arch/x86_64/mm/pageattr.c
++++ b/arch/x86_64/mm/pageattr.c
+@@ -229,9 +229,14 @@ void global_flush_tlb(void)
+ struct page *pg, *next;
+ struct list_head l;
+
+- down_read(&init_mm.mmap_sem);
++ /*
++ * Write-protect the semaphore, to exclude two contexts
++ * doing a list_replace_init() call in parallel and to
++ * exclude new additions to the deferred_pages list:
++ */
++ down_write(&init_mm.mmap_sem);
+ list_replace_init(&deferred_pages, &l);
+- up_read(&init_mm.mmap_sem);
++ up_write(&init_mm.mmap_sem);
+
+ flush_map(&l);
+
+diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
+index b0f0e58..be9e65b 100644
+--- a/fs/xfs/linux-2.6/xfs_buf.c
++++ b/fs/xfs/linux-2.6/xfs_buf.c
+@@ -187,6 +187,19 @@ free_address(
+ {
+ a_list_t *aentry;
+
++#ifdef CONFIG_XEN
++ /*
++ * Xen needs to be able to make sure it can get an exclusive
++ * RO mapping of pages it wants to turn into a pagetable. If
++ * a newly allocated page is also still being vmap()ed by xfs,
++ * it will cause pagetable construction to fail. This is a
++ * quick workaround to always eagerly unmap pages so that Xen
++ * is happy.
++ */
++ vunmap(addr);
++ return;
++#endif
++
+ aentry = kmalloc(sizeof(a_list_t), GFP_NOWAIT);
+ if (likely(aentry)) {
+ spin_lock(&as_lock);
+diff --git a/include/asm-mips/hazards.h b/include/asm-mips/hazards.h
+index 6a5fa32..684f622 100644
+--- a/include/asm-mips/hazards.h
++++ b/include/asm-mips/hazards.h
+@@ -10,11 +10,12 @@
+ #ifndef _ASM_HAZARDS_H
+ #define _ASM_HAZARDS_H
+
+-
+ #ifdef __ASSEMBLY__
+ #define ASMMACRO(name, code...) .macro name; code; .endm
+ #else
+
++#include <asm/cpu-features.h>
++
+ #define ASMMACRO(name, code...) \
+ __asm__(".macro " #name "; " #code "; .endm"); \
+ \
+@@ -86,6 +87,57 @@ do { \
+ : "=r" (tmp)); \
+ } while (0)
+
++#elif defined(CONFIG_CPU_MIPSR1)
++
++/*
++ * These are slightly complicated by the fact that we guarantee R1 kernels to
++ * run fine on R2 processors.
++ */
++ASMMACRO(mtc0_tlbw_hazard,
++ _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(tlbw_use_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(tlb_probe_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(irq_enable_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(irq_disable_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++ASMMACRO(back_to_back_c0_hazard,
++ _ssnop; _ssnop; _ssnop; _ehb
++ )
++/*
++ * gcc has a tradition of misscompiling the previous construct using the
++ * address of a label as argument to inline assembler. Gas otoh has the
++ * annoying difference between la and dla which are only usable for 32-bit
++ * rsp. 64-bit code, so can't be used without conditional compilation.
++ * The alterantive is switching the assembler to 64-bit code which happens
++ * to work right even for 32-bit code ...
++ */
++#define __instruction_hazard() \
++do { \
++ unsigned long tmp; \
++ \
++ __asm__ __volatile__( \
++ " .set mips64r2 \n" \
++ " dla %0, 1f \n" \
++ " jr.hb %0 \n" \
++ " .set mips0 \n" \
++ "1: \n" \
++ : "=r" (tmp)); \
++} while (0)
++
++#define instruction_hazard() \
++do { \
++ if (cpu_has_mips_r2) \
++ __instruction_hazard(); \
++} while (0)
++
+ #elif defined(CONFIG_CPU_R10000)
+
+ /*
+diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
+index c83534e..0365ec9 100644
+--- a/include/linux/bootmem.h
++++ b/include/linux/bootmem.h
+@@ -59,7 +59,6 @@ extern void *__alloc_bootmem_core(struct bootmem_data *bdata,
+ unsigned long align,
+ unsigned long goal,
+ unsigned long limit);
+-extern void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size);
+
+ #ifndef CONFIG_HAVE_ARCH_BOOTMEM_NODE
+ extern void reserve_bootmem(unsigned long addr, unsigned long size);
+diff --git a/include/xen/interface/vcpu.h b/include/xen/interface/vcpu.h
+index ff61ea3..b05d8a6 100644
+--- a/include/xen/interface/vcpu.h
++++ b/include/xen/interface/vcpu.h
+@@ -160,8 +160,9 @@ struct vcpu_set_singleshot_timer {
+ */
+ #define VCPUOP_register_vcpu_info 10 /* arg == struct vcpu_info */
+ struct vcpu_register_vcpu_info {
+- uint32_t mfn; /* mfn of page to place vcpu_info */
+- uint32_t offset; /* offset within page */
++ uint64_t mfn; /* mfn of page to place vcpu_info */
++ uint32_t offset; /* offset within page */
++ uint32_t rsvd; /* unused */
+ };
+
+ #endif /* __XEN_PUBLIC_VCPU_H__ */
+diff --git a/mm/sparse.c b/mm/sparse.c
+index 239f5a7..1facdff 100644
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -215,12 +215,6 @@ static int __meminit sparse_init_one_section(struct mem_section *ms,
+ return 1;
+ }
+
+-__attribute__((weak)) __init
+-void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+-{
+- return NULL;
+-}
+-
+ static struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
+ {
+ struct page *map;
+@@ -231,11 +225,6 @@ static struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
+ if (map)
+ return map;
+
+- map = alloc_bootmem_high_node(NODE_DATA(nid),
+- sizeof(struct page) * PAGES_PER_SECTION);
+- if (map)
+- return map;
+-
+ map = alloc_bootmem_node(NODE_DATA(nid),
+ sizeof(struct page) * PAGES_PER_SECTION);
+ if (map)
--- /dev/null
+# arch only patches
+fix-sparc64-niagara-optimized-raid-xor-asm.patch
+fix-sparc64-map_fixed-handling-of-framebuffer-mmaps.patch
+mips-mt-fix-bug-in-multithreaded-kernels.patch
+mips-r1-fix-hazard-barriers-to-make-kernels-work-on-r2-also.patch
+powerpc-fix-handling-of-stfiwx-math-emulation.patch
+powerpc-make-sure-to-of_node_get-the-result-of-pci_device_to_of_node.patch
+uml-stop-using-libc-asm-page.h.patch
+uml-fix-kernel-vs-libc-symbols-clash.patch
+uml-stop-using-libc-asm-user.h.patch
+uml-kill-subprocesses-on-exit.patch
+xen-multicall-callbacks.patch
+xen-handle-lazy-cr3-on-unpin.patch
+xen-fix-register_vcpu_info.patch
+xen-xfs-unmap.patch
+x86-fix-global_flush_tlb-bug.patch
+x86-setup-handle-boot-loaders-which-set-up-the-stack-incorrectly.patch
+x86-setup-sizeof-is-unsigned-unbreak-comparisons.patch
+x86-fix-tsc-clock-source-calibration-error.patch
+revert-x86_64-allocate-sparsemem-memmap-above-4g.patch
+
--- /dev/null
+ include/linux/netlink.h | 2
+ include/linux/skbuff.h | 3
+ include/net/9p/9p.h | 12 ++
+ ipc/mqueue.c | 6 -
+ net/8021q/vlan.c | 5 +
+ net/ieee80211/ieee80211_crypt_tkip.c | 2
+ net/ieee80211/softmac/ieee80211softmac_wx.c | 2
+ net/ipv4/ipcomp.c | 3
+ net/ipv6/ipcomp6.c | 3
+ net/mac80211/ieee80211.c | 55 +++++++-----
+ net/mac80211/ieee80211_ioctl.c | 11 ++
+ net/mac80211/ieee80211_sta.c | 128 +++++++++++-----------------
+ net/netfilter/nf_conntrack_proto_tcp.c | 38 +++-----
+ net/netlink/af_netlink.c | 10 +-
+ net/sched/cls_u32.c | 4
+ net/sched/sch_api.c | 5 -
+ net/sched/sch_teql.c | 3
+ net/socket.c | 6 +
+ 18 files changed, 161 insertions(+), 137 deletions(-)
--- /dev/null
+From gregkh@mini.kroah.org Wed Nov 14 21:53:42 2007
+Message-Id: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/23] 2.6.23-stable review, network changes
+Status: RO
+Content-Length: 1967
+Lines: 45
+
+
+This is the start of the stable review cycle for the 2.6.23.X release.
+There are 23 patches in this series, all will be posted as a response
+to this one. If anyone has any issues with these being applied, please
+let us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the
+Cc: line. If you wish to be a reviewer, please email stable@kernel.org
+to add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday 00:00:00 UTC. Anything received
+after that time might be too late.
+
+This set of patches focuses on only the core kernel. Other sets of
+patches will follow if you are interested in those instead.
+
+The diffstat of this review series is included below.
+
+thanks,
+
+greg k-h
+
+------
+
+ include/linux/netlink.h | 2
+ include/linux/skbuff.h | 3
+ include/net/9p/9p.h | 12 ++
+ ipc/mqueue.c | 6 -
+ net/8021q/vlan.c | 5 +
+ net/ieee80211/ieee80211_crypt_tkip.c | 2
+ net/ieee80211/softmac/ieee80211softmac_wx.c | 2
+ net/ipv4/ipcomp.c | 3
+ net/ipv6/ipcomp6.c | 3
+ net/mac80211/ieee80211.c | 55 +++++++-----
+ net/mac80211/ieee80211_ioctl.c | 11 ++
+ net/mac80211/ieee80211_sta.c | 128 +++++++++++-----------------
+ net/netfilter/nf_conntrack_proto_tcp.c | 38 +++-----
+ net/netlink/af_netlink.c | 10 +-
+ net/sched/cls_u32.c | 4
+ net/sched/sch_api.c | 5 -
+ net/sched/sch_teql.c | 3
+ net/socket.c | 6 +
+ 18 files changed, 161 insertions(+), 137 deletions(-)
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:43 2007
+Message-Id: <20071115055342.939624140@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Johannes Berg <johannes@sipsolutions.net>,
+ Michael Wu <flamingice@sourmilk.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 01/23] mac80211: filter locally-originated multicast frames
+Content-Disposition: inline; filename=mac80211-filter-locally-originated-multicast-frames.patch
+Content-Length: 1211
+Lines: 42
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: John W. Linville <linville@tuxdriver.com>
+
+patch b331615722779b078822988843ddffd4eaec9f83 in mainline.
+
+In STA mode, the AP will echo our traffic. This includes multicast
+traffic.
+
+Receiving these frames confuses some protocols and applications,
+notably IPv6 Duplicate Address Detection.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Acked-by: Michael Wu <flamingice@sourmilk.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/ieee80211.c
++++ b/net/mac80211/ieee80211.c
+@@ -2836,9 +2836,10 @@ ieee80211_rx_h_data(struct ieee80211_txr
+ memcpy(dst, hdr->addr1, ETH_ALEN);
+ memcpy(src, hdr->addr3, ETH_ALEN);
+
+- if (sdata->type != IEEE80211_IF_TYPE_STA) {
++ if (sdata->type != IEEE80211_IF_TYPE_STA ||
++ (is_multicast_ether_addr(dst) &&
++ !compare_ether_addr(src, dev->dev_addr)))
+ return TXRX_DROP;
+- }
+ break;
+ case 0:
+ /* DA SA BSSID */
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:43 2007
+Message-Id: <20071115055343.100693942@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ warmcat <andy@warmcat.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 02/23] mac80211: Improve sanity checks on injected packets
+Content-Disposition: inline; filename=mac80211-improve-sanity-checks-on-injected-packets.patch
+Content-Length: 3190
+Lines: 101
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andy Green <andy@warmcat.com>
+
+patch 9b8a74e3482f9fc077a88c13fa0ceca8feb0b772 in mainline.
+
+Michael Wu noticed that the skb length checking is not taken care of enough when
+a packet is presented on the Monitor interface for injection.
+
+This patch improves the sanity checking and removes fake offsets placed
+into the skb network and transport header.
+
+Signed-off-by: Andy Green <andy@warmcat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211.c | 48 +++++++++++++++++++++++++++--------------------
+ 1 file changed, 28 insertions(+), 20 deletions(-)
+
+--- a/net/mac80211/ieee80211.c
++++ b/net/mac80211/ieee80211.c
+@@ -1680,46 +1680,54 @@ int ieee80211_monitor_start_xmit(struct
+ struct ieee80211_tx_packet_data *pkt_data;
+ struct ieee80211_radiotap_header *prthdr =
+ (struct ieee80211_radiotap_header *)skb->data;
+- u16 len;
++ u16 len_rthdr;
+
+- /*
+- * there must be a radiotap header at the
+- * start in this case
+- */
+- if (unlikely(prthdr->it_version)) {
+- /* only version 0 is supported */
+- dev_kfree_skb(skb);
+- return NETDEV_TX_OK;
+- }
++ /* check for not even having the fixed radiotap header part */
++ if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
++ goto fail; /* too short to be possibly valid */
++
++ /* is it a header version we can trust to find length from? */
++ if (unlikely(prthdr->it_version))
++ goto fail; /* only version 0 is supported */
++
++ /* then there must be a radiotap header with a length we can use */
++ len_rthdr = ieee80211_get_radiotap_len(skb);
++
++ /* does the skb contain enough to deliver on the alleged length? */
++ if (unlikely(skb->len < len_rthdr))
++ goto fail; /* skb too short for claimed rt header extent */
+
+ skb->dev = local->mdev;
+
+ pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
+ memset(pkt_data, 0, sizeof(*pkt_data));
++ /* needed because we set skb device to master */
+ pkt_data->ifindex = dev->ifindex;
++
+ pkt_data->mgmt_iface = 0;
+ pkt_data->do_not_encrypt = 1;
+
+- /* above needed because we set skb device to master */
+-
+ /*
+ * fix up the pointers accounting for the radiotap
+ * header still being in there. We are being given
+ * a precooked IEEE80211 header so no need for
+ * normal processing
+ */
+- len = le16_to_cpu(get_unaligned(&prthdr->it_len));
+- skb_set_mac_header(skb, len);
+- skb_set_network_header(skb, len + sizeof(struct ieee80211_hdr));
+- skb_set_transport_header(skb, len + sizeof(struct ieee80211_hdr));
+-
++ skb_set_mac_header(skb, len_rthdr);
+ /*
+- * pass the radiotap header up to
+- * the next stage intact
++ * these are just fixed to the end of the rt area since we
++ * don't have any better information and at this point, nobody cares
+ */
+- dev_queue_xmit(skb);
++ skb_set_network_header(skb, len_rthdr);
++ skb_set_transport_header(skb, len_rthdr);
+
++ /* pass the radiotap header up to the next stage intact */
++ dev_queue_xmit(skb);
+ return NETDEV_TX_OK;
++
++fail:
++ dev_kfree_skb(skb);
++ return NETDEV_TX_OK; /* meaning, we dealt with the skb */
+ }
+
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:43 2007
+Message-Id: <20071115055343.247962182@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ warmcat <andy@warmcat.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 03/23] Add get_unaligned to ieee80211_get_radiotap_len
+Content-Disposition: inline; filename=add-get_unaligned-to-ieee80211_get_radiotap_len.patch
+Content-Length: 942
+Lines: 34
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Andy Green <andy@warmcat.com>
+
+patch dfe6e81deaa79c85086c0cc8d85b229e444ab97f in mainline.
+
+ieee80211_get_radiotap_len() tries to dereference radiotap length without
+taking care that it is completely unaligned and get_unaligned()
+is required.
+
+Signed-off-by: Andy Green <andy@warmcat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/ieee80211.c
++++ b/net/mac80211/ieee80211.c
+@@ -350,7 +350,7 @@ static int ieee80211_get_radiotap_len(st
+ struct ieee80211_radiotap_header *hdr =
+ (struct ieee80211_radiotap_header *) skb->data;
+
+- return le16_to_cpu(hdr->it_len);
++ return le16_to_cpu(get_unaligned(&hdr->it_len));
+ }
+
+ #ifdef CONFIG_MAC80211_LOWTX_FRAME_DUMP
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:43 2007
+Message-Id: <20071115055343.411450097@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:42 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 04/23] Fix advertised packet scheduler timer resolution
+Content-Disposition: inline; filename=fix-advertised-packet-scheduler-timer-resolution.patch
+Content-Length: 1199
+Lines: 40
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+patch 3c0cfc135829b98f7a4894938652f9ef78e24237 in mainline
+
+The fourth parameter of /proc/net/psched is supposed to show the timer
+resultion and is used by HTB userspace to calculate the necessary
+burst rate. Currently we show the clock resolution, which results in a
+too low burst rate when the two differ.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/sch_api.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1225,10 +1225,13 @@ EXPORT_SYMBOL(tcf_destroy_chain);
+ #ifdef CONFIG_PROC_FS
+ static int psched_show(struct seq_file *seq, void *v)
+ {
++ struct timespec ts;
++
++ hrtimer_get_res(CLOCK_MONOTONIC, &ts);
+ seq_printf(seq, "%08x %08x %08x %08x\n",
+ (u32)NSEC_PER_USEC, (u32)PSCHED_US2NS(1),
+ 1000000,
+- (u32)NSEC_PER_SEC/(u32)ktime_to_ns(KTIME_MONOTONIC_RES));
++ (u32)NSEC_PER_SEC/(u32)ktime_to_ns(timespec_to_ktime(ts)));
+
+ return 0;
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:43 2007
+Message-Id: <20071115055343.564225915@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:43 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Ingo Molnar <mingo@elte.hu>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 05/23] Fix 9P protocol build
+Content-Disposition: inline; filename=fix-9p-protocol-build.patch
+Content-Length: 1163
+Lines: 48
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ingo Molnar <mingo@elte.hu>
+
+patch 092e9d93b3728d484a4e73df9852dc4002cf9923 in mainline.
+
+[9P]: build fix with !CONFIG_SYSCTL
+
+found via make randconfig build testing:
+
+ net/built-in.o: In function `init_p9':
+ mod.c:(.init.text+0x3b39): undefined reference to `p9_sysctl_register'
+ net/built-in.o: In function `exit_p9':
+ mod.c:(.exit.text+0x36b): undefined reference to `p9_sysctl_unregister'
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/9p/9p.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/include/net/9p/9p.h
++++ b/include/net/9p/9p.h
+@@ -412,6 +412,18 @@ int p9_idpool_check(int id, struct p9_id
+
+ int p9_error_init(void);
+ int p9_errstr2errno(char *, int);
++
++#ifdef CONFIG_SYSCTL
+ int __init p9_sysctl_register(void);
+ void __exit p9_sysctl_unregister(void);
++#else
++static inline int p9_sysctl_register(void)
++{
++ return 0;
++}
++static inline void p9_sysctl_unregister(void)
++{
++}
++#endif
++
+ #endif /* NET_9P_H */
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:43 2007
+Message-Id: <20071115055343.721924007@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 06/23] Fix SKB_WITH_OVERHEAD calculations.
+Content-Disposition: inline; filename=fix-skb_with_overhead-calculations.patch
+Content-Length: 1643
+Lines: 46
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+patch deea84b0ae3d26b41502ae0a39fe7fe134e703d0 in mainline.
+
+[NET]: Fix SKB_WITH_OVERHEAD calculation
+
+The calculation in SKB_WITH_OVERHEAD is incorrect in that it can cause
+an overflow across a page boundary which is what it's meant to prevent.
+In particular, the header length (X) should not be lumped together with
+skb_shared_info. The latter needs to be aligned properly while the header
+has no choice but to sit in front of wherever the payload is.
+
+Therefore the correct calculation is to take away the aligned size of
+skb_shared_info, and then subtract the header length. The resulting
+quantity L satisfies the following inequality:
+
+ SKB_DATA_ALIGN(L + X) + sizeof(struct skb_shared_info) <= PAGE_SIZE
+
+This is the quantity used by alloc_skb to do the actual allocation.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/skbuff.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -41,8 +41,7 @@
+ #define SKB_DATA_ALIGN(X) (((X) + (SMP_CACHE_BYTES - 1)) & \
+ ~(SMP_CACHE_BYTES - 1))
+ #define SKB_WITH_OVERHEAD(X) \
+- (((X) - sizeof(struct skb_shared_info)) & \
+- ~(SMP_CACHE_BYTES - 1))
++ ((X) - SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
+ #define SKB_MAX_ORDER(X, ORDER) \
+ SKB_WITH_OVERHEAD((PAGE_SIZE << (ORDER)) - (X))
+ #define SKB_MAX_HEAD(X) (SKB_MAX_ORDER((X), 0))
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:44 2007
+Message-Id: <20071115055343.902044523@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Tony Battersby <tonyb@cybernetics.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 07/23] Fix kernel_accept() return handling.
+Content-Disposition: inline; filename=fix-kernel_accept-return-handling.patch
+Content-Length: 870
+Lines: 34
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+patch fa8705b00aeca19d91a1437b8a5cf865999b28f6 in mainline.
+
+[NET]: sanitize kernel_accept() error path
+
+If kernel_accept() returns an error, it may pass back a pointer to
+freed memory (which the caller should ignore). Make it pass back NULL
+instead for better safety.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2230,6 +2230,7 @@ int kernel_accept(struct socket *sock, s
+ err = sock->ops->accept(sock, *newsock, flags);
+ if (err < 0) {
+ sock_release(*newsock);
++ *newsock = NULL;
+ goto done;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:44 2007
+Message-Id: <20071115055344.051813502@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless <linux-wireless@vger.kernel.org>,
+ Johannes Berg <johannes@sipsolutions.net>
+Subject: [patch 08/23] softmac: fix wext MLME request reason code endianness
+Content-Disposition: inline; filename=softmac-fix-wext-mlme-request-reason-code-endianness.patch
+Content-Length: 1190
+Lines: 35
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+patch 94e10bfb8a7372df3ef2759c9ec2a37de2f24aca in mainline.
+
+The MLME request reason code is host-endian and our passing
+it to the low level functions is host-endian as well since
+they do the swapping. I noticed that the reason code 768 was
+sent (0x300) rather than 3 when wpa_supplicant terminates.
+This removes the superfluous cpu_to_le16() call.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ieee80211/softmac/ieee80211softmac_wx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
++++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
+@@ -469,7 +469,7 @@ ieee80211softmac_wx_set_mlme(struct net_
+ {
+ struct ieee80211softmac_device *mac = ieee80211_priv(dev);
+ struct iw_mlme *mlme = (struct iw_mlme *)extra;
+- u16 reason = cpu_to_le16(mlme->reason_code);
++ u16 reason = mlme->reason_code;
+ struct ieee80211softmac_network *net;
+ int err = -EINVAL;
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:44 2007
+Message-Id: <20071115055344.226061988@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 09/23] Fix error returns in sys_socketpair()
+Content-Disposition: inline; filename=fix-error-returns-in-sys_socketpair.patch
+Content-Length: 1058
+Lines: 44
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Miller <davem@davemloft.net>
+
+patch bf3c23d171e35e6e168074a1514b0acd59cfd81a in mainline.
+
+[NET]: Fix error reporting in sys_socketpair().
+
+If either of the two sock_alloc_fd() calls fail, we
+forget to update 'err' and thus we'll erroneously
+return zero in these cases.
+
+Based upon a report and patch from Rich Paul, and
+commentary from Chuck Ebbert.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1245,11 +1245,14 @@ asmlinkage long sys_socketpair(int famil
+ goto out_release_both;
+
+ fd1 = sock_alloc_fd(&newfile1);
+- if (unlikely(fd1 < 0))
++ if (unlikely(fd1 < 0)) {
++ err = fd1;
+ goto out_release_both;
++ }
+
+ fd2 = sock_alloc_fd(&newfile2);
+ if (unlikely(fd2 < 0)) {
++ err = fd2;
+ put_filp(newfile1);
+ put_unused_fd(fd1);
+ goto out_release_both;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:44 2007
+Message-Id: <20071115055344.377570044@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Evgeniy Polyakov <johnpol@2ka.mipt.ru>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 10/23] Fix TEQL oops.
+Content-Disposition: inline; filename=fix-teql-oops.patch
+Content-Length: 1092
+Lines: 37
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+
+[PKT_SCHED]: Fix OOPS when removing devices from a teql queuing discipline
+
+[ Upstream commit: 4f9f8311a08c0d95c70261264a2b47f2ae99683a ]
+
+tecl_reset() is called from deactivate and qdisc is set to noop already,
+but subsequent teql_xmit does not know about it and dereference private
+data as teql qdisc and thus oopses.
+not catch it first :)
+
+Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/sch_teql.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/sched/sch_teql.c
++++ b/net/sched/sch_teql.c
+@@ -249,6 +249,9 @@ __teql_resolve(struct sk_buff *skb, stru
+ static __inline__ int
+ teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *dev)
+ {
++ if (dev->qdisc == &noop_qdisc)
++ return -ENODEV;
++
+ if (dev->hard_header == NULL ||
+ skb->dst == NULL ||
+ skb->dst->neighbour == NULL)
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:44 2007
+Message-Id: <20071115055344.534189656@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 11/23] Fix endianness bug in U32 classifier.
+Content-Disposition: inline; filename=fix-endianness-bug-in-u32-classifier.patch
+Content-Length: 3045
+Lines: 82
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Radu Rendec <radu.rendec@ines.ro>
+
+changeset 543821c6f5dea5221426eaf1eac98b100249c7ac in mainline.
+
+[PKT_SCHED] CLS_U32: Fix endianness problem with u32 classifier hash masks.
+
+While trying to implement u32 hashes in my shaping machine I ran into
+a possible bug in the u32 hash/bucket computing algorithm
+(net/sched/cls_u32.c).
+
+The problem occurs only with hash masks that extend over the octet
+boundary, on little endian machines (where htonl() actually does
+something).
+
+Let's say that I would like to use 0x3fc0 as the hash mask. This means
+8 contiguous "1" bits starting at b6. With such a mask, the expected
+(and logical) behavior is to hash any address in, for instance,
+192.168.0.0/26 in bucket 0, then any address in 192.168.0.64/26 in
+bucket 1, then 192.168.0.128/26 in bucket 2 and so on.
+
+This is exactly what would happen on a big endian machine, but on
+little endian machines, what would actually happen with current
+implementation is 0x3fc0 being reversed (into 0xc03f0000) by htonl()
+in the userspace tool and then applied to 192.168.x.x in the u32
+classifier. When shifting right by 16 bits (rank of first "1" bit in
+the reversed mask) and applying the divisor mask (0xff for divisor
+256), what would actually remain is 0x3f applied on the "168" octet of
+the address.
+
+One could say is this can be easily worked around by taking endianness
+into account in userspace and supplying an appropriate mask (0xfc03)
+that would be turned into contiguous "1" bits when reversed
+(0x03fc0000). But the actual problem is the network address (inside
+the packet) not being converted to host order, but used as a
+host-order value when computing the bucket.
+
+Let's say the network address is written as n31 n30 ... n0, with n0
+being the least significant bit. When used directly (without any
+conversion) on a little endian machine, it becomes n7 ... n0 n8 ..n15
+etc in the machine's registers. Thus bits n7 and n8 would no longer be
+adjacent and 192.168.64.0/26 and 192.168.128.0/26 would no longer be
+consecutive.
+
+The fix is to apply ntohl() on the hmask before computing fshift,
+and in u32_hash_fold() convert the packet data to host order before
+shifting down by fshift.
+
+With helpful feedback from Jamal Hadi Salim and Jarek Poplawski.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/cls_u32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -91,7 +91,7 @@ static struct tc_u_common *u32_list;
+
+ static __inline__ unsigned u32_hash_fold(u32 key, struct tc_u32_sel *sel, u8 fshift)
+ {
+- unsigned h = (key & sel->hmask)>>fshift;
++ unsigned h = ntohl(key & sel->hmask)>>fshift;
+
+ return h;
+ }
+@@ -615,7 +615,7 @@ static int u32_change(struct tcf_proto *
+ n->handle = handle;
+ {
+ u8 i = 0;
+- u32 mask = s->hmask;
++ u32 mask = ntohl(s->hmask);
+ if (mask) {
+ while (!(mask & 1)) {
+ i++;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:44 2007
+Message-Id: <20071115055344.695305277@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 12/23] Fix VLAN address syncing.
+Content-Disposition: inline; filename=fix-vlan-address-syncing.patch
+Content-Length: 951
+Lines: 40
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Patrick McHardy <kaber@trash.net>
+
+patch d932e04a5e7b146c5f9bf517714b986a432a7594 in mainline.
+
+[PATCH] [VLAN]: Don't synchronize addresses while the vlan device is down
+
+While the VLAN device is down, the unicast addresses are not configured
+on the underlying device, so we shouldn't attempt to sync them.
+
+Noticed by Dmitry Butskoy <buc@odusz.so-cdu.ru>
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/8021q/vlan.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -629,6 +629,10 @@ static int vlan_device_event(struct noti
+ if (!vlandev)
+ continue;
+
++ flgs = vlandev->flags;
++ if (!(flgs & IFF_UP))
++ continue;
++
+ vlan_sync_address(dev, vlandev);
+ }
+ break;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:44 2007
+Message-Id: <20071115055344.858767349@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 13/23] Fix SET_VLAN_INGRESS_PRIORITY_CMD error return.
+Content-Disposition: inline; filename=fix-set_vlan_ingress_priority_cmd-error-return.patch
+Content-Length: 1305
+Lines: 45
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+patch fffe470a803e7f7b74c016291e542a0162761209 in mainline.
+
+[VLAN]: Fix SET_VLAN_INGRESS_PRIORITY_CMD ioctl
+
+Based on report and patch by Doug Kehn <rdkehn@yahoo.com>:
+
+vconfig returns the following error when attempting to execute the
+set_ingress_map command:
+
+vconfig: socket or ioctl error for set_ingress_map: Operation not permitted
+
+In vlan.c, vlan_ioctl_handler for SET_VLAN_INGRESS_PRIORITY_CMD
+sets err = -EPERM and calls vlan_dev_set_ingress_priority.
+vlan_dev_set_ingress_priority is a void function so err remains
+at -EPERM and results in the vconfig error (even though the ingress
+map was set).
+
+Fix by setting err = 0 after the vlan_dev_set_ingress_priority call.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/8021q/vlan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -744,6 +744,7 @@ static int vlan_ioctl_handler(void __use
+ vlan_dev_set_ingress_priority(dev,
+ args.u.skb_priority,
+ args.vlan_qos);
++ err = 0;
+ break;
+
+ case SET_VLAN_EGRESS_PRIORITY_CMD:
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:45 2007
+Message-Id: <20071115055345.022665885@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 14/23] Fix crypto_alloc_comp() error checking.
+Content-Disposition: inline; filename=fix-crypto_alloc_comp-error-checking.patch
+Content-Length: 1763
+Lines: 64
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[IPSEC]: Fix crypto_alloc_comp error checking
+
+[ Upstream commit: 4999f3621f4da622e77931b3d33ada6c7083c705 ]
+
+The function crypto_alloc_comp returns an errno instead of NULL
+to indicate error. So it needs to be tested with IS_ERR.
+
+This is based on a patch by Vicenç Beltran Querol.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/ipcomp.c | 3 ++-
+ net/ipv6/ipcomp6.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/ipcomp.c
++++ b/net/ipv4/ipcomp.c
+@@ -17,6 +17,7 @@
+ #include <asm/scatterlist.h>
+ #include <asm/semaphore.h>
+ #include <linux/crypto.h>
++#include <linux/err.h>
+ #include <linux/pfkeyv2.h>
+ #include <linux/percpu.h>
+ #include <linux/smp.h>
+@@ -355,7 +356,7 @@ static struct crypto_comp **ipcomp_alloc
+ for_each_possible_cpu(cpu) {
+ struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
+ CRYPTO_ALG_ASYNC);
+- if (!tfm)
++ if (IS_ERR(tfm))
+ goto error;
+ *per_cpu_ptr(tfms, cpu) = tfm;
+ }
+--- a/net/ipv6/ipcomp6.c
++++ b/net/ipv6/ipcomp6.c
+@@ -37,6 +37,7 @@
+ #include <asm/scatterlist.h>
+ #include <asm/semaphore.h>
+ #include <linux/crypto.h>
++#include <linux/err.h>
+ #include <linux/pfkeyv2.h>
+ #include <linux/random.h>
+ #include <linux/percpu.h>
+@@ -366,7 +367,7 @@ static struct crypto_comp **ipcomp6_allo
+ for_each_possible_cpu(cpu) {
+ struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
+ CRYPTO_ALG_ASYNC);
+- if (!tfm)
++ if (IS_ERR(tfm))
+ goto error;
+ *per_cpu_ptr(tfms, cpu) = tfm;
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:45 2007
+Message-Id: <20071115055345.181449233@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 15/23] Fix netlink timeouts.
+Content-Disposition: inline; filename=fix-netlink-timeouts.patch
+Content-Length: 3466
+Lines: 110
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+[NETLINK]: Fix unicast timeouts
+
+[ Upstream commit: c3d8d1e30cace31fed6186a4b8c6b1401836d89c ]
+
+Commit ed6dcf4a in the history.git tree broke netlink_unicast timeouts
+by moving the schedule_timeout() call to a new function that doesn't
+propagate the remaining timeout back to the caller. This means on each
+retry we start with the full timeout again.
+
+ipc/mqueue.c seems to actually want to wait indefinitely so this
+behaviour is retained.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/netlink.h | 2 +-
+ ipc/mqueue.c | 6 ++++--
+ net/netlink/af_netlink.c | 10 +++++-----
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/include/linux/netlink.h
++++ b/include/linux/netlink.h
+@@ -175,7 +175,7 @@ extern int netlink_unregister_notifier(s
+ /* finegrained unicast helpers: */
+ struct sock *netlink_getsockbyfilp(struct file *filp);
+ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+- long timeo, struct sock *ssk);
++ long *timeo, struct sock *ssk);
+ void netlink_detachskb(struct sock *sk, struct sk_buff *skb);
+ int netlink_sendskb(struct sock *sk, struct sk_buff *skb, int protocol);
+
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -1014,6 +1014,8 @@ asmlinkage long sys_mq_notify(mqd_t mqde
+ return -EINVAL;
+ }
+ if (notification.sigev_notify == SIGEV_THREAD) {
++ long timeo;
++
+ /* create the notify skb */
+ nc = alloc_skb(NOTIFY_COOKIE_LEN, GFP_KERNEL);
+ ret = -ENOMEM;
+@@ -1042,8 +1044,8 @@ retry:
+ goto out;
+ }
+
+- ret = netlink_attachskb(sock, nc, 0,
+- MAX_SCHEDULE_TIMEOUT, NULL);
++ timeo = MAX_SCHEDULE_TIMEOUT;
++ ret = netlink_attachskb(sock, nc, 0, &timeo, NULL);
+ if (ret == 1)
+ goto retry;
+ if (ret) {
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -744,7 +744,7 @@ struct sock *netlink_getsockbyfilp(struc
+ * 1: repeat lookup - reference dropped while waiting for socket memory.
+ */
+ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+- long timeo, struct sock *ssk)
++ long *timeo, struct sock *ssk)
+ {
+ struct netlink_sock *nlk;
+
+@@ -753,7 +753,7 @@ int netlink_attachskb(struct sock *sk, s
+ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
+ test_bit(0, &nlk->state)) {
+ DECLARE_WAITQUEUE(wait, current);
+- if (!timeo) {
++ if (!*timeo) {
+ if (!ssk || nlk_sk(ssk)->pid == 0)
+ netlink_overrun(sk);
+ sock_put(sk);
+@@ -767,7 +767,7 @@ int netlink_attachskb(struct sock *sk, s
+ if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
+ test_bit(0, &nlk->state)) &&
+ !sock_flag(sk, SOCK_DEAD))
+- timeo = schedule_timeout(timeo);
++ *timeo = schedule_timeout(*timeo);
+
+ __set_current_state(TASK_RUNNING);
+ remove_wait_queue(&nlk->wait, &wait);
+@@ -775,7 +775,7 @@ int netlink_attachskb(struct sock *sk, s
+
+ if (signal_pending(current)) {
+ kfree_skb(skb);
+- return sock_intr_errno(timeo);
++ return sock_intr_errno(*timeo);
+ }
+ return 1;
+ }
+@@ -839,7 +839,7 @@ retry:
+ kfree_skb(skb);
+ return PTR_ERR(sk);
+ }
+- err = netlink_attachskb(sk, skb, nonblock, timeo, ssk);
++ err = netlink_attachskb(sk, skb, nonblock, &timeo, ssk);
+ if (err == 1)
+ goto retry;
+ if (err)
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:45 2007
+Message-Id: <20071115055345.342737092@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Netfilter Development Mailinglist <netfilter-devel@vger.kernel.org>,
+ "David S. Miller" <davem@davemloft.net>,
+ Krzysztof Piotr Oledzki <ole@ans.pl>,
+ Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 16/23] NETFILTER: nf_conntrack_tcp: fix connection reopening
+Content-Disposition: inline; filename=netfilter-nf_conntrack_tcp-fix-connection-reopening.patch
+Content-Length: 3447
+Lines: 101
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+
+Upstream commits: 17311393 + bc34b841 merged together. Merge done by
+Patrick McHardy <kaber@trash.net>
+
+[NETFILTER]: nf_conntrack_tcp: fix connection reopening
+
+With your description I could reproduce the bug and actually you were
+completely right: the code above is incorrect. Somehow I was able to
+misread RFC1122 and mixed the roles :-(:
+
+ When a connection is >>closed actively<<, it MUST linger in
+ TIME-WAIT state for a time 2xMSL (Maximum Segment Lifetime).
+ However, it MAY >>accept<< a new SYN from the remote TCP to
+ reopen the connection directly from TIME-WAIT state, if it:
+ [...]
+
+The fix is as follows: if the receiver initiated an active close, then the
+sender may reopen the connection - otherwise try to figure out if we hold
+a dead connection.
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ net/netfilter/nf_conntrack_proto_tcp.c | 38 ++++++++++++++-------------------
+ 1 file changed, 17 insertions(+), 21 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -831,6 +831,22 @@ static int tcp_packet(struct nf_conn *co
+ tuple = &conntrack->tuplehash[dir].tuple;
+
+ switch (new_state) {
++ case TCP_CONNTRACK_SYN_SENT:
++ if (old_state < TCP_CONNTRACK_TIME_WAIT)
++ break;
++ if ((conntrack->proto.tcp.seen[!dir].flags &
++ IP_CT_TCP_FLAG_CLOSE_INIT)
++ || (conntrack->proto.tcp.last_dir == dir
++ && conntrack->proto.tcp.last_index == TCP_RST_SET)) {
++ /* Attempt to reopen a closed/aborted connection.
++ * Delete this connection and look up again. */
++ write_unlock_bh(&tcp_lock);
++ if (del_timer(&conntrack->timeout))
++ conntrack->timeout.function((unsigned long)
++ conntrack);
++ return -NF_REPEAT;
++ }
++ /* Fall through */
+ case TCP_CONNTRACK_IGNORE:
+ /* Ignored packets:
+ *
+@@ -879,27 +895,6 @@ static int tcp_packet(struct nf_conn *co
+ nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
+ "nf_ct_tcp: invalid state ");
+ return -NF_ACCEPT;
+- case TCP_CONNTRACK_SYN_SENT:
+- if (old_state < TCP_CONNTRACK_TIME_WAIT)
+- break;
+- if ((conntrack->proto.tcp.seen[dir].flags &
+- IP_CT_TCP_FLAG_CLOSE_INIT)
+- || after(ntohl(th->seq),
+- conntrack->proto.tcp.seen[dir].td_end)) {
+- /* Attempt to reopen a closed connection.
+- * Delete this connection and look up again. */
+- write_unlock_bh(&tcp_lock);
+- if (del_timer(&conntrack->timeout))
+- conntrack->timeout.function((unsigned long)
+- conntrack);
+- return -NF_REPEAT;
+- } else {
+- write_unlock_bh(&tcp_lock);
+- if (LOG_INVALID(IPPROTO_TCP))
+- nf_log_packet(pf, 0, skb, NULL, NULL,
+- NULL, "nf_ct_tcp: invalid SYN");
+- return -NF_ACCEPT;
+- }
+ case TCP_CONNTRACK_CLOSE:
+ if (index == TCP_RST_SET
+ && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
+@@ -932,6 +927,7 @@ static int tcp_packet(struct nf_conn *co
+ in_window:
+ /* From now on we have got in-window packets */
+ conntrack->proto.tcp.last_index = index;
++ conntrack->proto.tcp.last_dir = dir;
+
+ pr_debug("tcp_conntracks: ");
+ NF_CT_DUMP_TUPLE(tuple);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:45 2007
+Message-Id: <20071115055345.508845322@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 17/23] ieee80211: fix TKIP QoS bug
+Content-Disposition: inline; filename=ieee80211-fix-tkip-qos-bug.patch
+Content-Length: 1060
+Lines: 33
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+patch e797aa1b7da6bfcb2e19a10ae5ead9aa7aea732b in mainline.
+
+The commit 65b6a277 titled "ieee80211: Fix header->qos_ctl endian issue"
+*introduced* an endianness bug. Partially revert it.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ieee80211/ieee80211_crypt_tkip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ieee80211/ieee80211_crypt_tkip.c
++++ b/net/ieee80211/ieee80211_crypt_tkip.c
+@@ -584,7 +584,7 @@ static void michael_mic_hdr(struct sk_bu
+ if (stype & IEEE80211_STYPE_QOS_DATA) {
+ const struct ieee80211_hdr_3addrqos *qoshdr =
+ (struct ieee80211_hdr_3addrqos *)skb->data;
+- hdr[12] = qoshdr->qos_ctl & cpu_to_le16(IEEE80211_QCTL_TID);
++ hdr[12] = le16_to_cpu(qoshdr->qos_ctl) & IEEE80211_QCTL_TID;
+ } else
+ hdr[12] = 0; /* priority */
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:45 2007
+Message-Id: <20071115055345.668481271@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Michael Wu <flamingice@sourmilk.net>
+Subject: [patch 18/23] mac80211: reorder association debug output
+Content-Disposition: inline; filename=mac80211-reorder-association-debug-output.patch
+Content-Length: 1883
+Lines: 54
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+patch 1dd84aa213d0f98a91a1ec9be2f750f5f48e75a0 in mainline.
+
+There's no reason to warn about an invalid AID field when the
+association was denied.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Acked-by: Michael Wu <flamingice@sourmilk.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211_sta.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/mac80211/ieee80211_sta.c
++++ b/net/mac80211/ieee80211_sta.c
+@@ -1174,15 +1174,11 @@ static void ieee80211_rx_mgmt_assoc_resp
+ capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
+ status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+ aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
+- if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
+- printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
+- "set\n", dev->name, aid);
+- aid &= ~(BIT(15) | BIT(14));
+
+ printk(KERN_DEBUG "%s: RX %sssocResp from " MAC_FMT " (capab=0x%x "
+ "status=%d aid=%d)\n",
+ dev->name, reassoc ? "Rea" : "A", MAC_ARG(mgmt->sa),
+- capab_info, status_code, aid);
++ capab_info, status_code, aid & ~(BIT(15) | BIT(14)));
+
+ if (status_code != WLAN_STATUS_SUCCESS) {
+ printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
+@@ -1192,6 +1188,11 @@ static void ieee80211_rx_mgmt_assoc_resp
+ return;
+ }
+
++ if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
++ printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
++ "set\n", dev->name, aid);
++ aid &= ~(BIT(15) | BIT(14));
++
+ pos = mgmt->u.assoc_resp.variable;
+ if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
+ == ParseFailed) {
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:45 2007
+Message-Id: <20071115055345.830798580@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 19/23] mac80211: store channel info in sta_bss_list
+Content-Disposition: inline; filename=mac80211-store-channel-info-in-sta_bss_list.patch
+Content-Length: 6554
+Lines: 179
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: John W. Linville <linville@tuxdriver.com>
+
+patch 65c107ab3befc37b21d1c970a6159525bc0121b8 in mainline.
+
+Some AP equipment "in the wild" uses the same BSSID on multiple channels
+(particularly "a" vs. "b/g"). This patch changes the key of sta_bss_list
+to include both the BSSID and the channel so as to prevent a BSSID on
+one channel from eclipsing the same BSSID on another channel.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211_sta.c | 35 ++++++++++++++++++++---------------
+ 1 file changed, 20 insertions(+), 15 deletions(-)
+
+--- a/net/mac80211/ieee80211_sta.c
++++ b/net/mac80211/ieee80211_sta.c
+@@ -61,7 +61,7 @@
+ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
+ u8 *ssid, size_t ssid_len);
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid);
++ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel);
+ static void ieee80211_rx_bss_put(struct net_device *dev,
+ struct ieee80211_sta_bss *bss);
+ static int ieee80211_sta_find_ibss(struct net_device *dev,
+@@ -387,6 +387,7 @@ static void ieee80211_set_associated(str
+ struct ieee80211_if_sta *ifsta, int assoc)
+ {
+ union iwreq_data wrqu;
++ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+ if (ifsta->associated == assoc)
+@@ -401,7 +402,8 @@ static void ieee80211_set_associated(str
+ if (sdata->type != IEEE80211_IF_TYPE_STA)
+ return;
+
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
++ local->hw.conf.channel);
+ if (bss) {
+ if (bss->has_erp_value)
+ ieee80211_handle_erp_ie(dev, bss->erp_value);
+@@ -543,7 +545,7 @@ static void ieee80211_send_assoc(struct
+ capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
+ WLAN_CAPABILITY_SHORT_PREAMBLE;
+ }
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel);
+ if (bss) {
+ if (bss->capability & WLAN_CAPABILITY_PRIVACY)
+ capab |= WLAN_CAPABILITY_PRIVACY;
+@@ -695,6 +697,7 @@ static void ieee80211_send_disassoc(stru
+ static int ieee80211_privacy_mismatch(struct net_device *dev,
+ struct ieee80211_if_sta *ifsta)
+ {
++ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+ int res = 0;
+
+@@ -702,7 +705,7 @@ static int ieee80211_privacy_mismatch(st
+ ifsta->key_mgmt != IEEE80211_KEY_MGMT_NONE)
+ return 0;
+
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel);
+ if (!bss)
+ return 0;
+
+@@ -1211,7 +1214,8 @@ static void ieee80211_rx_mgmt_assoc_resp
+ * update our stored copy */
+ if (elems.erp_info && elems.erp_info_len >= 1) {
+ struct ieee80211_sta_bss *bss
+- = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ = ieee80211_rx_bss_get(dev, ifsta->bssid,
++ local->hw.conf.channel);
+ if (bss) {
+ bss->erp_value = elems.erp_info[0];
+ bss->has_erp_value = 1;
+@@ -1241,7 +1245,8 @@ static void ieee80211_rx_mgmt_assoc_resp
+ " AP\n", dev->name);
+ return;
+ }
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
++ local->hw.conf.channel);
+ if (bss) {
+ sta->last_rssi = bss->rssi;
+ sta->last_signal = bss->signal;
+@@ -1322,7 +1327,7 @@ static void __ieee80211_rx_bss_hash_del(
+
+
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid)
++ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel)
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+@@ -1333,6 +1338,7 @@ ieee80211_rx_bss_add(struct net_device *
+ atomic_inc(&bss->users);
+ atomic_inc(&bss->users);
+ memcpy(bss->bssid, bssid, ETH_ALEN);
++ bss->channel = channel;
+
+ spin_lock_bh(&local->sta_bss_lock);
+ /* TODO: order by RSSI? */
+@@ -1344,7 +1350,7 @@ ieee80211_rx_bss_add(struct net_device *
+
+
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid)
++ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel)
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+@@ -1352,7 +1358,8 @@ ieee80211_rx_bss_get(struct net_device *
+ spin_lock_bh(&local->sta_bss_lock);
+ bss = local->sta_bss_hash[STA_HASH(bssid)];
+ while (bss) {
+- if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0) {
++ if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0 &&
++ bss->channel == channel) {
+ atomic_inc(&bss->users);
+ break;
+ }
+@@ -1520,9 +1527,9 @@ static void ieee80211_rx_bss_info(struct
+ else
+ channel = rx_status->channel;
+
+- bss = ieee80211_rx_bss_get(dev, mgmt->bssid);
++ bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel);
+ if (!bss) {
+- bss = ieee80211_rx_bss_add(dev, mgmt->bssid);
++ bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel);
+ if (!bss)
+ return;
+ } else {
+@@ -1622,7 +1629,6 @@ static void ieee80211_rx_bss_info(struct
+
+
+ bss->hw_mode = rx_status->phymode;
+- bss->channel = channel;
+ bss->freq = rx_status->freq;
+ if (channel != rx_status->channel &&
+ (bss->hw_mode == MODE_IEEE80211G ||
+@@ -2355,7 +2361,7 @@ static int ieee80211_sta_create_ibss(str
+ printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID " MAC_FMT "\n",
+ dev->name, MAC_ARG(bssid));
+
+- bss = ieee80211_rx_bss_add(dev, bssid);
++ bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel);
+ if (!bss)
+ return -ENOMEM;
+
+@@ -2366,7 +2372,6 @@ static int ieee80211_sta_create_ibss(str
+ local->hw.conf.beacon_int = 100;
+ bss->beacon_int = local->hw.conf.beacon_int;
+ bss->hw_mode = local->hw.conf.phymode;
+- bss->channel = local->hw.conf.channel;
+ bss->freq = local->hw.conf.freq;
+ bss->last_update = jiffies;
+ bss->capability = WLAN_CAPABILITY_IBSS;
+@@ -2426,7 +2431,7 @@ static int ieee80211_sta_find_ibss(struc
+ MAC_FMT "\n", MAC_ARG(bssid), MAC_ARG(ifsta->bssid));
+ #endif /* CONFIG_MAC80211_IBSS_DEBUG */
+ if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
+- (bss = ieee80211_rx_bss_get(dev, bssid))) {
++ (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel))) {
+ printk(KERN_DEBUG "%s: Selected IBSS BSSID " MAC_FMT
+ " based on configured SSID\n",
+ dev->name, MAC_ARG(bssid));
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:46 2007
+Message-Id: <20071115055346.002008377@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 20/23] mac80211: store SSID in sta_bss_list
+Content-Disposition: inline; filename=mac80211-store-ssid-in-sta_bss_list.patch
+Content-Length: 7139
+Lines: 195
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: John W. Linville <linville@tuxdriver.com>
+
+patch cffdd30d20d163343b1c6de25bcb0cc978a1ebf9 in mainline.
+
+Some AP equipment "in the wild" services multiple SSIDs using the
+same BSSID. This patch changes the key of sta_bss_list to include
+the SSID as well as the BSSID and the channel so as to prevent one
+SSID from eclipsing another SSID with the same BSSID.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211_sta.c | 54 ++++++++++++++++++++++++++-----------------
+ 1 file changed, 33 insertions(+), 21 deletions(-)
+
+--- a/net/mac80211/ieee80211_sta.c
++++ b/net/mac80211/ieee80211_sta.c
+@@ -12,7 +12,6 @@
+ */
+
+ /* TODO:
+- * BSS table: use <BSSID,SSID> as the key to support multi-SSID APs
+ * order BSS list by RSSI(?) ("quality of AP")
+ * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
+ * SSID)
+@@ -61,7 +60,8 @@
+ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
+ u8 *ssid, size_t ssid_len);
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel);
++ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
++ u8 *ssid, u8 ssid_len);
+ static void ieee80211_rx_bss_put(struct net_device *dev,
+ struct ieee80211_sta_bss *bss);
+ static int ieee80211_sta_find_ibss(struct net_device *dev,
+@@ -403,7 +403,8 @@ static void ieee80211_set_associated(str
+ return;
+
+ bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
+- local->hw.conf.channel);
++ local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (bss) {
+ if (bss->has_erp_value)
+ ieee80211_handle_erp_ie(dev, bss->erp_value);
+@@ -545,7 +546,8 @@ static void ieee80211_send_assoc(struct
+ capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
+ WLAN_CAPABILITY_SHORT_PREAMBLE;
+ }
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (bss) {
+ if (bss->capability & WLAN_CAPABILITY_PRIVACY)
+ capab |= WLAN_CAPABILITY_PRIVACY;
+@@ -705,7 +707,8 @@ static int ieee80211_privacy_mismatch(st
+ ifsta->key_mgmt != IEEE80211_KEY_MGMT_NONE)
+ return 0;
+
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (!bss)
+ return 0;
+
+@@ -1215,7 +1218,8 @@ static void ieee80211_rx_mgmt_assoc_resp
+ if (elems.erp_info && elems.erp_info_len >= 1) {
+ struct ieee80211_sta_bss *bss
+ = ieee80211_rx_bss_get(dev, ifsta->bssid,
+- local->hw.conf.channel);
++ local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (bss) {
+ bss->erp_value = elems.erp_info[0];
+ bss->has_erp_value = 1;
+@@ -1246,7 +1250,8 @@ static void ieee80211_rx_mgmt_assoc_resp
+ return;
+ }
+ bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
+- local->hw.conf.channel);
++ local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (bss) {
+ sta->last_rssi = bss->rssi;
+ sta->last_signal = bss->signal;
+@@ -1327,7 +1332,8 @@ static void __ieee80211_rx_bss_hash_del(
+
+
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel)
++ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
++ u8 *ssid, u8 ssid_len)
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+@@ -1339,6 +1345,10 @@ ieee80211_rx_bss_add(struct net_device *
+ atomic_inc(&bss->users);
+ memcpy(bss->bssid, bssid, ETH_ALEN);
+ bss->channel = channel;
++ if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
++ memcpy(bss->ssid, ssid, ssid_len);
++ bss->ssid_len = ssid_len;
++ }
+
+ spin_lock_bh(&local->sta_bss_lock);
+ /* TODO: order by RSSI? */
+@@ -1350,7 +1360,8 @@ ieee80211_rx_bss_add(struct net_device *
+
+
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel)
++ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
++ u8 *ssid, u8 ssid_len)
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+@@ -1358,8 +1369,10 @@ ieee80211_rx_bss_get(struct net_device *
+ spin_lock_bh(&local->sta_bss_lock);
+ bss = local->sta_bss_hash[STA_HASH(bssid)];
+ while (bss) {
+- if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0 &&
+- bss->channel == channel) {
++ if (!memcmp(bss->bssid, bssid, ETH_ALEN) &&
++ bss->channel == channel &&
++ bss->ssid_len == ssid_len &&
++ (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
+ atomic_inc(&bss->users);
+ break;
+ }
+@@ -1527,9 +1540,11 @@ static void ieee80211_rx_bss_info(struct
+ else
+ channel = rx_status->channel;
+
+- bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel);
++ bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel,
++ elems.ssid, elems.ssid_len);
+ if (!bss) {
+- bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel);
++ bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel,
++ elems.ssid, elems.ssid_len);
+ if (!bss)
+ return;
+ } else {
+@@ -1555,10 +1570,6 @@ static void ieee80211_rx_bss_info(struct
+
+ bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
+ bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
+- if (elems.ssid && elems.ssid_len <= IEEE80211_MAX_SSID_LEN) {
+- memcpy(bss->ssid, elems.ssid, elems.ssid_len);
+- bss->ssid_len = elems.ssid_len;
+- }
+
+ bss->supp_rates_len = 0;
+ if (elems.supp_rates) {
+@@ -2339,7 +2350,7 @@ static int ieee80211_sta_create_ibss(str
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+- struct ieee80211_sub_if_data *sdata;
++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ struct ieee80211_hw_mode *mode;
+ u8 bssid[ETH_ALEN], *pos;
+ int i;
+@@ -2361,11 +2372,11 @@ static int ieee80211_sta_create_ibss(str
+ printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID " MAC_FMT "\n",
+ dev->name, MAC_ARG(bssid));
+
+- bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel);
++ bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel,
++ sdata->u.sta.ssid, sdata->u.sta.ssid_len);
+ if (!bss)
+ return -ENOMEM;
+
+- sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ mode = local->oper_hw_mode;
+
+ if (local->hw.conf.beacon_int == 0)
+@@ -2431,7 +2442,8 @@ static int ieee80211_sta_find_ibss(struc
+ MAC_FMT "\n", MAC_ARG(bssid), MAC_ARG(ifsta->bssid));
+ #endif /* CONFIG_MAC80211_IBSS_DEBUG */
+ if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
+- (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel))) {
++ (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len))) {
+ printk(KERN_DEBUG "%s: Selected IBSS BSSID " MAC_FMT
+ " based on configured SSID\n",
+ dev->name, MAC_ARG(bssid));
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:46 2007
+Message-Id: <20071115055346.161980841@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:52:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Abhijeet Kolekar <abhijeet.kolekar@intel.com>,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Bill Moss <bmoss@clemson.edu>
+Subject: [patch 21/23] mac80211: honor IW_SCAN_THIS_ESSID in siwscan ioctl
+Content-Disposition: inline; filename=mac80211-honor-iw_scan_this_essid-in-siwscan-ioctl.patch
+Content-Length: 2385
+Lines: 83
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Bill Moss <bmoss@clemson.edu>
+
+patch 107acb23ba763197d390ae9ffd347f3e2a524d39 in mainline.
+
+This patch fixes the problem of associating with wpa_secured hidden
+AP. Please try out.
+
+The original author of this patch is Bill Moss <bmoss@clemson.edu>
+
+Signed-off-by: Abhijeet Kolekar <abhijeet.kolekar@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211_ioctl.c | 40 ++++++++++++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 16 deletions(-)
+
+--- a/net/mac80211/ieee80211_ioctl.c
++++ b/net/mac80211/ieee80211_ioctl.c
+@@ -687,32 +687,40 @@ static int ieee80211_ioctl_giwap(struct
+
+ static int ieee80211_ioctl_siwscan(struct net_device *dev,
+ struct iw_request_info *info,
+- struct iw_point *data, char *extra)
++ union iwreq_data *wrqu, char *extra)
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++ struct iw_scan_req *req = NULL;
+ u8 *ssid = NULL;
+ size_t ssid_len = 0;
+
+ if (!netif_running(dev))
+ return -ENETDOWN;
+
+- switch (sdata->type) {
+- case IEEE80211_IF_TYPE_STA:
+- case IEEE80211_IF_TYPE_IBSS:
+- if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
+- ssid = sdata->u.sta.ssid;
+- ssid_len = sdata->u.sta.ssid_len;
+- }
+- break;
+- case IEEE80211_IF_TYPE_AP:
+- if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
+- ssid = sdata->u.ap.ssid;
+- ssid_len = sdata->u.ap.ssid_len;
++ if (wrqu->data.length == sizeof(struct iw_scan_req) &&
++ wrqu->data.flags & IW_SCAN_THIS_ESSID) {
++ req = (struct iw_scan_req *)extra;
++ ssid = req->essid;
++ ssid_len = req->essid_len;
++ } else {
++ switch (sdata->type) {
++ case IEEE80211_IF_TYPE_STA:
++ case IEEE80211_IF_TYPE_IBSS:
++ if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
++ ssid = sdata->u.sta.ssid;
++ ssid_len = sdata->u.sta.ssid_len;
++ }
++ break;
++ case IEEE80211_IF_TYPE_AP:
++ if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
++ ssid = sdata->u.ap.ssid;
++ ssid_len = sdata->u.ap.ssid_len;
++ }
++ break;
++ default:
++ return -EOPNOTSUPP;
+ }
+- break;
+- default:
+- return -EOPNOTSUPP;
+ }
+
+ return ieee80211_sta_req_scan(dev, ssid, ssid_len);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:46 2007
+Message-Id: <20071115055346.320056796@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:53:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 22/23] mac80211: only honor IW_SCAN_THIS_ESSID in STA, IBSS, and AP modes
+Content-Disposition: inline; filename=mac80211-only-honor-iw_scan_this_essid-in-sta-ibss-and-ap-modes.patch
+Content-Length: 2001
+Lines: 73
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: John W. Linville <linville@tuxdriver.com>
+
+patch d114f399b4da6fa7f9da3bbf1fb841370c11e788 in mainline.
+
+The previous IW_SCAN_THIS_ESSID patch left a hole allowing scan
+requests on interfaces in inappropriate modes.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211_ioctl.c | 37 +++++++++++++++++++------------------
+ 1 file changed, 19 insertions(+), 18 deletions(-)
+
+--- a/net/mac80211/ieee80211_ioctl.c
++++ b/net/mac80211/ieee80211_ioctl.c
+@@ -698,29 +698,30 @@ static int ieee80211_ioctl_siwscan(struc
+ if (!netif_running(dev))
+ return -ENETDOWN;
+
++ switch (sdata->type) {
++ case IEEE80211_IF_TYPE_STA:
++ case IEEE80211_IF_TYPE_IBSS:
++ if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
++ ssid = sdata->u.sta.ssid;
++ ssid_len = sdata->u.sta.ssid_len;
++ }
++ break;
++ case IEEE80211_IF_TYPE_AP:
++ if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
++ ssid = sdata->u.ap.ssid;
++ ssid_len = sdata->u.ap.ssid_len;
++ }
++ break;
++ default:
++ return -EOPNOTSUPP;
++ }
++
++ /* if SSID was specified explicitly then use that */
+ if (wrqu->data.length == sizeof(struct iw_scan_req) &&
+ wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+ req = (struct iw_scan_req *)extra;
+ ssid = req->essid;
+ ssid_len = req->essid_len;
+- } else {
+- switch (sdata->type) {
+- case IEEE80211_IF_TYPE_STA:
+- case IEEE80211_IF_TYPE_IBSS:
+- if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
+- ssid = sdata->u.sta.ssid;
+- ssid_len = sdata->u.sta.ssid_len;
+- }
+- break;
+- case IEEE80211_IF_TYPE_AP:
+- if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
+- ssid = sdata->u.ap.ssid;
+- ssid_len = sdata->u.ap.ssid_len;
+- }
+- break;
+- default:
+- return -EOPNOTSUPP;
+- }
+ }
+
+ return ieee80211_sta_req_scan(dev, ssid, ssid_len);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 21:53:46 2007
+Message-Id: <20071115055346.478777353@mini.kroah.org>
+References: <20071115055238.692814352@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 21:53:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Michael Wu <flamingice@sourmilk.net>
+Subject: [patch 23/23] mac80211: make ieee802_11_parse_elems return void
+Content-Disposition: inline; filename=mac80211-make-ieee802_11_parse_elems-return-void.patch
+Content-Length: 4941
+Lines: 162
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: John W. Linville <linville@tuxdriver.com>
+
+patch 67a4cce4a89718d252b61aaf58882c69c0e2f6e3 in mainline.
+
+Some APs send management frames with junk padding after the last IE.
+We already account for a similar problem with some Apple Airport
+devices, but at least one device is known to send more than a single
+extra byte. The device in question is the Draytek Vigor2900:
+
+ http://www.draytek.com.au/products/Vigor2900.php
+
+The junk in question looks like an IE that runs off the end of the
+frame. This cause us to return ParseFailed. Since the frame in
+question is an association response, this causes us to fail to associate
+with this AP.
+
+The return code from ieee802_11_parse_elems is superfluous.
+All callers still check for the presence of the specific IEs that
+interest them anyway. So, remove the return code so the parse never
+"fails".
+
+Acked-by: Michael Wu <flamingice@sourmilk.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211_sta.c | 56 ++++++-------------------------------------
+ 1 file changed, 9 insertions(+), 47 deletions(-)
+
+--- a/net/mac80211/ieee80211_sta.c
++++ b/net/mac80211/ieee80211_sta.c
+@@ -108,15 +108,11 @@ struct ieee802_11_elems {
+ u8 wmm_param_len;
+ };
+
+-typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
+-
+-
+-static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
+- struct ieee802_11_elems *elems)
++static void ieee802_11_parse_elems(u8 *start, size_t len,
++ struct ieee802_11_elems *elems)
+ {
+ size_t left = len;
+ u8 *pos = start;
+- int unknown = 0;
+
+ memset(elems, 0, sizeof(*elems));
+
+@@ -127,15 +123,8 @@ static ParseRes ieee802_11_parse_elems(u
+ elen = *pos++;
+ left -= 2;
+
+- if (elen > left) {
+-#if 0
+- if (net_ratelimit())
+- printk(KERN_DEBUG "IEEE 802.11 element parse "
+- "failed (id=%d elen=%d left=%d)\n",
+- id, elen, left);
+-#endif
+- return ParseFailed;
+- }
++ if (elen > left)
++ return;
+
+ switch (id) {
+ case WLAN_EID_SSID:
+@@ -202,28 +191,15 @@ static ParseRes ieee802_11_parse_elems(u
+ elems->ext_supp_rates_len = elen;
+ break;
+ default:
+-#if 0
+- printk(KERN_DEBUG "IEEE 802.11 element parse ignored "
+- "unknown element (id=%d elen=%d)\n",
+- id, elen);
+-#endif
+- unknown++;
+ break;
+ }
+
+ left -= elen;
+ pos += elen;
+ }
+-
+- /* Do not trigger error if left == 1 as Apple Airport base stations
+- * send AssocResps that are one spurious byte too long. */
+-
+- return unknown ? ParseUnknown : ParseOK;
+ }
+
+
+-
+-
+ static int ecw2cw(int ecw)
+ {
+ int cw = 1;
+@@ -907,12 +883,7 @@ static void ieee80211_auth_challenge(str
+
+ printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
+ pos = mgmt->u.auth.variable;
+- if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
+- == ParseFailed) {
+- printk(KERN_DEBUG "%s: failed to parse Auth(challenge)\n",
+- dev->name);
+- return;
+- }
++ ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+ if (!elems.challenge) {
+ printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
+ "frame\n", dev->name);
+@@ -1200,12 +1171,7 @@ static void ieee80211_rx_mgmt_assoc_resp
+ aid &= ~(BIT(15) | BIT(14));
+
+ pos = mgmt->u.assoc_resp.variable;
+- if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
+- == ParseFailed) {
+- printk(KERN_DEBUG "%s: failed to parse AssocResp\n",
+- dev->name);
+- return;
+- }
++ ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
+ if (!elems.supp_rates) {
+ printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
+@@ -1434,7 +1400,7 @@ static void ieee80211_rx_bss_info(struct
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee802_11_elems elems;
+ size_t baselen;
+- int channel, invalid = 0, clen;
++ int channel, clen;
+ struct ieee80211_sta_bss *bss;
+ struct sta_info *sta;
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+@@ -1478,9 +1444,7 @@ static void ieee80211_rx_bss_info(struct
+ #endif /* CONFIG_MAC80211_IBSS_DEBUG */
+ }
+
+- if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
+- &elems) == ParseFailed)
+- invalid = 1;
++ ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
+
+ if (sdata->type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
+ memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
+@@ -1699,9 +1663,7 @@ static void ieee80211_rx_mgmt_beacon(str
+ if (baselen > len)
+ return;
+
+- if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
+- &elems) == ParseFailed)
+- return;
++ ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
+
+ if (elems.erp_info && elems.erp_info_len >= 1)
+ ieee80211_handle_erp_ie(dev, elems.erp_info[0]);
+
+--
+
--- /dev/null
+diff --git a/include/linux/netlink.h b/include/linux/netlink.h
+index 83d8239..63af986 100644
+--- a/include/linux/netlink.h
++++ b/include/linux/netlink.h
+@@ -175,7 +175,7 @@ extern int netlink_unregister_notifier(struct notifier_block *nb);
+ /* finegrained unicast helpers: */
+ struct sock *netlink_getsockbyfilp(struct file *filp);
+ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+- long timeo, struct sock *ssk);
++ long *timeo, struct sock *ssk);
+ void netlink_detachskb(struct sock *sk, struct sk_buff *skb);
+ int netlink_sendskb(struct sock *sk, struct sk_buff *skb, int protocol);
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index a656cec..ed2c458 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -41,8 +41,7 @@
+ #define SKB_DATA_ALIGN(X) (((X) + (SMP_CACHE_BYTES - 1)) & \
+ ~(SMP_CACHE_BYTES - 1))
+ #define SKB_WITH_OVERHEAD(X) \
+- (((X) - sizeof(struct skb_shared_info)) & \
+- ~(SMP_CACHE_BYTES - 1))
++ ((X) - SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
+ #define SKB_MAX_ORDER(X, ORDER) \
+ SKB_WITH_OVERHEAD((PAGE_SIZE << (ORDER)) - (X))
+ #define SKB_MAX_HEAD(X) (SKB_MAX_ORDER((X), 0))
+diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
+index 88884d3..7726ff4 100644
+--- a/include/net/9p/9p.h
++++ b/include/net/9p/9p.h
+@@ -412,6 +412,18 @@ int p9_idpool_check(int id, struct p9_idpool *p);
+
+ int p9_error_init(void);
+ int p9_errstr2errno(char *, int);
++
++#ifdef CONFIG_SYSCTL
+ int __init p9_sysctl_register(void);
+ void __exit p9_sysctl_unregister(void);
++#else
++static inline int p9_sysctl_register(void)
++{
++ return 0;
++}
++static inline void p9_sysctl_unregister(void)
++{
++}
++#endif
++
+ #endif /* NET_9P_H */
+diff --git a/ipc/mqueue.c b/ipc/mqueue.c
+index 145d5a0..1c0de2c 100644
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -1014,6 +1014,8 @@ asmlinkage long sys_mq_notify(mqd_t mqdes,
+ return -EINVAL;
+ }
+ if (notification.sigev_notify == SIGEV_THREAD) {
++ long timeo;
++
+ /* create the notify skb */
+ nc = alloc_skb(NOTIFY_COOKIE_LEN, GFP_KERNEL);
+ ret = -ENOMEM;
+@@ -1042,8 +1044,8 @@ retry:
+ goto out;
+ }
+
+- ret = netlink_attachskb(sock, nc, 0,
+- MAX_SCHEDULE_TIMEOUT, NULL);
++ timeo = MAX_SCHEDULE_TIMEOUT;
++ ret = netlink_attachskb(sock, nc, 0, &timeo, NULL);
+ if (ret == 1)
+ goto retry;
+ if (ret) {
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index 2a54691..ef3f789 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -629,6 +629,10 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
+ if (!vlandev)
+ continue;
+
++ flgs = vlandev->flags;
++ if (!(flgs & IFF_UP))
++ continue;
++
+ vlan_sync_address(dev, vlandev);
+ }
+ break;
+@@ -740,6 +744,7 @@ static int vlan_ioctl_handler(void __user *arg)
+ vlan_dev_set_ingress_priority(dev,
+ args.u.skb_priority,
+ args.vlan_qos);
++ err = 0;
+ break;
+
+ case SET_VLAN_EGRESS_PRIORITY_CMD:
+diff --git a/net/ieee80211/ieee80211_crypt_tkip.c b/net/ieee80211/ieee80211_crypt_tkip.c
+index 5a48d8e..7f11dd9 100644
+--- a/net/ieee80211/ieee80211_crypt_tkip.c
++++ b/net/ieee80211/ieee80211_crypt_tkip.c
+@@ -584,7 +584,7 @@ static void michael_mic_hdr(struct sk_buff *skb, u8 * hdr)
+ if (stype & IEEE80211_STYPE_QOS_DATA) {
+ const struct ieee80211_hdr_3addrqos *qoshdr =
+ (struct ieee80211_hdr_3addrqos *)skb->data;
+- hdr[12] = qoshdr->qos_ctl & cpu_to_le16(IEEE80211_QCTL_TID);
++ hdr[12] = le16_to_cpu(qoshdr->qos_ctl) & IEEE80211_QCTL_TID;
+ } else
+ hdr[12] = 0; /* priority */
+
+diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
+index 5742dc8..2b0b4c7 100644
+--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
++++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
+@@ -469,7 +469,7 @@ ieee80211softmac_wx_set_mlme(struct net_device *dev,
+ {
+ struct ieee80211softmac_device *mac = ieee80211_priv(dev);
+ struct iw_mlme *mlme = (struct iw_mlme *)extra;
+- u16 reason = cpu_to_le16(mlme->reason_code);
++ u16 reason = mlme->reason_code;
+ struct ieee80211softmac_network *net;
+ int err = -EINVAL;
+
+diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
+index e787044..a8a9f13 100644
+--- a/net/ipv4/ipcomp.c
++++ b/net/ipv4/ipcomp.c
+@@ -17,6 +17,7 @@
+ #include <asm/scatterlist.h>
+ #include <asm/semaphore.h>
+ #include <linux/crypto.h>
++#include <linux/err.h>
+ #include <linux/pfkeyv2.h>
+ #include <linux/percpu.h>
+ #include <linux/smp.h>
+@@ -355,7 +356,7 @@ static struct crypto_comp **ipcomp_alloc_tfms(const char *alg_name)
+ for_each_possible_cpu(cpu) {
+ struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
+ CRYPTO_ALG_ASYNC);
+- if (!tfm)
++ if (IS_ERR(tfm))
+ goto error;
+ *per_cpu_ptr(tfms, cpu) = tfm;
+ }
+diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
+index 473f165..9dd1ebc 100644
+--- a/net/ipv6/ipcomp6.c
++++ b/net/ipv6/ipcomp6.c
+@@ -37,6 +37,7 @@
+ #include <asm/scatterlist.h>
+ #include <asm/semaphore.h>
+ #include <linux/crypto.h>
++#include <linux/err.h>
+ #include <linux/pfkeyv2.h>
+ #include <linux/random.h>
+ #include <linux/percpu.h>
+@@ -366,7 +367,7 @@ static struct crypto_comp **ipcomp6_alloc_tfms(const char *alg_name)
+ for_each_possible_cpu(cpu) {
+ struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
+ CRYPTO_ALG_ASYNC);
+- if (!tfm)
++ if (IS_ERR(tfm))
+ goto error;
+ *per_cpu_ptr(tfms, cpu) = tfm;
+ }
+diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
+index ff2172f..9e0da6e 100644
+--- a/net/mac80211/ieee80211.c
++++ b/net/mac80211/ieee80211.c
+@@ -350,7 +350,7 @@ static int ieee80211_get_radiotap_len(struct sk_buff *skb)
+ struct ieee80211_radiotap_header *hdr =
+ (struct ieee80211_radiotap_header *) skb->data;
+
+- return le16_to_cpu(hdr->it_len);
++ return le16_to_cpu(get_unaligned(&hdr->it_len));
+ }
+
+ #ifdef CONFIG_MAC80211_LOWTX_FRAME_DUMP
+@@ -1680,46 +1680,54 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
+ struct ieee80211_tx_packet_data *pkt_data;
+ struct ieee80211_radiotap_header *prthdr =
+ (struct ieee80211_radiotap_header *)skb->data;
+- u16 len;
++ u16 len_rthdr;
+
+- /*
+- * there must be a radiotap header at the
+- * start in this case
+- */
+- if (unlikely(prthdr->it_version)) {
+- /* only version 0 is supported */
+- dev_kfree_skb(skb);
+- return NETDEV_TX_OK;
+- }
++ /* check for not even having the fixed radiotap header part */
++ if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
++ goto fail; /* too short to be possibly valid */
++
++ /* is it a header version we can trust to find length from? */
++ if (unlikely(prthdr->it_version))
++ goto fail; /* only version 0 is supported */
++
++ /* then there must be a radiotap header with a length we can use */
++ len_rthdr = ieee80211_get_radiotap_len(skb);
++
++ /* does the skb contain enough to deliver on the alleged length? */
++ if (unlikely(skb->len < len_rthdr))
++ goto fail; /* skb too short for claimed rt header extent */
+
+ skb->dev = local->mdev;
+
+ pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
+ memset(pkt_data, 0, sizeof(*pkt_data));
++ /* needed because we set skb device to master */
+ pkt_data->ifindex = dev->ifindex;
++
+ pkt_data->mgmt_iface = 0;
+ pkt_data->do_not_encrypt = 1;
+
+- /* above needed because we set skb device to master */
+-
+ /*
+ * fix up the pointers accounting for the radiotap
+ * header still being in there. We are being given
+ * a precooked IEEE80211 header so no need for
+ * normal processing
+ */
+- len = le16_to_cpu(get_unaligned(&prthdr->it_len));
+- skb_set_mac_header(skb, len);
+- skb_set_network_header(skb, len + sizeof(struct ieee80211_hdr));
+- skb_set_transport_header(skb, len + sizeof(struct ieee80211_hdr));
+-
++ skb_set_mac_header(skb, len_rthdr);
+ /*
+- * pass the radiotap header up to
+- * the next stage intact
++ * these are just fixed to the end of the rt area since we
++ * don't have any better information and at this point, nobody cares
+ */
+- dev_queue_xmit(skb);
++ skb_set_network_header(skb, len_rthdr);
++ skb_set_transport_header(skb, len_rthdr);
+
++ /* pass the radiotap header up to the next stage intact */
++ dev_queue_xmit(skb);
+ return NETDEV_TX_OK;
++
++fail:
++ dev_kfree_skb(skb);
++ return NETDEV_TX_OK; /* meaning, we dealt with the skb */
+ }
+
+
+@@ -2836,9 +2844,10 @@ ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
+ memcpy(dst, hdr->addr1, ETH_ALEN);
+ memcpy(src, hdr->addr3, ETH_ALEN);
+
+- if (sdata->type != IEEE80211_IF_TYPE_STA) {
++ if (sdata->type != IEEE80211_IF_TYPE_STA ||
++ (is_multicast_ether_addr(dst) &&
++ !compare_ether_addr(src, dev->dev_addr)))
+ return TXRX_DROP;
+- }
+ break;
+ case 0:
+ /* DA SA BSSID */
+diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
+index e7904db..7b5b801 100644
+--- a/net/mac80211/ieee80211_ioctl.c
++++ b/net/mac80211/ieee80211_ioctl.c
+@@ -687,10 +687,11 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
+
+ static int ieee80211_ioctl_siwscan(struct net_device *dev,
+ struct iw_request_info *info,
+- struct iw_point *data, char *extra)
++ union iwreq_data *wrqu, char *extra)
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++ struct iw_scan_req *req = NULL;
+ u8 *ssid = NULL;
+ size_t ssid_len = 0;
+
+@@ -715,6 +716,14 @@ static int ieee80211_ioctl_siwscan(struct net_device *dev,
+ return -EOPNOTSUPP;
+ }
+
++ /* if SSID was specified explicitly then use that */
++ if (wrqu->data.length == sizeof(struct iw_scan_req) &&
++ wrqu->data.flags & IW_SCAN_THIS_ESSID) {
++ req = (struct iw_scan_req *)extra;
++ ssid = req->essid;
++ ssid_len = req->essid_len;
++ }
++
+ return ieee80211_sta_req_scan(dev, ssid, ssid_len);
+ }
+
+diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
+index 0d99b68..73d39e1 100644
+--- a/net/mac80211/ieee80211_sta.c
++++ b/net/mac80211/ieee80211_sta.c
+@@ -12,7 +12,6 @@
+ */
+
+ /* TODO:
+- * BSS table: use <BSSID,SSID> as the key to support multi-SSID APs
+ * order BSS list by RSSI(?) ("quality of AP")
+ * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
+ * SSID)
+@@ -61,7 +60,8 @@
+ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
+ u8 *ssid, size_t ssid_len);
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid);
++ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
++ u8 *ssid, u8 ssid_len);
+ static void ieee80211_rx_bss_put(struct net_device *dev,
+ struct ieee80211_sta_bss *bss);
+ static int ieee80211_sta_find_ibss(struct net_device *dev,
+@@ -108,15 +108,11 @@ struct ieee802_11_elems {
+ u8 wmm_param_len;
+ };
+
+-typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
+-
+-
+-static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
+- struct ieee802_11_elems *elems)
++static void ieee802_11_parse_elems(u8 *start, size_t len,
++ struct ieee802_11_elems *elems)
+ {
+ size_t left = len;
+ u8 *pos = start;
+- int unknown = 0;
+
+ memset(elems, 0, sizeof(*elems));
+
+@@ -127,15 +123,8 @@ static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
+ elen = *pos++;
+ left -= 2;
+
+- if (elen > left) {
+-#if 0
+- if (net_ratelimit())
+- printk(KERN_DEBUG "IEEE 802.11 element parse "
+- "failed (id=%d elen=%d left=%d)\n",
+- id, elen, left);
+-#endif
+- return ParseFailed;
+- }
++ if (elen > left)
++ return;
+
+ switch (id) {
+ case WLAN_EID_SSID:
+@@ -202,28 +191,15 @@ static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
+ elems->ext_supp_rates_len = elen;
+ break;
+ default:
+-#if 0
+- printk(KERN_DEBUG "IEEE 802.11 element parse ignored "
+- "unknown element (id=%d elen=%d)\n",
+- id, elen);
+-#endif
+- unknown++;
+ break;
+ }
+
+ left -= elen;
+ pos += elen;
+ }
+-
+- /* Do not trigger error if left == 1 as Apple Airport base stations
+- * send AssocResps that are one spurious byte too long. */
+-
+- return unknown ? ParseUnknown : ParseOK;
+ }
+
+
+-
+-
+ static int ecw2cw(int ecw)
+ {
+ int cw = 1;
+@@ -387,6 +363,7 @@ static void ieee80211_set_associated(struct net_device *dev,
+ struct ieee80211_if_sta *ifsta, int assoc)
+ {
+ union iwreq_data wrqu;
++ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+ if (ifsta->associated == assoc)
+@@ -401,7 +378,9 @@ static void ieee80211_set_associated(struct net_device *dev,
+ if (sdata->type != IEEE80211_IF_TYPE_STA)
+ return;
+
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
++ local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (bss) {
+ if (bss->has_erp_value)
+ ieee80211_handle_erp_ie(dev, bss->erp_value);
+@@ -543,7 +522,8 @@ static void ieee80211_send_assoc(struct net_device *dev,
+ capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
+ WLAN_CAPABILITY_SHORT_PREAMBLE;
+ }
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (bss) {
+ if (bss->capability & WLAN_CAPABILITY_PRIVACY)
+ capab |= WLAN_CAPABILITY_PRIVACY;
+@@ -695,6 +675,7 @@ static void ieee80211_send_disassoc(struct net_device *dev,
+ static int ieee80211_privacy_mismatch(struct net_device *dev,
+ struct ieee80211_if_sta *ifsta)
+ {
++ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+ int res = 0;
+
+@@ -702,7 +683,8 @@ static int ieee80211_privacy_mismatch(struct net_device *dev,
+ ifsta->key_mgmt != IEEE80211_KEY_MGMT_NONE)
+ return 0;
+
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (!bss)
+ return 0;
+
+@@ -901,12 +883,7 @@ static void ieee80211_auth_challenge(struct net_device *dev,
+
+ printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
+ pos = mgmt->u.auth.variable;
+- if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
+- == ParseFailed) {
+- printk(KERN_DEBUG "%s: failed to parse Auth(challenge)\n",
+- dev->name);
+- return;
+- }
++ ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+ if (!elems.challenge) {
+ printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
+ "frame\n", dev->name);
+@@ -1174,15 +1151,11 @@ static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
+ capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
+ status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+ aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
+- if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
+- printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
+- "set\n", dev->name, aid);
+- aid &= ~(BIT(15) | BIT(14));
+
+ printk(KERN_DEBUG "%s: RX %sssocResp from " MAC_FMT " (capab=0x%x "
+ "status=%d aid=%d)\n",
+ dev->name, reassoc ? "Rea" : "A", MAC_ARG(mgmt->sa),
+- capab_info, status_code, aid);
++ capab_info, status_code, aid & ~(BIT(15) | BIT(14)));
+
+ if (status_code != WLAN_STATUS_SUCCESS) {
+ printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
+@@ -1192,13 +1165,13 @@ static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
+ return;
+ }
+
++ if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
++ printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
++ "set\n", dev->name, aid);
++ aid &= ~(BIT(15) | BIT(14));
++
+ pos = mgmt->u.assoc_resp.variable;
+- if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
+- == ParseFailed) {
+- printk(KERN_DEBUG "%s: failed to parse AssocResp\n",
+- dev->name);
+- return;
+- }
++ ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
+ if (!elems.supp_rates) {
+ printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
+@@ -1210,7 +1183,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
+ * update our stored copy */
+ if (elems.erp_info && elems.erp_info_len >= 1) {
+ struct ieee80211_sta_bss *bss
+- = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ = ieee80211_rx_bss_get(dev, ifsta->bssid,
++ local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (bss) {
+ bss->erp_value = elems.erp_info[0];
+ bss->has_erp_value = 1;
+@@ -1240,7 +1215,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
+ " AP\n", dev->name);
+ return;
+ }
+- bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
++ bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
++ local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len);
+ if (bss) {
+ sta->last_rssi = bss->rssi;
+ sta->last_signal = bss->signal;
+@@ -1321,7 +1298,8 @@ static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
+
+
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid)
++ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
++ u8 *ssid, u8 ssid_len)
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+@@ -1332,6 +1310,11 @@ ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid)
+ atomic_inc(&bss->users);
+ atomic_inc(&bss->users);
+ memcpy(bss->bssid, bssid, ETH_ALEN);
++ bss->channel = channel;
++ if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
++ memcpy(bss->ssid, ssid, ssid_len);
++ bss->ssid_len = ssid_len;
++ }
+
+ spin_lock_bh(&local->sta_bss_lock);
+ /* TODO: order by RSSI? */
+@@ -1343,7 +1326,8 @@ ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid)
+
+
+ static struct ieee80211_sta_bss *
+-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid)
++ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
++ u8 *ssid, u8 ssid_len)
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+@@ -1351,7 +1335,10 @@ ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid)
+ spin_lock_bh(&local->sta_bss_lock);
+ bss = local->sta_bss_hash[STA_HASH(bssid)];
+ while (bss) {
+- if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0) {
++ if (!memcmp(bss->bssid, bssid, ETH_ALEN) &&
++ bss->channel == channel &&
++ bss->ssid_len == ssid_len &&
++ (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
+ atomic_inc(&bss->users);
+ break;
+ }
+@@ -1413,7 +1400,7 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee802_11_elems elems;
+ size_t baselen;
+- int channel, invalid = 0, clen;
++ int channel, clen;
+ struct ieee80211_sta_bss *bss;
+ struct sta_info *sta;
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+@@ -1457,9 +1444,7 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
+ #endif /* CONFIG_MAC80211_IBSS_DEBUG */
+ }
+
+- if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
+- &elems) == ParseFailed)
+- invalid = 1;
++ ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
+
+ if (sdata->type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
+ memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
+@@ -1519,9 +1504,11 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
+ else
+ channel = rx_status->channel;
+
+- bss = ieee80211_rx_bss_get(dev, mgmt->bssid);
++ bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel,
++ elems.ssid, elems.ssid_len);
+ if (!bss) {
+- bss = ieee80211_rx_bss_add(dev, mgmt->bssid);
++ bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel,
++ elems.ssid, elems.ssid_len);
+ if (!bss)
+ return;
+ } else {
+@@ -1547,10 +1534,6 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
+
+ bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
+ bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
+- if (elems.ssid && elems.ssid_len <= IEEE80211_MAX_SSID_LEN) {
+- memcpy(bss->ssid, elems.ssid, elems.ssid_len);
+- bss->ssid_len = elems.ssid_len;
+- }
+
+ bss->supp_rates_len = 0;
+ if (elems.supp_rates) {
+@@ -1621,7 +1604,6 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
+
+
+ bss->hw_mode = rx_status->phymode;
+- bss->channel = channel;
+ bss->freq = rx_status->freq;
+ if (channel != rx_status->channel &&
+ (bss->hw_mode == MODE_IEEE80211G ||
+@@ -1681,9 +1663,7 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
+ if (baselen > len)
+ return;
+
+- if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
+- &elems) == ParseFailed)
+- return;
++ ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
+
+ if (elems.erp_info && elems.erp_info_len >= 1)
+ ieee80211_handle_erp_ie(dev, elems.erp_info[0]);
+@@ -2332,7 +2312,7 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
+ {
+ struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+ struct ieee80211_sta_bss *bss;
+- struct ieee80211_sub_if_data *sdata;
++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ struct ieee80211_hw_mode *mode;
+ u8 bssid[ETH_ALEN], *pos;
+ int i;
+@@ -2354,18 +2334,17 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
+ printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID " MAC_FMT "\n",
+ dev->name, MAC_ARG(bssid));
+
+- bss = ieee80211_rx_bss_add(dev, bssid);
++ bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel,
++ sdata->u.sta.ssid, sdata->u.sta.ssid_len);
+ if (!bss)
+ return -ENOMEM;
+
+- sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ mode = local->oper_hw_mode;
+
+ if (local->hw.conf.beacon_int == 0)
+ local->hw.conf.beacon_int = 100;
+ bss->beacon_int = local->hw.conf.beacon_int;
+ bss->hw_mode = local->hw.conf.phymode;
+- bss->channel = local->hw.conf.channel;
+ bss->freq = local->hw.conf.freq;
+ bss->last_update = jiffies;
+ bss->capability = WLAN_CAPABILITY_IBSS;
+@@ -2425,7 +2404,8 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
+ MAC_FMT "\n", MAC_ARG(bssid), MAC_ARG(ifsta->bssid));
+ #endif /* CONFIG_MAC80211_IBSS_DEBUG */
+ if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
+- (bss = ieee80211_rx_bss_get(dev, bssid))) {
++ (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel,
++ ifsta->ssid, ifsta->ssid_len))) {
+ printk(KERN_DEBUG "%s: Selected IBSS BSSID " MAC_FMT
+ " based on configured SSID\n",
+ dev->name, MAC_ARG(bssid));
+diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
+index eb3fe74..70c5b7d 100644
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -831,6 +831,22 @@ static int tcp_packet(struct nf_conn *conntrack,
+ tuple = &conntrack->tuplehash[dir].tuple;
+
+ switch (new_state) {
++ case TCP_CONNTRACK_SYN_SENT:
++ if (old_state < TCP_CONNTRACK_TIME_WAIT)
++ break;
++ if ((conntrack->proto.tcp.seen[!dir].flags &
++ IP_CT_TCP_FLAG_CLOSE_INIT)
++ || (conntrack->proto.tcp.last_dir == dir
++ && conntrack->proto.tcp.last_index == TCP_RST_SET)) {
++ /* Attempt to reopen a closed/aborted connection.
++ * Delete this connection and look up again. */
++ write_unlock_bh(&tcp_lock);
++ if (del_timer(&conntrack->timeout))
++ conntrack->timeout.function((unsigned long)
++ conntrack);
++ return -NF_REPEAT;
++ }
++ /* Fall through */
+ case TCP_CONNTRACK_IGNORE:
+ /* Ignored packets:
+ *
+@@ -879,27 +895,6 @@ static int tcp_packet(struct nf_conn *conntrack,
+ nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
+ "nf_ct_tcp: invalid state ");
+ return -NF_ACCEPT;
+- case TCP_CONNTRACK_SYN_SENT:
+- if (old_state < TCP_CONNTRACK_TIME_WAIT)
+- break;
+- if ((conntrack->proto.tcp.seen[dir].flags &
+- IP_CT_TCP_FLAG_CLOSE_INIT)
+- || after(ntohl(th->seq),
+- conntrack->proto.tcp.seen[dir].td_end)) {
+- /* Attempt to reopen a closed connection.
+- * Delete this connection and look up again. */
+- write_unlock_bh(&tcp_lock);
+- if (del_timer(&conntrack->timeout))
+- conntrack->timeout.function((unsigned long)
+- conntrack);
+- return -NF_REPEAT;
+- } else {
+- write_unlock_bh(&tcp_lock);
+- if (LOG_INVALID(IPPROTO_TCP))
+- nf_log_packet(pf, 0, skb, NULL, NULL,
+- NULL, "nf_ct_tcp: invalid SYN");
+- return -NF_ACCEPT;
+- }
+ case TCP_CONNTRACK_CLOSE:
+ if (index == TCP_RST_SET
+ && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
+@@ -932,6 +927,7 @@ static int tcp_packet(struct nf_conn *conntrack,
+ in_window:
+ /* From now on we have got in-window packets */
+ conntrack->proto.tcp.last_index = index;
++ conntrack->proto.tcp.last_dir = dir;
+
+ pr_debug("tcp_conntracks: ");
+ NF_CT_DUMP_TUPLE(tuple);
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 5681ce3..1a0fcc5 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -744,7 +744,7 @@ struct sock *netlink_getsockbyfilp(struct file *filp)
+ * 1: repeat lookup - reference dropped while waiting for socket memory.
+ */
+ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+- long timeo, struct sock *ssk)
++ long *timeo, struct sock *ssk)
+ {
+ struct netlink_sock *nlk;
+
+@@ -753,7 +753,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
+ test_bit(0, &nlk->state)) {
+ DECLARE_WAITQUEUE(wait, current);
+- if (!timeo) {
++ if (!*timeo) {
+ if (!ssk || nlk_sk(ssk)->pid == 0)
+ netlink_overrun(sk);
+ sock_put(sk);
+@@ -767,7 +767,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+ if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
+ test_bit(0, &nlk->state)) &&
+ !sock_flag(sk, SOCK_DEAD))
+- timeo = schedule_timeout(timeo);
++ *timeo = schedule_timeout(*timeo);
+
+ __set_current_state(TASK_RUNNING);
+ remove_wait_queue(&nlk->wait, &wait);
+@@ -775,7 +775,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+
+ if (signal_pending(current)) {
+ kfree_skb(skb);
+- return sock_intr_errno(timeo);
++ return sock_intr_errno(*timeo);
+ }
+ return 1;
+ }
+@@ -839,7 +839,7 @@ retry:
+ kfree_skb(skb);
+ return PTR_ERR(sk);
+ }
+- err = netlink_attachskb(sk, skb, nonblock, timeo, ssk);
++ err = netlink_attachskb(sk, skb, nonblock, &timeo, ssk);
+ if (err == 1)
+ goto retry;
+ if (err)
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index d4d5d2f..fceb75b 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -91,7 +91,7 @@ static struct tc_u_common *u32_list;
+
+ static __inline__ unsigned u32_hash_fold(u32 key, struct tc_u32_sel *sel, u8 fshift)
+ {
+- unsigned h = (key & sel->hmask)>>fshift;
++ unsigned h = ntohl(key & sel->hmask)>>fshift;
+
+ return h;
+ }
+@@ -615,7 +615,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
+ n->handle = handle;
+ {
+ u8 i = 0;
+- u32 mask = s->hmask;
++ u32 mask = ntohl(s->hmask);
+ if (mask) {
+ while (!(mask & 1)) {
+ i++;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index dee0d5f..8f1bcf6 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1225,10 +1225,13 @@ EXPORT_SYMBOL(tcf_destroy_chain);
+ #ifdef CONFIG_PROC_FS
+ static int psched_show(struct seq_file *seq, void *v)
+ {
++ struct timespec ts;
++
++ hrtimer_get_res(CLOCK_MONOTONIC, &ts);
+ seq_printf(seq, "%08x %08x %08x %08x\n",
+ (u32)NSEC_PER_USEC, (u32)PSCHED_US2NS(1),
+ 1000000,
+- (u32)NSEC_PER_SEC/(u32)ktime_to_ns(KTIME_MONOTONIC_RES));
++ (u32)NSEC_PER_SEC/(u32)ktime_to_ns(timespec_to_ktime(ts)));
+
+ return 0;
+ }
+diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
+index 0968184..cb5754b 100644
+--- a/net/sched/sch_teql.c
++++ b/net/sched/sch_teql.c
+@@ -249,6 +249,9 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *
+ static __inline__ int
+ teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *dev)
+ {
++ if (dev->qdisc == &noop_qdisc)
++ return -ENODEV;
++
+ if (dev->hard_header == NULL ||
+ skb->dst == NULL ||
+ skb->dst->neighbour == NULL)
+diff --git a/net/socket.c b/net/socket.c
+index b09eb90..8e5be74 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1245,11 +1245,14 @@ asmlinkage long sys_socketpair(int family, int type, int protocol,
+ goto out_release_both;
+
+ fd1 = sock_alloc_fd(&newfile1);
+- if (unlikely(fd1 < 0))
++ if (unlikely(fd1 < 0)) {
++ err = fd1;
+ goto out_release_both;
++ }
+
+ fd2 = sock_alloc_fd(&newfile2);
+ if (unlikely(fd2 < 0)) {
++ err = fd2;
+ put_filp(newfile1);
+ put_unused_fd(fd1);
+ goto out_release_both;
+@@ -2230,6 +2233,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
+ err = sock->ops->accept(sock, *newsock, flags);
+ if (err < 0) {
+ sock_release(*newsock);
++ *newsock = NULL;
+ goto done;
+ }
+
--- /dev/null
+# network core
+mac80211-filter-locally-originated-multicast-frames.patch
+mac80211-improve-sanity-checks-on-injected-packets.patch
+add-get_unaligned-to-ieee80211_get_radiotap_len.patch
+fix-advertised-packet-scheduler-timer-resolution.patch
+fix-9p-protocol-build.patch
+fix-skb_with_overhead-calculations.patch
+fix-kernel_accept-return-handling.patch
+softmac-fix-wext-mlme-request-reason-code-endianness.patch
+fix-error-returns-in-sys_socketpair.patch
+fix-teql-oops.patch
+fix-endianness-bug-in-u32-classifier.patch
+fix-vlan-address-syncing.patch
+fix-set_vlan_ingress_priority_cmd-error-return.patch
+fix-crypto_alloc_comp-error-checking.patch
+fix-netlink-timeouts.patch
+netfilter-nf_conntrack_tcp-fix-connection-reopening.patch
+ieee80211-fix-tkip-qos-bug.patch
+mac80211-reorder-association-debug-output.patch
+mac80211-store-channel-info-in-sta_bss_list.patch
+mac80211-store-ssid-in-sta_bss_list.patch
+mac80211-honor-iw_scan_this_essid-in-siwscan-ioctl.patch
+mac80211-only-honor-iw_scan_this_essid-in-sta-ibss-and-ap-modes.patch
+mac80211-make-ieee802_11_parse_elems-return-void.patch
--- /dev/null
+ drivers/net/ehea/ehea_qmr.c | 20 +---
+ drivers/net/ehea/ehea_qmr.h | 2
+ drivers/net/forcedeth.c | 35 ++++++--
+ drivers/net/pppol2tp.c | 25 ++++-
+ drivers/net/skge.c | 141 +++++++++++++++++----------------
+ drivers/net/skge.h | 6 -
+ drivers/net/sky2.c | 87 ++++++++++++++++----
+ drivers/net/tg3.c | 10 +-
+ drivers/net/wireless/ipw2100.c | 39 +++++++++
+ drivers/net/wireless/ipw2100.h | 4
+ drivers/net/wireless/libertas/11d.c | 2
+ drivers/net/wireless/libertas/cmd.c | 6 -
+ drivers/net/wireless/libertas/wext.c | 8 -
+ drivers/net/wireless/rtl8187_dev.c | 31 +++----
+ drivers/net/wireless/zd1201.c | 4
+ drivers/net/wireless/zd1211rw/zd_usb.c | 7 +
+ include/linux/pci_ids.h | 4
+ 17 files changed, 283 insertions(+), 148 deletions(-)
--- /dev/null
+From gregkh@mini.kroah.org Wed Nov 14 22:04:51 2007
+Message-Id: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:03:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/16] 2.6.23-stable review, network driver changes
+Status: RO
+Content-Length: 1789
+Lines: 42
+
+This is the start of the stable review cycle for the 2.6.23.X release.
+There are 16 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday 00:00:00 UTC. Anything received
+after that time might be too late.
+
+This set of patches focuses on only networking drivers.
+
+The diffstat of this review series is included below.
+
+thanks,
+
+greg k-h
+
+-----
+
+ drivers/net/ehea/ehea_qmr.c | 20 +---
+ drivers/net/ehea/ehea_qmr.h | 2
+ drivers/net/forcedeth.c | 35 ++++++--
+ drivers/net/pppol2tp.c | 25 ++++-
+ drivers/net/skge.c | 141 +++++++++++++++++----------------
+ drivers/net/skge.h | 6 -
+ drivers/net/sky2.c | 87 ++++++++++++++++----
+ drivers/net/tg3.c | 10 +-
+ drivers/net/wireless/ipw2100.c | 39 +++++++++
+ drivers/net/wireless/ipw2100.h | 4
+ drivers/net/wireless/libertas/11d.c | 2
+ drivers/net/wireless/libertas/cmd.c | 6 -
+ drivers/net/wireless/libertas/wext.c | 8 -
+ drivers/net/wireless/rtl8187_dev.c | 31 +++----
+ drivers/net/wireless/zd1201.c | 4
+ drivers/net/wireless/zd1211rw/zd_usb.c | 7 +
+ include/linux/pci_ids.h | 4
+ 17 files changed, 283 insertions(+), 148 deletions(-)
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:51 2007
+Message-Id: <20071115060451.785831881@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:03:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Al Viro <viro@zeniv.linux.org.uk>,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Al Viro <viro@ftp.linux.org.uk>,
+ Dan Williams <dcbw@redhat.com>
+Subject: [patch 01/16] libertas: more endianness breakage
+Content-Disposition: inline; filename=libertas-more-endianness-breakage.patch
+Status: RO
+Content-Length: 2320
+Lines: 62
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Al Viro <viro@ftp.linux.org.uk>
+
+based on patch 8362cd413e8116306fafbaf414f0419db0595142 in mainline.
+
+ domain->header.len is le16 and has just been assigned
+cpu_to_le16(arithmetical expression). And all fields of adapter->logmsg
+are __le32; not a single 16-bit among them...
+ That's incremental to the previous one
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/11d.c | 2 +-
+ drivers/net/wireless/libertas/wext.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/libertas/11d.c
++++ b/drivers/net/wireless/libertas/11d.c
+@@ -562,7 +562,7 @@ int libertas_cmd_802_11d_domain_info(wla
+ nr_subband * sizeof(struct ieeetypes_subbandset));
+
+ cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
+- domain->header.len +
++ le16_to_cpu(domain->header.len) +
+ sizeof(struct mrvlietypesheader) +
+ S_DS_GEN);
+ } else {
+--- a/drivers/net/wireless/libertas/wext.c
++++ b/drivers/net/wireless/libertas/wext.c
+@@ -973,7 +973,7 @@ static struct iw_statistics *wlan_get_wi
+ /* Quality by TX errors */
+ priv->wstats.discard.retries = priv->stats.tx_errors;
+
+- tx_retries = le16_to_cpu(adapter->logmsg.retry);
++ tx_retries = le32_to_cpu(adapter->logmsg.retry);
+
+ if (tx_retries > 75)
+ tx_qual = (90 - tx_retries) * POOR / 15;
+@@ -989,10 +989,10 @@ static struct iw_statistics *wlan_get_wi
+ (PERFECT - VERY_GOOD) / 50 + VERY_GOOD;
+ quality = min(quality, tx_qual);
+
+- priv->wstats.discard.code = le16_to_cpu(adapter->logmsg.wepundecryptable);
+- priv->wstats.discard.fragment = le16_to_cpu(adapter->logmsg.rxfrag);
++ priv->wstats.discard.code = le32_to_cpu(adapter->logmsg.wepundecryptable);
++ priv->wstats.discard.fragment = le32_to_cpu(adapter->logmsg.rxfrag);
+ priv->wstats.discard.retries = tx_retries;
+- priv->wstats.discard.misc = le16_to_cpu(adapter->logmsg.ackfailure);
++ priv->wstats.discard.misc = le32_to_cpu(adapter->logmsg.ackfailure);
+
+ /* Calculate quality */
+ priv->wstats.qual.qual = max(quality, (u32)100);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:52 2007
+Message-Id: <20071115060452.104346309@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:03:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan-Bernd Themann <themann@de.ibm.com>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 03/16] ehea: 64K page kernel support fix
+Content-Disposition: inline; filename=ehea-64k-page-kernel-support-fix.patch
+Content-Length: 2987
+Lines: 95
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jan-Bernd Themann <ossthema@de.ibm.com>
+
+based on 2c69448bbcedebeb8409ddb05fbc7d3fe1cfbda7 in mainline.
+
+The current eHEA module compiled for 64K page kernels can not
+be loaded with insmod due to bad hypervisor call parameters.
+The patch is a subset of the follwing patch which has been applied
+for 2.6.24 upstream:
+
+http://www.spinics.net/lists/netdev/msg42814.html
+
+Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
+Cc: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/ehea/ehea_qmr.c | 20 ++++++++------------
+ drivers/net/ehea/ehea_qmr.h | 2 +-
+ 2 files changed, 9 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ehea/ehea_qmr.c
++++ b/drivers/net/ehea/ehea_qmr.c
+@@ -563,8 +563,7 @@ int ehea_destroy_qp(struct ehea_qp *qp)
+ int ehea_create_busmap( void )
+ {
+ u64 vaddr = EHEA_BUSMAP_START;
+- unsigned long abs_max_pfn = 0;
+- unsigned long sec_max_pfn;
++ unsigned long high_section_index = 0;
+ int i;
+
+ /*
+@@ -574,14 +573,10 @@ int ehea_create_busmap( void )
+ ehea_bmap.valid_sections = 0;
+
+ for (i = 0; i < NR_MEM_SECTIONS; i++)
+- if (valid_section_nr(i)) {
+- sec_max_pfn = section_nr_to_pfn(i);
+- if (sec_max_pfn > abs_max_pfn)
+- abs_max_pfn = sec_max_pfn;
+- ehea_bmap.valid_sections++;
+- }
++ if (valid_section_nr(i))
++ high_section_index = i;
+
+- ehea_bmap.entries = abs_max_pfn / EHEA_PAGES_PER_SECTION + 1;
++ ehea_bmap.entries = high_section_index + 1;
+ ehea_bmap.vaddr = vmalloc(ehea_bmap.entries * sizeof(*ehea_bmap.vaddr));
+
+ if (!ehea_bmap.vaddr)
+@@ -593,6 +588,7 @@ int ehea_create_busmap( void )
+ if (pfn_valid(pfn)) {
+ ehea_bmap.vaddr[i] = vaddr;
+ vaddr += EHEA_SECTSIZE;
++ ehea_bmap.valid_sections++;
+ } else
+ ehea_bmap.vaddr[i] = 0;
+ }
+@@ -637,7 +633,7 @@ int ehea_reg_kernel_mr(struct ehea_adapt
+
+ mr_len = ehea_bmap.valid_sections * EHEA_SECTSIZE;
+
+- pt = kzalloc(EHEA_MAX_RPAGE * sizeof(u64), GFP_KERNEL);
++ pt = kzalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!pt) {
+ ehea_error("no mem");
+ ret = -ENOMEM;
+@@ -660,8 +656,8 @@ int ehea_reg_kernel_mr(struct ehea_adapt
+ void *sectbase = __va(i << SECTION_SIZE_BITS);
+ unsigned long k = 0;
+
+- for (j = 0; j < (PAGES_PER_SECTION / EHEA_MAX_RPAGE);
+- j++) {
++ for (j = 0; j < (EHEA_PAGES_PER_SECTION /
++ EHEA_MAX_RPAGE); j++) {
+
+ for (m = 0; m < EHEA_MAX_RPAGE; m++) {
+ pg = sectbase + ((k++) * EHEA_PAGESIZE);
+--- a/drivers/net/ehea/ehea_qmr.h
++++ b/drivers/net/ehea/ehea_qmr.h
+@@ -39,7 +39,7 @@
+ #define EHEA_PAGESHIFT 12
+ #define EHEA_PAGESIZE (1UL << EHEA_PAGESHIFT)
+ #define EHEA_SECTSIZE (1UL << 24)
+-#define EHEA_PAGES_PER_SECTION (EHEA_SECTSIZE >> PAGE_SHIFT)
++#define EHEA_PAGES_PER_SECTION (EHEA_SECTSIZE >> EHEA_PAGESHIFT)
+
+ #if (1UL << SECTION_SIZE_BITS) < EHEA_SECTSIZE
+ #error eHEA module can't work if kernel sectionsize < ehea sectionsize
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:52 2007
+Message-Id: <20071115060452.264406220@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:03:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Manfred Spraul <manfred@colorfullife.com>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 04/16] forcedeth msi bugfix
+Content-Disposition: inline; filename=forcedeth-msi-bugfix.patch
+Content-Length: 4246
+Lines: 125
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Manfred Spraul <manfred@colorfullife.com>
+
+patch a7475906bc496456ded9e4b062f94067fb93057a in mainline.
+
+pci_enable_msi() replaces the INTx irq number in pci_dev->irq with the
+new MSI irq number.
+The forcedeth driver did not update the copy in netdevice->irq and
+parts of the driver used the stale copy.
+See bugzilla.kernel.org, bug 9047.
+
+The patch
+- updates netdevice->irq
+- replaces all accesses to netdevice->irq with pci_dev->irq.
+
+The patch is against 2.6.23.1. IMHO suitable for both 2.6.23 and 2.6.24
+
+Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -988,7 +988,7 @@ static void nv_enable_irq(struct net_dev
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq(dev->irq);
++ enable_irq(np->pci_dev->irq);
+ } else {
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+@@ -1004,7 +1004,7 @@ static void nv_disable_irq(struct net_de
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq(dev->irq);
++ disable_irq(np->pci_dev->irq);
+ } else {
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+@@ -1601,7 +1601,7 @@ static void nv_do_rx_refill(unsigned lon
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq(dev->irq);
++ disable_irq(np->pci_dev->irq);
+ } else {
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ }
+@@ -1619,7 +1619,7 @@ static void nv_do_rx_refill(unsigned lon
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq(dev->irq);
++ enable_irq(np->pci_dev->irq);
+ } else {
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ }
+@@ -3557,10 +3557,12 @@ static int nv_request_irq(struct net_dev
+ if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
+ if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
+ np->msi_flags |= NV_MSI_ENABLED;
++ dev->irq = np->pci_dev->irq;
+ if (request_irq(np->pci_dev->irq, handler, IRQF_SHARED, dev->name, dev) != 0) {
+ printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+ pci_disable_msi(np->pci_dev);
+ np->msi_flags &= ~NV_MSI_ENABLED;
++ dev->irq = np->pci_dev->irq;
+ goto out_err;
+ }
+
+@@ -3623,7 +3625,7 @@ static void nv_do_nic_poll(unsigned long
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq_lockdep(dev->irq);
++ disable_irq_lockdep(np->pci_dev->irq);
+ mask = np->irqmask;
+ } else {
+ if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+@@ -3641,6 +3643,8 @@ static void nv_do_nic_poll(unsigned long
+ }
+ np->nic_poll_irq = 0;
+
++ /* disable_irq() contains synchronize_irq, thus no irq handler can run now */
++
+ if (np->recover_error) {
+ np->recover_error = 0;
+ printk(KERN_INFO "forcedeth: MAC in recoverable error state\n");
+@@ -3677,7 +3681,6 @@ static void nv_do_nic_poll(unsigned long
+ }
+ }
+
+- /* FIXME: Do we need synchronize_irq(dev->irq) here? */
+
+ writel(mask, base + NvRegIrqMask);
+ pci_push(base);
+@@ -3690,7 +3693,7 @@ static void nv_do_nic_poll(unsigned long
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq_lockdep(dev->irq);
++ enable_irq_lockdep(np->pci_dev->irq);
+ } else {
+ if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+ nv_nic_irq_rx(0, dev);
+@@ -4943,7 +4946,7 @@ static int nv_close(struct net_device *d
+ np->in_shutdown = 1;
+ spin_unlock_irq(&np->lock);
+ netif_poll_disable(dev);
+- synchronize_irq(dev->irq);
++ synchronize_irq(np->pci_dev->irq);
+
+ del_timer_sync(&np->oom_kick);
+ del_timer_sync(&np->nic_poll);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:52 2007
+Message-Id: <20071115060452.416649956@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:03:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ayaz Abdulla <aabdulla@nvidia.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 05/16] forcedeth: add MCP77 device IDs
+Content-Disposition: inline; filename=forcedeth-add-mcp77-device-ids.patch
+Content-Length: 2748
+Lines: 57
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+
+patch 96fd4cd3e40e240f0c385af87f58e74da8b7099a in mainline.
+
+Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 16 ++++++++++++++++
+ include/linux/pci_ids.h | 4 ++++
+ 2 files changed, 20 insertions(+)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -5566,6 +5566,22 @@ static struct pci_device_id pci_tbl[] =
+ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_31),
+ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
+ },
++ { /* MCP77 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_32),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP77 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_33),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP77 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_34),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP77 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_35),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
+ {0,},
+ };
+
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1233,6 +1233,10 @@
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_IDE 0x0560
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE 0x056C
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE 0x0759
++#define PCI_DEVICE_ID_NVIDIA_NVENET_32 0x0760
++#define PCI_DEVICE_ID_NVIDIA_NVENET_33 0x0761
++#define PCI_DEVICE_ID_NVIDIA_NVENET_34 0x0762
++#define PCI_DEVICE_ID_NVIDIA_NVENET_35 0x0763
+
+ #define PCI_VENDOR_ID_IMS 0x10e0
+ #define PCI_DEVICE_ID_IMS_TT128 0x9128
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:52 2007
+Message-Id: <20071115060452.577280152@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:03:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Chan <mchan@broadcom.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 06/16] TG3: Fix performance regression on 5705.
+Content-Disposition: inline; filename=tg3-fix-performance-regression-on-5705.patch
+Content-Length: 1812
+Lines: 60
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Chan <mchan@broadcom.com>
+
+patch 114342f2d38439cb1a54f1f724fa38729b093c48 in mainline.
+
+A performance regression was introduced by the following commit:
+
+ commit ee6a99b539a50b4e9398938a0a6d37f8bf911550
+ Author: Michael Chan <mchan@broadcom.com>
+ Date: Wed Jul 18 21:49:10 2007 -0700
+
+ [TG3]: Fix msi issue with kexec/kdump.
+
+In making that change, the PCI latency timer and cache line size
+registers were not restored after chip reset. On the 5705, the
+latency timer gets reset to 0 during chip reset and this causes
+very poor performance.
+
+Update version to 3.81.1
+
+Signed-off-by: Michael Chan <mchan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/tg3.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/tg3.c
++++ b/drivers/net/tg3.c
+@@ -64,8 +64,8 @@
+
+ #define DRV_MODULE_NAME "tg3"
+ #define PFX DRV_MODULE_NAME ": "
+-#define DRV_MODULE_VERSION "3.81"
+-#define DRV_MODULE_RELDATE "September 5, 2007"
++#define DRV_MODULE_VERSION "3.81.1"
++#define DRV_MODULE_RELDATE "October 18, 2007"
+
+ #define TG3_DEF_MAC_MODE 0
+ #define TG3_DEF_RX_MODE 0
+@@ -4874,6 +4874,12 @@ static void tg3_restore_pci_state(struct
+
+ pci_write_config_dword(tp->pdev, TG3PCI_COMMAND, tp->pci_cmd);
+
++ if (!(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS)) {
++ pci_write_config_byte(tp->pdev, PCI_CACHE_LINE_SIZE,
++ tp->pci_cacheline_sz);
++ pci_write_config_byte(tp->pdev, PCI_LATENCY_TIMER,
++ tp->pci_lat_timer);
++ }
+ /* Make sure PCI-X relaxed ordering bit is clear. */
+ pci_read_config_dword(tp->pdev, TG3PCI_X_CAPS, &val);
+ val &= ~PCIX_CAPS_RELAXED_ORDERING;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:52 2007
+Message-Id: <20071115060452.739013625@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ bunk@kernel.org,
+ James Chapman <jchapman@katalix.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 07/16] Fix L2TP oopses.
+Content-Disposition: inline; filename=fix-l2tp-oopses.patch
+Content-Length: 3195
+Lines: 111
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: James Chapman <jchapman@katalix.com>
+
+changeset 91781004b9c029ee55b7aa9ef950a373ba865dc6 in mainline.
+
+[PPP]: L2TP: Fix oops in transmit and receive paths
+
+Changes made on 18-sep to fix skb handling in the pppol2tp driver
+broke the transmit and receive paths. Users are only running into this
+now because distros are now using 2.6.23 and I must have messed up
+when I tested the change.
+
+For receive, we now do our own calculation of how much to pull from
+the skb (variable length L2TP header) rather than using
+skb_transport_offset(). Also, if the skb isn't a data packet, it must
+be passed back to UDP with skb->data pointing to the UDP header.
+
+For transmit, make sure skb->sk is set up because ip_queue_xmit()
+needs it.
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/pppol2tp.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -487,7 +487,7 @@ static int pppol2tp_recv_core(struct soc
+ {
+ struct pppol2tp_session *session = NULL;
+ struct pppol2tp_tunnel *tunnel;
+- unsigned char *ptr;
++ unsigned char *ptr, *optr;
+ u16 hdrflags;
+ u16 tunnel_id, session_id;
+ int length;
+@@ -495,7 +495,7 @@ static int pppol2tp_recv_core(struct soc
+
+ tunnel = pppol2tp_sock_to_tunnel(sock);
+ if (tunnel == NULL)
+- goto error;
++ goto no_tunnel;
+
+ /* UDP always verifies the packet length. */
+ __skb_pull(skb, sizeof(struct udphdr));
+@@ -508,7 +508,7 @@ static int pppol2tp_recv_core(struct soc
+ }
+
+ /* Point to L2TP header */
+- ptr = skb->data;
++ optr = ptr = skb->data;
+
+ /* Get L2TP header flags */
+ hdrflags = ntohs(*(__be16*)ptr);
+@@ -636,12 +636,14 @@ static int pppol2tp_recv_core(struct soc
+ /* If offset bit set, skip it. */
+ if (hdrflags & L2TP_HDRFLAG_O) {
+ offset = ntohs(*(__be16 *)ptr);
+- skb->transport_header += 2 + offset;
+- if (!pskb_may_pull(skb, skb_transport_offset(skb) + 2))
+- goto discard;
++ ptr += 2 + offset;
+ }
+
+- __skb_pull(skb, skb_transport_offset(skb));
++ offset = ptr - optr;
++ if (!pskb_may_pull(skb, offset))
++ goto discard;
++
++ __skb_pull(skb, offset);
+
+ /* Skip PPP header, if present. In testing, Microsoft L2TP clients
+ * don't send the PPP header (PPP header compression enabled), but
+@@ -651,6 +653,9 @@ static int pppol2tp_recv_core(struct soc
+ * Note that skb->data[] isn't dereferenced from a u16 ptr here since
+ * the field may be unaligned.
+ */
++ if (!pskb_may_pull(skb, 2))
++ goto discard;
++
+ if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))
+ skb_pull(skb, 2);
+
+@@ -708,6 +713,10 @@ discard:
+ return 0;
+
+ error:
++ /* Put UDP header back */
++ __skb_push(skb, sizeof(struct udphdr));
++
++no_tunnel:
+ return 1;
+ }
+
+@@ -1049,6 +1058,8 @@ static int pppol2tp_xmit(struct ppp_chan
+ /* Get routing info from the tunnel socket */
+ dst_release(skb->dst);
+ skb->dst = sk_dst_get(sk_tun);
++ skb_orphan(skb);
++ skb->sk = sk_tun;
+
+ /* Queue the packet to IP for output */
+ len = skb->len;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:53 2007
+Message-Id: <20071115060453.055336656@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Hemminger <shemminger@linux-foundation.org>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 09/16] skge: XM PHY handling fixes
+Content-Disposition: inline; filename=skge-xm-phy-poll.patch
+Content-Length: 7517
+Lines: 252
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+patch 501fb72d052d2a302b423bef7dec98d9d98c8a36 in mainline.
+
+Change how PHY is managed on SysKonnect fibre based boards.
+Poll for PHY coming up 1 per second, but use interrupt to detect loss.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/skge.c | 90 ++++++++++++++++++++++++++++-------------------------
+ drivers/net/skge.h | 6 +--
+ 2 files changed, 51 insertions(+), 45 deletions(-)
+
+--- a/drivers/net/skge.c
++++ b/drivers/net/skge.c
+@@ -57,7 +57,7 @@
+ #define TX_WATCHDOG (5 * HZ)
+ #define NAPI_WEIGHT 64
+ #define BLINK_MS 250
+-#define LINK_HZ (HZ/2)
++#define LINK_HZ HZ
+
+ MODULE_DESCRIPTION("SysKonnect Gigabit Ethernet driver");
+ MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
+@@ -992,19 +992,15 @@ static void xm_link_down(struct skge_hw
+ {
+ struct net_device *dev = hw->dev[port];
+ struct skge_port *skge = netdev_priv(dev);
+- u16 cmd, msk;
++ u16 cmd = xm_read16(hw, port, XM_MMU_CMD);
+
+- if (hw->phy_type == SK_PHY_XMAC) {
+- msk = xm_read16(hw, port, XM_IMSK);
+- msk |= XM_IS_INP_ASS | XM_IS_LIPA_RC | XM_IS_RX_PAGE | XM_IS_AND;
+- xm_write16(hw, port, XM_IMSK, msk);
+- }
++ xm_write16(hw, port, XM_IMSK, XM_IMSK_DISABLE);
+
+- cmd = xm_read16(hw, port, XM_MMU_CMD);
+ cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
+ xm_write16(hw, port, XM_MMU_CMD, cmd);
++
+ /* dummy read to ensure writing */
+- (void) xm_read16(hw, port, XM_MMU_CMD);
++ xm_read16(hw, port, XM_MMU_CMD);
+
+ if (netif_carrier_ok(dev))
+ skge_link_down(skge);
+@@ -1100,7 +1096,7 @@ static void genesis_reset(struct skge_hw
+
+ /* reset the statistics module */
+ xm_write32(hw, port, XM_GP_PORT, XM_GP_RES_STAT);
+- xm_write16(hw, port, XM_IMSK, 0xffff); /* disable XMAC IRQs */
++ xm_write16(hw, port, XM_IMSK, XM_IMSK_DISABLE);
+ xm_write32(hw, port, XM_MODE, 0); /* clear Mode Reg */
+ xm_write16(hw, port, XM_TX_CMD, 0); /* reset TX CMD Reg */
+ xm_write16(hw, port, XM_RX_CMD, 0); /* reset RX CMD Reg */
+@@ -1138,7 +1134,7 @@ static void bcom_check_link(struct skge_
+ u16 status;
+
+ /* read twice because of latch */
+- (void) xm_phy_read(hw, port, PHY_BCOM_STAT);
++ xm_phy_read(hw, port, PHY_BCOM_STAT);
+ status = xm_phy_read(hw, port, PHY_BCOM_STAT);
+
+ if ((status & PHY_ST_LSYNC) == 0) {
+@@ -1339,7 +1335,7 @@ static void xm_phy_init(struct skge_port
+ mod_timer(&skge->link_timer, jiffies + LINK_HZ);
+ }
+
+-static void xm_check_link(struct net_device *dev)
++static int xm_check_link(struct net_device *dev)
+ {
+ struct skge_port *skge = netdev_priv(dev);
+ struct skge_hw *hw = skge->hw;
+@@ -1347,25 +1343,25 @@ static void xm_check_link(struct net_dev
+ u16 status;
+
+ /* read twice because of latch */
+- (void) xm_phy_read(hw, port, PHY_XMAC_STAT);
++ xm_phy_read(hw, port, PHY_XMAC_STAT);
+ status = xm_phy_read(hw, port, PHY_XMAC_STAT);
+
+ if ((status & PHY_ST_LSYNC) == 0) {
+ xm_link_down(hw, port);
+- return;
++ return 0;
+ }
+
+ if (skge->autoneg == AUTONEG_ENABLE) {
+ u16 lpa, res;
+
+ if (!(status & PHY_ST_AN_OVER))
+- return;
++ return 0;
+
+ lpa = xm_phy_read(hw, port, PHY_XMAC_AUNE_LP);
+ if (lpa & PHY_B_AN_RF) {
+ printk(KERN_NOTICE PFX "%s: remote fault\n",
+ dev->name);
+- return;
++ return 0;
+ }
+
+ res = xm_phy_read(hw, port, PHY_XMAC_RES_ABI);
+@@ -1381,7 +1377,7 @@ static void xm_check_link(struct net_dev
+ default:
+ printk(KERN_NOTICE PFX "%s: duplex mismatch\n",
+ dev->name);
+- return;
++ return 0;
+ }
+
+ /* We are using IEEE 802.3z/D5.0 Table 37-4 */
+@@ -1405,11 +1401,14 @@ static void xm_check_link(struct net_dev
+
+ if (!netif_carrier_ok(dev))
+ genesis_link_up(skge);
++ return 1;
+ }
+
+ /* Poll to check for link coming up.
++ *
+ * Since internal PHY is wired to a level triggered pin, can't
+- * get an interrupt when carrier is detected.
++ * get an interrupt when carrier is detected, need to poll for
++ * link coming up.
+ */
+ static void xm_link_timer(unsigned long arg)
+ {
+@@ -1417,29 +1416,35 @@ static void xm_link_timer(unsigned long
+ struct net_device *dev = skge->netdev;
+ struct skge_hw *hw = skge->hw;
+ int port = skge->port;
++ int i;
++ unsigned long flags;
+
+ if (!netif_running(dev))
+ return;
+
+- if (netif_carrier_ok(dev)) {
++ spin_lock_irqsave(&hw->phy_lock, flags);
++
++ /*
++ * Verify that the link by checking GPIO register three times.
++ * This pin has the signal from the link_sync pin connected to it.
++ */
++ for (i = 0; i < 3; i++) {
++ if (xm_read16(hw, port, XM_GP_PORT) & XM_GP_INP_ASS)
++ goto link_down;
++ }
++
++ /* Re-enable interrupt to detect link down */
++ if (xm_check_link(dev)) {
++ u16 msk = xm_read16(hw, port, XM_IMSK);
++ msk &= ~XM_IS_INP_ASS;
++ xm_write16(hw, port, XM_IMSK, msk);
+ xm_read16(hw, port, XM_ISRC);
+- if (!(xm_read16(hw, port, XM_ISRC) & XM_IS_INP_ASS))
+- goto nochange;
+ } else {
+- if (xm_read32(hw, port, XM_GP_PORT) & XM_GP_INP_ASS)
+- goto nochange;
+- xm_read16(hw, port, XM_ISRC);
+- if (xm_read16(hw, port, XM_ISRC) & XM_IS_INP_ASS)
+- goto nochange;
++link_down:
++ mod_timer(&skge->link_timer,
++ round_jiffies(jiffies + LINK_HZ));
+ }
+-
+- spin_lock(&hw->phy_lock);
+- xm_check_link(dev);
+- spin_unlock(&hw->phy_lock);
+-
+-nochange:
+- if (netif_running(dev))
+- mod_timer(&skge->link_timer, jiffies + LINK_HZ);
++ spin_unlock_irqrestore(&hw->phy_lock, flags);
+ }
+
+ static void genesis_mac_init(struct skge_hw *hw, int port)
+@@ -1683,14 +1688,16 @@ static void genesis_mac_intr(struct skge
+ printk(KERN_DEBUG PFX "%s: mac interrupt status 0x%x\n",
+ skge->netdev->name, status);
+
+- if (hw->phy_type == SK_PHY_XMAC &&
+- (status & (XM_IS_INP_ASS | XM_IS_LIPA_RC)))
+- xm_link_down(hw, port);
++ if (hw->phy_type == SK_PHY_XMAC && (status & XM_IS_INP_ASS)) {
++ xm_link_down(hw, port);
++ mod_timer(&skge->link_timer, jiffies + 1);
++ }
+
+ if (status & XM_IS_TXF_UR) {
+ xm_write32(hw, port, XM_MODE, XM_MD_FTF);
+ ++skge->net_stats.tx_fifo_errors;
+ }
++
+ if (status & XM_IS_RXF_OV) {
+ xm_write32(hw, port, XM_MODE, XM_MD_FRF);
+ ++skge->net_stats.rx_fifo_errors;
+@@ -1750,11 +1757,12 @@ static void genesis_link_up(struct skge_
+ }
+
+ xm_write32(hw, port, XM_MODE, mode);
+- msk = XM_DEF_MSK;
+- if (hw->phy_type != SK_PHY_XMAC)
+- msk |= XM_IS_INP_ASS; /* disable GP0 interrupt bit */
+
++ /* Turn on detection of Tx underrun, Rx overrun */
++ msk = xm_read16(hw, port, XM_IMSK);
++ msk &= ~(XM_IS_RXF_OV | XM_IS_TXF_UR);
+ xm_write16(hw, port, XM_IMSK, msk);
++
+ xm_read16(hw, port, XM_ISRC);
+
+ /* get MMU Command Reg. */
+@@ -2185,7 +2193,7 @@ static void yukon_mac_intr(struct skge_h
+ u8 status = skge_read8(hw, SK_REG(port, GMAC_IRQ_SRC));
+
+ if (netif_msg_intr(skge))
+- printk(KERN_DEBUG PFX "%s: mac interrupt status 0x%x\n",
++ printk(KERN_DEBUG PFX "%s: yukon mac interrupt status 0x%x\n",
+ dev->name, status);
+
+ if (status & GM_IS_RX_FF_OR) {
+--- a/drivers/net/skge.h
++++ b/drivers/net/skge.h
+@@ -2193,11 +2193,9 @@ enum {
+ XM_IS_TXF_UR = 1<<2, /* Bit 2: Transmit FIFO Underrun */
+ XM_IS_TX_COMP = 1<<1, /* Bit 1: Frame Tx Complete */
+ XM_IS_RX_COMP = 1<<0, /* Bit 0: Frame Rx Complete */
+-};
+-
+-#define XM_DEF_MSK (~(XM_IS_INP_ASS | XM_IS_LIPA_RC | \
+- XM_IS_RXF_OV | XM_IS_TXF_UR))
+
++ XM_IMSK_DISABLE = 0xffff,
++};
+
+ /* XM_HW_CFG 16 bit r/w Hardware Config Register */
+ enum {
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:53 2007
+Message-Id: <20071115060453.220403912@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Hemminger <shemminger@linux-foundation.org>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 10/16] sky2: status ring race fix
+Content-Disposition: inline; filename=sky2-status-race.patch
+Content-Length: 1802
+Lines: 64
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+patch ab5adecb2d02f3688719dfb5936a82833fcc3955 in mainline.
+
+The D-Link PCI-X board (and maybe others) can lie about status
+ring entries. It seems it will update the register for last status
+index before completing the DMA for the ring entry. To avoid reading
+stale data, zap the old entry and check.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -2246,20 +2246,26 @@ static int sky2_status_intr(struct sky2_
+ while (hw->st_idx != hwidx) {
+ struct sky2_port *sky2;
+ struct sky2_status_le *le = hw->st_le + hw->st_idx;
+- unsigned port = le->css & CSS_LINK_BIT;
++ unsigned port;
+ struct net_device *dev;
+ struct sk_buff *skb;
+ u32 status;
+ u16 length;
++ u8 opcode = le->opcode;
++
++ if (!(opcode & HW_OWNER))
++ break;
+
+ hw->st_idx = RING_NEXT(hw->st_idx, STATUS_RING_SIZE);
+
++ port = le->css & CSS_LINK_BIT;
+ dev = hw->dev[port];
+ sky2 = netdev_priv(dev);
+ length = le16_to_cpu(le->length);
+ status = le32_to_cpu(le->status);
+
+- switch (le->opcode & ~HW_OWNER) {
++ le->opcode = 0;
++ switch (opcode & ~HW_OWNER) {
+ case OP_RXSTAT:
+ ++rx[port];
+ skb = sky2_receive(dev, length, status);
+@@ -2352,7 +2358,7 @@ static int sky2_status_intr(struct sky2_
+ default:
+ if (net_ratelimit())
+ printk(KERN_WARNING PFX
+- "unknown status opcode 0x%x\n", le->opcode);
++ "unknown status opcode 0x%x\n", opcode);
+ }
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:53 2007
+Message-Id: <20071115060453.384213884@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Hemminger <shemminger@linux-foundation.org>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 11/16] sky2: ethtool register reserved area blackout
+Content-Disposition: inline; filename=sky2-ethdump.patch
+Content-Length: 3089
+Lines: 104
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+patch 295b54c4902c52cd00d7c837d50a86e39e26caec in mainline.
+
+Make sure and not dump reserved areas of device space.
+Touching some of these causes machine check exceptions on boards
+like D-Link DGE-550SX.
+
+Coding note, used a complex switch statement rather than bitmap
+because it is easier to relate the block values to the documentation
+rather than looking at a encoded bitmask.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/net/sky2.c | 62 +++++++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 53 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -3570,20 +3570,64 @@ static void sky2_get_regs(struct net_dev
+ {
+ const struct sky2_port *sky2 = netdev_priv(dev);
+ const void __iomem *io = sky2->hw->regs;
++ unsigned int b;
+
+ regs->version = 1;
+- memset(p, 0, regs->len);
+
+- memcpy_fromio(p, io, B3_RAM_ADDR);
+-
+- /* skip diagnostic ram region */
+- memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1, 0x2000 - B3_RI_WTO_R1);
++ for (b = 0; b < 128; b++) {
++ /* This complicated switch statement is to make sure and
++ * only access regions that are unreserved.
++ * Some blocks are only valid on dual port cards.
++ * and block 3 has some special diagnostic registers that
++ * are poison.
++ */
++ switch (b) {
++ case 3:
++ /* skip diagnostic ram region */
++ memcpy_fromio(p + 0x10, io + 0x10, 128 - 0x10);
++ break;
+
+- /* copy GMAC registers */
+- memcpy_fromio(p + BASE_GMAC_1, io + BASE_GMAC_1, 0x1000);
+- if (sky2->hw->ports > 1)
+- memcpy_fromio(p + BASE_GMAC_2, io + BASE_GMAC_2, 0x1000);
++ /* dual port cards only */
++ case 5: /* Tx Arbiter 2 */
++ case 9: /* RX2 */
++ case 14 ... 15: /* TX2 */
++ case 17: case 19: /* Ram Buffer 2 */
++ case 22 ... 23: /* Tx Ram Buffer 2 */
++ case 25: /* Rx MAC Fifo 1 */
++ case 27: /* Tx MAC Fifo 2 */
++ case 31: /* GPHY 2 */
++ case 40 ... 47: /* Pattern Ram 2 */
++ case 52: case 54: /* TCP Segmentation 2 */
++ case 112 ... 116: /* GMAC 2 */
++ if (sky2->hw->ports == 1)
++ goto reserved;
++ /* fall through */
++ case 0: /* Control */
++ case 2: /* Mac address */
++ case 4: /* Tx Arbiter 1 */
++ case 7: /* PCI express reg */
++ case 8: /* RX1 */
++ case 12 ... 13: /* TX1 */
++ case 16: case 18:/* Rx Ram Buffer 1 */
++ case 20 ... 21: /* Tx Ram Buffer 1 */
++ case 24: /* Rx MAC Fifo 1 */
++ case 26: /* Tx MAC Fifo 1 */
++ case 28 ... 29: /* Descriptor and status unit */
++ case 30: /* GPHY 1*/
++ case 32 ... 39: /* Pattern Ram 1 */
++ case 48: case 50: /* TCP Segmentation 1 */
++ case 56 ... 60: /* PCI space */
++ case 80 ... 84: /* GMAC 1 */
++ memcpy_fromio(p, io, 128);
++ break;
++ default:
++reserved:
++ memset(p, 0, 128);
++ }
+
++ p += 128;
++ io += 128;
++ }
+ }
+
+ /* In order to do Jumbo packets on these chips, need to turn off the
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:53 2007
+Message-Id: <20071115060453.548951540@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Hemminger <shemminger@linux-foundation.org>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 12/16] sky2: fix power settings on Yukon XL
+Content-Disposition: inline; filename=sky2-phy-power.patch
+Content-Length: 1543
+Lines: 53
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+patch ff35164e72648e0bf0b10ec4410c195e8607e88b in mainline.
+
+Make sure PCI register for PHY power gets set correctly.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/net/sky2.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -603,21 +603,22 @@ static void sky2_phy_init(struct sky2_hw
+ static void sky2_phy_power(struct sky2_hw *hw, unsigned port, int onoff)
+ {
+ u32 reg1;
+- static const u32 phy_power[]
+- = { PCI_Y2_PHY1_POWD, PCI_Y2_PHY2_POWD };
+-
+- /* looks like this XL is back asswards .. */
+- if (hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
+- onoff = !onoff;
++ static const u32 phy_power[] = { PCI_Y2_PHY1_POWD, PCI_Y2_PHY2_POWD };
++ static const u32 coma_mode[] = { PCI_Y2_PHY1_COMA, PCI_Y2_PHY2_COMA };
+
+ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
+ reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
++
+ if (onoff)
+ /* Turn off phy power saving */
+ reg1 &= ~phy_power[port];
+ else
+ reg1 |= phy_power[port];
+
++ if (onoff && hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
++ reg1 |= coma_mode[port];
++
++
+ sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+ sky2_pci_read32(hw, PCI_DEV_REG1);
+ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:53 2007
+Message-Id: <20071115060453.704698156@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 13/16] zd1201: avoid null ptr access of skb->dev
+Content-Disposition: inline; filename=zd1201-avoid-null-ptr-access-of-skb-dev.patch
+Content-Length: 1292
+Lines: 43
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: John W. Linville <linville@tuxdriver.com>
+
+patch 3ba72b25211217de195e3f528dd36132b38a205b in mainline.
+
+skb->dev is not set until eth_type_trans is called...
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/zd1201.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/zd1201.c
++++ b/drivers/net/wireless/zd1201.c
+@@ -327,8 +327,8 @@ static void zd1201_usbrx(struct urb *urb
+ memcpy(skb_put(skb, 6), &data[datalen-8], 6);
+ memcpy(skb_put(skb, 2), &data[datalen-24], 2);
+ memcpy(skb_put(skb, len), data, len);
+- skb->dev->last_rx = jiffies;
+ skb->protocol = eth_type_trans(skb, zd->dev);
++ skb->dev->last_rx = jiffies;
+ zd->stats.rx_packets++;
+ zd->stats.rx_bytes += skb->len;
+ netif_rx(skb);
+@@ -384,8 +384,8 @@ static void zd1201_usbrx(struct urb *urb
+ memcpy(skb_put(skb, 2), &data[6], 2);
+ memcpy(skb_put(skb, len), data+8, len);
+ }
+- skb->dev->last_rx = jiffies;
+ skb->protocol = eth_type_trans(skb, zd->dev);
++ skb->dev->last_rx = jiffies;
+ zd->stats.rx_packets++;
+ zd->stats.rx_bytes += skb->len;
+ netif_rx(skb);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:54 2007
+Message-Id: <20071115060453.860504909@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dan Williams <dcbw@redhat.com>,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 14/16] ipw2100: send WEXT scan events
+Content-Disposition: inline; filename=ipw2100-send-wext-scan-events.patch
+Content-Length: 3618
+Lines: 114
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dcbw@redhat.com>
+
+patch d20c678a450a25c1c12925f60c1b4cc040acc17d in mainline
+
+ipw2100 wasn't sending WEXT scan events at all on scan completion. And
+like ipw2200, the driver aggressively auto-scans, requiring
+non-user-requested scan events to be batched together and sent at
+specific intervals instead of many times per seconds.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ipw2100.c | 39 +++++++++++++++++++++++++++++++++++++++
+ drivers/net/wireless/ipw2100.h | 4 ++++
+ 2 files changed, 43 insertions(+)
+
+--- a/drivers/net/wireless/ipw2100.c
++++ b/drivers/net/wireless/ipw2100.c
+@@ -2102,12 +2102,46 @@ static void isr_indicate_rf_kill(struct
+ queue_delayed_work(priv->workqueue, &priv->rf_kill, round_jiffies(HZ));
+ }
+
++static void send_scan_event(void *data)
++{
++ struct ipw2100_priv *priv = data;
++ union iwreq_data wrqu;
++
++ wrqu.data.length = 0;
++ wrqu.data.flags = 0;
++ wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
++}
++
++static void ipw2100_scan_event_later(struct work_struct *work)
++{
++ send_scan_event(container_of(work, struct ipw2100_priv,
++ scan_event_later.work));
++}
++
++static void ipw2100_scan_event_now(struct work_struct *work)
++{
++ send_scan_event(container_of(work, struct ipw2100_priv,
++ scan_event_now));
++}
++
+ static void isr_scan_complete(struct ipw2100_priv *priv, u32 status)
+ {
+ IPW_DEBUG_SCAN("scan complete\n");
+ /* Age the scan results... */
+ priv->ieee->scans++;
+ priv->status &= ~STATUS_SCANNING;
++
++ /* Only userspace-requested scan completion events go out immediately */
++ if (!priv->user_requested_scan) {
++ if (!delayed_work_pending(&priv->scan_event_later))
++ queue_delayed_work(priv->workqueue,
++ &priv->scan_event_later,
++ round_jiffies(msecs_to_jiffies(4000)));
++ } else {
++ priv->user_requested_scan = 0;
++ cancel_delayed_work(&priv->scan_event_later);
++ queue_work(priv->workqueue, &priv->scan_event_now);
++ }
+ }
+
+ #ifdef CONFIG_IPW2100_DEBUG
+@@ -4376,6 +4410,7 @@ static void ipw2100_kill_workqueue(struc
+ cancel_delayed_work(&priv->wx_event_work);
+ cancel_delayed_work(&priv->hang_check);
+ cancel_delayed_work(&priv->rf_kill);
++ cancel_delayed_work(&priv->scan_event_later);
+ destroy_workqueue(priv->workqueue);
+ priv->workqueue = NULL;
+ }
+@@ -6118,6 +6153,8 @@ static struct net_device *ipw2100_alloc_
+ INIT_DELAYED_WORK(&priv->wx_event_work, ipw2100_wx_event_work);
+ INIT_DELAYED_WORK(&priv->hang_check, ipw2100_hang_check);
+ INIT_DELAYED_WORK(&priv->rf_kill, ipw2100_rf_kill);
++ INIT_WORK(&priv->scan_event_now, ipw2100_scan_event_now);
++ INIT_DELAYED_WORK(&priv->scan_event_later, ipw2100_scan_event_later);
+
+ tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
+ ipw2100_irq_tasklet, (unsigned long)priv);
+@@ -7427,6 +7464,8 @@ static int ipw2100_wx_set_scan(struct ne
+ }
+
+ IPW_DEBUG_WX("Initiating scan...\n");
++
++ priv->user_requested_scan = 1;
+ if (ipw2100_set_scan_options(priv) || ipw2100_start_scan(priv)) {
+ IPW_DEBUG_WX("Start scan failed.\n");
+
+--- a/drivers/net/wireless/ipw2100.h
++++ b/drivers/net/wireless/ipw2100.h
+@@ -588,6 +588,10 @@ struct ipw2100_priv {
+ struct delayed_work wx_event_work;
+ struct delayed_work hang_check;
+ struct delayed_work rf_kill;
++ struct work_struct scan_event_now;
++ struct delayed_work scan_event_later;
++
++ int user_requested_scan;
+
+ u32 interrupts;
+ int tx_interrupts;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:54 2007
+Message-Id: <20071115060454.029257620@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Wu <flamingice@sourmilk.net>,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 15/16] rtl8187: Fix more frag bit checking, rts duration calc
+Content-Disposition: inline; filename=rtl8187-fix-more-frag-bit-checking-rts-duration-calc.patch
+Content-Length: 2489
+Lines: 78
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Wu <flamingice@sourmilk.net>
+
+patch 98798f4875b7149db4eb7d0a126fc6dcd9637821 in mainline.
+
+The wrong pointer is passed to ieee80211_get_morefrag. Fix this.
+
+While we're at it, reorder things so they look better and the rts duration
+calculation is done with the right length.
+
+Thanks to Christoph Hellwig for finding the ieee80211_get_morefrag issue.
+
+Signed-off-by: Michael Wu <flamingice@sourmilk.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtl8187_dev.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/rtl8187_dev.c
++++ b/drivers/net/wireless/rtl8187_dev.c
+@@ -78,7 +78,8 @@ static int rtl8187_tx(struct ieee80211_h
+ struct rtl8187_tx_hdr *hdr;
+ struct rtl8187_tx_info *info;
+ struct urb *urb;
+- u32 tmp;
++ __le16 rts_dur = 0;
++ u32 flags;
+
+ urb = usb_alloc_urb(0, GFP_ATOMIC);
+ if (!urb) {
+@@ -86,24 +87,24 @@ static int rtl8187_tx(struct ieee80211_h
+ return 0;
+ }
+
+- hdr = (struct rtl8187_tx_hdr *)skb_push(skb, sizeof(*hdr));
+- tmp = skb->len - sizeof(*hdr);
+- tmp |= RTL8187_TX_FLAG_NO_ENCRYPT;
+- tmp |= control->rts_cts_rate << 19;
+- tmp |= control->tx_rate << 24;
+- if (ieee80211_get_morefrag((struct ieee80211_hdr *)skb))
+- tmp |= RTL8187_TX_FLAG_MORE_FRAG;
++ flags = skb->len;
++ flags |= RTL8187_TX_FLAG_NO_ENCRYPT;
++ flags |= control->rts_cts_rate << 19;
++ flags |= control->tx_rate << 24;
++ if (ieee80211_get_morefrag((struct ieee80211_hdr *)skb->data))
++ flags |= RTL8187_TX_FLAG_MORE_FRAG;
+ if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS) {
+- tmp |= RTL8187_TX_FLAG_RTS;
+- hdr->rts_duration =
+- ieee80211_rts_duration(dev, skb->len, control);
++ flags |= RTL8187_TX_FLAG_RTS;
++ rts_dur = ieee80211_rts_duration(dev, skb->len, control);
+ }
+ if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
+- tmp |= RTL8187_TX_FLAG_CTS;
+- hdr->flags = cpu_to_le32(tmp);
++ flags |= RTL8187_TX_FLAG_CTS;
++
++ hdr = (struct rtl8187_tx_hdr *)skb_push(skb, sizeof(*hdr));
++ hdr->flags = cpu_to_le32(flags);
+ hdr->len = 0;
+- tmp = control->retry_limit << 8;
+- hdr->retry = cpu_to_le32(tmp);
++ hdr->rts_duration = rts_dur;
++ hdr->retry = cpu_to_le32(control->retry_limit << 8);
+
+ info = (struct rtl8187_tx_info *)skb->cb;
+ info->control = kmemdup(control, sizeof(*control), GFP_ATOMIC);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:54 2007
+Message-Id: <20071115060454.189053235@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Marc Pignat <marc.pignat@hevs.ch>,
+ Daniel Drake <dsd@gentoo.org>
+Subject: [patch 16/16] zd1211rw, fix oops when ejecting install media
+Content-Disposition: inline; filename=zd1211rw-fix-oops-when-ejecting-install-media.patch
+Content-Length: 1279
+Lines: 46
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Marc Pignat <marc.pignat@hevs.ch>
+
+patch e0579d576cb894a4cf3c5af04fbf38e8c1281738 in mainline.
+
+The disconnect function can dereference the net_device structure when it
+is never allocated. This is the case when ejecting the device installer.
+
+Signed-off-by: Marc Pignat <marc.pignat@hevs.ch>
+Acked-by: Daniel Drake <dsd@gentoo.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/zd1211rw/zd_usb.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zd1211rw/zd_usb.c
+@@ -1041,14 +1041,17 @@ error:
+ static void disconnect(struct usb_interface *intf)
+ {
+ struct net_device *netdev = zd_intf_to_netdev(intf);
+- struct zd_mac *mac = zd_netdev_mac(netdev);
+- struct zd_usb *usb = &mac->chip.usb;
++ struct zd_mac *mac;
++ struct zd_usb *usb;
+
+ /* Either something really bad happened, or we're just dealing with
+ * a DEVICE_INSTALLER. */
+ if (netdev == NULL)
+ return;
+
++ mac = zd_netdev_mac(netdev);
++ usb = &mac->chip.usb;
++
+ dev_dbg_f(zd_usb_dev(usb), "\n");
+
+ zd_netdev_disconnect(netdev);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:52 2007
+Message-Id: <20071115060451.944780344@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:03:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Al Viro <viro@zeniv.linux.org.uk>,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Al Viro <viro@ftp.linux.org.uk>,
+ Dan Williams <dcbw@redhat.com>
+Subject: [patch 02/16] libertas: fix endianness breakage
+Content-Disposition: inline; filename=libertas-fix-endianness-breakage.patch
+Content-Length: 1139
+Lines: 41
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Al Viro <viro@ftp.linux.org.uk>
+
+patch 5707708111ca6c4e9a1160acffdc98a98d95e462 in mainline.
+
+ wep->keytype[] is u8
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/cmd.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/libertas/cmd.c
++++ b/drivers/net/wireless/libertas/cmd.c
+@@ -185,14 +185,12 @@ static int wlan_cmd_802_11_set_wep(wlan_
+
+ switch (pkey->len) {
+ case KEY_LEN_WEP_40:
+- wep->keytype[i] =
+- cpu_to_le16(cmd_type_wep_40_bit);
++ wep->keytype[i] = cmd_type_wep_40_bit;
+ memmove(&wep->keymaterial[i], pkey->key,
+ pkey->len);
+ break;
+ case KEY_LEN_WEP_104:
+- wep->keytype[i] =
+- cpu_to_le16(cmd_type_wep_104_bit);
++ wep->keytype[i] = cmd_type_wep_104_bit;
+ memmove(&wep->keymaterial[i], pkey->key,
+ pkey->len);
+ break;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:04:53 2007
+Message-Id: <20071115060452.901465734@mini.kroah.org>
+References: <20071115060353.071060513@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:04:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Hemminger <shemminger@linux-foundation.org>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 08/16] skge: fix ram buffer size calculation
+Content-Disposition: inline; filename=skge-ram-buffer-fix.patch
+Content-Length: 3844
+Lines: 121
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+patch 7fb7ac241162dc51ec0f7644d4a97b2855213c32 in mainline.
+
+This fixes problems with transmit hangs on older fiber based SysKonnect boards.
+
+Adjust ram buffer sizing calculation to make it correct on all boards
+and make it like the code in sky2 driver.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+
+---
+ drivers/net/skge.c | 51 ++++++++++++++++++++++++---------------------------
+ 1 file changed, 24 insertions(+), 27 deletions(-)
+
+--- a/drivers/net/skge.c
++++ b/drivers/net/skge.c
+@@ -2400,32 +2400,31 @@ static int skge_ioctl(struct net_device
+ return err;
+ }
+
+-static void skge_ramset(struct skge_hw *hw, u16 q, u32 start, size_t len)
++/* Assign Ram Buffer allocation to queue */
++static void skge_ramset(struct skge_hw *hw, u16 q, u32 start, u32 space)
+ {
+ u32 end;
+
+- start /= 8;
+- len /= 8;
+- end = start + len - 1;
++ /* convert from K bytes to qwords used for hw register */
++ start *= 1024/8;
++ space *= 1024/8;
++ end = start + space - 1;
+
+ skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_RST_CLR);
+ skge_write32(hw, RB_ADDR(q, RB_START), start);
++ skge_write32(hw, RB_ADDR(q, RB_END), end);
+ skge_write32(hw, RB_ADDR(q, RB_WP), start);
+ skge_write32(hw, RB_ADDR(q, RB_RP), start);
+- skge_write32(hw, RB_ADDR(q, RB_END), end);
+
+ if (q == Q_R1 || q == Q_R2) {
++ u32 tp = space - space/4;
++
+ /* Set thresholds on receive queue's */
+- skge_write32(hw, RB_ADDR(q, RB_RX_UTPP),
+- start + (2*len)/3);
+- skge_write32(hw, RB_ADDR(q, RB_RX_LTPP),
+- start + (len/3));
+- } else {
+- /* Enable store & forward on Tx queue's because
+- * Tx FIFO is only 4K on Genesis and 1K on Yukon
+- */
++ skge_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp);
++ skge_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4);
++ } else if (hw->chip_id != CHIP_ID_GENESIS)
++ /* Genesis Tx Fifo is too small for normal store/forward */
+ skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_ENA_STFWD);
+- }
+
+ skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_ENA_OP_MD);
+ }
+@@ -2453,7 +2452,7 @@ static int skge_up(struct net_device *de
+ struct skge_port *skge = netdev_priv(dev);
+ struct skge_hw *hw = skge->hw;
+ int port = skge->port;
+- u32 chunk, ram_addr;
++ u32 ramaddr, ramsize, rxspace;
+ size_t rx_size, tx_size;
+ int err;
+
+@@ -2508,14 +2507,15 @@ static int skge_up(struct net_device *de
+ spin_unlock_bh(&hw->phy_lock);
+
+ /* Configure RAMbuffers */
+- chunk = hw->ram_size / ((hw->ports + 1)*2);
+- ram_addr = hw->ram_offset + 2 * chunk * port;
++ ramsize = (hw->ram_size - hw->ram_offset) / hw->ports;
++ ramaddr = hw->ram_offset + port * ramsize;
++ rxspace = 8 + (2*(ramsize - 16))/3;
+
+- skge_ramset(hw, rxqaddr[port], ram_addr, chunk);
+- skge_qset(skge, rxqaddr[port], skge->rx_ring.to_clean);
++ skge_ramset(hw, rxqaddr[port], ramaddr, rxspace);
++ skge_ramset(hw, txqaddr[port], ramaddr + rxspace, ramsize - rxspace);
+
++ skge_qset(skge, rxqaddr[port], skge->rx_ring.to_clean);
+ BUG_ON(skge->tx_ring.to_use != skge->tx_ring.to_clean);
+- skge_ramset(hw, txqaddr[port], ram_addr+chunk, chunk);
+ skge_qset(skge, txqaddr[port], skge->tx_ring.to_use);
+
+ /* Start receiver BMU */
+@@ -3450,15 +3450,12 @@ static int skge_reset(struct skge_hw *hw
+ if (hw->chip_id == CHIP_ID_GENESIS) {
+ if (t8 == 3) {
+ /* special case: 4 x 64k x 36, offset = 0x80000 */
+- hw->ram_size = 0x100000;
+- hw->ram_offset = 0x80000;
++ hw->ram_size = 1024;
++ hw->ram_offset = 512;
+ } else
+ hw->ram_size = t8 * 512;
+- }
+- else if (t8 == 0)
+- hw->ram_size = 0x20000;
+- else
+- hw->ram_size = t8 * 4096;
++ } else /* Yukon */
++ hw->ram_size = t8 ? t8 * 4 : 128;
+
+ hw->intr_mask = IS_HW_ERR;
+
+
+--
+
--- /dev/null
+diff --git a/drivers/net/ehea/ehea_qmr.c b/drivers/net/ehea/ehea_qmr.c
+index c82e245..329a252 100644
+--- a/drivers/net/ehea/ehea_qmr.c
++++ b/drivers/net/ehea/ehea_qmr.c
+@@ -563,8 +563,7 @@ int ehea_destroy_qp(struct ehea_qp *qp)
+ int ehea_create_busmap( void )
+ {
+ u64 vaddr = EHEA_BUSMAP_START;
+- unsigned long abs_max_pfn = 0;
+- unsigned long sec_max_pfn;
++ unsigned long high_section_index = 0;
+ int i;
+
+ /*
+@@ -574,14 +573,10 @@ int ehea_create_busmap( void )
+ ehea_bmap.valid_sections = 0;
+
+ for (i = 0; i < NR_MEM_SECTIONS; i++)
+- if (valid_section_nr(i)) {
+- sec_max_pfn = section_nr_to_pfn(i);
+- if (sec_max_pfn > abs_max_pfn)
+- abs_max_pfn = sec_max_pfn;
+- ehea_bmap.valid_sections++;
+- }
++ if (valid_section_nr(i))
++ high_section_index = i;
+
+- ehea_bmap.entries = abs_max_pfn / EHEA_PAGES_PER_SECTION + 1;
++ ehea_bmap.entries = high_section_index + 1;
+ ehea_bmap.vaddr = vmalloc(ehea_bmap.entries * sizeof(*ehea_bmap.vaddr));
+
+ if (!ehea_bmap.vaddr)
+@@ -593,6 +588,7 @@ int ehea_create_busmap( void )
+ if (pfn_valid(pfn)) {
+ ehea_bmap.vaddr[i] = vaddr;
+ vaddr += EHEA_SECTSIZE;
++ ehea_bmap.valid_sections++;
+ } else
+ ehea_bmap.vaddr[i] = 0;
+ }
+@@ -637,7 +633,7 @@ int ehea_reg_kernel_mr(struct ehea_adapter *adapter, struct ehea_mr *mr)
+
+ mr_len = ehea_bmap.valid_sections * EHEA_SECTSIZE;
+
+- pt = kzalloc(EHEA_MAX_RPAGE * sizeof(u64), GFP_KERNEL);
++ pt = kzalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!pt) {
+ ehea_error("no mem");
+ ret = -ENOMEM;
+@@ -660,8 +656,8 @@ int ehea_reg_kernel_mr(struct ehea_adapter *adapter, struct ehea_mr *mr)
+ void *sectbase = __va(i << SECTION_SIZE_BITS);
+ unsigned long k = 0;
+
+- for (j = 0; j < (PAGES_PER_SECTION / EHEA_MAX_RPAGE);
+- j++) {
++ for (j = 0; j < (EHEA_PAGES_PER_SECTION /
++ EHEA_MAX_RPAGE); j++) {
+
+ for (m = 0; m < EHEA_MAX_RPAGE; m++) {
+ pg = sectbase + ((k++) * EHEA_PAGESIZE);
+diff --git a/drivers/net/ehea/ehea_qmr.h b/drivers/net/ehea/ehea_qmr.h
+index b71f845..352cb38 100644
+--- a/drivers/net/ehea/ehea_qmr.h
++++ b/drivers/net/ehea/ehea_qmr.h
+@@ -39,7 +39,7 @@
+ #define EHEA_PAGESHIFT 12
+ #define EHEA_PAGESIZE (1UL << EHEA_PAGESHIFT)
+ #define EHEA_SECTSIZE (1UL << 24)
+-#define EHEA_PAGES_PER_SECTION (EHEA_SECTSIZE >> PAGE_SHIFT)
++#define EHEA_PAGES_PER_SECTION (EHEA_SECTSIZE >> EHEA_PAGESHIFT)
+
+ #if (1UL << SECTION_SIZE_BITS) < EHEA_SECTSIZE
+ #error eHEA module can't work if kernel sectionsize < ehea sectionsize
+diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
+index 1938d6d..d68796e 100644
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -988,7 +988,7 @@ static void nv_enable_irq(struct net_device *dev)
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq(dev->irq);
++ enable_irq(np->pci_dev->irq);
+ } else {
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+@@ -1004,7 +1004,7 @@ static void nv_disable_irq(struct net_device *dev)
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq(dev->irq);
++ disable_irq(np->pci_dev->irq);
+ } else {
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+@@ -1601,7 +1601,7 @@ static void nv_do_rx_refill(unsigned long data)
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq(dev->irq);
++ disable_irq(np->pci_dev->irq);
+ } else {
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ }
+@@ -1619,7 +1619,7 @@ static void nv_do_rx_refill(unsigned long data)
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq(dev->irq);
++ enable_irq(np->pci_dev->irq);
+ } else {
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ }
+@@ -3557,10 +3557,12 @@ static int nv_request_irq(struct net_device *dev, int intr_test)
+ if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
+ if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
+ np->msi_flags |= NV_MSI_ENABLED;
++ dev->irq = np->pci_dev->irq;
+ if (request_irq(np->pci_dev->irq, handler, IRQF_SHARED, dev->name, dev) != 0) {
+ printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+ pci_disable_msi(np->pci_dev);
+ np->msi_flags &= ~NV_MSI_ENABLED;
++ dev->irq = np->pci_dev->irq;
+ goto out_err;
+ }
+
+@@ -3623,7 +3625,7 @@ static void nv_do_nic_poll(unsigned long data)
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq_lockdep(dev->irq);
++ disable_irq_lockdep(np->pci_dev->irq);
+ mask = np->irqmask;
+ } else {
+ if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+@@ -3641,6 +3643,8 @@ static void nv_do_nic_poll(unsigned long data)
+ }
+ np->nic_poll_irq = 0;
+
++ /* disable_irq() contains synchronize_irq, thus no irq handler can run now */
++
+ if (np->recover_error) {
+ np->recover_error = 0;
+ printk(KERN_INFO "forcedeth: MAC in recoverable error state\n");
+@@ -3677,7 +3681,6 @@ static void nv_do_nic_poll(unsigned long data)
+ }
+ }
+
+- /* FIXME: Do we need synchronize_irq(dev->irq) here? */
+
+ writel(mask, base + NvRegIrqMask);
+ pci_push(base);
+@@ -3690,7 +3693,7 @@ static void nv_do_nic_poll(unsigned long data)
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq_lockdep(dev->irq);
++ enable_irq_lockdep(np->pci_dev->irq);
+ } else {
+ if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+ nv_nic_irq_rx(0, dev);
+@@ -4943,7 +4946,7 @@ static int nv_close(struct net_device *dev)
+ np->in_shutdown = 1;
+ spin_unlock_irq(&np->lock);
+ netif_poll_disable(dev);
+- synchronize_irq(dev->irq);
++ synchronize_irq(np->pci_dev->irq);
+
+ del_timer_sync(&np->oom_kick);
+ del_timer_sync(&np->nic_poll);
+@@ -5563,6 +5566,22 @@ static struct pci_device_id pci_tbl[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_31),
+ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
+ },
++ { /* MCP77 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_32),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP77 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_33),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP77 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_34),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP77 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_35),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
+ {0,},
+ };
+
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index abe91cb..7da0d07 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -487,7 +487,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
+ {
+ struct pppol2tp_session *session = NULL;
+ struct pppol2tp_tunnel *tunnel;
+- unsigned char *ptr;
++ unsigned char *ptr, *optr;
+ u16 hdrflags;
+ u16 tunnel_id, session_id;
+ int length;
+@@ -495,7 +495,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
+
+ tunnel = pppol2tp_sock_to_tunnel(sock);
+ if (tunnel == NULL)
+- goto error;
++ goto no_tunnel;
+
+ /* UDP always verifies the packet length. */
+ __skb_pull(skb, sizeof(struct udphdr));
+@@ -508,7 +508,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
+ }
+
+ /* Point to L2TP header */
+- ptr = skb->data;
++ optr = ptr = skb->data;
+
+ /* Get L2TP header flags */
+ hdrflags = ntohs(*(__be16*)ptr);
+@@ -636,12 +636,14 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
+ /* If offset bit set, skip it. */
+ if (hdrflags & L2TP_HDRFLAG_O) {
+ offset = ntohs(*(__be16 *)ptr);
+- skb->transport_header += 2 + offset;
+- if (!pskb_may_pull(skb, skb_transport_offset(skb) + 2))
+- goto discard;
++ ptr += 2 + offset;
+ }
+
+- __skb_pull(skb, skb_transport_offset(skb));
++ offset = ptr - optr;
++ if (!pskb_may_pull(skb, offset))
++ goto discard;
++
++ __skb_pull(skb, offset);
+
+ /* Skip PPP header, if present. In testing, Microsoft L2TP clients
+ * don't send the PPP header (PPP header compression enabled), but
+@@ -651,6 +653,9 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
+ * Note that skb->data[] isn't dereferenced from a u16 ptr here since
+ * the field may be unaligned.
+ */
++ if (!pskb_may_pull(skb, 2))
++ goto discard;
++
+ if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))
+ skb_pull(skb, 2);
+
+@@ -708,6 +713,10 @@ discard:
+ return 0;
+
+ error:
++ /* Put UDP header back */
++ __skb_push(skb, sizeof(struct udphdr));
++
++no_tunnel:
+ return 1;
+ }
+
+@@ -1049,6 +1058,8 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ /* Get routing info from the tunnel socket */
+ dst_release(skb->dst);
+ skb->dst = sk_dst_get(sk_tun);
++ skb_orphan(skb);
++ skb->sk = sk_tun;
+
+ /* Queue the packet to IP for output */
+ len = skb->len;
+diff --git a/drivers/net/skge.c b/drivers/net/skge.c
+index e3d8520..f497a5b 100644
+--- a/drivers/net/skge.c
++++ b/drivers/net/skge.c
+@@ -57,7 +57,7 @@
+ #define TX_WATCHDOG (5 * HZ)
+ #define NAPI_WEIGHT 64
+ #define BLINK_MS 250
+-#define LINK_HZ (HZ/2)
++#define LINK_HZ HZ
+
+ MODULE_DESCRIPTION("SysKonnect Gigabit Ethernet driver");
+ MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
+@@ -992,19 +992,15 @@ static void xm_link_down(struct skge_hw *hw, int port)
+ {
+ struct net_device *dev = hw->dev[port];
+ struct skge_port *skge = netdev_priv(dev);
+- u16 cmd, msk;
++ u16 cmd = xm_read16(hw, port, XM_MMU_CMD);
+
+- if (hw->phy_type == SK_PHY_XMAC) {
+- msk = xm_read16(hw, port, XM_IMSK);
+- msk |= XM_IS_INP_ASS | XM_IS_LIPA_RC | XM_IS_RX_PAGE | XM_IS_AND;
+- xm_write16(hw, port, XM_IMSK, msk);
+- }
++ xm_write16(hw, port, XM_IMSK, XM_IMSK_DISABLE);
+
+- cmd = xm_read16(hw, port, XM_MMU_CMD);
+ cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
+ xm_write16(hw, port, XM_MMU_CMD, cmd);
++
+ /* dummy read to ensure writing */
+- (void) xm_read16(hw, port, XM_MMU_CMD);
++ xm_read16(hw, port, XM_MMU_CMD);
+
+ if (netif_carrier_ok(dev))
+ skge_link_down(skge);
+@@ -1100,7 +1096,7 @@ static void genesis_reset(struct skge_hw *hw, int port)
+
+ /* reset the statistics module */
+ xm_write32(hw, port, XM_GP_PORT, XM_GP_RES_STAT);
+- xm_write16(hw, port, XM_IMSK, 0xffff); /* disable XMAC IRQs */
++ xm_write16(hw, port, XM_IMSK, XM_IMSK_DISABLE);
+ xm_write32(hw, port, XM_MODE, 0); /* clear Mode Reg */
+ xm_write16(hw, port, XM_TX_CMD, 0); /* reset TX CMD Reg */
+ xm_write16(hw, port, XM_RX_CMD, 0); /* reset RX CMD Reg */
+@@ -1138,7 +1134,7 @@ static void bcom_check_link(struct skge_hw *hw, int port)
+ u16 status;
+
+ /* read twice because of latch */
+- (void) xm_phy_read(hw, port, PHY_BCOM_STAT);
++ xm_phy_read(hw, port, PHY_BCOM_STAT);
+ status = xm_phy_read(hw, port, PHY_BCOM_STAT);
+
+ if ((status & PHY_ST_LSYNC) == 0) {
+@@ -1339,7 +1335,7 @@ static void xm_phy_init(struct skge_port *skge)
+ mod_timer(&skge->link_timer, jiffies + LINK_HZ);
+ }
+
+-static void xm_check_link(struct net_device *dev)
++static int xm_check_link(struct net_device *dev)
+ {
+ struct skge_port *skge = netdev_priv(dev);
+ struct skge_hw *hw = skge->hw;
+@@ -1347,25 +1343,25 @@ static void xm_check_link(struct net_device *dev)
+ u16 status;
+
+ /* read twice because of latch */
+- (void) xm_phy_read(hw, port, PHY_XMAC_STAT);
++ xm_phy_read(hw, port, PHY_XMAC_STAT);
+ status = xm_phy_read(hw, port, PHY_XMAC_STAT);
+
+ if ((status & PHY_ST_LSYNC) == 0) {
+ xm_link_down(hw, port);
+- return;
++ return 0;
+ }
+
+ if (skge->autoneg == AUTONEG_ENABLE) {
+ u16 lpa, res;
+
+ if (!(status & PHY_ST_AN_OVER))
+- return;
++ return 0;
+
+ lpa = xm_phy_read(hw, port, PHY_XMAC_AUNE_LP);
+ if (lpa & PHY_B_AN_RF) {
+ printk(KERN_NOTICE PFX "%s: remote fault\n",
+ dev->name);
+- return;
++ return 0;
+ }
+
+ res = xm_phy_read(hw, port, PHY_XMAC_RES_ABI);
+@@ -1381,7 +1377,7 @@ static void xm_check_link(struct net_device *dev)
+ default:
+ printk(KERN_NOTICE PFX "%s: duplex mismatch\n",
+ dev->name);
+- return;
++ return 0;
+ }
+
+ /* We are using IEEE 802.3z/D5.0 Table 37-4 */
+@@ -1405,11 +1401,14 @@ static void xm_check_link(struct net_device *dev)
+
+ if (!netif_carrier_ok(dev))
+ genesis_link_up(skge);
++ return 1;
+ }
+
+ /* Poll to check for link coming up.
++ *
+ * Since internal PHY is wired to a level triggered pin, can't
+- * get an interrupt when carrier is detected.
++ * get an interrupt when carrier is detected, need to poll for
++ * link coming up.
+ */
+ static void xm_link_timer(unsigned long arg)
+ {
+@@ -1417,29 +1416,35 @@ static void xm_link_timer(unsigned long arg)
+ struct net_device *dev = skge->netdev;
+ struct skge_hw *hw = skge->hw;
+ int port = skge->port;
++ int i;
++ unsigned long flags;
+
+ if (!netif_running(dev))
+ return;
+
+- if (netif_carrier_ok(dev)) {
++ spin_lock_irqsave(&hw->phy_lock, flags);
++
++ /*
++ * Verify that the link by checking GPIO register three times.
++ * This pin has the signal from the link_sync pin connected to it.
++ */
++ for (i = 0; i < 3; i++) {
++ if (xm_read16(hw, port, XM_GP_PORT) & XM_GP_INP_ASS)
++ goto link_down;
++ }
++
++ /* Re-enable interrupt to detect link down */
++ if (xm_check_link(dev)) {
++ u16 msk = xm_read16(hw, port, XM_IMSK);
++ msk &= ~XM_IS_INP_ASS;
++ xm_write16(hw, port, XM_IMSK, msk);
+ xm_read16(hw, port, XM_ISRC);
+- if (!(xm_read16(hw, port, XM_ISRC) & XM_IS_INP_ASS))
+- goto nochange;
+ } else {
+- if (xm_read32(hw, port, XM_GP_PORT) & XM_GP_INP_ASS)
+- goto nochange;
+- xm_read16(hw, port, XM_ISRC);
+- if (xm_read16(hw, port, XM_ISRC) & XM_IS_INP_ASS)
+- goto nochange;
++link_down:
++ mod_timer(&skge->link_timer,
++ round_jiffies(jiffies + LINK_HZ));
+ }
+-
+- spin_lock(&hw->phy_lock);
+- xm_check_link(dev);
+- spin_unlock(&hw->phy_lock);
+-
+-nochange:
+- if (netif_running(dev))
+- mod_timer(&skge->link_timer, jiffies + LINK_HZ);
++ spin_unlock_irqrestore(&hw->phy_lock, flags);
+ }
+
+ static void genesis_mac_init(struct skge_hw *hw, int port)
+@@ -1683,14 +1688,16 @@ static void genesis_mac_intr(struct skge_hw *hw, int port)
+ printk(KERN_DEBUG PFX "%s: mac interrupt status 0x%x\n",
+ skge->netdev->name, status);
+
+- if (hw->phy_type == SK_PHY_XMAC &&
+- (status & (XM_IS_INP_ASS | XM_IS_LIPA_RC)))
+- xm_link_down(hw, port);
++ if (hw->phy_type == SK_PHY_XMAC && (status & XM_IS_INP_ASS)) {
++ xm_link_down(hw, port);
++ mod_timer(&skge->link_timer, jiffies + 1);
++ }
+
+ if (status & XM_IS_TXF_UR) {
+ xm_write32(hw, port, XM_MODE, XM_MD_FTF);
+ ++skge->net_stats.tx_fifo_errors;
+ }
++
+ if (status & XM_IS_RXF_OV) {
+ xm_write32(hw, port, XM_MODE, XM_MD_FRF);
+ ++skge->net_stats.rx_fifo_errors;
+@@ -1750,11 +1757,12 @@ static void genesis_link_up(struct skge_port *skge)
+ }
+
+ xm_write32(hw, port, XM_MODE, mode);
+- msk = XM_DEF_MSK;
+- if (hw->phy_type != SK_PHY_XMAC)
+- msk |= XM_IS_INP_ASS; /* disable GP0 interrupt bit */
+
++ /* Turn on detection of Tx underrun, Rx overrun */
++ msk = xm_read16(hw, port, XM_IMSK);
++ msk &= ~(XM_IS_RXF_OV | XM_IS_TXF_UR);
+ xm_write16(hw, port, XM_IMSK, msk);
++
+ xm_read16(hw, port, XM_ISRC);
+
+ /* get MMU Command Reg. */
+@@ -2185,7 +2193,7 @@ static void yukon_mac_intr(struct skge_hw *hw, int port)
+ u8 status = skge_read8(hw, SK_REG(port, GMAC_IRQ_SRC));
+
+ if (netif_msg_intr(skge))
+- printk(KERN_DEBUG PFX "%s: mac interrupt status 0x%x\n",
++ printk(KERN_DEBUG PFX "%s: yukon mac interrupt status 0x%x\n",
+ dev->name, status);
+
+ if (status & GM_IS_RX_FF_OR) {
+@@ -2400,32 +2408,31 @@ static int skge_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ return err;
+ }
+
+-static void skge_ramset(struct skge_hw *hw, u16 q, u32 start, size_t len)
++/* Assign Ram Buffer allocation to queue */
++static void skge_ramset(struct skge_hw *hw, u16 q, u32 start, u32 space)
+ {
+ u32 end;
+
+- start /= 8;
+- len /= 8;
+- end = start + len - 1;
++ /* convert from K bytes to qwords used for hw register */
++ start *= 1024/8;
++ space *= 1024/8;
++ end = start + space - 1;
+
+ skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_RST_CLR);
+ skge_write32(hw, RB_ADDR(q, RB_START), start);
++ skge_write32(hw, RB_ADDR(q, RB_END), end);
+ skge_write32(hw, RB_ADDR(q, RB_WP), start);
+ skge_write32(hw, RB_ADDR(q, RB_RP), start);
+- skge_write32(hw, RB_ADDR(q, RB_END), end);
+
+ if (q == Q_R1 || q == Q_R2) {
++ u32 tp = space - space/4;
++
+ /* Set thresholds on receive queue's */
+- skge_write32(hw, RB_ADDR(q, RB_RX_UTPP),
+- start + (2*len)/3);
+- skge_write32(hw, RB_ADDR(q, RB_RX_LTPP),
+- start + (len/3));
+- } else {
+- /* Enable store & forward on Tx queue's because
+- * Tx FIFO is only 4K on Genesis and 1K on Yukon
+- */
++ skge_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp);
++ skge_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4);
++ } else if (hw->chip_id != CHIP_ID_GENESIS)
++ /* Genesis Tx Fifo is too small for normal store/forward */
+ skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_ENA_STFWD);
+- }
+
+ skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_ENA_OP_MD);
+ }
+@@ -2453,7 +2460,7 @@ static int skge_up(struct net_device *dev)
+ struct skge_port *skge = netdev_priv(dev);
+ struct skge_hw *hw = skge->hw;
+ int port = skge->port;
+- u32 chunk, ram_addr;
++ u32 ramaddr, ramsize, rxspace;
+ size_t rx_size, tx_size;
+ int err;
+
+@@ -2508,14 +2515,15 @@ static int skge_up(struct net_device *dev)
+ spin_unlock_bh(&hw->phy_lock);
+
+ /* Configure RAMbuffers */
+- chunk = hw->ram_size / ((hw->ports + 1)*2);
+- ram_addr = hw->ram_offset + 2 * chunk * port;
++ ramsize = (hw->ram_size - hw->ram_offset) / hw->ports;
++ ramaddr = hw->ram_offset + port * ramsize;
++ rxspace = 8 + (2*(ramsize - 16))/3;
+
+- skge_ramset(hw, rxqaddr[port], ram_addr, chunk);
+- skge_qset(skge, rxqaddr[port], skge->rx_ring.to_clean);
++ skge_ramset(hw, rxqaddr[port], ramaddr, rxspace);
++ skge_ramset(hw, txqaddr[port], ramaddr + rxspace, ramsize - rxspace);
+
++ skge_qset(skge, rxqaddr[port], skge->rx_ring.to_clean);
+ BUG_ON(skge->tx_ring.to_use != skge->tx_ring.to_clean);
+- skge_ramset(hw, txqaddr[port], ram_addr+chunk, chunk);
+ skge_qset(skge, txqaddr[port], skge->tx_ring.to_use);
+
+ /* Start receiver BMU */
+@@ -3450,15 +3458,12 @@ static int skge_reset(struct skge_hw *hw)
+ if (hw->chip_id == CHIP_ID_GENESIS) {
+ if (t8 == 3) {
+ /* special case: 4 x 64k x 36, offset = 0x80000 */
+- hw->ram_size = 0x100000;
+- hw->ram_offset = 0x80000;
++ hw->ram_size = 1024;
++ hw->ram_offset = 512;
+ } else
+ hw->ram_size = t8 * 512;
+- }
+- else if (t8 == 0)
+- hw->ram_size = 0x20000;
+- else
+- hw->ram_size = t8 * 4096;
++ } else /* Yukon */
++ hw->ram_size = t8 ? t8 * 4 : 128;
+
+ hw->intr_mask = IS_HW_ERR;
+
+diff --git a/drivers/net/skge.h b/drivers/net/skge.h
+index edd7146..323d6c6 100644
+--- a/drivers/net/skge.h
++++ b/drivers/net/skge.h
+@@ -2193,11 +2193,9 @@ enum {
+ XM_IS_TXF_UR = 1<<2, /* Bit 2: Transmit FIFO Underrun */
+ XM_IS_TX_COMP = 1<<1, /* Bit 1: Frame Tx Complete */
+ XM_IS_RX_COMP = 1<<0, /* Bit 0: Frame Rx Complete */
+-};
+-
+-#define XM_DEF_MSK (~(XM_IS_INP_ASS | XM_IS_LIPA_RC | \
+- XM_IS_RXF_OV | XM_IS_TXF_UR))
+
++ XM_IMSK_DISABLE = 0xffff,
++};
+
+ /* XM_HW_CFG 16 bit r/w Hardware Config Register */
+ enum {
+diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
+index ea117fc..2575077 100644
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -603,21 +603,22 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
+ static void sky2_phy_power(struct sky2_hw *hw, unsigned port, int onoff)
+ {
+ u32 reg1;
+- static const u32 phy_power[]
+- = { PCI_Y2_PHY1_POWD, PCI_Y2_PHY2_POWD };
+-
+- /* looks like this XL is back asswards .. */
+- if (hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
+- onoff = !onoff;
++ static const u32 phy_power[] = { PCI_Y2_PHY1_POWD, PCI_Y2_PHY2_POWD };
++ static const u32 coma_mode[] = { PCI_Y2_PHY1_COMA, PCI_Y2_PHY2_COMA };
+
+ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
+ reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
++
+ if (onoff)
+ /* Turn off phy power saving */
+ reg1 &= ~phy_power[port];
+ else
+ reg1 |= phy_power[port];
+
++ if (onoff && hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
++ reg1 |= coma_mode[port];
++
++
+ sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+ sky2_pci_read32(hw, PCI_DEV_REG1);
+ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
+@@ -2246,20 +2247,26 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do)
+ while (hw->st_idx != hwidx) {
+ struct sky2_port *sky2;
+ struct sky2_status_le *le = hw->st_le + hw->st_idx;
+- unsigned port = le->css & CSS_LINK_BIT;
++ unsigned port;
+ struct net_device *dev;
+ struct sk_buff *skb;
+ u32 status;
+ u16 length;
++ u8 opcode = le->opcode;
++
++ if (!(opcode & HW_OWNER))
++ break;
+
+ hw->st_idx = RING_NEXT(hw->st_idx, STATUS_RING_SIZE);
+
++ port = le->css & CSS_LINK_BIT;
+ dev = hw->dev[port];
+ sky2 = netdev_priv(dev);
+ length = le16_to_cpu(le->length);
+ status = le32_to_cpu(le->status);
+
+- switch (le->opcode & ~HW_OWNER) {
++ le->opcode = 0;
++ switch (opcode & ~HW_OWNER) {
+ case OP_RXSTAT:
+ ++rx[port];
+ skb = sky2_receive(dev, length, status);
+@@ -2352,7 +2359,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do)
+ default:
+ if (net_ratelimit())
+ printk(KERN_WARNING PFX
+- "unknown status opcode 0x%x\n", le->opcode);
++ "unknown status opcode 0x%x\n", opcode);
+ }
+ }
+
+@@ -3564,20 +3571,64 @@ static void sky2_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+ {
+ const struct sky2_port *sky2 = netdev_priv(dev);
+ const void __iomem *io = sky2->hw->regs;
++ unsigned int b;
+
+ regs->version = 1;
+- memset(p, 0, regs->len);
+
+- memcpy_fromio(p, io, B3_RAM_ADDR);
+-
+- /* skip diagnostic ram region */
+- memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1, 0x2000 - B3_RI_WTO_R1);
++ for (b = 0; b < 128; b++) {
++ /* This complicated switch statement is to make sure and
++ * only access regions that are unreserved.
++ * Some blocks are only valid on dual port cards.
++ * and block 3 has some special diagnostic registers that
++ * are poison.
++ */
++ switch (b) {
++ case 3:
++ /* skip diagnostic ram region */
++ memcpy_fromio(p + 0x10, io + 0x10, 128 - 0x10);
++ break;
+
+- /* copy GMAC registers */
+- memcpy_fromio(p + BASE_GMAC_1, io + BASE_GMAC_1, 0x1000);
+- if (sky2->hw->ports > 1)
+- memcpy_fromio(p + BASE_GMAC_2, io + BASE_GMAC_2, 0x1000);
++ /* dual port cards only */
++ case 5: /* Tx Arbiter 2 */
++ case 9: /* RX2 */
++ case 14 ... 15: /* TX2 */
++ case 17: case 19: /* Ram Buffer 2 */
++ case 22 ... 23: /* Tx Ram Buffer 2 */
++ case 25: /* Rx MAC Fifo 1 */
++ case 27: /* Tx MAC Fifo 2 */
++ case 31: /* GPHY 2 */
++ case 40 ... 47: /* Pattern Ram 2 */
++ case 52: case 54: /* TCP Segmentation 2 */
++ case 112 ... 116: /* GMAC 2 */
++ if (sky2->hw->ports == 1)
++ goto reserved;
++ /* fall through */
++ case 0: /* Control */
++ case 2: /* Mac address */
++ case 4: /* Tx Arbiter 1 */
++ case 7: /* PCI express reg */
++ case 8: /* RX1 */
++ case 12 ... 13: /* TX1 */
++ case 16: case 18:/* Rx Ram Buffer 1 */
++ case 20 ... 21: /* Tx Ram Buffer 1 */
++ case 24: /* Rx MAC Fifo 1 */
++ case 26: /* Tx MAC Fifo 1 */
++ case 28 ... 29: /* Descriptor and status unit */
++ case 30: /* GPHY 1*/
++ case 32 ... 39: /* Pattern Ram 1 */
++ case 48: case 50: /* TCP Segmentation 1 */
++ case 56 ... 60: /* PCI space */
++ case 80 ... 84: /* GMAC 1 */
++ memcpy_fromio(p, io, 128);
++ break;
++ default:
++reserved:
++ memset(p, 0, 128);
++ }
+
++ p += 128;
++ io += 128;
++ }
+ }
+
+ /* In order to do Jumbo packets on these chips, need to turn off the
+diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
+index 9034a05..f80721e 100644
+--- a/drivers/net/tg3.c
++++ b/drivers/net/tg3.c
+@@ -64,8 +64,8 @@
+
+ #define DRV_MODULE_NAME "tg3"
+ #define PFX DRV_MODULE_NAME ": "
+-#define DRV_MODULE_VERSION "3.81"
+-#define DRV_MODULE_RELDATE "September 5, 2007"
++#define DRV_MODULE_VERSION "3.81.1"
++#define DRV_MODULE_RELDATE "October 18, 2007"
+
+ #define TG3_DEF_MAC_MODE 0
+ #define TG3_DEF_RX_MODE 0
+@@ -4874,6 +4874,12 @@ static void tg3_restore_pci_state(struct tg3 *tp)
+
+ pci_write_config_dword(tp->pdev, TG3PCI_COMMAND, tp->pci_cmd);
+
++ if (!(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS)) {
++ pci_write_config_byte(tp->pdev, PCI_CACHE_LINE_SIZE,
++ tp->pci_cacheline_sz);
++ pci_write_config_byte(tp->pdev, PCI_LATENCY_TIMER,
++ tp->pci_lat_timer);
++ }
+ /* Make sure PCI-X relaxed ordering bit is clear. */
+ pci_read_config_dword(tp->pdev, TG3PCI_X_CAPS, &val);
+ val &= ~PCIX_CAPS_RELAXED_ORDERING;
+diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
+index 8990585..e690609 100644
+--- a/drivers/net/wireless/ipw2100.c
++++ b/drivers/net/wireless/ipw2100.c
+@@ -2102,12 +2102,46 @@ static void isr_indicate_rf_kill(struct ipw2100_priv *priv, u32 status)
+ queue_delayed_work(priv->workqueue, &priv->rf_kill, round_jiffies(HZ));
+ }
+
++static void send_scan_event(void *data)
++{
++ struct ipw2100_priv *priv = data;
++ union iwreq_data wrqu;
++
++ wrqu.data.length = 0;
++ wrqu.data.flags = 0;
++ wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
++}
++
++static void ipw2100_scan_event_later(struct work_struct *work)
++{
++ send_scan_event(container_of(work, struct ipw2100_priv,
++ scan_event_later.work));
++}
++
++static void ipw2100_scan_event_now(struct work_struct *work)
++{
++ send_scan_event(container_of(work, struct ipw2100_priv,
++ scan_event_now));
++}
++
+ static void isr_scan_complete(struct ipw2100_priv *priv, u32 status)
+ {
+ IPW_DEBUG_SCAN("scan complete\n");
+ /* Age the scan results... */
+ priv->ieee->scans++;
+ priv->status &= ~STATUS_SCANNING;
++
++ /* Only userspace-requested scan completion events go out immediately */
++ if (!priv->user_requested_scan) {
++ if (!delayed_work_pending(&priv->scan_event_later))
++ queue_delayed_work(priv->workqueue,
++ &priv->scan_event_later,
++ round_jiffies(msecs_to_jiffies(4000)));
++ } else {
++ priv->user_requested_scan = 0;
++ cancel_delayed_work(&priv->scan_event_later);
++ queue_work(priv->workqueue, &priv->scan_event_now);
++ }
+ }
+
+ #ifdef CONFIG_IPW2100_DEBUG
+@@ -4376,6 +4410,7 @@ static void ipw2100_kill_workqueue(struct ipw2100_priv *priv)
+ cancel_delayed_work(&priv->wx_event_work);
+ cancel_delayed_work(&priv->hang_check);
+ cancel_delayed_work(&priv->rf_kill);
++ cancel_delayed_work(&priv->scan_event_later);
+ destroy_workqueue(priv->workqueue);
+ priv->workqueue = NULL;
+ }
+@@ -6118,6 +6153,8 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
+ INIT_DELAYED_WORK(&priv->wx_event_work, ipw2100_wx_event_work);
+ INIT_DELAYED_WORK(&priv->hang_check, ipw2100_hang_check);
+ INIT_DELAYED_WORK(&priv->rf_kill, ipw2100_rf_kill);
++ INIT_WORK(&priv->scan_event_now, ipw2100_scan_event_now);
++ INIT_DELAYED_WORK(&priv->scan_event_later, ipw2100_scan_event_later);
+
+ tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
+ ipw2100_irq_tasklet, (unsigned long)priv);
+@@ -7427,6 +7464,8 @@ static int ipw2100_wx_set_scan(struct net_device *dev,
+ }
+
+ IPW_DEBUG_WX("Initiating scan...\n");
++
++ priv->user_requested_scan = 1;
+ if (ipw2100_set_scan_options(priv) || ipw2100_start_scan(priv)) {
+ IPW_DEBUG_WX("Start scan failed.\n");
+
+diff --git a/drivers/net/wireless/ipw2100.h b/drivers/net/wireless/ipw2100.h
+index de7d384..1ee3348 100644
+--- a/drivers/net/wireless/ipw2100.h
++++ b/drivers/net/wireless/ipw2100.h
+@@ -588,6 +588,10 @@ struct ipw2100_priv {
+ struct delayed_work wx_event_work;
+ struct delayed_work hang_check;
+ struct delayed_work rf_kill;
++ struct work_struct scan_event_now;
++ struct delayed_work scan_event_later;
++
++ int user_requested_scan;
+
+ u32 interrupts;
+ int tx_interrupts;
+diff --git a/drivers/net/wireless/libertas/11d.c b/drivers/net/wireless/libertas/11d.c
+index 4cf0ff7..0560270 100644
+--- a/drivers/net/wireless/libertas/11d.c
++++ b/drivers/net/wireless/libertas/11d.c
+@@ -562,7 +562,7 @@ int libertas_cmd_802_11d_domain_info(wlan_private * priv,
+ nr_subband * sizeof(struct ieeetypes_subbandset));
+
+ cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
+- domain->header.len +
++ le16_to_cpu(domain->header.len) +
+ sizeof(struct mrvlietypesheader) +
+ S_DS_GEN);
+ } else {
+diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
+index 4a8f5dc..86fff8d 100644
+--- a/drivers/net/wireless/libertas/cmd.c
++++ b/drivers/net/wireless/libertas/cmd.c
+@@ -185,14 +185,12 @@ static int wlan_cmd_802_11_set_wep(wlan_private * priv,
+
+ switch (pkey->len) {
+ case KEY_LEN_WEP_40:
+- wep->keytype[i] =
+- cpu_to_le16(cmd_type_wep_40_bit);
++ wep->keytype[i] = cmd_type_wep_40_bit;
+ memmove(&wep->keymaterial[i], pkey->key,
+ pkey->len);
+ break;
+ case KEY_LEN_WEP_104:
+- wep->keytype[i] =
+- cpu_to_le16(cmd_type_wep_104_bit);
++ wep->keytype[i] = cmd_type_wep_104_bit;
+ memmove(&wep->keymaterial[i], pkey->key,
+ pkey->len);
+ break;
+diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
+index 2fcc3bf..873c405 100644
+--- a/drivers/net/wireless/libertas/wext.c
++++ b/drivers/net/wireless/libertas/wext.c
+@@ -973,7 +973,7 @@ static struct iw_statistics *wlan_get_wireless_stats(struct net_device *dev)
+ /* Quality by TX errors */
+ priv->wstats.discard.retries = priv->stats.tx_errors;
+
+- tx_retries = le16_to_cpu(adapter->logmsg.retry);
++ tx_retries = le32_to_cpu(adapter->logmsg.retry);
+
+ if (tx_retries > 75)
+ tx_qual = (90 - tx_retries) * POOR / 15;
+@@ -989,10 +989,10 @@ static struct iw_statistics *wlan_get_wireless_stats(struct net_device *dev)
+ (PERFECT - VERY_GOOD) / 50 + VERY_GOOD;
+ quality = min(quality, tx_qual);
+
+- priv->wstats.discard.code = le16_to_cpu(adapter->logmsg.wepundecryptable);
+- priv->wstats.discard.fragment = le16_to_cpu(adapter->logmsg.rxfrag);
++ priv->wstats.discard.code = le32_to_cpu(adapter->logmsg.wepundecryptable);
++ priv->wstats.discard.fragment = le32_to_cpu(adapter->logmsg.rxfrag);
+ priv->wstats.discard.retries = tx_retries;
+- priv->wstats.discard.misc = le16_to_cpu(adapter->logmsg.ackfailure);
++ priv->wstats.discard.misc = le32_to_cpu(adapter->logmsg.ackfailure);
+
+ /* Calculate quality */
+ priv->wstats.qual.qual = max(quality, (u32)100);
+diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
+index e61c6d5..66704b8 100644
+--- a/drivers/net/wireless/rtl8187_dev.c
++++ b/drivers/net/wireless/rtl8187_dev.c
+@@ -78,7 +78,8 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
+ struct rtl8187_tx_hdr *hdr;
+ struct rtl8187_tx_info *info;
+ struct urb *urb;
+- u32 tmp;
++ __le16 rts_dur = 0;
++ u32 flags;
+
+ urb = usb_alloc_urb(0, GFP_ATOMIC);
+ if (!urb) {
+@@ -86,24 +87,24 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
+ return 0;
+ }
+
+- hdr = (struct rtl8187_tx_hdr *)skb_push(skb, sizeof(*hdr));
+- tmp = skb->len - sizeof(*hdr);
+- tmp |= RTL8187_TX_FLAG_NO_ENCRYPT;
+- tmp |= control->rts_cts_rate << 19;
+- tmp |= control->tx_rate << 24;
+- if (ieee80211_get_morefrag((struct ieee80211_hdr *)skb))
+- tmp |= RTL8187_TX_FLAG_MORE_FRAG;
++ flags = skb->len;
++ flags |= RTL8187_TX_FLAG_NO_ENCRYPT;
++ flags |= control->rts_cts_rate << 19;
++ flags |= control->tx_rate << 24;
++ if (ieee80211_get_morefrag((struct ieee80211_hdr *)skb->data))
++ flags |= RTL8187_TX_FLAG_MORE_FRAG;
+ if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS) {
+- tmp |= RTL8187_TX_FLAG_RTS;
+- hdr->rts_duration =
+- ieee80211_rts_duration(dev, skb->len, control);
++ flags |= RTL8187_TX_FLAG_RTS;
++ rts_dur = ieee80211_rts_duration(dev, skb->len, control);
+ }
+ if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
+- tmp |= RTL8187_TX_FLAG_CTS;
+- hdr->flags = cpu_to_le32(tmp);
++ flags |= RTL8187_TX_FLAG_CTS;
++
++ hdr = (struct rtl8187_tx_hdr *)skb_push(skb, sizeof(*hdr));
++ hdr->flags = cpu_to_le32(flags);
+ hdr->len = 0;
+- tmp = control->retry_limit << 8;
+- hdr->retry = cpu_to_le32(tmp);
++ hdr->rts_duration = rts_dur;
++ hdr->retry = cpu_to_le32(control->retry_limit << 8);
+
+ info = (struct rtl8187_tx_info *)skb->cb;
+ info->control = kmemdup(control, sizeof(*control), GFP_ATOMIC);
+diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
+index 935b144..d5c0c66 100644
+--- a/drivers/net/wireless/zd1201.c
++++ b/drivers/net/wireless/zd1201.c
+@@ -327,8 +327,8 @@ static void zd1201_usbrx(struct urb *urb)
+ memcpy(skb_put(skb, 6), &data[datalen-8], 6);
+ memcpy(skb_put(skb, 2), &data[datalen-24], 2);
+ memcpy(skb_put(skb, len), data, len);
+- skb->dev->last_rx = jiffies;
+ skb->protocol = eth_type_trans(skb, zd->dev);
++ skb->dev->last_rx = jiffies;
+ zd->stats.rx_packets++;
+ zd->stats.rx_bytes += skb->len;
+ netif_rx(skb);
+@@ -384,8 +384,8 @@ static void zd1201_usbrx(struct urb *urb)
+ memcpy(skb_put(skb, 2), &data[6], 2);
+ memcpy(skb_put(skb, len), data+8, len);
+ }
+- skb->dev->last_rx = jiffies;
+ skb->protocol = eth_type_trans(skb, zd->dev);
++ skb->dev->last_rx = jiffies;
+ zd->stats.rx_packets++;
+ zd->stats.rx_bytes += skb->len;
+ netif_rx(skb);
+diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
+index a9c339e..5326301 100644
+--- a/drivers/net/wireless/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zd1211rw/zd_usb.c
+@@ -1041,14 +1041,17 @@ error:
+ static void disconnect(struct usb_interface *intf)
+ {
+ struct net_device *netdev = zd_intf_to_netdev(intf);
+- struct zd_mac *mac = zd_netdev_mac(netdev);
+- struct zd_usb *usb = &mac->chip.usb;
++ struct zd_mac *mac;
++ struct zd_usb *usb;
+
+ /* Either something really bad happened, or we're just dealing with
+ * a DEVICE_INSTALLER. */
+ if (netdev == NULL)
+ return;
+
++ mac = zd_netdev_mac(netdev);
++ usb = &mac->chip.usb;
++
+ dev_dbg_f(zd_usb_dev(usb), "\n");
+
+ zd_netdev_disconnect(netdev);
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 55f307f..85d434b 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1233,6 +1233,10 @@
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_IDE 0x0560
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE 0x056C
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE 0x0759
++#define PCI_DEVICE_ID_NVIDIA_NVENET_32 0x0760
++#define PCI_DEVICE_ID_NVIDIA_NVENET_33 0x0761
++#define PCI_DEVICE_ID_NVIDIA_NVENET_34 0x0762
++#define PCI_DEVICE_ID_NVIDIA_NVENET_35 0x0763
+
+ #define PCI_VENDOR_ID_IMS 0x10e0
+ #define PCI_DEVICE_ID_IMS_TT128 0x9128
--- /dev/null
+# network drivers
+libertas-more-endianness-breakage.patch
+libertas-fix-endianness-breakage.patch
+ehea-64k-page-kernel-support-fix.patch
+forcedeth-msi-bugfix.patch
+forcedeth-add-mcp77-device-ids.patch
+tg3-fix-performance-regression-on-5705.patch
+fix-l2tp-oopses.patch
+skge-ram-buffer-fix.patch
+skge-xm-phy-poll.patch
+sky2-status-race.patch
+sky2-ethdump.patch
+sky2-phy-power.patch
+zd1201-avoid-null-ptr-access-of-skb-dev.patch
+ipw2100-send-wext-scan-events.patch
+rtl8187-fix-more-frag-bit-checking-rts-duration-calc.patch
+zd1211rw-fix-oops-when-ejecting-install-media.patch
--- /dev/null
+ drivers/acpi/sleep/main.c | 5 -
+ drivers/ata/ahci.c | 143 ++++++++++++++++++++++++++++++++
+ drivers/ata/libata-core.c | 9 +-
+ drivers/ata/libata-eh.c | 32 +++++--
+ drivers/char/drm/i915_irq.c | 2
+ drivers/char/drm/radeon_cp.c | 5 -
+ drivers/char/drm/radeon_drv.h | 1
+ drivers/char/moxa.c | 4
+ drivers/char/rocket.c | 14 ++-
+ drivers/hwmon/lm87.c | 4
+ drivers/hwmon/w83627hf.c | 78 +++++++++--------
+ drivers/ide/pci/cs5535.c | 2
+ drivers/ide/pci/serverworks.c | 1
+ drivers/ide/pci/siimage.c | 2
+ drivers/infiniband/core/uverbs_cmd.c | 8 +
+ drivers/infiniband/hw/mthca/mthca_cmd.c | 6 +
+ drivers/isdn/hardware/avm/b1.c | 28 ++----
+ drivers/isdn/hardware/avm/c4.c | 14 ++-
+ drivers/md/bitmap.c | 2
+ drivers/md/dm-delay.c | 2
+ drivers/md/dm.c | 4
+ drivers/md/raid5.c | 17 +++
+ drivers/pci/msi.c | 2
+ drivers/scsi/hptiop.c | 5 -
+ drivers/usb/core/hcd.h | 8 +
+ drivers/usb/core/hub.c | 15 +++
+ drivers/usb/core/quirks.c | 81 ------------------
+ drivers/usb/core/urb.c | 2
+ drivers/usb/gadget/ether.c | 12 ++
+ drivers/usb/host/ehci-hcd.c | 8 +
+ drivers/usb/serial/generic.c | 7 -
+ drivers/video/platinumfb.c | 48 +++++-----
+ include/linux/ide.h | 7 +
+ include/linux/libata.h | 2
+ include/linux/usb/quirks.h | 7 -
+ sound/core/Makefile | 3
+ sound/core/memalloc.c | 6 +
+ sound/pci/emu10k1/emumixer.c | 4
+ sound/pci/hda/patch_sigmatel.c | 29 ++++--
+ sound/pci/rme9652/hdsp.c | 3
+ sound/usb/usbmixer.c | 2
+ 41 files changed, 418 insertions(+), 216 deletions(-)
--- /dev/null
+From gregkh@mini.kroah.org Wed Nov 14 22:28:59 2007
+Message-Id: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:10 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/40] 2.6.23-stable review, driver (sans network) changes
+Status: RO
+Content-Length: 3054
+Lines: 67
+
+This is the start of the stable review cycle for the 2.6.23.X release.
+There are 40 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday 00:00:00 UTC. Anything received
+after that time might be too late.
+
+This set of patches focuses on drivers except for networking (those were
+in a different series).
+
+The diffstat of this review series is included below.
+
+thanks,
+
+greg k-h
+
+-----
+
+ drivers/acpi/sleep/main.c | 5 -
+ drivers/ata/ahci.c | 143 ++++++++++++++++++++++++++++++++
+ drivers/ata/libata-core.c | 9 +-
+ drivers/ata/libata-eh.c | 32 +++++--
+ drivers/char/drm/i915_irq.c | 2
+ drivers/char/drm/radeon_cp.c | 5 -
+ drivers/char/drm/radeon_drv.h | 1
+ drivers/char/moxa.c | 4
+ drivers/char/rocket.c | 14 ++-
+ drivers/hwmon/lm87.c | 4
+ drivers/hwmon/w83627hf.c | 78 +++++++++--------
+ drivers/ide/pci/cs5535.c | 2
+ drivers/ide/pci/serverworks.c | 1
+ drivers/ide/pci/siimage.c | 2
+ drivers/infiniband/core/uverbs_cmd.c | 8 +
+ drivers/infiniband/hw/mthca/mthca_cmd.c | 6 +
+ drivers/isdn/hardware/avm/b1.c | 28 ++----
+ drivers/isdn/hardware/avm/c4.c | 14 ++-
+ drivers/md/bitmap.c | 2
+ drivers/md/dm-delay.c | 2
+ drivers/md/dm.c | 4
+ drivers/md/raid5.c | 17 +++
+ drivers/pci/msi.c | 2
+ drivers/scsi/hptiop.c | 5 -
+ drivers/usb/core/hcd.h | 8 +
+ drivers/usb/core/hub.c | 15 +++
+ drivers/usb/core/quirks.c | 81 ------------------
+ drivers/usb/core/urb.c | 2
+ drivers/usb/gadget/ether.c | 12 ++
+ drivers/usb/host/ehci-hcd.c | 8 +
+ drivers/usb/serial/generic.c | 7 -
+ drivers/video/platinumfb.c | 48 +++++-----
+ include/linux/ide.h | 7 +
+ include/linux/libata.h | 2
+ include/linux/usb/quirks.h | 7 -
+ sound/core/Makefile | 3
+ sound/core/memalloc.c | 6 +
+ sound/pci/emu10k1/emumixer.c | 4
+ sound/pci/hda/patch_sigmatel.c | 29 ++++--
+ sound/pci/rme9652/hdsp.c | 3
+ sound/usb/usbmixer.c | 2
+ 41 files changed, 418 insertions(+), 216 deletions(-)
+
+From gregkh@mini.kroah.org Wed Nov 14 22:28:59 2007
+Message-Id: <20071115062859.766284615@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:11 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Paul Mackerras <paulus@samba.org>
+Subject: [patch 01/40] POWERPC: Fix platinumfb framebuffer
+Content-Disposition: inline; filename=powerpc-fix-platinumfb-framebuffer.patch
+Content-Length: 3724
+Lines: 115
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+Patch 4c2a54b09ba35a409afc34bd331a57a994921664 in mailine.
+
+Current kernels have a non-working platinumfb due to some resource
+management issues. This fixes it.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/platinumfb.c | 48 ++++++++++++++++++++++++---------------------
+ 1 file changed, 26 insertions(+), 22 deletions(-)
+
+--- a/drivers/video/platinumfb.c
++++ b/drivers/video/platinumfb.c
+@@ -17,6 +17,8 @@
+ * more details.
+ */
+
++#undef DEBUG
++
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+@@ -535,33 +537,35 @@ static int __devinit platinumfb_probe(st
+ volatile __u8 *fbuffer;
+ int bank0, bank1, bank2, bank3, rc;
+
+- printk(KERN_INFO "platinumfb: Found Apple Platinum video hardware\n");
++ dev_info(&odev->dev, "Found Apple Platinum video hardware\n");
+
+ info = framebuffer_alloc(sizeof(*pinfo), &odev->dev);
+- if (info == NULL)
++ if (info == NULL) {
++ dev_err(&odev->dev, "Failed to allocate fbdev !\n");
+ return -ENOMEM;
++ }
+ pinfo = info->par;
+
+ if (of_address_to_resource(dp, 0, &pinfo->rsrc_reg) ||
+ of_address_to_resource(dp, 1, &pinfo->rsrc_fb)) {
+- printk(KERN_ERR "platinumfb: Can't get resources\n");
+- framebuffer_release(info);
+- return -ENXIO;
+- }
+- if (!request_mem_region(pinfo->rsrc_reg.start,
+- pinfo->rsrc_reg.start -
+- pinfo->rsrc_reg.end + 1,
+- "platinumfb registers")) {
++ dev_err(&odev->dev, "Can't get resources\n");
+ framebuffer_release(info);
+ return -ENXIO;
+ }
++ dev_dbg(&odev->dev, " registers : 0x%llx...0x%llx\n",
++ (unsigned long long)pinfo->rsrc_reg.start,
++ (unsigned long long)pinfo->rsrc_reg.end);
++ dev_dbg(&odev->dev, " framebuffer: 0x%llx...0x%llx\n",
++ (unsigned long long)pinfo->rsrc_fb.start,
++ (unsigned long long)pinfo->rsrc_fb.end);
++
++ /* Do not try to request register space, they overlap with the
++ * northbridge and that can fail. Only request framebuffer
++ */
+ if (!request_mem_region(pinfo->rsrc_fb.start,
+- pinfo->rsrc_fb.start
+- - pinfo->rsrc_fb.end + 1,
++ pinfo->rsrc_fb.end - pinfo->rsrc_fb.start + 1,
+ "platinumfb framebuffer")) {
+- release_mem_region(pinfo->rsrc_reg.start,
+- pinfo->rsrc_reg.end -
+- pinfo->rsrc_reg.start + 1);
++ printk(KERN_ERR "platinumfb: Can't request framebuffer !\n");
+ framebuffer_release(info);
+ return -ENXIO;
+ }
+@@ -600,7 +604,8 @@ static int __devinit platinumfb_probe(st
+ bank2 = fbuffer[0x200000] == 0x56;
+ bank3 = fbuffer[0x300000] == 0x78;
+ pinfo->total_vram = (bank0 + bank1 + bank2 + bank3) * 0x100000;
+- printk(KERN_INFO "platinumfb: Total VRAM = %dMB (%d%d%d%d)\n", (int) (pinfo->total_vram / 1024 / 1024),
++ printk(KERN_INFO "platinumfb: Total VRAM = %dMB (%d%d%d%d)\n",
++ (unsigned int) (pinfo->total_vram / 1024 / 1024),
+ bank3, bank2, bank1, bank0);
+
+ /*
+@@ -644,16 +649,15 @@ static int __devexit platinumfb_remove(s
+ unregister_framebuffer (info);
+
+ /* Unmap frame buffer and registers */
++ iounmap(pinfo->frame_buffer);
++ iounmap(pinfo->platinum_regs);
++ iounmap(pinfo->cmap_regs);
++
+ release_mem_region(pinfo->rsrc_fb.start,
+ pinfo->rsrc_fb.end -
+ pinfo->rsrc_fb.start + 1);
+- release_mem_region(pinfo->rsrc_reg.start,
+- pinfo->rsrc_reg.end -
+- pinfo->rsrc_reg.start + 1);
+- iounmap(pinfo->frame_buffer);
+- iounmap(pinfo->platinum_regs);
++
+ release_mem_region(pinfo->cmap_regs_phys, 0x1000);
+- iounmap(pinfo->cmap_regs);
+
+ framebuffer_release(info);
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:00 2007
+Message-Id: <20071115062859.934103146@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:12 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Airlie <airlied@linux.ie>
+Subject: [patch 02/40] i915: fix vbl swap allocation size.
+Content-Disposition: inline; filename=i915-fix-vbl-swap-allocation-size.patch
+Content-Length: 759
+Lines: 30
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dave Airlie <airlied@linux.ie>
+
+This is upstream as 54583bf4efda79388fc13163e35c016c8bc5de81
+
+Oops...
+
+Signed-off-by: Dave Airlie <airlied@linux.ie>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/drm/i915_irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/drm/i915_irq.c
++++ b/drivers/char/drm/i915_irq.c
+@@ -553,7 +553,7 @@ int i915_vblank_swap(DRM_IOCTL_ARGS)
+ return DRM_ERR(EBUSY);
+ }
+
+- vbl_swap = drm_calloc(1, sizeof(vbl_swap), DRM_MEM_DRIVER);
++ vbl_swap = drm_calloc(1, sizeof(*vbl_swap), DRM_MEM_DRIVER);
+
+ if (!vbl_swap) {
+ DRM_ERROR("Failed to allocate memory to queue swap\n");
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:00 2007
+Message-Id: <20071115062900.101493455@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:13 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Mark M. Hoffman" <mhoffman@lightlink.com>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 03/40] hwmon/w83627hf: Fix setting fan min right after driver load
+Content-Disposition: inline; filename=hwmon-w83627hf-fix-setting-fan-min-right-after-driver-load.patch
+Content-Length: 3235
+Lines: 88
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c09c5184a26158da32801e89d5849d774605f0dd
+
+We need to read the fan clock dividers at initialization time,
+otherwise the code in store_fan_min() may use uninitialized values.
+That's pretty much the same bug and same fix as for the w83627ehf
+driver last month.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/w83627hf.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -391,6 +391,7 @@ static int __devexit w83627hf_remove(str
+
+ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg);
+ static int w83627hf_write_value(struct w83627hf_data *data, u16 reg, u16 value);
++static void w83627hf_update_fan_div(struct w83627hf_data *data);
+ static struct w83627hf_data *w83627hf_update_device(struct device *dev);
+ static void w83627hf_init_device(struct platform_device *pdev);
+
+@@ -1244,6 +1245,7 @@ static int __devinit w83627hf_probe(stru
+ data->fan_min[0] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(1));
+ data->fan_min[1] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(2));
+ data->fan_min[2] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(3));
++ w83627hf_update_fan_div(data);
+
+ /* Register common device attributes */
+ if ((err = sysfs_create_group(&dev->kobj, &w83627hf_group)))
+@@ -1556,6 +1558,24 @@ static void __devinit w83627hf_init_devi
+ | 0x01);
+ }
+
++static void w83627hf_update_fan_div(struct w83627hf_data *data)
++{
++ int reg;
++
++ reg = w83627hf_read_value(data, W83781D_REG_VID_FANDIV);
++ data->fan_div[0] = (reg >> 4) & 0x03;
++ data->fan_div[1] = (reg >> 6) & 0x03;
++ if (data->type != w83697hf) {
++ data->fan_div[2] = (w83627hf_read_value(data,
++ W83781D_REG_PIN) >> 6) & 0x03;
++ }
++ reg = w83627hf_read_value(data, W83781D_REG_VBAT);
++ data->fan_div[0] |= (reg >> 3) & 0x04;
++ data->fan_div[1] |= (reg >> 4) & 0x04;
++ if (data->type != w83697hf)
++ data->fan_div[2] |= (reg >> 5) & 0x04;
++}
++
+ static struct w83627hf_data *w83627hf_update_device(struct device *dev)
+ {
+ struct w83627hf_data *data = dev_get_drvdata(dev);
+@@ -1633,18 +1653,8 @@ static struct w83627hf_data *w83627hf_up
+ w83627hf_read_value(data, W83781D_REG_TEMP_HYST(3));
+ }
+
+- i = w83627hf_read_value(data, W83781D_REG_VID_FANDIV);
+- data->fan_div[0] = (i >> 4) & 0x03;
+- data->fan_div[1] = (i >> 6) & 0x03;
+- if (data->type != w83697hf) {
+- data->fan_div[2] = (w83627hf_read_value(data,
+- W83781D_REG_PIN) >> 6) & 0x03;
+- }
+- i = w83627hf_read_value(data, W83781D_REG_VBAT);
+- data->fan_div[0] |= (i >> 3) & 0x04;
+- data->fan_div[1] |= (i >> 4) & 0x04;
+- if (data->type != w83697hf)
+- data->fan_div[2] |= (i >> 5) & 0x04;
++ w83627hf_update_fan_div(data);
++
+ data->alarms =
+ w83627hf_read_value(data, W83781D_REG_ALARM1) |
+ (w83627hf_read_value(data, W83781D_REG_ALARM2) << 8) |
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:00 2007
+Message-Id: <20071115062900.257727381@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:14 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Mark M. Hoffman" <mhoffman@lightlink.com>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 04/40] hwmon/w83627hf: Dont assume bank 0
+Content-Disposition: inline; filename=hwmon-w83627hf-don-t-assume-bank-0.patch
+Content-Length: 3724
+Lines: 111
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d58df9cd788e6fb4962e1c8d5ba7b8b95d639a44
+
+The bank switching code assumes that the bank selector is set to 0
+when the driver is loaded. This might not be the case. This is exactly
+the same bug as was fixed in the w83627ehf driver two months ago:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0956895aa6f8dc6a33210967252fd7787652537d
+
+In practice, this bug was causing the sensor thermal types to be
+improperly reported for my W83627THF the first time I was loading the
+w83627hf driver. From the driver history, I'd say that it has been
+broken since September 2005 (when we stopped resetting the chip by
+default at driver load.)
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/w83627hf.c | 44 ++++++++++++++++++++++----------------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -1335,6 +1335,24 @@ static int __devexit w83627hf_remove(str
+ }
+
+
++/* Registers 0x50-0x5f are banked */
++static inline void w83627hf_set_bank(struct w83627hf_data *data, u16 reg)
++{
++ if ((reg & 0x00f0) == 0x50) {
++ outb_p(W83781D_REG_BANK, data->addr + W83781D_ADDR_REG_OFFSET);
++ outb_p(reg >> 8, data->addr + W83781D_DATA_REG_OFFSET);
++ }
++}
++
++/* Not strictly necessary, but play it safe for now */
++static inline void w83627hf_reset_bank(struct w83627hf_data *data, u16 reg)
++{
++ if (reg & 0xff00) {
++ outb_p(W83781D_REG_BANK, data->addr + W83781D_ADDR_REG_OFFSET);
++ outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
++ }
++}
++
+ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg)
+ {
+ int res, word_sized;
+@@ -1345,12 +1363,7 @@ static int w83627hf_read_value(struct w8
+ && (((reg & 0x00ff) == 0x50)
+ || ((reg & 0x00ff) == 0x53)
+ || ((reg & 0x00ff) == 0x55));
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(reg >> 8,
+- data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_set_bank(data, reg);
+ outb_p(reg & 0xff, data->addr + W83781D_ADDR_REG_OFFSET);
+ res = inb_p(data->addr + W83781D_DATA_REG_OFFSET);
+ if (word_sized) {
+@@ -1360,11 +1373,7 @@ static int w83627hf_read_value(struct w8
+ (res << 8) + inb_p(data->addr +
+ W83781D_DATA_REG_OFFSET);
+ }
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_reset_bank(data, reg);
+ mutex_unlock(&data->lock);
+ return res;
+ }
+@@ -1435,12 +1444,7 @@ static int w83627hf_write_value(struct w
+ || ((reg & 0xff00) == 0x200))
+ && (((reg & 0x00ff) == 0x53)
+ || ((reg & 0x00ff) == 0x55));
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(reg >> 8,
+- data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_set_bank(data, reg);
+ outb_p(reg & 0xff, data->addr + W83781D_ADDR_REG_OFFSET);
+ if (word_sized) {
+ outb_p(value >> 8,
+@@ -1450,11 +1454,7 @@ static int w83627hf_write_value(struct w
+ }
+ outb_p(value & 0xff,
+ data->addr + W83781D_DATA_REG_OFFSET);
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_reset_bank(data, reg);
+ mutex_unlock(&data->lock);
+ return 0;
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:00 2007
+Message-Id: <20071115062900.532863431@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:15 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Mark M. Hoffman" <mhoffman@lightlink.com>,
+ Jean Delvare <khali@linux-fr.org>,
+ Hans de Goede <j.w.r.degoede@hhs.nl>
+Subject: [patch 05/40] hwmon/lm87: Fix a division by zero
+Content-Disposition: inline; filename=hwmon-lm87-fix-a-division-by-zero.patch
+Content-Length: 1143
+Lines: 34
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=b965d4b7f614522170af6a7e450be0333792ccd2
+
+Missing parentheses in the definition of FAN_FROM_REG cause a
+division by zero for a specific register value.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Hans de Goede <j.w.r.degoede@hhs.nl>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm87.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm87.c
++++ b/drivers/hwmon/lm87.c
+@@ -129,7 +129,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A,
+ (((val) < 0 ? (val)-500 : (val)+500) / 1000))
+
+ #define FAN_FROM_REG(reg,div) ((reg) == 255 || (reg) == 0 ? 0 : \
+- 1350000 + (reg)*(div) / 2) / ((reg)*(div))
++ (1350000 + (reg)*(div) / 2) / ((reg)*(div)))
+ #define FAN_TO_REG(val,div) ((val)*(div) * 255 <= 1350000 ? 255 : \
+ (1350000 + (val)*(div) / 2) / ((val)*(div)))
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:00 2007
+Message-Id: <20071115062900.723238418@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:16 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Mark M. Hoffman" <mhoffman@lightlink.com>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 06/40] hwmon/lm87: Disable VID when it should be
+Content-Disposition: inline; filename=hwmon-lm87-disable-vid-when-it-should-be.patch
+Content-Length: 967
+Lines: 33
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=889af3d5d9586db795a06c619e416b4baee11da8
+
+A stupid bit shifting bug caused the VID value to be always exported
+even when the hardware is configured for something different.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm87.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm87.c
++++ b/drivers/hwmon/lm87.c
+@@ -145,7 +145,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A,
+ #define CHAN_NO_FAN(nr) (1 << (nr))
+ #define CHAN_TEMP3 (1 << 2)
+ #define CHAN_VCC_5V (1 << 3)
+-#define CHAN_NO_VID (1 << 8)
++#define CHAN_NO_VID (1 << 7)
+
+ /*
+ * Functions declaration
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:01 2007
+Message-Id: <20071115062900.944023752@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:17 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland Dreier <rolandd@cisco.com>
+Subject: [patch 07/40] IB/uverbs: Fix checking of userspace object ownership
+Content-Disposition: inline; filename=ib-uverbs-fix-checking-of-userspace-object-ownership.patch
+Content-Length: 1328
+Lines: 44
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roland Dreier <rolandd@cisco.com>
+
+Upstream as cbfb50e6e2e9c580848c0f51d37c24cdfb1cb704
+
+Commit 9ead190b ("IB/uverbs: Don't serialize with ib_uverbs_idr_mutex")
+rewrote how userspace objects are looked up in the uverbs module's
+idrs, and introduced a severe bug in the process: there is no checking
+that an operation is being performed by the right process any more.
+Fix this by adding the missing check of uobj->context in __idr_get_uobj().
+
+Apparently everyone is being very careful to only touch their own
+objects, because this bug was introduced in June 2006 in 2.6.18, and
+has gone undetected until now.
+
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/core/uverbs_cmd.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -147,8 +147,12 @@ static struct ib_uobject *__idr_get_uobj
+
+ spin_lock(&ib_uverbs_idr_lock);
+ uobj = idr_find(idr, id);
+- if (uobj)
+- kref_get(&uobj->ref);
++ if (uobj) {
++ if (uobj->context == context)
++ kref_get(&uobj->ref);
++ else
++ uobj = NULL;
++ }
+ spin_unlock(&ib_uverbs_idr_lock);
+
+ return uobj;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:01 2007
+Message-Id: <20071115062901.112340629@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:18 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland Dreier <rolandd@cisco.com>
+Subject: [patch 08/40] IB/mthca: Use mmiowb() to avoid firmware commands getting jumbled up
+Content-Disposition: inline; filename=ib-mthca-use-mmiowb-to-avoid-firmware-commands-getting-jumbled-up.patch
+Content-Length: 1380
+Lines: 42
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roland Dreier <rdreier@cisco.com>
+
+Upstream as 76d7cc0345a037e8eea426f8abc710abd22946dd
+
+Firmware commands are sent to the HCA by writing multiple words to a
+command register block. Access to this block of registers is
+serialized with a mutex. However, on large SGI systems, problems were
+seen with multiple CPUs issuing FW commands at the same time, because
+the writes to the register block may be reordered within the system
+interconnect and reach the HCA in a different order than they were
+issued (even with the mutex). Fix this by adding an mmiowb() before
+dropping the mutex.
+
+Tested-by: Arthur Kepner <akepner@sgi.com>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/hw/mthca/mthca_cmd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
++++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
+@@ -290,6 +290,12 @@ static int mthca_cmd_post(struct mthca_d
+ err = mthca_cmd_post_hcr(dev, in_param, out_param, in_modifier,
+ op_modifier, op, token, event);
+
++ /*
++ * Make sure that our HCR writes don't get mixed in with
++ * writes from another CPU starting a FW command.
++ */
++ mmiowb();
++
+ mutex_unlock(&dev->cmd.hcr_mutex);
+ return err;
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:01 2007
+Message-Id: <20071115062901.284125043@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:19 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 09/40] ALSA: hda-codec - Avoid zero NID in line_out_pinsof STAC codecs
+Content-Disposition: inline; filename=alsa-hda-codec-avoid-zero-nid-in-line_out_pins-of-stac-codecs.patch
+Content-Length: 2333
+Lines: 69
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+patch c480f79bdca58923e605ff5e4698cfe1779bae70 in mainline
+
+[ALSA] hda-codec - Avoid zero NID in line_out_pins[] of STAC codecs
+
+The STAC codes adds line_out_pins[] for shared mic/line-inputs accordingly.
+But, the current code may give a hole with NID=0 in some setting, which
+results in an error at probe. This patch fixes the problem.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1182,7 +1182,8 @@ static int stac92xx_add_dyn_out_pins(str
+ case 3:
+ /* add line-in as side */
+ if (cfg->input_pins[AUTO_PIN_LINE] && num_dacs > 3) {
+- cfg->line_out_pins[3] = cfg->input_pins[AUTO_PIN_LINE];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_LINE];
+ spec->line_switch = 1;
+ cfg->line_outs++;
+ }
+@@ -1190,12 +1191,14 @@ static int stac92xx_add_dyn_out_pins(str
+ case 2:
+ /* add line-in as clfe and mic as side */
+ if (cfg->input_pins[AUTO_PIN_LINE] && num_dacs > 2) {
+- cfg->line_out_pins[2] = cfg->input_pins[AUTO_PIN_LINE];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_LINE];
+ spec->line_switch = 1;
+ cfg->line_outs++;
+ }
+ if (cfg->input_pins[AUTO_PIN_MIC] && num_dacs > 3) {
+- cfg->line_out_pins[3] = cfg->input_pins[AUTO_PIN_MIC];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_MIC];
+ spec->mic_switch = 1;
+ cfg->line_outs++;
+ }
+@@ -1203,12 +1206,14 @@ static int stac92xx_add_dyn_out_pins(str
+ case 1:
+ /* add line-in as surr and mic as clfe */
+ if (cfg->input_pins[AUTO_PIN_LINE] && num_dacs > 1) {
+- cfg->line_out_pins[1] = cfg->input_pins[AUTO_PIN_LINE];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_LINE];
+ spec->line_switch = 1;
+ cfg->line_outs++;
+ }
+ if (cfg->input_pins[AUTO_PIN_MIC] && num_dacs > 2) {
+- cfg->line_out_pins[2] = cfg->input_pins[AUTO_PIN_MIC];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_MIC];
+ spec->mic_switch = 1;
+ cfg->line_outs++;
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:01 2007
+Message-Id: <20071115062901.452224911@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:20 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Russ Cox <rsc@swtch.com>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 10/40] ALSA: fix selector unit bug affecting some USB speakerphones
+Content-Disposition: inline; filename=alsa-fix-selector-unit-bug-affecting-some-usb-speakerphones.patch
+Content-Length: 1149
+Lines: 38
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Russ Cox <rsc@swtch.com>
+
+patch 38977e96cb32e658716e11a05ec7f1fc4618e0f3 in mainline.
+
+[ALSA] fix selector unit bug affecting some USB speakerphones
+
+Following the suggestion in this thread:
+https://bugs.launchpad.net/ubuntu/+source/alsa-lib/+bug/26683
+the correct upper bound on desc[0] is 5 + num_ins not 6 + num_ins,
+because the index used later is 5+i, not 6+i.
+This change makes my Vosky Chatterbox speakerphone work.
+Apparently it also helps with the Minivox MV100.
+
+Signed-off-by: Russ Cox <rsc@swtch.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbmixer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/usbmixer.c
++++ b/sound/usb/usbmixer.c
+@@ -1483,7 +1483,7 @@ static int parse_audio_selector_unit(str
+ struct snd_kcontrol *kctl;
+ char **namelist;
+
+- if (! num_ins || desc[0] < 6 + num_ins) {
++ if (! num_ins || desc[0] < 5 + num_ins) {
+ snd_printk(KERN_ERR "invalid SELECTOR UNIT descriptor %d\n", unitid);
+ return -EINVAL;
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:01 2007
+Message-Id: <20071115062901.611741913@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:21 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 11/40] ALSA: Fix build error without CONFIG_HAS_DMA
+Content-Disposition: inline; filename=alsa-fix-build-error-without-config_has_dma.patch
+Content-Length: 2349
+Lines: 83
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+patch 8f11551b1798170dcffdd28475075ca4f1c6c990 in mainline
+
+[ALSA] Fix build error without CONFIG_HAS_DMA
+
+The recent change of include/asm-generic/dma-mapping-broken.h breaks
+the build without CONFIG_HAS_DMA. This patch is an ad hoc fix.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/Makefile | 3 ++-
+ sound/core/memalloc.c | 6 ++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/sound/core/Makefile
++++ b/sound/core/Makefile
+@@ -14,7 +14,8 @@ endif
+ snd-pcm-objs := pcm.o pcm_native.o pcm_lib.o pcm_timer.o pcm_misc.o \
+ pcm_memory.o
+
+-snd-page-alloc-objs := memalloc.o sgbuf.o
++snd-page-alloc-y := memalloc.o
++snd-page-alloc-$(CONFIG_HAS_DMA) += sgbuf.o
+
+ snd-rawmidi-objs := rawmidi.o
+ snd-timer-objs := timer.o
+--- a/sound/core/memalloc.c
++++ b/sound/core/memalloc.c
+@@ -206,6 +206,7 @@ void snd_free_pages(void *ptr, size_t si
+ *
+ */
+
++#ifdef CONFIG_HAS_DMA
+ /* allocate the coherent DMA pages */
+ static void *snd_malloc_dev_pages(struct device *dev, size_t size, dma_addr_t *dma)
+ {
+@@ -239,6 +240,7 @@ static void snd_free_dev_pages(struct de
+ dec_snd_pages(pg);
+ dma_free_coherent(dev, PAGE_SIZE << pg, ptr, dma);
+ }
++#endif /* CONFIG_HAS_DMA */
+
+ #ifdef CONFIG_SBUS
+
+@@ -312,12 +314,14 @@ int snd_dma_alloc_pages(int type, struct
+ dmab->area = snd_malloc_sbus_pages(device, size, &dmab->addr);
+ break;
+ #endif
++#ifdef CONFIG_HAS_DMA
+ case SNDRV_DMA_TYPE_DEV:
+ dmab->area = snd_malloc_dev_pages(device, size, &dmab->addr);
+ break;
+ case SNDRV_DMA_TYPE_DEV_SG:
+ snd_malloc_sgbuf_pages(device, size, dmab, NULL);
+ break;
++#endif
+ default:
+ printk(KERN_ERR "snd-malloc: invalid device type %d\n", type);
+ dmab->area = NULL;
+@@ -383,12 +387,14 @@ void snd_dma_free_pages(struct snd_dma_b
+ snd_free_sbus_pages(dmab->dev.dev, dmab->bytes, dmab->area, dmab->addr);
+ break;
+ #endif
++#ifdef CONFIG_HAS_DMA
+ case SNDRV_DMA_TYPE_DEV:
+ snd_free_dev_pages(dmab->dev.dev, dmab->bytes, dmab->area, dmab->addr);
+ break;
+ case SNDRV_DMA_TYPE_DEV_SG:
+ snd_free_sgbuf_pages(dmab);
+ break;
++#endif
+ default:
+ printk(KERN_ERR "snd-malloc: invalid device type %d\n", dmab->dev.type);
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:01 2007
+Message-Id: <20071115062901.775262306@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:22 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 12/40] ALSA: emu10k1 - Fix memory corruption
+Content-Disposition: inline; filename=alsa-emu10k1-fix-memory-corruption.patch
+Content-Length: 1331
+Lines: 43
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+patch 7583cb51a1e276591f57a2fae05489c878f8ef54 from mainline.
+
+[ALSA] emu10k1 - Fix memory corruption
+
+The number of mixer elements for SPDIF control don't match with the
+actual array size (3). This may result in a memory corruption that
+overwrites the i2c_capture_source field (ALSA bug#3095).
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/emu10k1/emumixer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/emu10k1/emumixer.c
++++ b/sound/pci/emu10k1/emumixer.c
+@@ -871,7 +871,7 @@ static struct snd_kcontrol_new snd_emu10
+ .access = SNDRV_CTL_ELEM_ACCESS_READ,
+ .iface = SNDRV_CTL_ELEM_IFACE_PCM,
+ .name = SNDRV_CTL_NAME_IEC958("",PLAYBACK,MASK),
+- .count = 4,
++ .count = 3,
+ .info = snd_emu10k1_spdif_info,
+ .get = snd_emu10k1_spdif_get_mask
+ };
+@@ -880,7 +880,7 @@ static struct snd_kcontrol_new snd_emu10
+ {
+ .iface = SNDRV_CTL_ELEM_IFACE_PCM,
+ .name = SNDRV_CTL_NAME_IEC958("",PLAYBACK,DEFAULT),
+- .count = 4,
++ .count = 3,
+ .info = snd_emu10k1_spdif_info,
+ .get = snd_emu10k1_spdif_get,
+ .put = snd_emu10k1_spdif_put
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:02 2007
+Message-Id: <20071115062901.939572300@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:23 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>,
+ Jaroslav Kysela <perex@perex.cz>,
+ Maarten Bressers <mbressers@gmail.com>,
+ gentoo kernel <kernel@gentoo.org>
+Subject: [patch 13/40] ALSA: hdsp - Fix zero division
+Content-Disposition: inline; filename=alsa-hdsp-fix-zero-division.patch
+Content-Length: 859
+Lines: 34
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+patch 2a3988f6d2c5be9d02463097775d1c66a8290527 in mainline.
+
+Fix zero-division bug in the calculation dds offset.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Cc: Maarten Bressers <mbressers@gmail.com>
+Cc: gentoo kernel <kernel@gentoo.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/rme9652/hdsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -3108,6 +3108,9 @@ static int hdsp_dds_offset(struct hdsp *
+ unsigned int dds_value = hdsp->dds_value;
+ int system_sample_rate = hdsp->system_sample_rate;
+
++ if (!dds_value)
++ return 0;
++
+ n = DDS_NUMERATOR;
+ /*
+ * dds_value = n / rate
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:02 2007
+Message-Id: <20071115062902.117794562@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:24 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Jeff Garzik <jeff@garzik.org>,
+ linux-ide@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <htejun@gmail.com>
+Subject: [patch 14/40] libata: sync NCQ blacklist with upstream
+Content-Disposition: inline; filename=libata-sync-ncq-blacklist-with-upstream.patch
+Content-Length: 1526
+Lines: 40
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <htejun@gmail.com>
+
+Synchronize NCQ blacklist with the current upstream. Based on changes
+already in Linus's 2.6.24-rc kernel tree.
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Cc: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3793,11 +3793,17 @@ static const struct ata_blacklist_entry
+ /* Drives which do spurious command completion */
+ { "HTS541680J9SA00", "SB2IC7EP", ATA_HORKAGE_NONCQ, },
+ { "HTS541612J9SA00", "SBDIC7JP", ATA_HORKAGE_NONCQ, },
++ { "HDT722516DLA380", "V43OA96A", ATA_HORKAGE_NONCQ, },
+ { "Hitachi HTS541616J9SA00", "SB4OC70P", ATA_HORKAGE_NONCQ, },
+ { "WDC WD740ADFD-00NLR1", NULL, ATA_HORKAGE_NONCQ, },
++ { "WDC WD3200AAJS-00RYA0", "12.01B01", ATA_HORKAGE_NONCQ, },
+ { "FUJITSU MHV2080BH", "00840028", ATA_HORKAGE_NONCQ, },
++ { "ST9120822AS", "3.CLF", ATA_HORKAGE_NONCQ, },
+ { "ST9160821AS", "3.CLF", ATA_HORKAGE_NONCQ, },
+- { "ST3160812AS", "3.AD", ATA_HORKAGE_NONCQ, },
++ { "ST9160821AS", "3.ALD", ATA_HORKAGE_NONCQ, },
++ { "ST9160821AS", "3.CCD", ATA_HORKAGE_NONCQ, },
++ { "ST3160812AS", "3.ADJ", ATA_HORKAGE_NONCQ, },
++ { "ST980813AS", "3.ADB", ATA_HORKAGE_NONCQ, },
+ { "SAMSUNG HD401LJ", "ZZ100-15", ATA_HORKAGE_NONCQ, },
+
+ /* devices which puke on READ_NATIVE_MAX */
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:02 2007
+Message-Id: <20071115062902.341212363@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:25 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ dm-devel@redhat.com,
+ Milan Broz <mbroz@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 15/40] dm delay: fix status
+Content-Disposition: inline; filename=dm-delay-fix-status.patch
+Content-Length: 927
+Lines: 35
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Milan Broz <mbroz@redhat.com>
+
+patch 79662d1ea37392651f2cff08626cab6a40ba3adc in mainline.
+
+
+Fix missing space in dm-delay target status output
+if separate read and write delay are configured.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/md/dm-delay.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-delay.c
++++ b/drivers/md/dm-delay.c
+@@ -305,7 +305,7 @@ static int delay_status(struct dm_target
+ (unsigned long long) dc->start_read,
+ dc->read_delay);
+ if (dc->dev_write)
+- DMEMIT("%s %llu %u", dc->dev_write->name,
++ DMEMIT(" %s %llu %u", dc->dev_write->name,
+ (unsigned long long) dc->start_write,
+ dc->write_delay);
+ break;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:02 2007
+Message-Id: <20071115062902.531027122@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:26 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Junichi Nomura" <j-nomura@ce.jp.nec.com>,
+ dm-devel@redhat.com,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 16/40] dm: fix thaw_bdev
+Content-Disposition: inline; filename=dm-fix-thaw_bdev.patch
+Content-Length: 2581
+Lines: 87
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
+
+patch ae9da83f6d800fe1f3b23bfbc8f7222ad1c5bb74 in mainline.
+
+This patch fixes a bd_mount_sem counter corruption bug in device-mapper.
+
+thaw_bdev() should be called only when freeze_bdev() was called for the
+device.
+Otherwise, thaw_bdev() will up bd_mount_sem and corrupt the semaphore counter.
+struct block_device with the corrupted semaphore may remain in slab cache
+and be reused later.
+
+Attached patch will fix it by calling unlock_fs() instead.
+unlock_fs() will determine whether it should call thaw_bdev()
+by checking the device is frozen or not.
+
+Easy reproducer is:
+ #!/bin/sh
+ while [ 1 ]; do
+ dmsetup --notable create a
+ dmsetup --nolockfs suspend a
+ dmsetup remove a
+ done
+
+It's not easy to see the effect of corrupted semaphore.
+So I have tested with putting printk below in bdev_alloc_inode():
+ if (atomic_read(&ei->bdev.bd_mount_sem.count) != 1)
+ printk(KERN_DEBUG "Incorrect semaphore count = %d (%p)\n",
+ atomic_read(&ei->bdev.bd_mount_sem.count),
+ &ei->bdev);
+
+Without the patch, I saw something like:
+ Incorrect semaphore count = 17 (f2ab91c0)
+
+With the patch, the message didn't appear.
+
+The bug was introduced in 2.6.16 with this bug fix:
+
+commit d9dde59ba03095e526640988c0fedd75e93bc8b7
+Date: Fri Feb 24 13:04:24 2006 -0800
+
+ [PATCH] dm: missing bdput/thaw_bdev at removal
+
+ Need to unfreeze and release bdev otherwise the bdev inode with
+ inconsistent state is reused later and cause problem.
+
+and backported to 2.6.15.5.
+
+It occurs only in free_dev(), which is called only when the dm device is
+removed. The buggy code is executed only if md->suspended_bdev is
+non-NULL and that can happen only when the device was suspended without
+noflush.
+
+Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/md/dm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1064,12 +1064,14 @@ static struct mapped_device *alloc_dev(i
+ return NULL;
+ }
+
++static void unlock_fs(struct mapped_device *md);
++
+ static void free_dev(struct mapped_device *md)
+ {
+ int minor = md->disk->first_minor;
+
+ if (md->suspended_bdev) {
+- thaw_bdev(md->suspended_bdev, NULL);
++ unlock_fs(md);
+ bdput(md->suspended_bdev);
+ }
+ mempool_destroy(md->tio_pool);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:02 2007
+Message-Id: <20071115062902.714338798@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:27 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ neilb@suse.de
+Subject: [patch 17/40] md: fix an unsigned compare to allow creation of bitmaps with v1.0 metadata
+Content-Disposition: inline; filename=md-fix-an-unsigned-compare-to-allow-creation-of-bitmaps-with-v1.0-metadata.patch
+Content-Length: 976
+Lines: 34
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: NeilBrown <neilb@suse.de>
+
+patch 85bfb4da8cad483a4e550ec89060d05a4daf895b in mainline.
+
+As page->index is unsigned, this all becomes an unsigned comparison, which
+ almost always returns an error.
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -274,7 +274,7 @@ static int write_sb_page(struct bitmap *
+ if (bitmap->offset < 0) {
+ /* DATA BITMAP METADATA */
+ if (bitmap->offset
+- + page->index * (PAGE_SIZE/512)
++ + (long)(page->index * (PAGE_SIZE/512))
+ + size/512 > 0)
+ /* bitmap runs in to metadata */
+ return -EINVAL;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:03 2007
+Message-Id: <20071115062902.869696445@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:28 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ joel.bertrand@systella.fr,
+ neilb@suse.de,
+ dan.j.williams@intel.com
+Subject: [patch 18/40] md: raid5: fix clearing of biofill operations
+Content-Disposition: inline; filename=md-raid5-not-raid6-fix-clearing-of-biofill-operations.patch
+Content-Length: 2033
+Lines: 69
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+raid5: fix clearing of biofill operations
+
+This is the correct merge of the two upstream patches for this issue (it
+was mis-merged...)
+
+ops_complete_biofill() runs outside of spin_lock(&sh->lock) and clears the
+'pending' and 'ack' bits. Since the test_and_ack_op() macro only checks
+against 'complete' it can get an inconsistent snapshot of pending work.
+
+Move the clearing of these bits to handle_stripe5(), under the lock.
+
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Tested-by: Joel Bertrand <joel.bertrand@systella.fr>
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -377,7 +377,12 @@ static unsigned long get_stripe_work(str
+ ack++;
+
+ sh->ops.count -= ack;
+- BUG_ON(sh->ops.count < 0);
++ if (unlikely(sh->ops.count < 0)) {
++ printk(KERN_ERR "pending: %#lx ops.pending: %#lx ops.ack: %#lx "
++ "ops.complete: %#lx\n", pending, sh->ops.pending,
++ sh->ops.ack, sh->ops.complete);
++ BUG();
++ }
+
+ return pending;
+ }
+@@ -551,8 +556,7 @@ static void ops_complete_biofill(void *s
+ }
+ }
+ }
+- clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
+- clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
++ set_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
+
+ return_io(return_bi);
+
+@@ -2630,6 +2634,13 @@ static void handle_stripe5(struct stripe
+ s.expanded = test_bit(STRIPE_EXPAND_READY, &sh->state);
+ /* Now to look around and see what can be done */
+
++ /* clean-up completed biofill operations */
++ if (test_bit(STRIPE_OP_BIOFILL, &sh->ops.complete)) {
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
++ }
++
+ rcu_read_lock();
+ for (i=disks; i--; ) {
+ mdk_rdev_t *rdev;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:03 2007
+Message-Id: <20071115062903.059059165@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:29 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ linux-pci@atrey.karlin.mff.cuni.cz
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland Dreier <roland@digitalvampire.org>,
+ "Eric W. Biederman" <ebiederm@xmission.com>
+Subject: [patch 19/40] MSI: Use correct data offset for 32-bit MSI in read_msi_msg()
+Content-Disposition: inline; filename=msi-use-correct-data-offset-for-32-bit-msi-in-read_msi_msg.patch
+Content-Length: 1040
+Lines: 35
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roland Dreier <roland@digitalvampire.org>
+
+patch cbf5d9e6b9bcf03291cbb51db144b3e2773a8a2d in mainline.
+
+While reading the MSI code trying to find a reason why MSI wouldn't
+work for devices that have a 32-bit MSI address capability, I noticed
+that read_msi_msg() seems to read the message data from the wrong
+offset in this case.
+
+Signed-off-by: Roland Dreier <roland@digitalvampire.org>
+Acked-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/msi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -132,7 +132,7 @@ void read_msi_msg(unsigned int irq, stru
+ pci_read_config_word(dev, msi_data_reg(pos, 1), &data);
+ } else {
+ msg->address_hi = 0;
+- pci_read_config_word(dev, msi_data_reg(pos, 1), &data);
++ pci_read_config_word(dev, msi_data_reg(pos, 0), &data);
+ }
+ msg->data = data;
+ break;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:03 2007
+Message-Id: <20071115062903.221282881@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:30 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ linux-usb-devel@lists.sourceforge.net
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 20/40] USB: remove USB_QUIRK_NO_AUTOSUSPEND
+Content-Disposition: inline; filename=usb-remove-usb_quirk_no_autosuspend.patch
+Content-Length: 6668
+Lines: 163
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Stern <stern@rowland.harvard.edu>
+
+patch a691efa9888e71232dfb4088fb8a8304ffc7b0f9 in mainline.
+
+This patch (as995) cleans up the remains of the former NO_AUTOSUSPEND
+quirk. Since autosuspend is disabled by default, we will let
+userspace worry about which devices can safely be suspended. Thus the
+lengthy series of quirk entries is no longer needed, and neither is
+the quirk ID. I suppose someone might eventually run across a hub
+that can't be suspended; let's ignore the possibility for now.
+
+The patch also cleans up the hasty way in which autosuspend gets
+disabled. Setting udev->autosuspend_delay to -1 wasn't quite right,
+because the value is always supposed to be a multiple of HZ. It's
+better to leave the delay value alone and set autosuspend_disabled,
+which is what the quirk routine used to do.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/quirks.c | 81 ---------------------------------------------
+ include/linux/usb/quirks.h | 7 +--
+ 2 files changed, 3 insertions(+), 85 deletions(-)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -32,52 +32,6 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* HP 5300/5370C scanner */
+ { USB_DEVICE(0x03f0, 0x0701), .driver_info = USB_QUIRK_STRING_FETCH_255 },
+- /* Hewlett-Packard PhotoSmart 720 / PhotoSmart 935 (storage) */
+- { USB_DEVICE(0x03f0, 0x4002), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* SGS Thomson Microelectronics 4in1 card reader */
+- { USB_DEVICE(0x0483, 0x0321), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* Acer Peripherals Inc. (now BenQ Corp.) Prisa 640BU */
+- { USB_DEVICE(0x04a5, 0x207e), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Benq S2W 3300U */
+- { USB_DEVICE(0x04a5, 0x20b0), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Canon, Inc. CanoScan N1240U/LiDE30 */
+- { USB_DEVICE(0x04a9, 0x220e), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Canon, Inc. CanoScan N650U/N656U */
+- { USB_DEVICE(0x04a9, 0x2206), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Canon, Inc. CanoScan 1220U */
+- { USB_DEVICE(0x04a9, 0x2207), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Canon, Inc. CanoScan N670U/N676U/LiDE 20 */
+- { USB_DEVICE(0x04a9, 0x220d), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* old Cannon scanner */
+- { USB_DEVICE(0x04a9, 0x2220), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seiko Epson Corp. Perfection 1200 */
+- { USB_DEVICE(0x04b8, 0x0104), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seiko Epson Corp. Perfection 660 */
+- { USB_DEVICE(0x04b8, 0x0114), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Epson Perfection 1260 Photo */
+- { USB_DEVICE(0x04b8, 0x011d), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seiko Epson Corp - Perfection 1670 */
+- { USB_DEVICE(0x04b8, 0x011f), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* EPSON Perfection 2480 */
+- { USB_DEVICE(0x04b8, 0x0121), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seiko Epson Corp.*/
+- { USB_DEVICE(0x04b8, 0x0122), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Samsung ML-2010 printer */
+- { USB_DEVICE(0x04e8, 0x326c), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Samsung ML-2510 Series printer */
+- { USB_DEVICE(0x04e8, 0x327e), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Elsa MicroLink 56k (V.250) */
+- { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Ultima Electronics Corp.*/
+- { USB_DEVICE(0x05d8, 0x4005), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* Genesys USB-to-IDE */
+- { USB_DEVICE(0x0503, 0x0702), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* USB Graphical LCD - EEH Datalink GmbH */
+- { USB_DEVICE(0x060c, 0x04eb), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+
+ /* INTEL VALUE SSD */
+ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+@@ -85,44 +39,15 @@ static const struct usb_device_id usb_qu
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* Agfa Snapscan1212u */
+- { USB_DEVICE(0x06bd, 0x2061), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seagate RSS LLC */
+- { USB_DEVICE(0x0bc2, 0x3000), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Umax [hex] Astra 3400U */
+- { USB_DEVICE(0x1606, 0x0060), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+ /* Philips PSC805 audio device */
+ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* Alcor multi-card reader */
+- { USB_DEVICE(0x058f, 0x6366), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* Canon EOS 5D in PC Connection mode */
+- { USB_DEVICE(0x04a9, 0x3101), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* RIM Blackberry */
+- { USB_DEVICE(0x0fca, 0x0001), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- { USB_DEVICE(0x0fca, 0x0004), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- { USB_DEVICE(0x0fca, 0x0006), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* Apple iPhone */
+- { USB_DEVICE(0x05ac, 0x1290), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+ /* SKYMEDI USB_DRIVE */
+ { USB_DEVICE(0x1516, 0x8628), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ { } /* terminating entry must be last */
+ };
+
+-static void usb_autosuspend_quirk(struct usb_device *udev)
+-{
+-#ifdef CONFIG_USB_SUSPEND
+- /* disable autosuspend, but allow the user to re-enable it via sysfs */
+- udev->autosuspend_disabled = 1;
+-#endif
+-}
+-
+ static const struct usb_device_id *find_id(struct usb_device *udev)
+ {
+ const struct usb_device_id *id = usb_quirk_list;
+@@ -149,13 +74,9 @@ void usb_detect_quirks(struct usb_device
+ dev_dbg(&udev->dev, "USB quirks for this device: %x\n",
+ udev->quirks);
+
+- /* do any special quirk handling here if needed */
+- if (udev->quirks & USB_QUIRK_NO_AUTOSUSPEND)
+- usb_autosuspend_quirk(udev);
+-
+ /* By default, disable autosuspend for all non-hubs */
+ #ifdef CONFIG_USB_SUSPEND
+ if (udev->descriptor.bDeviceClass != USB_CLASS_HUB)
+- udev->autosuspend_delay = -1;
++ udev->autosuspend_disabled = 1;
+ #endif
+ }
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -4,11 +4,8 @@
+ * belong here.
+ */
+
+-/* device must not be autosuspended */
+-#define USB_QUIRK_NO_AUTOSUSPEND 0x00000001
+-
+ /* string descriptors must not be fetched using a 255-byte read */
+-#define USB_QUIRK_STRING_FETCH_255 0x00000002
++#define USB_QUIRK_STRING_FETCH_255 0x00000001
+
+ /* device can't resume correctly so reset it instead */
+-#define USB_QUIRK_RESET_RESUME 0x00000004
++#define USB_QUIRK_RESET_RESUME 0x00000002
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:03 2007
+Message-Id: <20071115062903.379882048@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:31 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ linux-usb-devel@lists.sourceforge.net
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benedikt Spranger <bene@linutronix.de>,
+ Thomas Gleixner <tglx@linutronix.de>,
+ David Brownell <dbrownell@users.sourceforge.net>
+Subject: [patch 21/40] usb-gadget-ether: prevent oops caused by error interrupt race
+Content-Disposition: inline; filename=usb-gadget-ether-prevent-oops-caused-by-error-interrupt-race.patch
+Content-Length: 2005
+Lines: 56
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benedikt Spranger <bene@linutronix.de>
+
+patch 5395353e0c8272fe73ac914acd7e4add0da2bef0 in mainline.
+
+Fix a longstanding race in the Ethernet gadget driver, which can cause an
+oops on device disconnect. The fix is just to make the TX path check
+whether its freelist is empty. That check is otherwise not necessary,
+since the queue is always stopped when that list empties (and restarted
+when request completion puts an entry back on that freelist).
+
+The race window starts when the network code decides to transmit a packet,
+and ends when hard_start_xmit() grabs the freelist lock. When disconnect()
+is called inside that window, it shuts down the TX queue and breaks the
+otherwise-solid assumption that packets are never sent through a TX queue
+that's stopped.
+
+Signed-off-by: Benedikt Spranger <bene@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/ether.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/gadget/ether.c
++++ b/drivers/usb/gadget/ether.c
+@@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buf
+ }
+
+ spin_lock_irqsave(&dev->req_lock, flags);
++ /*
++ * this freelist can be empty if an interrupt triggered disconnect()
++ * and reconfigured the gadget (shutting down this queue) after the
++ * network stack decided to xmit but before we got the spinlock.
++ */
++ if (list_empty(&dev->tx_reqs)) {
++ spin_unlock_irqrestore(&dev->req_lock, flags);
++ return 1;
++ }
++
+ req = container_of (dev->tx_reqs.next, struct usb_request, list);
+ list_del (&req->list);
++
++ /* temporarily stop TX queue when the freelist empties */
+ if (list_empty (&dev->tx_reqs))
+ netif_stop_queue (net);
+ spin_unlock_irqrestore(&dev->req_lock, flags);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:03 2007
+Message-Id: <20071115062903.550853114@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:32 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ linux-usb-devel@lists.sourceforge.net
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ David Brownell <david-b@pacbell.net>,
+ David Miller <davem@davemloft.net>,
+ Dely L Sy <dely.l.sy@intel.com>
+Subject: [patch 22/40] USB: mutual exclusion for EHCI init and port resets
+Content-Disposition: inline; filename=usb-mutual-exclusion-for-ehci-init-and-port-resets.patch
+Content-Length: 3867
+Lines: 118
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Stern <stern@rowland.harvard.edu>
+
+patch 32fe01985aa2cb2562f6fc171e526e279abe10db in mainline.
+
+This patch (as999) fixes a problem that sometimes shows up when host
+controller driver modules are loaded in the wrong order. If ehci-hcd
+happens to initialize an EHCI controller while the companion OHCI or
+UHCI controller is in the middle of a port reset, the reset can fail
+and the companion may get very confused. The patch adds an
+rw-semaphore and uses it to keep EHCI initialization and port resets
+mutually exclusive.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: David Brownell <david-b@pacbell.net>
+Cc: David Miller <davem@davemloft.net>
+Cc: Dely L Sy <dely.l.sy@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/core/hcd.h | 8 +++++++-
+ drivers/usb/core/hub.c | 15 ++++++++++++++-
+ drivers/usb/host/ehci-hcd.c | 8 ++++++++
+ 3 files changed, 29 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/core/hcd.h
++++ b/drivers/usb/core/hcd.h
+@@ -19,6 +19,8 @@
+
+ #ifdef __KERNEL__
+
++#include <linux/rwsem.h>
++
+ /* This file contains declarations of usbcore internals that are mostly
+ * used or exposed by Host Controller Drivers.
+ */
+@@ -454,5 +456,9 @@ static inline void usbmon_urb_complete(s
+ : (in_interrupt () ? "in_interrupt" : "can sleep"))
+
+
+-#endif /* __KERNEL__ */
++/* This rwsem is for use only by the hub driver and ehci-hcd.
++ * Nobody else should touch it.
++ */
++extern struct rw_semaphore ehci_cf_port_reset_rwsem;
+
++#endif /* __KERNEL__ */
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -125,6 +125,12 @@ MODULE_PARM_DESC(use_both_schemes,
+ "try the other device initialization scheme if the "
+ "first one fails");
+
++/* Mutual exclusion for EHCI CF initialization. This interferes with
++ * port reset on some companion controllers.
++ */
++DECLARE_RWSEM(ehci_cf_port_reset_rwsem);
++EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem);
++
+
+ static inline char *portspeed(int portstatus)
+ {
+@@ -1460,6 +1466,11 @@ static int hub_port_reset(struct usb_hub
+ {
+ int i, status;
+
++ /* Block EHCI CF initialization during the port reset.
++ * Some companion controllers don't like it when they mix.
++ */
++ down_read(&ehci_cf_port_reset_rwsem);
++
+ /* Reset the port */
+ for (i = 0; i < PORT_RESET_TRIES; i++) {
+ status = set_port_feature(hub->hdev,
+@@ -1490,7 +1501,7 @@ static int hub_port_reset(struct usb_hub
+ usb_set_device_state(udev, status
+ ? USB_STATE_NOTATTACHED
+ : USB_STATE_DEFAULT);
+- return status;
++ goto done;
+ }
+
+ dev_dbg (hub->intfdev,
+@@ -1503,6 +1514,8 @@ static int hub_port_reset(struct usb_hub
+ "Cannot enable port %i. Maybe the USB cable is bad?\n",
+ port1);
+
++ done:
++ up_read(&ehci_cf_port_reset_rwsem);
+ return status;
+ }
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -570,10 +570,18 @@ static int ehci_run (struct usb_hcd *hcd
+ * are explicitly handed to companion controller(s), so no TT is
+ * involved with the root hub. (Except where one is integrated,
+ * and there's no companion controller unless maybe for USB OTG.)
++ *
++ * Turning on the CF flag will transfer ownership of all ports
++ * from the companions to the EHCI controller. If any of the
++ * companions are in the middle of a port reset at the time, it
++ * could cause trouble. Write-locking ehci_cf_port_reset_rwsem
++ * guarantees that no resets are in progress.
+ */
++ down_write(&ehci_cf_port_reset_rwsem);
+ hcd->state = HC_STATE_RUNNING;
+ ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
++ up_write(&ehci_cf_port_reset_rwsem);
+
+ temp = HC_VERSION(ehci_readl(ehci, &ehci->caps->hc_capbase));
+ ehci_info (ehci,
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:03 2007
+Message-Id: <20071115062903.709282975@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:33 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ linux-usb-devel@lists.sourceforge.net
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oliver Neukum <oneukum@suse.de>,
+ Marcel Holtmann <marcel@holtmann.org>
+Subject: [patch 23/40] USB: add URB_FREE_BUFFER to permissible flags
+Content-Disposition: inline; filename=usb-add-urb_free_buffer-to-permissible-flags.patch
+Content-Length: 866
+Lines: 34
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Oliver Neukum <oliver@neukum.org>
+
+patch 0b28baaf74ca04be2e0cc4d4dd2bbc801697f744 in mainline.
+
+URB_FREE_BUFFER needs to be allowed in the sanity checks to use drivers that
+use that flag.
+
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/urb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -358,7 +358,7 @@ int usb_submit_urb(struct urb *urb, gfp_
+
+ /* enforce simple/standard policy */
+ allowed = (URB_NO_TRANSFER_DMA_MAP | URB_NO_SETUP_DMA_MAP |
+- URB_NO_INTERRUPT);
++ URB_NO_INTERRUPT | URB_FREE_BUFFER);
+ switch (temp) {
+ case PIPE_BULK:
+ if (is_out)
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:04 2007
+Message-Id: <20071115062903.875198292@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:34 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Kosina <jkosina@suse.cz>,
+ Larry Finger <larry.finger@lwfinger.net>,
+ Marcin Slusarz <marcin.slusarz@gmail.com>
+Subject: [patch 24/40] USB: usbserial - fix potential deadlock between write() and IRQ
+Content-Disposition: inline; filename=usb-usbserial-fix-potential-deadlock-between-write-and-irq.patch
+Content-Length: 1447
+Lines: 46
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jiri Kosina <jkosina@suse.cz>
+
+patch acd2a847e7fee7df11817f67dba75a2802793e5d in mainline.
+
+USB: usbserial - fix potential deadlock between write() and IRQ
+
+usb_serial_generic_write() doesn't disable interrupts when taking port->lock,
+and could therefore deadlock with usb_serial_generic_read_bulk_callback()
+being called from interrupt, taking the same lock. Fix it.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Larry Finger <larry.finger@lwfinger.net>
+Cc: Marcin Slusarz <marcin.slusarz@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/generic.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -208,14 +208,15 @@ int usb_serial_generic_write(struct usb_
+
+ /* only do something if we have a bulk out endpoint */
+ if (serial->num_bulk_out) {
+- spin_lock_bh(&port->lock);
++ unsigned long flags;
++ spin_lock_irqsave(&port->lock, flags);
+ if (port->write_urb_busy) {
+- spin_unlock_bh(&port->lock);
++ spin_unlock_irqrestore(&port->lock, flags);
+ dbg("%s - already writing", __FUNCTION__);
+ return 0;
+ }
+ port->write_urb_busy = 1;
+- spin_unlock_bh(&port->lock);
++ spin_unlock_irqrestore(&port->lock, flags);
+
+ count = (count > port->bulk_out_size) ? port->bulk_out_size : count;
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:04 2007
+Message-Id: <20071115062904.037713962@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:35 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 25/40] ALSA: hda-codec - Add array terminator for dmic in STAC codec
+Content-Disposition: inline; filename=alsa-hda-codec-add-array-terminator-for-dmic-in-stac-codec.patch
+Content-Length: 1912
+Lines: 68
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+patch f6e9852ad05fa28301c83d4e2b082620de010358 in mainline.
+
+[ALSA] hda-codec - Add array terminator for dmic in STAC codec
+
+Reported by Jan-Marek Glogowski.
+
+The dmic array is passed to snd_hda_parse_pin_def_config() and
+should be zero-terminated.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -162,8 +162,9 @@ static hda_nid_t stac925x_dac_nids[1] =
+ 0x02,
+ };
+
+-static hda_nid_t stac925x_dmic_nids[1] = {
+- 0x15,
++#define STAC925X_NUM_DMICS 1
++static hda_nid_t stac925x_dmic_nids[STAC925X_NUM_DMICS + 1] = {
++ 0x15, 0
+ };
+
+ static hda_nid_t stac922x_adc_nids[2] = {
+@@ -190,8 +191,9 @@ static hda_nid_t stac9205_mux_nids[2] =
+ 0x19, 0x1a
+ };
+
+-static hda_nid_t stac9205_dmic_nids[2] = {
+- 0x17, 0x18,
++#define STAC9205_NUM_DMICS 2
++static hda_nid_t stac9205_dmic_nids[STAC9205_NUM_DMICS + 1] = {
++ 0x17, 0x18, 0
+ };
+
+ static hda_nid_t stac9200_pin_nids[8] = {
+@@ -2063,7 +2065,7 @@ static int patch_stac925x(struct hda_cod
+ case 0x83847633: /* STAC9202D */
+ case 0x83847636: /* STAC9251 */
+ case 0x83847637: /* STAC9251D */
+- spec->num_dmics = 1;
++ spec->num_dmics = STAC925X_NUM_DMICS;
+ spec->dmic_nids = stac925x_dmic_nids;
+ break;
+ default:
+@@ -2307,7 +2309,7 @@ static int patch_stac9205(struct hda_cod
+ spec->mux_nids = stac9205_mux_nids;
+ spec->num_muxes = ARRAY_SIZE(stac9205_mux_nids);
+ spec->dmic_nids = stac9205_dmic_nids;
+- spec->num_dmics = ARRAY_SIZE(stac9205_dmic_nids);
++ spec->num_dmics = STAC9205_NUM_DMICS;
+ spec->dmux_nid = 0x1d;
+
+ spec->init = stac9205_core_init;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:04 2007
+Message-Id: <20071115062904.192183806@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:36 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ rainer.brestan@frequentis.com,
+ kkeil@suse.de,
+ rsc@runtux.com
+Subject: [patch 26/40] i4l: Fix random hard freeze with AVM c4 card
+Content-Disposition: inline; filename=i4l-fix-random-hard-freeze-with-avm-c4-card.patch
+Content-Length: 3274
+Lines: 102
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Karsten Keil <kkeil@suse.de>
+
+patch 1ccfd63367c1a6aaf8b33943f18856dde85f2f0b in mainline.
+
+The patch
+- Includes the call to capilib_data_b3_req in the spinlock. This routine
+ in turn calls the offending mq_enqueue routine that triggered the
+ freeze if not locked. This should also fix other indicators of
+ incosistent capilib_msgidqueue list, that trigger messages like:
+ Oct 5 03:05:57 BERL0 kernel: kcapi: msgid 3019 ncci 0x30301 not on queue
+ that we saw several times a day (usually several in a row).
+- Fixes all occurrences of c4_dispatch_tx to be called with active
+ spinlock, there were some instances where no lock was active. Mostly
+ these are in very infrequently called routines, so the additional
+ performance penalty is minimal.
+
+Signed-off-by: Karsten Keil <kkeil@suse.de>
+Signed-off-by: Rainer Brestan <rainer.brestan@frequentis.com>
+Signed-off-by: Ralf Schlatterbeck <rsc@runtux.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/hardware/avm/c4.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/isdn/hardware/avm/c4.c
++++ b/drivers/isdn/hardware/avm/c4.c
+@@ -727,6 +727,7 @@ static void c4_send_init(avmcard *card)
+ {
+ struct sk_buff *skb;
+ void *p;
++ unsigned long flags;
+
+ skb = alloc_skb(15, GFP_ATOMIC);
+ if (!skb) {
+@@ -744,12 +745,15 @@ static void c4_send_init(avmcard *card)
+ skb_put(skb, (u8 *)p - (u8 *)skb->data);
+
+ skb_queue_tail(&card->dma->send_queue, skb);
++ spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
++ spin_unlock_irqrestore(&card->lock, flags);
+ }
+
+ static int queue_sendconfigword(avmcard *card, u32 val)
+ {
+ struct sk_buff *skb;
++ unsigned long flags;
+ void *p;
+
+ skb = alloc_skb(3+4, GFP_ATOMIC);
+@@ -766,7 +770,9 @@ static int queue_sendconfigword(avmcard
+ skb_put(skb, (u8 *)p - (u8 *)skb->data);
+
+ skb_queue_tail(&card->dma->send_queue, skb);
++ spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
++ spin_unlock_irqrestore(&card->lock, flags);
+ return 0;
+ }
+
+@@ -986,7 +992,9 @@ static void c4_release_appl(struct capi_
+ struct sk_buff *skb;
+ void *p;
+
++ spin_lock_irqsave(&card->lock, flags);
+ capilib_release_appl(&cinfo->ncci_head, appl);
++ spin_unlock_irqrestore(&card->lock, flags);
+
+ if (ctrl->cnr == card->cardnr) {
+ skb = alloc_skb(7, GFP_ATOMIC);
+@@ -1019,7 +1027,8 @@ static u16 c4_send_message(struct capi_c
+ u16 retval = CAPI_NOERROR;
+ unsigned long flags;
+
+- if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_REQ) {
++ spin_lock_irqsave(&card->lock, flags);
++ if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_REQ) {
+ retval = capilib_data_b3_req(&cinfo->ncci_head,
+ CAPIMSG_APPID(skb->data),
+ CAPIMSG_NCCI(skb->data),
+@@ -1027,10 +1036,9 @@ static u16 c4_send_message(struct capi_c
+ }
+ if (retval == CAPI_NOERROR) {
+ skb_queue_tail(&card->dma->send_queue, skb);
+- spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
+- spin_unlock_irqrestore(&card->lock, flags);
+ }
++ spin_unlock_irqrestore(&card->lock, flags);
+ return retval;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:04 2007
+Message-Id: <20071115062904.441671979@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:37 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ kkeil@suse.de
+Subject: [patch 27/40] i4l: fix random freezes with AVM B1 drivers
+Content-Disposition: inline; filename=i4l-fix-random-freezes-with-avm-b1-drivers.patch
+Content-Length: 4214
+Lines: 134
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Karsten Keil <kkeil@suse.de>
+
+patch 9713d9e650045f7f2afd81d58a068827be306993 in mainline.
+
+This fix the same issue which was debbuged for the C4 controller for the B1
+versions.
+
+The capilib_ function modify or traverse a linked list without locking.
+
+This patch extends the existing locking to the calls of these function to
+prevent access to a list which is in the middle of a modification.
+
+Signed-off-by: Karsten Keil <kkeil@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/hardware/avm/b1.c | 28 +++++++++++++---------------
+ 1 file changed, 13 insertions(+), 15 deletions(-)
+
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -321,12 +321,15 @@ void b1_reset_ctr(struct capi_ctr *ctrl)
+ avmctrl_info *cinfo = (avmctrl_info *)(ctrl->driverdata);
+ avmcard *card = cinfo->card;
+ unsigned int port = card->port;
++ unsigned long flags;
+
+ b1_reset(port);
+ b1_reset(port);
+
+ memset(cinfo->version, 0, sizeof(cinfo->version));
++ spin_lock_irqsave(&card->lock, flags);
+ capilib_release(&cinfo->ncci_head);
++ spin_unlock_irqrestore(&card->lock, flags);
+ capi_ctr_reseted(ctrl);
+ }
+
+@@ -361,9 +364,8 @@ void b1_release_appl(struct capi_ctr *ct
+ unsigned int port = card->port;
+ unsigned long flags;
+
+- capilib_release_appl(&cinfo->ncci_head, appl);
+-
+ spin_lock_irqsave(&card->lock, flags);
++ capilib_release_appl(&cinfo->ncci_head, appl);
+ b1_put_byte(port, SEND_RELEASE);
+ b1_put_word(port, appl);
+ spin_unlock_irqrestore(&card->lock, flags);
+@@ -380,27 +382,27 @@ u16 b1_send_message(struct capi_ctr *ctr
+ u8 subcmd = CAPIMSG_SUBCOMMAND(skb->data);
+ u16 dlen, retval;
+
++ spin_lock_irqsave(&card->lock, flags);
+ if (CAPICMD(cmd, subcmd) == CAPI_DATA_B3_REQ) {
+ retval = capilib_data_b3_req(&cinfo->ncci_head,
+ CAPIMSG_APPID(skb->data),
+ CAPIMSG_NCCI(skb->data),
+ CAPIMSG_MSGID(skb->data));
+- if (retval != CAPI_NOERROR)
++ if (retval != CAPI_NOERROR) {
++ spin_unlock_irqrestore(&card->lock, flags);
+ return retval;
++ }
+
+ dlen = CAPIMSG_DATALEN(skb->data);
+
+- spin_lock_irqsave(&card->lock, flags);
+ b1_put_byte(port, SEND_DATA_B3_REQ);
+ b1_put_slice(port, skb->data, len);
+ b1_put_slice(port, skb->data + len, dlen);
+- spin_unlock_irqrestore(&card->lock, flags);
+ } else {
+- spin_lock_irqsave(&card->lock, flags);
+ b1_put_byte(port, SEND_MESSAGE);
+ b1_put_slice(port, skb->data, len);
+- spin_unlock_irqrestore(&card->lock, flags);
+ }
++ spin_unlock_irqrestore(&card->lock, flags);
+
+ dev_kfree_skb_any(skb);
+ return CAPI_NOERROR;
+@@ -534,17 +536,17 @@ irqreturn_t b1_interrupt(int interrupt,
+
+ ApplId = (unsigned) b1_get_word(card->port);
+ MsgLen = b1_get_slice(card->port, card->msgbuf);
+- spin_unlock_irqrestore(&card->lock, flags);
+ if (!(skb = alloc_skb(MsgLen, GFP_ATOMIC))) {
+ printk(KERN_ERR "%s: incoming packet dropped\n",
+ card->name);
++ spin_unlock_irqrestore(&card->lock, flags);
+ } else {
+ memcpy(skb_put(skb, MsgLen), card->msgbuf, MsgLen);
+ if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_CONF)
+ capilib_data_b3_conf(&cinfo->ncci_head, ApplId,
+ CAPIMSG_NCCI(skb->data),
+ CAPIMSG_MSGID(skb->data));
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ capi_ctr_handle_message(ctrl, ApplId, skb);
+ }
+ break;
+@@ -554,21 +556,17 @@ irqreturn_t b1_interrupt(int interrupt,
+ ApplId = b1_get_word(card->port);
+ NCCI = b1_get_word(card->port);
+ WindowSize = b1_get_word(card->port);
+- spin_unlock_irqrestore(&card->lock, flags);
+-
+ capilib_new_ncci(&cinfo->ncci_head, ApplId, NCCI, WindowSize);
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ break;
+
+ case RECEIVE_FREE_NCCI:
+
+ ApplId = b1_get_word(card->port);
+ NCCI = b1_get_word(card->port);
+- spin_unlock_irqrestore(&card->lock, flags);
+-
+ if (NCCI != 0xffffffff)
+ capilib_free_ncci(&cinfo->ncci_head, ApplId, NCCI);
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ break;
+
+ case RECEIVE_START:
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:04 2007
+Message-Id: <20071115062904.637205807@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:38 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tony Battersby <tonyb@cybernetics.com>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Subject: [patch 28/40] ide: fix serverworks.c UDMA regression
+Content-Disposition: inline; filename=ide-fix-serverworks.c-udma-regression.patch
+Content-Length: 1166
+Lines: 41
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tony Battersby <tonyb@cybernetics.com>
+
+patch 0c824b51b338c808de650b440ba5f9f4a725f7fc in mainline.
+
+The patch described by the following excerpt from ChangeLog-2.6.22 makes
+it impossible to use UDMA on a Tyan S2707 motherboard (SvrWks CSB5):
+
+commit 2d5eaa6dd744a641e75503232a01f52d0768884c
+Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Date: Thu May 10 00:01:08 2007 +0200
+
+ ide: rework the code for selecting the best DMA transfer mode (v3)
+
+ ...
+
+This one-line patch against 2.6.23 fixes the problem.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/pci/serverworks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ide/pci/serverworks.c
++++ b/drivers/ide/pci/serverworks.c
+@@ -97,6 +97,7 @@ static u8 svwks_udma_filter(ide_drive_t
+ mode = 2;
+
+ switch(mode) {
++ case 3: mask = 0x3f; break;
+ case 2: mask = 0x1f; break;
+ case 1: mask = 0x07; break;
+ default: mask = 0x00; break;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:05 2007
+Message-Id: <20071115062904.884670493@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:39 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Andrew Morton <akpm@osdl.org>,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Subject: [patch 29/40] ide: Add ide_get_paired_drive() helper
+Content-Disposition: inline; filename=ide-add-ide_get_paired_drive-helper.patch
+Content-Length: 987
+Lines: 37
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+patch 1b678347121001c3c230c6eccfdf9f65c3ec1a4e in mainline.
+
+This adds a helper to get to the "other" drive on a pair connected
+to a given hwif.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Andrew Morton <akpm@osdl.org>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/ide.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/include/linux/ide.h
++++ b/include/linux/ide.h
+@@ -1437,4 +1437,11 @@ static inline int hwif_to_node(ide_hwif_
+ return dev ? pcibus_to_node(dev->bus) : -1;
+ }
+
++static inline ide_drive_t *ide_get_paired_drive(ide_drive_t *drive)
++{
++ ide_hwif_t *hwif = HWIF(drive);
++
++ return &hwif->drives[(drive->dn ^ 1) & 1];
++}
++
+ #endif /* _IDE_H */
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:05 2007
+Message-Id: <20071115062905.084062783@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:40 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Andrew Morton <akpm@osdl.org>,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Subject: [patch 30/40] ide: Fix siimage driver accessing beyond array boundary
+Content-Disposition: inline; filename=ide-fix-siimage-driver-accessing-beyond-array-boundary.patch
+Content-Length: 1250
+Lines: 38
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+patch a87a87ccdc541e0a0cc8c7d01a365be8d9153a7b in mainline.
+
+The siimage uses an incorrect construct to access the other drive of a pair,
+causing it to access beyond an array boundary on the secondary interface.
+
+This fixes it by using the new ide_get_paired_drive() helper instead.
+
+Bart: patch description fixes
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Andrew Morton <akpm@osdl.org>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/pci/siimage.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ide/pci/siimage.c
++++ b/drivers/ide/pci/siimage.c
+@@ -180,7 +180,7 @@ static void sil_tune_pio(ide_drive_t *dr
+ const u16 data_speed[] = { 0x328a, 0x2283, 0x1104, 0x10c3, 0x10c1 };
+
+ ide_hwif_t *hwif = HWIF(drive);
+- ide_drive_t *pair = &hwif->drives[drive->dn ^ 1];
++ ide_drive_t *pair = ide_get_paired_drive(drive);
+ u32 speedt = 0;
+ u16 speedp = 0;
+ unsigned long addr = siimage_seldev(drive, 0x04);
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:05 2007
+Message-Id: <20071115062905.245258865@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:41 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Andrew Morton <akpm@osdl.org>,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Subject: [patch 31/40] ide: Fix cs5535 driver accessing beyond array boundary
+Content-Disposition: inline; filename=ide-fix-cs5535-driver-accessing-beyond-array-boundary.patch
+Content-Length: 1183
+Lines: 39
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+
+patch 15d8061bf02aa299b2447f7a22fd18b4a503ea9d in mainline.
+
+The cs5535 uses an incorrect construct to access the other drive of a pair,
+causing it to access beyond an array boundary on the secondary interface.
+
+This fixes it by using the new ide_get_paired_drive() helper instead.
+
+Bart: patch description fixes
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Andrew Morton <akpm@osdl.org>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/pci/cs5535.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ide/pci/cs5535.c
++++ b/drivers/ide/pci/cs5535.c
+@@ -84,7 +84,7 @@ static void cs5535_set_speed(ide_drive_t
+
+ /* Set the PIO timings */
+ if ((speed & XFER_MODE) == XFER_PIO) {
+- ide_drive_t *pair = &drive->hwif->drives[drive->dn ^ 1];
++ ide_drive_t *pair = ide_get_paired_drive(drive);
+ u8 cmd, pioa;
+
+ cmd = pioa = speed - XFER_PIO_0;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:05 2007
+Message-Id: <20071115062905.407815533@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:42 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ James.Bottomley@steeleye.com
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux@highpoint-tech.com,
+ linux-scsi@vger.kernel.org
+Subject: [patch 32/40] hptiop: avoid buffer overflow when returning sense data
+Content-Disposition: inline; filename=hptiop-avoid-buffer-overflow-when-returning-sense-data.patch
+Content-Length: 1282
+Lines: 42
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: HighPoint Linux Team <linux@highpoint-tech.com>
+
+patch 0fec02c93f60fb44ba3a24a0d3e4a52521d34d3f in mainline.
+
+avoid buffer overflow when returning sense data.
+
+With current adapter firmware the driver is working but future firmware
+updates may return sense data larger than 96 bytes, causing overflow on
+scp->sense_buffer and a kernel crash.
+
+This fix should be backported to earlier kernels.
+
+Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
+Signed-off-by: James Bottomley <James.Bottomley@steeleye.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/hptiop.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/hptiop.c
++++ b/drivers/scsi/hptiop.c
+@@ -365,8 +365,9 @@ static void hptiop_host_request_callback
+ scp->result = SAM_STAT_CHECK_CONDITION;
+ memset(&scp->sense_buffer,
+ 0, sizeof(scp->sense_buffer));
+- memcpy(&scp->sense_buffer,
+- &req->sg_list, le32_to_cpu(req->dataxfer_length));
++ memcpy(&scp->sense_buffer, &req->sg_list,
++ min(sizeof(scp->sense_buffer),
++ le32_to_cpu(req->dataxfer_length)));
+ break;
+
+ default:
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:05 2007
+Message-Id: <20071115062905.569474410@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:43 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Ferenc Wagner <wferi@niif.hu>
+Subject: [patch 33/40] Char: rocket, fix dynamic_dev tty
+Content-Disposition: inline; filename=char-rocket-fix-dynamic_dev-tty.patch
+Content-Length: 2186
+Lines: 70
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jiri Slaby <jirislaby@gmail.com>
+
+patch ac6aec2f5683588361ab408cb3346b08c66bdfbe in mainline.
+
+- register_device unconditionally (non-pci dependent) to have also isa
+ devices in /dev
+- unregister devices on module removal
+- don't set TTY_DRIVER_DYNAMIC_DEV twice (removed the one dependent on some
+ macro)
+
+This is the substantial part of the patch and the previous point is for
+not checking which devices to unregister and which not (simply register
+and unregister all found no matter on which bus they are plugged).
+
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Cc: Ferenc Wagner <wferi@niif.hu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/rocket.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/char/rocket.c
++++ b/drivers/char/rocket.c
+@@ -699,8 +699,8 @@ static void init_r_port(int board, int a
+ spin_lock_init(&info->slock);
+ mutex_init(&info->write_mtx);
+ rp_table[line] = info;
+- if (pci_dev)
+- tty_register_device(rocket_driver, line, &pci_dev->dev);
++ tty_register_device(rocket_driver, line, pci_dev ? &pci_dev->dev :
++ NULL);
+ }
+
+ /*
+@@ -2434,7 +2434,7 @@ static int __init rp_init(void)
+ rocket_driver->init_termios.c_ispeed = 9600;
+ rocket_driver->init_termios.c_ospeed = 9600;
+ #ifdef ROCKET_SOFT_FLOW
+- rocket_driver->flags |= TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
++ rocket_driver->flags |= TTY_DRIVER_REAL_RAW;
+ #endif
+ tty_set_operations(rocket_driver, &rocket_ops);
+
+@@ -2491,10 +2491,14 @@ static void rp_cleanup_module(void)
+ if (retval)
+ printk(KERN_INFO "Error %d while trying to unregister "
+ "rocketport driver\n", -retval);
+- put_tty_driver(rocket_driver);
+
+ for (i = 0; i < MAX_RP_PORTS; i++)
+- kfree(rp_table[i]);
++ if (rp_table[i]) {
++ tty_unregister_device(rocket_driver, i);
++ kfree(rp_table[i]);
++ }
++
++ put_tty_driver(rocket_driver);
+
+ for (i = 0; i < NUM_BOARDS; i++) {
+ if (rcktpt_io_addr[i] <= 0 || is_PCI[i])
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:05 2007
+Message-Id: <20071115062905.740208282@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:44 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>
+Subject: [patch 34/40] Char: moxa, fix and optimise empty timer
+Content-Disposition: inline; filename=char-moxa-fix-and-optimise-empty-timer.patch
+Content-Length: 1366
+Lines: 48
+
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jiri Slaby <jirislaby@gmail.com>
+
+patch c43422053bea7a5ce09f18d0c50a606fe1a549f4 in mainline.
+
+moxa, fix and optimise empty timer
+
+don't wait and delete empty timer in empty timer function. Also fire next
+empty timer at rounded jiffies to save power.
+
+This fixes a lockup, because we wait for ourselves to finish forever.
+(i.e. sync called from the timer itself).
+
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/moxa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/moxa.c
++++ b/drivers/char/moxa.c
+@@ -1040,14 +1040,14 @@ static void check_xmit_empty(unsigned lo
+ struct moxa_port *ch;
+
+ ch = (struct moxa_port *) data;
+- del_timer_sync(&moxa_ports[ch->port].emptyTimer);
+ if (ch->tty && (ch->statusflags & EMPTYWAIT)) {
+ if (MoxaPortTxQueue(ch->port) == 0) {
+ ch->statusflags &= ~EMPTYWAIT;
+ tty_wakeup(ch->tty);
+ return;
+ }
+- mod_timer(&moxa_ports[ch->port].emptyTimer, jiffies + HZ);
++ mod_timer(&moxa_ports[ch->port].emptyTimer,
++ round_jiffies(jiffies + HZ));
+ } else
+ ch->statusflags &= ~EMPTYWAIT;
+ }
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:06 2007
+Message-Id: <20071115062905.896870988@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:45 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Airlie <airlied@redhat.com>
+Subject: [patch 35/40] radeon: set the address to access the GART table on the CPU side correctly
+Content-Disposition: inline; filename=radeon-set-the-address-to-access-the-gart-table-on-the-cpu-side-correctly.patch
+Content-Length: 1812
+Lines: 53
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dave Airlie <airlied@linux.ie>
+
+Upstream as 7fc86860cf73e060ab8ed9763010dfe5b5389b1c
+
+This code relied on the CPU and GPU address for the aperture being the same,
+On some r5xx hardware I was playing with I noticed that this isn't always true.
+This fixes issues seen on some r400 cards. (bugs.freedesktop.org 9957)
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/drm/radeon_cp.c | 5 +++--
+ drivers/char/drm/radeon_drv.h | 1 +
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/drm/radeon_cp.c
++++ b/drivers/char/drm/radeon_cp.c
+@@ -1679,7 +1679,7 @@ static int radeon_do_init_cp(struct drm_
+ dev_priv->gart_info.bus_addr =
+ dev_priv->pcigart_offset + dev_priv->fb_location;
+ dev_priv->gart_info.mapping.offset =
+- dev_priv->gart_info.bus_addr;
++ dev_priv->pcigart_offset + dev_priv->fb_aper_offset;
+ dev_priv->gart_info.mapping.size =
+ dev_priv->gart_info.table_size;
+
+@@ -2291,7 +2291,8 @@ int radeon_driver_firstopen(struct drm_d
+ if (ret != 0)
+ return ret;
+
+- ret = drm_addmap(dev, drm_get_resource_start(dev, 0),
++ dev_priv->fb_aper_offset = drm_get_resource_start(dev, 0);
++ ret = drm_addmap(dev, dev_priv->fb_aper_offset,
+ drm_get_resource_len(dev, 0), _DRM_FRAME_BUFFER,
+ _DRM_WRITE_COMBINING, &map);
+ if (ret != 0)
+--- a/drivers/char/drm/radeon_drv.h
++++ b/drivers/char/drm/radeon_drv.h
+@@ -293,6 +293,7 @@ typedef struct drm_radeon_private {
+
+ /* starting from here on, data is preserved accross an open */
+ uint32_t flags; /* see radeon_chip_flags */
++ unsigned long fb_aper_offset;
+ } drm_radeon_private_t;
+
+ typedef struct drm_radeon_buf_priv {
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:06 2007
+Message-Id: <20071115062906.104644849@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:46 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Luca Tettamanti <kronos.it@gmail.com>,
+ Tejun Heo <htejun@gmail.com>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 36/40] libata: add HTS542525K9SA00 to NCQ blacklist
+Content-Disposition: inline; filename=libata-add-hts542525k9sa00-to-ncq-blacklist.patch
+Content-Length: 1062
+Lines: 31
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <htejun@gmail.com>
+
+patch e14cbfa630cd3ab2631ee21b718b290928f47868 in mainline.
+
+Another one doing spurious NCQ completions. Blacklist it.
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Cc: Luca Tettamanti <kronos.it@gmail.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3795,6 +3795,7 @@ static const struct ata_blacklist_entry
+ { "HTS541612J9SA00", "SBDIC7JP", ATA_HORKAGE_NONCQ, },
+ { "HDT722516DLA380", "V43OA96A", ATA_HORKAGE_NONCQ, },
+ { "Hitachi HTS541616J9SA00", "SB4OC70P", ATA_HORKAGE_NONCQ, },
++ { "Hitachi HTS542525K9SA00", "BBFOC31P", ATA_HORKAGE_NONCQ, },
+ { "WDC WD740ADFD-00NLR1", NULL, ATA_HORKAGE_NONCQ, },
+ { "WDC WD3200AAJS-00RYA0", "12.01B01", ATA_HORKAGE_NONCQ, },
+ { "FUJITSU MHV2080BH", "00840028", ATA_HORKAGE_NONCQ, },
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:06 2007
+Message-Id: <20071115062906.267279395@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:47 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ linux-ide@vger.kernel.org,
+ Jeff Garzik <jeff@garzik.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <htejun@gmail.com>
+Subject: [patch 37/40] libata: backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA
+Content-Disposition: inline; filename=libata-backport-ata_flag_no_srst-and-ata_flag_assume_ata.patch
+Content-Length: 3755
+Lines: 116
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <htejun@gmail.com>
+
+Differs from mainline, but the functionality is already there.
+
+Backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA. These are
+originally link flags (ATA_LFLAG_*) but link abstraction doesn't exist
+on 2.6.23, so make it port flags.
+
+This is for the following workaround for ASUS P5W DH Deluxe.
+
+These new flags don't introduce any behavior change unless set and
+nobody sets them yet.
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Cc: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-eh.c | 32 ++++++++++++++++++++++++--------
+ include/linux/libata.h | 2 ++
+ 2 files changed, 26 insertions(+), 8 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -1759,9 +1759,11 @@ static int ata_do_reset(struct ata_port
+ return 0;
+ }
+
+-static int ata_eh_followup_srst_needed(int rc, int classify,
+- const unsigned int *classes)
++static int ata_eh_followup_srst_needed(struct ata_port *ap, int rc,
++ int classify, const unsigned int *classes)
+ {
++ if (ap->flags & ATA_FLAG_NO_SRST)
++ return 0;
+ if (rc == -EAGAIN)
+ return 1;
+ if (rc != 0)
+@@ -1792,7 +1794,8 @@ static int ata_eh_reset(struct ata_port
+ */
+ action = ehc->i.action;
+ ehc->i.action &= ~ATA_EH_RESET_MASK;
+- if (softreset && (!hardreset || (!sata_set_spd_needed(ap) &&
++ if (softreset && (!hardreset || (!(ap->flags & ATA_FLAG_NO_SRST) &&
++ !sata_set_spd_needed(ap) &&
+ !(action & ATA_EH_HARDRESET))))
+ ehc->i.action |= ATA_EH_SOFTRESET;
+ else
+@@ -1855,7 +1858,7 @@ static int ata_eh_reset(struct ata_port
+ rc = ata_do_reset(ap, reset, classes, deadline);
+
+ if (reset == hardreset &&
+- ata_eh_followup_srst_needed(rc, classify, classes)) {
++ ata_eh_followup_srst_needed(ap, rc, classify, classes)) {
+ /* okay, let's do follow-up softreset */
+ reset = softreset;
+
+@@ -1870,8 +1873,8 @@ static int ata_eh_reset(struct ata_port
+ ata_eh_about_to_do(ap, NULL, ATA_EH_RESET_MASK);
+ rc = ata_do_reset(ap, reset, classes, deadline);
+
+- if (rc == 0 && classify &&
+- classes[0] == ATA_DEV_UNKNOWN) {
++ if (rc == 0 && classify && classes[0] == ATA_DEV_UNKNOWN &&
++ !(ap->flags & ATA_FLAG_ASSUME_ATA)) {
+ ata_port_printk(ap, KERN_ERR,
+ "classification failed\n");
+ rc = -EINVAL;
+@@ -1879,6 +1882,10 @@ static int ata_eh_reset(struct ata_port
+ }
+ }
+
++ /* if we skipped follow-up srst, clear rc */
++ if (rc == -EAGAIN)
++ rc = 0;
++
+ if (rc && try < ARRAY_SIZE(ata_eh_reset_timeouts)) {
+ unsigned long now = jiffies;
+
+@@ -1906,8 +1913,17 @@ static int ata_eh_reset(struct ata_port
+ /* After the reset, the device state is PIO 0 and the
+ * controller state is undefined. Record the mode.
+ */
+- for (i = 0; i < ATA_MAX_DEVICES; i++)
+- ap->device[i].pio_mode = XFER_PIO_0;
++ for (i = 0; i < ata_port_max_devices(ap); i++) {
++ struct ata_device *dev = &ap->device[i];
++
++ dev->pio_mode = XFER_PIO_0;
++
++ if (ata_port_offline(ap))
++ continue;
++
++ if (ap->flags & ATA_FLAG_ASSUME_ATA)
++ classes[dev->devno] = ATA_DEV_ATA;
++ }
+
+ /* record current link speed */
+ if (sata_scr_read(ap, SCR_STATUS, &sstatus) == 0)
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -177,6 +177,8 @@ enum {
+ ATA_FLAG_IGN_SIMPLEX = (1 << 15), /* ignore SIMPLEX */
+ ATA_FLAG_NO_IORDY = (1 << 16), /* controller lacks iordy */
+ ATA_FLAG_ACPI_SATA = (1 << 17), /* need native SATA ACPI layout */
++ ATA_FLAG_NO_SRST = (1 << 18),
++ ATA_FLAG_ASSUME_ATA = (1 << 19),
+
+ /* The following flag belongs to ap->pflags but is kept in
+ * ap->flags because it's referenced in many LLDs and will be
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:06 2007
+Message-Id: <20071115062906.422610571@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:48 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ linux-ide@vger.kernel.org,
+ Jeff Garzik <jeff@garzik.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <htejun@gmail.com>
+Subject: [patch 38/40] libata: backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA, part 2
+Content-Disposition: inline; filename=libata-backport-ata_flag_no_srst-and-ata_flag_assume_ata-part-2.patch
+Content-Length: 7255
+Lines: 230
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <htejun@gmail.com>
+
+Differs from mainline, but the functionality is already there.
+
+P5W-DH Deluxe has ICH7R which doesn't have PMP support but SIMG 4726
+hardwired to the second port of AHCI controller at PCI device 1f.2.
+The 4726 doesn't work as PMP but as a storage processor which can do
+hardware RAID on downstream ports.
+
+When no device is attached to the downstream port of the 4726, pseudo
+ATA device for configuration appears. Unfortunately, ATA emulation on
+the device is very lousy and causes long hang during boot.
+
+This patch implements workaround for the board. If the mainboard is
+P5W-DH Deluxe (matched using DMI), only hardreset is used on the
+second port of AHCI controller @ 1f.2 and the hardreset doesn't depend
+on receiving the first FIS and just proceed to IDENTIFY.
+
+This workaround fixes bugzilla #8923.
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=8923
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Cc: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 143 +++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 143 insertions(+)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -41,6 +41,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/device.h>
++#include <linux/dmi.h>
+ #include <scsi/scsi_host.h>
+ #include <scsi/scsi_cmnd.h>
+ #include <linux/libata.h>
+@@ -231,6 +232,7 @@ static void ahci_freeze(struct ata_port
+ static void ahci_thaw(struct ata_port *ap);
+ static void ahci_error_handler(struct ata_port *ap);
+ static void ahci_vt8251_error_handler(struct ata_port *ap);
++static void ahci_p5wdh_error_handler(struct ata_port *ap);
+ static void ahci_post_internal_cmd(struct ata_queued_cmd *qc);
+ static int ahci_port_resume(struct ata_port *ap);
+ static unsigned int ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl);
+@@ -329,6 +331,40 @@ static const struct ata_port_operations
+ .port_stop = ahci_port_stop,
+ };
+
++static const struct ata_port_operations ahci_p5wdh_ops = {
++ .port_disable = ata_port_disable,
++
++ .check_status = ahci_check_status,
++ .check_altstatus = ahci_check_status,
++ .dev_select = ata_noop_dev_select,
++
++ .tf_read = ahci_tf_read,
++
++ .qc_prep = ahci_qc_prep,
++ .qc_issue = ahci_qc_issue,
++
++ .irq_clear = ahci_irq_clear,
++ .irq_on = ata_dummy_irq_on,
++ .irq_ack = ata_dummy_irq_ack,
++
++ .scr_read = ahci_scr_read,
++ .scr_write = ahci_scr_write,
++
++ .freeze = ahci_freeze,
++ .thaw = ahci_thaw,
++
++ .error_handler = ahci_p5wdh_error_handler,
++ .post_internal_cmd = ahci_post_internal_cmd,
++
++#ifdef CONFIG_PM
++ .port_suspend = ahci_port_suspend,
++ .port_resume = ahci_port_resume,
++#endif
++
++ .port_start = ahci_port_start,
++ .port_stop = ahci_port_stop,
++};
++
+ static const struct ata_port_info ahci_port_info[] = {
+ /* board_ahci */
+ {
+@@ -1176,6 +1212,52 @@ static int ahci_vt8251_hardreset(struct
+ return rc ?: -EAGAIN;
+ }
+
++static int ahci_p5wdh_hardreset(struct ata_port *ap, unsigned int *class,
++ unsigned long deadline)
++{
++ struct ahci_port_priv *pp = ap->private_data;
++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
++ struct ata_taskfile tf;
++ int rc;
++
++ ahci_stop_engine(ap);
++
++ /* clear D2H reception area to properly wait for D2H FIS */
++ ata_tf_init(ap->device, &tf);
++ tf.command = 0x80;
++ ata_tf_to_fis(&tf, 0, 0, d2h_fis);
++
++ rc = sata_port_hardreset(ap, sata_ehc_deb_timing(&ap->eh_context),
++ deadline);
++
++ ahci_start_engine(ap);
++
++ if (rc || ata_port_offline(ap))
++ return rc;
++
++ /* spec mandates ">= 2ms" before checking status */
++ msleep(150);
++
++ /* The pseudo configuration device on SIMG4726 attached to
++ * ASUS P5W-DH Deluxe doesn't send signature FIS after
++ * hardreset if no device is attached to the first downstream
++ * port && the pseudo device locks up on SRST w/ PMP==0. To
++ * work around this, wait for !BSY only briefly. If BSY isn't
++ * cleared, perform CLO and proceed to IDENTIFY (achieved by
++ * ATA_LFLAG_NO_SRST and ATA_LFLAG_ASSUME_ATA).
++ *
++ * Wait for two seconds. Devices attached to downstream port
++ * which can't process the following IDENTIFY after this will
++ * have to be reset again. For most cases, this should
++ * suffice while making probing snappish enough.
++ */
++ rc = ata_wait_ready(ap, jiffies + 2 * HZ);
++ if (rc)
++ ahci_kick_engine(ap, 0);
++
++ return 0;
++}
++
+ static void ahci_postreset(struct ata_port *ap, unsigned int *class)
+ {
+ void __iomem *port_mmio = ahci_port_base(ap);
+@@ -1556,6 +1638,19 @@ static void ahci_vt8251_error_handler(st
+ ahci_postreset);
+ }
+
++static void ahci_p5wdh_error_handler(struct ata_port *ap)
++{
++ if (!(ap->pflags & ATA_PFLAG_FROZEN)) {
++ /* restart engine */
++ ahci_stop_engine(ap);
++ ahci_start_engine(ap);
++ }
++
++ /* perform recovery */
++ ata_do_eh(ap, ata_std_prereset, ahci_softreset, ahci_p5wdh_hardreset,
++ ahci_postreset);
++}
++
+ static void ahci_post_internal_cmd(struct ata_queued_cmd *qc)
+ {
+ struct ata_port *ap = qc->ap;
+@@ -1802,6 +1897,51 @@ static void ahci_print_info(struct ata_h
+ );
+ }
+
++/* On ASUS P5W DH Deluxe, the second port of PCI device 00:1f.2 is
++ * hardwired to on-board SIMG 4726. The chipset is ICH8 and doesn't
++ * support PMP and the 4726 either directly exports the device
++ * attached to the first downstream port or acts as a hardware storage
++ * controller and emulate a single ATA device (can be RAID 0/1 or some
++ * other configuration).
++ *
++ * When there's no device attached to the first downstream port of the
++ * 4726, "Config Disk" appears, which is a pseudo ATA device to
++ * configure the 4726. However, ATA emulation of the device is very
++ * lame. It doesn't send signature D2H Reg FIS after the initial
++ * hardreset, pukes on SRST w/ PMP==0 and has bunch of other issues.
++ *
++ * The following function works around the problem by always using
++ * hardreset on the port and not depending on receiving signature FIS
++ * afterward. If signature FIS isn't received soon, ATA class is
++ * assumed without follow-up softreset.
++ */
++static void ahci_p5wdh_workaround(struct ata_host *host)
++{
++ static struct dmi_system_id sysids[] = {
++ {
++ .ident = "P5W DH Deluxe",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR,
++ "ASUSTEK COMPUTER INC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P5W DH Deluxe"),
++ },
++ },
++ { }
++ };
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++
++ if (pdev->bus->number == 0 && pdev->devfn == PCI_DEVFN(0x1f, 2) &&
++ dmi_check_system(sysids)) {
++ struct ata_port *ap = host->ports[1];
++
++ dev_printk(KERN_INFO, &pdev->dev, "enabling ASUS P5W DH "
++ "Deluxe on-board SIMG4726 workaround\n");
++
++ ap->ops = &ahci_p5wdh_ops;
++ ap->flags |= ATA_FLAG_NO_SRST | ATA_FLAG_ASSUME_ATA;
++ }
++}
++
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ static int printed_version;
+@@ -1863,6 +2003,9 @@ static int ahci_init_one(struct pci_dev
+ ap->ops = &ata_dummy_port_ops;
+ }
+
++ /* apply workaround for ASUS P5W DH Deluxe mainboard */
++ ahci_p5wdh_workaround(host);
++
+ /* initialize adapter */
+ rc = ahci_configure_dma_masks(pdev, hpriv->cap & HOST_CAP_64);
+ if (rc)
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:06 2007
+Message-Id: <20071115062906.586942148@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:49 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Len Brown <len.brown@intel.com>,
+ Alexey Starikovskiy <astarikovskiy@suse.de>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 39/40] ACPI: sleep: Fix GPE suspend cleanup
+Content-Disposition: inline; filename=acpi-sleep-fix-gpe-suspend-cleanup.patch
+Content-Length: 1139
+Lines: 38
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alexey Starikovskiy <astarikovskiy@suse.de>
+
+patch is 9c1c6a1ba786d58bd03e27ee49f89a5685e8e07b in mainline.
+
+ACPI: sleep: Fix GPE suspend cleanup
+
+Commit 9b039330808b83acac3597535da26f47ad1862ce removed
+acpi_gpe_sleep_prepare(), the only function used at S5 transition
+Add call to generic acpi_enable_wake_device().
+
+Reference: https://bugzilla.novell.com/show_bug.cgi?id=299882
+
+Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
+Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/sleep/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/acpi/sleep/main.c
++++ b/drivers/acpi/sleep/main.c
+@@ -389,6 +389,7 @@ static void acpi_power_off(void)
+ /* acpi_sleep_prepare(ACPI_STATE_S5) should have already been called */
+ printk("%s called\n", __FUNCTION__);
+ local_irq_disable();
++ acpi_enable_wakeup_device(ACPI_STATE_S5);
+ acpi_enter_sleep_state(ACPI_STATE_S5);
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:29:06 2007
+Message-Id: <20071115062906.788288011@mini.kroah.org>
+References: <20071115062710.885284510@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:27:50 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Len Brown <len.brown@intel.com>,
+ Alexey Starikovskiy <astarikovskiy@suse.de>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 40/40] ACPI: suspend: Wrong order of GPE restore.
+Content-Disposition: inline; filename=acpi-suspend-wrong-order-of-gpe-restore.patch
+Content-Length: 1500
+Lines: 50
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alexey Starikovskiy <astarikovskiy@suse.de>
+
+commit 1dbc1fda5d8ca907f320b806005d4a447977d26a in mainline.
+
+ACPI: suspend: Wrong order of GPE restore.
+
+acpi_leave_sleep_state() should have correct list of wake and
+runtime GPEs, which is available only after disable_wakeup_device()
+is called.
+
+[cebbert@redhat.com: backport to 2.6.23]
+
+Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
+Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/sleep/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/sleep/main.c
++++ b/drivers/acpi/sleep/main.c
+@@ -170,8 +170,8 @@ static int acpi_pm_finish(suspend_state_
+ {
+ u32 acpi_state = acpi_target_sleep_state;
+
+- acpi_leave_sleep_state(acpi_state);
+ acpi_disable_wakeup_device(acpi_state);
++ acpi_leave_sleep_state(acpi_state);
+
+ /* reset firmware waking vector */
+ acpi_set_firmware_waking_vector((acpi_physical_address) 0);
+@@ -256,8 +256,8 @@ static int acpi_hibernation_enter(void)
+
+ static void acpi_hibernation_finish(void)
+ {
+- acpi_leave_sleep_state(ACPI_STATE_S4);
+ acpi_disable_wakeup_device(ACPI_STATE_S4);
++ acpi_leave_sleep_state(ACPI_STATE_S4);
+
+ /* reset firmware waking vector */
+ acpi_set_firmware_waking_vector((acpi_physical_address) 0);
+
+--
+
--- /dev/null
+diff --git a/drivers/acpi/sleep/main.c b/drivers/acpi/sleep/main.c
+index 2cbb9aa..37b651e 100644
+--- a/drivers/acpi/sleep/main.c
++++ b/drivers/acpi/sleep/main.c
+@@ -170,8 +170,8 @@ static int acpi_pm_finish(suspend_state_t pm_state)
+ {
+ u32 acpi_state = acpi_target_sleep_state;
+
+- acpi_leave_sleep_state(acpi_state);
+ acpi_disable_wakeup_device(acpi_state);
++ acpi_leave_sleep_state(acpi_state);
+
+ /* reset firmware waking vector */
+ acpi_set_firmware_waking_vector((acpi_physical_address) 0);
+@@ -256,8 +256,8 @@ static int acpi_hibernation_enter(void)
+
+ static void acpi_hibernation_finish(void)
+ {
+- acpi_leave_sleep_state(ACPI_STATE_S4);
+ acpi_disable_wakeup_device(ACPI_STATE_S4);
++ acpi_leave_sleep_state(ACPI_STATE_S4);
+
+ /* reset firmware waking vector */
+ acpi_set_firmware_waking_vector((acpi_physical_address) 0);
+@@ -389,6 +389,7 @@ static void acpi_power_off(void)
+ /* acpi_sleep_prepare(ACPI_STATE_S5) should have already been called */
+ printk("%s called\n", __FUNCTION__);
+ local_irq_disable();
++ acpi_enable_wakeup_device(ACPI_STATE_S5);
+ acpi_enter_sleep_state(ACPI_STATE_S5);
+ }
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index c168203..d684208 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -41,6 +41,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/device.h>
++#include <linux/dmi.h>
+ #include <scsi/scsi_host.h>
+ #include <scsi/scsi_cmnd.h>
+ #include <linux/libata.h>
+@@ -231,6 +232,7 @@ static void ahci_freeze(struct ata_port *ap);
+ static void ahci_thaw(struct ata_port *ap);
+ static void ahci_error_handler(struct ata_port *ap);
+ static void ahci_vt8251_error_handler(struct ata_port *ap);
++static void ahci_p5wdh_error_handler(struct ata_port *ap);
+ static void ahci_post_internal_cmd(struct ata_queued_cmd *qc);
+ static int ahci_port_resume(struct ata_port *ap);
+ static unsigned int ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl);
+@@ -329,6 +331,40 @@ static const struct ata_port_operations ahci_vt8251_ops = {
+ .port_stop = ahci_port_stop,
+ };
+
++static const struct ata_port_operations ahci_p5wdh_ops = {
++ .port_disable = ata_port_disable,
++
++ .check_status = ahci_check_status,
++ .check_altstatus = ahci_check_status,
++ .dev_select = ata_noop_dev_select,
++
++ .tf_read = ahci_tf_read,
++
++ .qc_prep = ahci_qc_prep,
++ .qc_issue = ahci_qc_issue,
++
++ .irq_clear = ahci_irq_clear,
++ .irq_on = ata_dummy_irq_on,
++ .irq_ack = ata_dummy_irq_ack,
++
++ .scr_read = ahci_scr_read,
++ .scr_write = ahci_scr_write,
++
++ .freeze = ahci_freeze,
++ .thaw = ahci_thaw,
++
++ .error_handler = ahci_p5wdh_error_handler,
++ .post_internal_cmd = ahci_post_internal_cmd,
++
++#ifdef CONFIG_PM
++ .port_suspend = ahci_port_suspend,
++ .port_resume = ahci_port_resume,
++#endif
++
++ .port_start = ahci_port_start,
++ .port_stop = ahci_port_stop,
++};
++
+ static const struct ata_port_info ahci_port_info[] = {
+ /* board_ahci */
+ {
+@@ -1176,6 +1212,52 @@ static int ahci_vt8251_hardreset(struct ata_port *ap, unsigned int *class,
+ return rc ?: -EAGAIN;
+ }
+
++static int ahci_p5wdh_hardreset(struct ata_port *ap, unsigned int *class,
++ unsigned long deadline)
++{
++ struct ahci_port_priv *pp = ap->private_data;
++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
++ struct ata_taskfile tf;
++ int rc;
++
++ ahci_stop_engine(ap);
++
++ /* clear D2H reception area to properly wait for D2H FIS */
++ ata_tf_init(ap->device, &tf);
++ tf.command = 0x80;
++ ata_tf_to_fis(&tf, 0, 0, d2h_fis);
++
++ rc = sata_port_hardreset(ap, sata_ehc_deb_timing(&ap->eh_context),
++ deadline);
++
++ ahci_start_engine(ap);
++
++ if (rc || ata_port_offline(ap))
++ return rc;
++
++ /* spec mandates ">= 2ms" before checking status */
++ msleep(150);
++
++ /* The pseudo configuration device on SIMG4726 attached to
++ * ASUS P5W-DH Deluxe doesn't send signature FIS after
++ * hardreset if no device is attached to the first downstream
++ * port && the pseudo device locks up on SRST w/ PMP==0. To
++ * work around this, wait for !BSY only briefly. If BSY isn't
++ * cleared, perform CLO and proceed to IDENTIFY (achieved by
++ * ATA_LFLAG_NO_SRST and ATA_LFLAG_ASSUME_ATA).
++ *
++ * Wait for two seconds. Devices attached to downstream port
++ * which can't process the following IDENTIFY after this will
++ * have to be reset again. For most cases, this should
++ * suffice while making probing snappish enough.
++ */
++ rc = ata_wait_ready(ap, jiffies + 2 * HZ);
++ if (rc)
++ ahci_kick_engine(ap, 0);
++
++ return 0;
++}
++
+ static void ahci_postreset(struct ata_port *ap, unsigned int *class)
+ {
+ void __iomem *port_mmio = ahci_port_base(ap);
+@@ -1556,6 +1638,19 @@ static void ahci_vt8251_error_handler(struct ata_port *ap)
+ ahci_postreset);
+ }
+
++static void ahci_p5wdh_error_handler(struct ata_port *ap)
++{
++ if (!(ap->pflags & ATA_PFLAG_FROZEN)) {
++ /* restart engine */
++ ahci_stop_engine(ap);
++ ahci_start_engine(ap);
++ }
++
++ /* perform recovery */
++ ata_do_eh(ap, ata_std_prereset, ahci_softreset, ahci_p5wdh_hardreset,
++ ahci_postreset);
++}
++
+ static void ahci_post_internal_cmd(struct ata_queued_cmd *qc)
+ {
+ struct ata_port *ap = qc->ap;
+@@ -1802,6 +1897,51 @@ static void ahci_print_info(struct ata_host *host)
+ );
+ }
+
++/* On ASUS P5W DH Deluxe, the second port of PCI device 00:1f.2 is
++ * hardwired to on-board SIMG 4726. The chipset is ICH8 and doesn't
++ * support PMP and the 4726 either directly exports the device
++ * attached to the first downstream port or acts as a hardware storage
++ * controller and emulate a single ATA device (can be RAID 0/1 or some
++ * other configuration).
++ *
++ * When there's no device attached to the first downstream port of the
++ * 4726, "Config Disk" appears, which is a pseudo ATA device to
++ * configure the 4726. However, ATA emulation of the device is very
++ * lame. It doesn't send signature D2H Reg FIS after the initial
++ * hardreset, pukes on SRST w/ PMP==0 and has bunch of other issues.
++ *
++ * The following function works around the problem by always using
++ * hardreset on the port and not depending on receiving signature FIS
++ * afterward. If signature FIS isn't received soon, ATA class is
++ * assumed without follow-up softreset.
++ */
++static void ahci_p5wdh_workaround(struct ata_host *host)
++{
++ static struct dmi_system_id sysids[] = {
++ {
++ .ident = "P5W DH Deluxe",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR,
++ "ASUSTEK COMPUTER INC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P5W DH Deluxe"),
++ },
++ },
++ { }
++ };
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++
++ if (pdev->bus->number == 0 && pdev->devfn == PCI_DEVFN(0x1f, 2) &&
++ dmi_check_system(sysids)) {
++ struct ata_port *ap = host->ports[1];
++
++ dev_printk(KERN_INFO, &pdev->dev, "enabling ASUS P5W DH "
++ "Deluxe on-board SIMG4726 workaround\n");
++
++ ap->ops = &ahci_p5wdh_ops;
++ ap->flags |= ATA_FLAG_NO_SRST | ATA_FLAG_ASSUME_ATA;
++ }
++}
++
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ static int printed_version;
+@@ -1863,6 +2003,9 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ ap->ops = &ata_dummy_port_ops;
+ }
+
++ /* apply workaround for ASUS P5W DH Deluxe mainboard */
++ ahci_p5wdh_workaround(host);
++
+ /* initialize adapter */
+ rc = ahci_configure_dma_masks(pdev, hpriv->cap & HOST_CAP_64);
+ if (rc)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 772be09..78b670d 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3793,11 +3793,18 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* Drives which do spurious command completion */
+ { "HTS541680J9SA00", "SB2IC7EP", ATA_HORKAGE_NONCQ, },
+ { "HTS541612J9SA00", "SBDIC7JP", ATA_HORKAGE_NONCQ, },
++ { "HDT722516DLA380", "V43OA96A", ATA_HORKAGE_NONCQ, },
+ { "Hitachi HTS541616J9SA00", "SB4OC70P", ATA_HORKAGE_NONCQ, },
++ { "Hitachi HTS542525K9SA00", "BBFOC31P", ATA_HORKAGE_NONCQ, },
+ { "WDC WD740ADFD-00NLR1", NULL, ATA_HORKAGE_NONCQ, },
++ { "WDC WD3200AAJS-00RYA0", "12.01B01", ATA_HORKAGE_NONCQ, },
+ { "FUJITSU MHV2080BH", "00840028", ATA_HORKAGE_NONCQ, },
++ { "ST9120822AS", "3.CLF", ATA_HORKAGE_NONCQ, },
+ { "ST9160821AS", "3.CLF", ATA_HORKAGE_NONCQ, },
+- { "ST3160812AS", "3.AD", ATA_HORKAGE_NONCQ, },
++ { "ST9160821AS", "3.ALD", ATA_HORKAGE_NONCQ, },
++ { "ST9160821AS", "3.CCD", ATA_HORKAGE_NONCQ, },
++ { "ST3160812AS", "3.ADJ", ATA_HORKAGE_NONCQ, },
++ { "ST980813AS", "3.ADB", ATA_HORKAGE_NONCQ, },
+ { "SAMSUNG HD401LJ", "ZZ100-15", ATA_HORKAGE_NONCQ, },
+
+ /* devices which puke on READ_NATIVE_MAX */
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index ac6ceed..6ebdbd8 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -1759,9 +1759,11 @@ static int ata_do_reset(struct ata_port *ap, ata_reset_fn_t reset,
+ return 0;
+ }
+
+-static int ata_eh_followup_srst_needed(int rc, int classify,
+- const unsigned int *classes)
++static int ata_eh_followup_srst_needed(struct ata_port *ap, int rc,
++ int classify, const unsigned int *classes)
+ {
++ if (ap->flags & ATA_FLAG_NO_SRST)
++ return 0;
+ if (rc == -EAGAIN)
+ return 1;
+ if (rc != 0)
+@@ -1792,7 +1794,8 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
+ */
+ action = ehc->i.action;
+ ehc->i.action &= ~ATA_EH_RESET_MASK;
+- if (softreset && (!hardreset || (!sata_set_spd_needed(ap) &&
++ if (softreset && (!hardreset || (!(ap->flags & ATA_FLAG_NO_SRST) &&
++ !sata_set_spd_needed(ap) &&
+ !(action & ATA_EH_HARDRESET))))
+ ehc->i.action |= ATA_EH_SOFTRESET;
+ else
+@@ -1855,7 +1858,7 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
+ rc = ata_do_reset(ap, reset, classes, deadline);
+
+ if (reset == hardreset &&
+- ata_eh_followup_srst_needed(rc, classify, classes)) {
++ ata_eh_followup_srst_needed(ap, rc, classify, classes)) {
+ /* okay, let's do follow-up softreset */
+ reset = softreset;
+
+@@ -1870,8 +1873,8 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
+ ata_eh_about_to_do(ap, NULL, ATA_EH_RESET_MASK);
+ rc = ata_do_reset(ap, reset, classes, deadline);
+
+- if (rc == 0 && classify &&
+- classes[0] == ATA_DEV_UNKNOWN) {
++ if (rc == 0 && classify && classes[0] == ATA_DEV_UNKNOWN &&
++ !(ap->flags & ATA_FLAG_ASSUME_ATA)) {
+ ata_port_printk(ap, KERN_ERR,
+ "classification failed\n");
+ rc = -EINVAL;
+@@ -1879,6 +1882,10 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
+ }
+ }
+
++ /* if we skipped follow-up srst, clear rc */
++ if (rc == -EAGAIN)
++ rc = 0;
++
+ if (rc && try < ARRAY_SIZE(ata_eh_reset_timeouts)) {
+ unsigned long now = jiffies;
+
+@@ -1906,8 +1913,17 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
+ /* After the reset, the device state is PIO 0 and the
+ * controller state is undefined. Record the mode.
+ */
+- for (i = 0; i < ATA_MAX_DEVICES; i++)
+- ap->device[i].pio_mode = XFER_PIO_0;
++ for (i = 0; i < ata_port_max_devices(ap); i++) {
++ struct ata_device *dev = &ap->device[i];
++
++ dev->pio_mode = XFER_PIO_0;
++
++ if (ata_port_offline(ap))
++ continue;
++
++ if (ap->flags & ATA_FLAG_ASSUME_ATA)
++ classes[dev->devno] = ATA_DEV_ATA;
++ }
+
+ /* record current link speed */
+ if (sata_scr_read(ap, SCR_STATUS, &sstatus) == 0)
+diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
+index bb8e9e9..94d638e 100644
+--- a/drivers/char/drm/i915_irq.c
++++ b/drivers/char/drm/i915_irq.c
+@@ -553,7 +553,7 @@ int i915_vblank_swap(DRM_IOCTL_ARGS)
+ return DRM_ERR(EBUSY);
+ }
+
+- vbl_swap = drm_calloc(1, sizeof(vbl_swap), DRM_MEM_DRIVER);
++ vbl_swap = drm_calloc(1, sizeof(*vbl_swap), DRM_MEM_DRIVER);
+
+ if (!vbl_swap) {
+ DRM_ERROR("Failed to allocate memory to queue swap\n");
+diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
+index af5790f..2e9fdb9 100644
+--- a/drivers/char/drm/radeon_cp.c
++++ b/drivers/char/drm/radeon_cp.c
+@@ -1679,7 +1679,7 @@ static int radeon_do_init_cp(struct drm_device * dev, drm_radeon_init_t * init)
+ dev_priv->gart_info.bus_addr =
+ dev_priv->pcigart_offset + dev_priv->fb_location;
+ dev_priv->gart_info.mapping.offset =
+- dev_priv->gart_info.bus_addr;
++ dev_priv->pcigart_offset + dev_priv->fb_aper_offset;
+ dev_priv->gart_info.mapping.size =
+ dev_priv->gart_info.table_size;
+
+@@ -2291,7 +2291,8 @@ int radeon_driver_firstopen(struct drm_device *dev)
+ if (ret != 0)
+ return ret;
+
+- ret = drm_addmap(dev, drm_get_resource_start(dev, 0),
++ dev_priv->fb_aper_offset = drm_get_resource_start(dev, 0);
++ ret = drm_addmap(dev, dev_priv->fb_aper_offset,
+ drm_get_resource_len(dev, 0), _DRM_FRAME_BUFFER,
+ _DRM_WRITE_COMBINING, &map);
+ if (ret != 0)
+diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
+index 3b3d935..41e91ea 100644
+--- a/drivers/char/drm/radeon_drv.h
++++ b/drivers/char/drm/radeon_drv.h
+@@ -293,6 +293,7 @@ typedef struct drm_radeon_private {
+
+ /* starting from here on, data is preserved accross an open */
+ uint32_t flags; /* see radeon_chip_flags */
++ unsigned long fb_aper_offset;
+ } drm_radeon_private_t;
+
+ typedef struct drm_radeon_buf_priv {
+diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
+index ed76f0a..5000b3b 100644
+--- a/drivers/char/moxa.c
++++ b/drivers/char/moxa.c
+@@ -1040,14 +1040,14 @@ static void check_xmit_empty(unsigned long data)
+ struct moxa_port *ch;
+
+ ch = (struct moxa_port *) data;
+- del_timer_sync(&moxa_ports[ch->port].emptyTimer);
+ if (ch->tty && (ch->statusflags & EMPTYWAIT)) {
+ if (MoxaPortTxQueue(ch->port) == 0) {
+ ch->statusflags &= ~EMPTYWAIT;
+ tty_wakeup(ch->tty);
+ return;
+ }
+- mod_timer(&moxa_ports[ch->port].emptyTimer, jiffies + HZ);
++ mod_timer(&moxa_ports[ch->port].emptyTimer,
++ round_jiffies(jiffies + HZ));
+ } else
+ ch->statusflags &= ~EMPTYWAIT;
+ }
+diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
+index 56cbba7..94bb3d0 100644
+--- a/drivers/char/rocket.c
++++ b/drivers/char/rocket.c
+@@ -699,8 +699,8 @@ static void init_r_port(int board, int aiop, int chan, struct pci_dev *pci_dev)
+ spin_lock_init(&info->slock);
+ mutex_init(&info->write_mtx);
+ rp_table[line] = info;
+- if (pci_dev)
+- tty_register_device(rocket_driver, line, &pci_dev->dev);
++ tty_register_device(rocket_driver, line, pci_dev ? &pci_dev->dev :
++ NULL);
+ }
+
+ /*
+@@ -2434,7 +2434,7 @@ static int __init rp_init(void)
+ rocket_driver->init_termios.c_ispeed = 9600;
+ rocket_driver->init_termios.c_ospeed = 9600;
+ #ifdef ROCKET_SOFT_FLOW
+- rocket_driver->flags |= TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
++ rocket_driver->flags |= TTY_DRIVER_REAL_RAW;
+ #endif
+ tty_set_operations(rocket_driver, &rocket_ops);
+
+@@ -2491,10 +2491,14 @@ static void rp_cleanup_module(void)
+ if (retval)
+ printk(KERN_INFO "Error %d while trying to unregister "
+ "rocketport driver\n", -retval);
+- put_tty_driver(rocket_driver);
+
+ for (i = 0; i < MAX_RP_PORTS; i++)
+- kfree(rp_table[i]);
++ if (rp_table[i]) {
++ tty_unregister_device(rocket_driver, i);
++ kfree(rp_table[i]);
++ }
++
++ put_tty_driver(rocket_driver);
+
+ for (i = 0; i < NUM_BOARDS; i++) {
+ if (rcktpt_io_addr[i] <= 0 || is_PCI[i])
+diff --git a/drivers/hwmon/lm87.c b/drivers/hwmon/lm87.c
+index 988ae1c..1128153 100644
+--- a/drivers/hwmon/lm87.c
++++ b/drivers/hwmon/lm87.c
+@@ -129,7 +129,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A, 0x38, 0x2C };
+ (((val) < 0 ? (val)-500 : (val)+500) / 1000))
+
+ #define FAN_FROM_REG(reg,div) ((reg) == 255 || (reg) == 0 ? 0 : \
+- 1350000 + (reg)*(div) / 2) / ((reg)*(div))
++ (1350000 + (reg)*(div) / 2) / ((reg)*(div)))
+ #define FAN_TO_REG(val,div) ((val)*(div) * 255 <= 1350000 ? 255 : \
+ (1350000 + (val)*(div) / 2) / ((val)*(div)))
+
+@@ -145,7 +145,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A, 0x38, 0x2C };
+ #define CHAN_NO_FAN(nr) (1 << (nr))
+ #define CHAN_TEMP3 (1 << 2)
+ #define CHAN_VCC_5V (1 << 3)
+-#define CHAN_NO_VID (1 << 8)
++#define CHAN_NO_VID (1 << 7)
+
+ /*
+ * Functions declaration
+diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
+index 7a4a15f..329b599 100644
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -391,6 +391,7 @@ static int __devexit w83627hf_remove(struct platform_device *pdev);
+
+ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg);
+ static int w83627hf_write_value(struct w83627hf_data *data, u16 reg, u16 value);
++static void w83627hf_update_fan_div(struct w83627hf_data *data);
+ static struct w83627hf_data *w83627hf_update_device(struct device *dev);
+ static void w83627hf_init_device(struct platform_device *pdev);
+
+@@ -1244,6 +1245,7 @@ static int __devinit w83627hf_probe(struct platform_device *pdev)
+ data->fan_min[0] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(1));
+ data->fan_min[1] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(2));
+ data->fan_min[2] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(3));
++ w83627hf_update_fan_div(data);
+
+ /* Register common device attributes */
+ if ((err = sysfs_create_group(&dev->kobj, &w83627hf_group)))
+@@ -1333,6 +1335,24 @@ static int __devexit w83627hf_remove(struct platform_device *pdev)
+ }
+
+
++/* Registers 0x50-0x5f are banked */
++static inline void w83627hf_set_bank(struct w83627hf_data *data, u16 reg)
++{
++ if ((reg & 0x00f0) == 0x50) {
++ outb_p(W83781D_REG_BANK, data->addr + W83781D_ADDR_REG_OFFSET);
++ outb_p(reg >> 8, data->addr + W83781D_DATA_REG_OFFSET);
++ }
++}
++
++/* Not strictly necessary, but play it safe for now */
++static inline void w83627hf_reset_bank(struct w83627hf_data *data, u16 reg)
++{
++ if (reg & 0xff00) {
++ outb_p(W83781D_REG_BANK, data->addr + W83781D_ADDR_REG_OFFSET);
++ outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
++ }
++}
++
+ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg)
+ {
+ int res, word_sized;
+@@ -1343,12 +1363,7 @@ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg)
+ && (((reg & 0x00ff) == 0x50)
+ || ((reg & 0x00ff) == 0x53)
+ || ((reg & 0x00ff) == 0x55));
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(reg >> 8,
+- data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_set_bank(data, reg);
+ outb_p(reg & 0xff, data->addr + W83781D_ADDR_REG_OFFSET);
+ res = inb_p(data->addr + W83781D_DATA_REG_OFFSET);
+ if (word_sized) {
+@@ -1358,11 +1373,7 @@ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg)
+ (res << 8) + inb_p(data->addr +
+ W83781D_DATA_REG_OFFSET);
+ }
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_reset_bank(data, reg);
+ mutex_unlock(&data->lock);
+ return res;
+ }
+@@ -1433,12 +1444,7 @@ static int w83627hf_write_value(struct w83627hf_data *data, u16 reg, u16 value)
+ || ((reg & 0xff00) == 0x200))
+ && (((reg & 0x00ff) == 0x53)
+ || ((reg & 0x00ff) == 0x55));
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(reg >> 8,
+- data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_set_bank(data, reg);
+ outb_p(reg & 0xff, data->addr + W83781D_ADDR_REG_OFFSET);
+ if (word_sized) {
+ outb_p(value >> 8,
+@@ -1448,11 +1454,7 @@ static int w83627hf_write_value(struct w83627hf_data *data, u16 reg, u16 value)
+ }
+ outb_p(value & 0xff,
+ data->addr + W83781D_DATA_REG_OFFSET);
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_reset_bank(data, reg);
+ mutex_unlock(&data->lock);
+ return 0;
+ }
+@@ -1556,6 +1558,24 @@ static void __devinit w83627hf_init_device(struct platform_device *pdev)
+ | 0x01);
+ }
+
++static void w83627hf_update_fan_div(struct w83627hf_data *data)
++{
++ int reg;
++
++ reg = w83627hf_read_value(data, W83781D_REG_VID_FANDIV);
++ data->fan_div[0] = (reg >> 4) & 0x03;
++ data->fan_div[1] = (reg >> 6) & 0x03;
++ if (data->type != w83697hf) {
++ data->fan_div[2] = (w83627hf_read_value(data,
++ W83781D_REG_PIN) >> 6) & 0x03;
++ }
++ reg = w83627hf_read_value(data, W83781D_REG_VBAT);
++ data->fan_div[0] |= (reg >> 3) & 0x04;
++ data->fan_div[1] |= (reg >> 4) & 0x04;
++ if (data->type != w83697hf)
++ data->fan_div[2] |= (reg >> 5) & 0x04;
++}
++
+ static struct w83627hf_data *w83627hf_update_device(struct device *dev)
+ {
+ struct w83627hf_data *data = dev_get_drvdata(dev);
+@@ -1633,18 +1653,8 @@ static struct w83627hf_data *w83627hf_update_device(struct device *dev)
+ w83627hf_read_value(data, W83781D_REG_TEMP_HYST(3));
+ }
+
+- i = w83627hf_read_value(data, W83781D_REG_VID_FANDIV);
+- data->fan_div[0] = (i >> 4) & 0x03;
+- data->fan_div[1] = (i >> 6) & 0x03;
+- if (data->type != w83697hf) {
+- data->fan_div[2] = (w83627hf_read_value(data,
+- W83781D_REG_PIN) >> 6) & 0x03;
+- }
+- i = w83627hf_read_value(data, W83781D_REG_VBAT);
+- data->fan_div[0] |= (i >> 3) & 0x04;
+- data->fan_div[1] |= (i >> 4) & 0x04;
+- if (data->type != w83697hf)
+- data->fan_div[2] |= (i >> 5) & 0x04;
++ w83627hf_update_fan_div(data);
++
+ data->alarms =
+ w83627hf_read_value(data, W83781D_REG_ALARM1) |
+ (w83627hf_read_value(data, W83781D_REG_ALARM2) << 8) |
+diff --git a/drivers/ide/pci/cs5535.c b/drivers/ide/pci/cs5535.c
+index 082ca7d..6102aa9 100644
+--- a/drivers/ide/pci/cs5535.c
++++ b/drivers/ide/pci/cs5535.c
+@@ -84,7 +84,7 @@ static void cs5535_set_speed(ide_drive_t *drive, u8 speed)
+
+ /* Set the PIO timings */
+ if ((speed & XFER_MODE) == XFER_PIO) {
+- ide_drive_t *pair = &drive->hwif->drives[drive->dn ^ 1];
++ ide_drive_t *pair = ide_get_paired_drive(drive);
+ u8 cmd, pioa;
+
+ cmd = pioa = speed - XFER_PIO_0;
+diff --git a/drivers/ide/pci/serverworks.c b/drivers/ide/pci/serverworks.c
+index 9fead2e..e887058 100644
+--- a/drivers/ide/pci/serverworks.c
++++ b/drivers/ide/pci/serverworks.c
+@@ -97,6 +97,7 @@ static u8 svwks_udma_filter(ide_drive_t *drive)
+ mode = 2;
+
+ switch(mode) {
++ case 3: mask = 0x3f; break;
+ case 2: mask = 0x1f; break;
+ case 1: mask = 0x07; break;
+ default: mask = 0x00; break;
+diff --git a/drivers/ide/pci/siimage.c b/drivers/ide/pci/siimage.c
+index 50f6d17..713064d 100644
+--- a/drivers/ide/pci/siimage.c
++++ b/drivers/ide/pci/siimage.c
+@@ -180,7 +180,7 @@ static void sil_tune_pio(ide_drive_t *drive, u8 pio)
+ const u16 data_speed[] = { 0x328a, 0x2283, 0x1104, 0x10c3, 0x10c1 };
+
+ ide_hwif_t *hwif = HWIF(drive);
+- ide_drive_t *pair = &hwif->drives[drive->dn ^ 1];
++ ide_drive_t *pair = ide_get_paired_drive(drive);
+ u32 speedt = 0;
+ u16 speedp = 0;
+ unsigned long addr = siimage_seldev(drive, 0x04);
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 01d7008..495c803 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -147,8 +147,12 @@ static struct ib_uobject *__idr_get_uobj(struct idr *idr, int id,
+
+ spin_lock(&ib_uverbs_idr_lock);
+ uobj = idr_find(idr, id);
+- if (uobj)
+- kref_get(&uobj->ref);
++ if (uobj) {
++ if (uobj->context == context)
++ kref_get(&uobj->ref);
++ else
++ uobj = NULL;
++ }
+ spin_unlock(&ib_uverbs_idr_lock);
+
+ return uobj;
+diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
+index acc9589..6966f94 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
++++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
+@@ -290,6 +290,12 @@ static int mthca_cmd_post(struct mthca_dev *dev,
+ err = mthca_cmd_post_hcr(dev, in_param, out_param, in_modifier,
+ op_modifier, op, token, event);
+
++ /*
++ * Make sure that our HCR writes don't get mixed in with
++ * writes from another CPU starting a FW command.
++ */
++ mmiowb();
++
+ mutex_unlock(&dev->cmd.hcr_mutex);
+ return err;
+ }
+diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
+index 7a69a18..4484a64 100644
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -321,12 +321,15 @@ void b1_reset_ctr(struct capi_ctr *ctrl)
+ avmctrl_info *cinfo = (avmctrl_info *)(ctrl->driverdata);
+ avmcard *card = cinfo->card;
+ unsigned int port = card->port;
++ unsigned long flags;
+
+ b1_reset(port);
+ b1_reset(port);
+
+ memset(cinfo->version, 0, sizeof(cinfo->version));
++ spin_lock_irqsave(&card->lock, flags);
+ capilib_release(&cinfo->ncci_head);
++ spin_unlock_irqrestore(&card->lock, flags);
+ capi_ctr_reseted(ctrl);
+ }
+
+@@ -361,9 +364,8 @@ void b1_release_appl(struct capi_ctr *ctrl, u16 appl)
+ unsigned int port = card->port;
+ unsigned long flags;
+
+- capilib_release_appl(&cinfo->ncci_head, appl);
+-
+ spin_lock_irqsave(&card->lock, flags);
++ capilib_release_appl(&cinfo->ncci_head, appl);
+ b1_put_byte(port, SEND_RELEASE);
+ b1_put_word(port, appl);
+ spin_unlock_irqrestore(&card->lock, flags);
+@@ -380,27 +382,27 @@ u16 b1_send_message(struct capi_ctr *ctrl, struct sk_buff *skb)
+ u8 subcmd = CAPIMSG_SUBCOMMAND(skb->data);
+ u16 dlen, retval;
+
++ spin_lock_irqsave(&card->lock, flags);
+ if (CAPICMD(cmd, subcmd) == CAPI_DATA_B3_REQ) {
+ retval = capilib_data_b3_req(&cinfo->ncci_head,
+ CAPIMSG_APPID(skb->data),
+ CAPIMSG_NCCI(skb->data),
+ CAPIMSG_MSGID(skb->data));
+- if (retval != CAPI_NOERROR)
++ if (retval != CAPI_NOERROR) {
++ spin_unlock_irqrestore(&card->lock, flags);
+ return retval;
++ }
+
+ dlen = CAPIMSG_DATALEN(skb->data);
+
+- spin_lock_irqsave(&card->lock, flags);
+ b1_put_byte(port, SEND_DATA_B3_REQ);
+ b1_put_slice(port, skb->data, len);
+ b1_put_slice(port, skb->data + len, dlen);
+- spin_unlock_irqrestore(&card->lock, flags);
+ } else {
+- spin_lock_irqsave(&card->lock, flags);
+ b1_put_byte(port, SEND_MESSAGE);
+ b1_put_slice(port, skb->data, len);
+- spin_unlock_irqrestore(&card->lock, flags);
+ }
++ spin_unlock_irqrestore(&card->lock, flags);
+
+ dev_kfree_skb_any(skb);
+ return CAPI_NOERROR;
+@@ -534,17 +536,17 @@ irqreturn_t b1_interrupt(int interrupt, void *devptr)
+
+ ApplId = (unsigned) b1_get_word(card->port);
+ MsgLen = b1_get_slice(card->port, card->msgbuf);
+- spin_unlock_irqrestore(&card->lock, flags);
+ if (!(skb = alloc_skb(MsgLen, GFP_ATOMIC))) {
+ printk(KERN_ERR "%s: incoming packet dropped\n",
+ card->name);
++ spin_unlock_irqrestore(&card->lock, flags);
+ } else {
+ memcpy(skb_put(skb, MsgLen), card->msgbuf, MsgLen);
+ if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_CONF)
+ capilib_data_b3_conf(&cinfo->ncci_head, ApplId,
+ CAPIMSG_NCCI(skb->data),
+ CAPIMSG_MSGID(skb->data));
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ capi_ctr_handle_message(ctrl, ApplId, skb);
+ }
+ break;
+@@ -554,21 +556,17 @@ irqreturn_t b1_interrupt(int interrupt, void *devptr)
+ ApplId = b1_get_word(card->port);
+ NCCI = b1_get_word(card->port);
+ WindowSize = b1_get_word(card->port);
+- spin_unlock_irqrestore(&card->lock, flags);
+-
+ capilib_new_ncci(&cinfo->ncci_head, ApplId, NCCI, WindowSize);
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ break;
+
+ case RECEIVE_FREE_NCCI:
+
+ ApplId = b1_get_word(card->port);
+ NCCI = b1_get_word(card->port);
+- spin_unlock_irqrestore(&card->lock, flags);
+-
+ if (NCCI != 0xffffffff)
+ capilib_free_ncci(&cinfo->ncci_head, ApplId, NCCI);
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ break;
+
+ case RECEIVE_START:
+diff --git a/drivers/isdn/hardware/avm/c4.c b/drivers/isdn/hardware/avm/c4.c
+index d58f927..8710cf6 100644
+--- a/drivers/isdn/hardware/avm/c4.c
++++ b/drivers/isdn/hardware/avm/c4.c
+@@ -727,6 +727,7 @@ static void c4_send_init(avmcard *card)
+ {
+ struct sk_buff *skb;
+ void *p;
++ unsigned long flags;
+
+ skb = alloc_skb(15, GFP_ATOMIC);
+ if (!skb) {
+@@ -744,12 +745,15 @@ static void c4_send_init(avmcard *card)
+ skb_put(skb, (u8 *)p - (u8 *)skb->data);
+
+ skb_queue_tail(&card->dma->send_queue, skb);
++ spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
++ spin_unlock_irqrestore(&card->lock, flags);
+ }
+
+ static int queue_sendconfigword(avmcard *card, u32 val)
+ {
+ struct sk_buff *skb;
++ unsigned long flags;
+ void *p;
+
+ skb = alloc_skb(3+4, GFP_ATOMIC);
+@@ -766,7 +770,9 @@ static int queue_sendconfigword(avmcard *card, u32 val)
+ skb_put(skb, (u8 *)p - (u8 *)skb->data);
+
+ skb_queue_tail(&card->dma->send_queue, skb);
++ spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
++ spin_unlock_irqrestore(&card->lock, flags);
+ return 0;
+ }
+
+@@ -986,7 +992,9 @@ static void c4_release_appl(struct capi_ctr *ctrl, u16 appl)
+ struct sk_buff *skb;
+ void *p;
+
++ spin_lock_irqsave(&card->lock, flags);
+ capilib_release_appl(&cinfo->ncci_head, appl);
++ spin_unlock_irqrestore(&card->lock, flags);
+
+ if (ctrl->cnr == card->cardnr) {
+ skb = alloc_skb(7, GFP_ATOMIC);
+@@ -1019,7 +1027,8 @@ static u16 c4_send_message(struct capi_ctr *ctrl, struct sk_buff *skb)
+ u16 retval = CAPI_NOERROR;
+ unsigned long flags;
+
+- if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_REQ) {
++ spin_lock_irqsave(&card->lock, flags);
++ if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_REQ) {
+ retval = capilib_data_b3_req(&cinfo->ncci_head,
+ CAPIMSG_APPID(skb->data),
+ CAPIMSG_NCCI(skb->data),
+@@ -1027,10 +1036,9 @@ static u16 c4_send_message(struct capi_ctr *ctrl, struct sk_buff *skb)
+ }
+ if (retval == CAPI_NOERROR) {
+ skb_queue_tail(&card->dma->send_queue, skb);
+- spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
+- spin_unlock_irqrestore(&card->lock, flags);
+ }
++ spin_unlock_irqrestore(&card->lock, flags);
+ return retval;
+ }
+
+diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
+index 927cb34..7c426d0 100644
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -274,7 +274,7 @@ static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
+ if (bitmap->offset < 0) {
+ /* DATA BITMAP METADATA */
+ if (bitmap->offset
+- + page->index * (PAGE_SIZE/512)
++ + (long)(page->index * (PAGE_SIZE/512))
+ + size/512 > 0)
+ /* bitmap runs in to metadata */
+ return -EINVAL;
+diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
+index 6928c13..9538331 100644
+--- a/drivers/md/dm-delay.c
++++ b/drivers/md/dm-delay.c
+@@ -305,7 +305,7 @@ static int delay_status(struct dm_target *ti, status_type_t type,
+ (unsigned long long) dc->start_read,
+ dc->read_delay);
+ if (dc->dev_write)
+- DMEMIT("%s %llu %u", dc->dev_write->name,
++ DMEMIT(" %s %llu %u", dc->dev_write->name,
+ (unsigned long long) dc->start_write,
+ dc->write_delay);
+ break;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 2120155..998d450 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1064,12 +1064,14 @@ static struct mapped_device *alloc_dev(int minor)
+ return NULL;
+ }
+
++static void unlock_fs(struct mapped_device *md);
++
+ static void free_dev(struct mapped_device *md)
+ {
+ int minor = md->disk->first_minor;
+
+ if (md->suspended_bdev) {
+- thaw_bdev(md->suspended_bdev, NULL);
++ unlock_fs(md);
+ bdput(md->suspended_bdev);
+ }
+ mempool_destroy(md->tio_pool);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index f96dea9..3808f52 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -377,7 +377,12 @@ static unsigned long get_stripe_work(struct stripe_head *sh)
+ ack++;
+
+ sh->ops.count -= ack;
+- BUG_ON(sh->ops.count < 0);
++ if (unlikely(sh->ops.count < 0)) {
++ printk(KERN_ERR "pending: %#lx ops.pending: %#lx ops.ack: %#lx "
++ "ops.complete: %#lx\n", pending, sh->ops.pending,
++ sh->ops.ack, sh->ops.complete);
++ BUG();
++ }
+
+ return pending;
+ }
+@@ -551,8 +556,7 @@ static void ops_complete_biofill(void *stripe_head_ref)
+ }
+ }
+ }
+- clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
+- clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
++ set_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
+
+ return_io(return_bi);
+
+@@ -2630,6 +2634,13 @@ static void handle_stripe5(struct stripe_head *sh)
+ s.expanded = test_bit(STRIPE_EXPAND_READY, &sh->state);
+ /* Now to look around and see what can be done */
+
++ /* clean-up completed biofill operations */
++ if (test_bit(STRIPE_OP_BIOFILL, &sh->ops.complete)) {
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
++ }
++
+ rcu_read_lock();
+ for (i=disks; i--; ) {
+ mdk_rdev_t *rdev;
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index be1df85..87e0161 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -132,7 +132,7 @@ void read_msi_msg(unsigned int irq, struct msi_msg *msg)
+ pci_read_config_word(dev, msi_data_reg(pos, 1), &data);
+ } else {
+ msg->address_hi = 0;
+- pci_read_config_word(dev, msi_data_reg(pos, 1), &data);
++ pci_read_config_word(dev, msi_data_reg(pos, 0), &data);
+ }
+ msg->data = data;
+ break;
+diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
+index 0e579ca..ffdd0da 100644
+--- a/drivers/scsi/hptiop.c
++++ b/drivers/scsi/hptiop.c
+@@ -365,8 +365,9 @@ static void hptiop_host_request_callback(struct hptiop_hba *hba, u32 tag)
+ scp->result = SAM_STAT_CHECK_CONDITION;
+ memset(&scp->sense_buffer,
+ 0, sizeof(scp->sense_buffer));
+- memcpy(&scp->sense_buffer,
+- &req->sg_list, le32_to_cpu(req->dataxfer_length));
++ memcpy(&scp->sense_buffer, &req->sg_list,
++ min(sizeof(scp->sense_buffer),
++ le32_to_cpu(req->dataxfer_length)));
+ break;
+
+ default:
+diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
+index b5ebb73..6e2382e 100644
+--- a/drivers/usb/core/hcd.h
++++ b/drivers/usb/core/hcd.h
+@@ -19,6 +19,8 @@
+
+ #ifdef __KERNEL__
+
++#include <linux/rwsem.h>
++
+ /* This file contains declarations of usbcore internals that are mostly
+ * used or exposed by Host Controller Drivers.
+ */
+@@ -454,5 +456,9 @@ static inline void usbmon_urb_complete(struct usb_bus *bus, struct urb *urb) {}
+ : (in_interrupt () ? "in_interrupt" : "can sleep"))
+
+
+-#endif /* __KERNEL__ */
++/* This rwsem is for use only by the hub driver and ehci-hcd.
++ * Nobody else should touch it.
++ */
++extern struct rw_semaphore ehci_cf_port_reset_rwsem;
+
++#endif /* __KERNEL__ */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index f7b337f..c3adffa 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -125,6 +125,12 @@ MODULE_PARM_DESC(use_both_schemes,
+ "try the other device initialization scheme if the "
+ "first one fails");
+
++/* Mutual exclusion for EHCI CF initialization. This interferes with
++ * port reset on some companion controllers.
++ */
++DECLARE_RWSEM(ehci_cf_port_reset_rwsem);
++EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem);
++
+
+ static inline char *portspeed(int portstatus)
+ {
+@@ -1460,6 +1466,11 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ {
+ int i, status;
+
++ /* Block EHCI CF initialization during the port reset.
++ * Some companion controllers don't like it when they mix.
++ */
++ down_read(&ehci_cf_port_reset_rwsem);
++
+ /* Reset the port */
+ for (i = 0; i < PORT_RESET_TRIES; i++) {
+ status = set_port_feature(hub->hdev,
+@@ -1490,7 +1501,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ usb_set_device_state(udev, status
+ ? USB_STATE_NOTATTACHED
+ : USB_STATE_DEFAULT);
+- return status;
++ goto done;
+ }
+
+ dev_dbg (hub->intfdev,
+@@ -1503,6 +1514,8 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ "Cannot enable port %i. Maybe the USB cable is bad?\n",
+ port1);
+
++ done:
++ up_read(&ehci_cf_port_reset_rwsem);
+ return status;
+ }
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index ebf3dc2..d42c561 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -32,52 +32,6 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* HP 5300/5370C scanner */
+ { USB_DEVICE(0x03f0, 0x0701), .driver_info = USB_QUIRK_STRING_FETCH_255 },
+- /* Hewlett-Packard PhotoSmart 720 / PhotoSmart 935 (storage) */
+- { USB_DEVICE(0x03f0, 0x4002), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* SGS Thomson Microelectronics 4in1 card reader */
+- { USB_DEVICE(0x0483, 0x0321), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* Acer Peripherals Inc. (now BenQ Corp.) Prisa 640BU */
+- { USB_DEVICE(0x04a5, 0x207e), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Benq S2W 3300U */
+- { USB_DEVICE(0x04a5, 0x20b0), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Canon, Inc. CanoScan N1240U/LiDE30 */
+- { USB_DEVICE(0x04a9, 0x220e), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Canon, Inc. CanoScan N650U/N656U */
+- { USB_DEVICE(0x04a9, 0x2206), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Canon, Inc. CanoScan 1220U */
+- { USB_DEVICE(0x04a9, 0x2207), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Canon, Inc. CanoScan N670U/N676U/LiDE 20 */
+- { USB_DEVICE(0x04a9, 0x220d), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* old Cannon scanner */
+- { USB_DEVICE(0x04a9, 0x2220), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seiko Epson Corp. Perfection 1200 */
+- { USB_DEVICE(0x04b8, 0x0104), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seiko Epson Corp. Perfection 660 */
+- { USB_DEVICE(0x04b8, 0x0114), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Epson Perfection 1260 Photo */
+- { USB_DEVICE(0x04b8, 0x011d), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seiko Epson Corp - Perfection 1670 */
+- { USB_DEVICE(0x04b8, 0x011f), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* EPSON Perfection 2480 */
+- { USB_DEVICE(0x04b8, 0x0121), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seiko Epson Corp.*/
+- { USB_DEVICE(0x04b8, 0x0122), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Samsung ML-2010 printer */
+- { USB_DEVICE(0x04e8, 0x326c), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Samsung ML-2510 Series printer */
+- { USB_DEVICE(0x04e8, 0x327e), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Elsa MicroLink 56k (V.250) */
+- { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Ultima Electronics Corp.*/
+- { USB_DEVICE(0x05d8, 0x4005), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* Genesys USB-to-IDE */
+- { USB_DEVICE(0x0503, 0x0702), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* USB Graphical LCD - EEH Datalink GmbH */
+- { USB_DEVICE(0x060c, 0x04eb), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+
+ /* INTEL VALUE SSD */
+ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+@@ -85,44 +39,15 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* Agfa Snapscan1212u */
+- { USB_DEVICE(0x06bd, 0x2061), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Seagate RSS LLC */
+- { USB_DEVICE(0x0bc2, 0x3000), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- /* Umax [hex] Astra 3400U */
+- { USB_DEVICE(0x1606, 0x0060), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+ /* Philips PSC805 audio device */
+ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* Alcor multi-card reader */
+- { USB_DEVICE(0x058f, 0x6366), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* Canon EOS 5D in PC Connection mode */
+- { USB_DEVICE(0x04a9, 0x3101), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* RIM Blackberry */
+- { USB_DEVICE(0x0fca, 0x0001), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- { USB_DEVICE(0x0fca, 0x0004), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+- { USB_DEVICE(0x0fca, 0x0006), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+- /* Apple iPhone */
+- { USB_DEVICE(0x05ac, 0x1290), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+-
+ /* SKYMEDI USB_DRIVE */
+ { USB_DEVICE(0x1516, 0x8628), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ { } /* terminating entry must be last */
+ };
+
+-static void usb_autosuspend_quirk(struct usb_device *udev)
+-{
+-#ifdef CONFIG_USB_SUSPEND
+- /* disable autosuspend, but allow the user to re-enable it via sysfs */
+- udev->autosuspend_disabled = 1;
+-#endif
+-}
+-
+ static const struct usb_device_id *find_id(struct usb_device *udev)
+ {
+ const struct usb_device_id *id = usb_quirk_list;
+@@ -149,13 +74,9 @@ void usb_detect_quirks(struct usb_device *udev)
+ dev_dbg(&udev->dev, "USB quirks for this device: %x\n",
+ udev->quirks);
+
+- /* do any special quirk handling here if needed */
+- if (udev->quirks & USB_QUIRK_NO_AUTOSUSPEND)
+- usb_autosuspend_quirk(udev);
+-
+ /* By default, disable autosuspend for all non-hubs */
+ #ifdef CONFIG_USB_SUSPEND
+ if (udev->descriptor.bDeviceClass != USB_CLASS_HUB)
+- udev->autosuspend_delay = -1;
++ udev->autosuspend_disabled = 1;
+ #endif
+ }
+diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
+index be63022..3da7979 100644
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -358,7 +358,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
+
+ /* enforce simple/standard policy */
+ allowed = (URB_NO_TRANSFER_DMA_MAP | URB_NO_SETUP_DMA_MAP |
+- URB_NO_INTERRUPT);
++ URB_NO_INTERRUPT | URB_FREE_BUFFER);
+ switch (temp) {
+ case PIPE_BULK:
+ if (is_out)
+diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
+index 593e235..d57de87 100644
+--- a/drivers/usb/gadget/ether.c
++++ b/drivers/usb/gadget/ether.c
+@@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
+ }
+
+ spin_lock_irqsave(&dev->req_lock, flags);
++ /*
++ * this freelist can be empty if an interrupt triggered disconnect()
++ * and reconfigured the gadget (shutting down this queue) after the
++ * network stack decided to xmit but before we got the spinlock.
++ */
++ if (list_empty(&dev->tx_reqs)) {
++ spin_unlock_irqrestore(&dev->req_lock, flags);
++ return 1;
++ }
++
+ req = container_of (dev->tx_reqs.next, struct usb_request, list);
+ list_del (&req->list);
++
++ /* temporarily stop TX queue when the freelist empties */
+ if (list_empty (&dev->tx_reqs))
+ netif_stop_queue (net);
+ spin_unlock_irqrestore(&dev->req_lock, flags);
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 35cdba1..31310ca 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -570,10 +570,18 @@ static int ehci_run (struct usb_hcd *hcd)
+ * are explicitly handed to companion controller(s), so no TT is
+ * involved with the root hub. (Except where one is integrated,
+ * and there's no companion controller unless maybe for USB OTG.)
++ *
++ * Turning on the CF flag will transfer ownership of all ports
++ * from the companions to the EHCI controller. If any of the
++ * companions are in the middle of a port reset at the time, it
++ * could cause trouble. Write-locking ehci_cf_port_reset_rwsem
++ * guarantees that no resets are in progress.
+ */
++ down_write(&ehci_cf_port_reset_rwsem);
+ hcd->state = HC_STATE_RUNNING;
+ ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
++ up_write(&ehci_cf_port_reset_rwsem);
+
+ temp = HC_VERSION(ehci_readl(ehci, &ehci->caps->hc_capbase));
+ ehci_info (ehci,
+diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
+index 88a2c7d..9eb4a65 100644
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -208,14 +208,15 @@ int usb_serial_generic_write(struct usb_serial_port *port, const unsigned char *
+
+ /* only do something if we have a bulk out endpoint */
+ if (serial->num_bulk_out) {
+- spin_lock_bh(&port->lock);
++ unsigned long flags;
++ spin_lock_irqsave(&port->lock, flags);
+ if (port->write_urb_busy) {
+- spin_unlock_bh(&port->lock);
++ spin_unlock_irqrestore(&port->lock, flags);
+ dbg("%s - already writing", __FUNCTION__);
+ return 0;
+ }
+ port->write_urb_busy = 1;
+- spin_unlock_bh(&port->lock);
++ spin_unlock_irqrestore(&port->lock, flags);
+
+ count = (count > port->bulk_out_size) ? port->bulk_out_size : count;
+
+diff --git a/drivers/video/platinumfb.c b/drivers/video/platinumfb.c
+index 8503e73..cbe71a5 100644
+--- a/drivers/video/platinumfb.c
++++ b/drivers/video/platinumfb.c
+@@ -17,6 +17,8 @@
+ * more details.
+ */
+
++#undef DEBUG
++
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+@@ -535,33 +537,35 @@ static int __devinit platinumfb_probe(struct of_device* odev,
+ volatile __u8 *fbuffer;
+ int bank0, bank1, bank2, bank3, rc;
+
+- printk(KERN_INFO "platinumfb: Found Apple Platinum video hardware\n");
++ dev_info(&odev->dev, "Found Apple Platinum video hardware\n");
+
+ info = framebuffer_alloc(sizeof(*pinfo), &odev->dev);
+- if (info == NULL)
++ if (info == NULL) {
++ dev_err(&odev->dev, "Failed to allocate fbdev !\n");
+ return -ENOMEM;
++ }
+ pinfo = info->par;
+
+ if (of_address_to_resource(dp, 0, &pinfo->rsrc_reg) ||
+ of_address_to_resource(dp, 1, &pinfo->rsrc_fb)) {
+- printk(KERN_ERR "platinumfb: Can't get resources\n");
+- framebuffer_release(info);
+- return -ENXIO;
+- }
+- if (!request_mem_region(pinfo->rsrc_reg.start,
+- pinfo->rsrc_reg.start -
+- pinfo->rsrc_reg.end + 1,
+- "platinumfb registers")) {
++ dev_err(&odev->dev, "Can't get resources\n");
+ framebuffer_release(info);
+ return -ENXIO;
+ }
++ dev_dbg(&odev->dev, " registers : 0x%llx...0x%llx\n",
++ (unsigned long long)pinfo->rsrc_reg.start,
++ (unsigned long long)pinfo->rsrc_reg.end);
++ dev_dbg(&odev->dev, " framebuffer: 0x%llx...0x%llx\n",
++ (unsigned long long)pinfo->rsrc_fb.start,
++ (unsigned long long)pinfo->rsrc_fb.end);
++
++ /* Do not try to request register space, they overlap with the
++ * northbridge and that can fail. Only request framebuffer
++ */
+ if (!request_mem_region(pinfo->rsrc_fb.start,
+- pinfo->rsrc_fb.start
+- - pinfo->rsrc_fb.end + 1,
++ pinfo->rsrc_fb.end - pinfo->rsrc_fb.start + 1,
+ "platinumfb framebuffer")) {
+- release_mem_region(pinfo->rsrc_reg.start,
+- pinfo->rsrc_reg.end -
+- pinfo->rsrc_reg.start + 1);
++ printk(KERN_ERR "platinumfb: Can't request framebuffer !\n");
+ framebuffer_release(info);
+ return -ENXIO;
+ }
+@@ -600,7 +604,8 @@ static int __devinit platinumfb_probe(struct of_device* odev,
+ bank2 = fbuffer[0x200000] == 0x56;
+ bank3 = fbuffer[0x300000] == 0x78;
+ pinfo->total_vram = (bank0 + bank1 + bank2 + bank3) * 0x100000;
+- printk(KERN_INFO "platinumfb: Total VRAM = %dMB (%d%d%d%d)\n", (int) (pinfo->total_vram / 1024 / 1024),
++ printk(KERN_INFO "platinumfb: Total VRAM = %dMB (%d%d%d%d)\n",
++ (unsigned int) (pinfo->total_vram / 1024 / 1024),
+ bank3, bank2, bank1, bank0);
+
+ /*
+@@ -644,16 +649,15 @@ static int __devexit platinumfb_remove(struct of_device* odev)
+ unregister_framebuffer (info);
+
+ /* Unmap frame buffer and registers */
++ iounmap(pinfo->frame_buffer);
++ iounmap(pinfo->platinum_regs);
++ iounmap(pinfo->cmap_regs);
++
+ release_mem_region(pinfo->rsrc_fb.start,
+ pinfo->rsrc_fb.end -
+ pinfo->rsrc_fb.start + 1);
+- release_mem_region(pinfo->rsrc_reg.start,
+- pinfo->rsrc_reg.end -
+- pinfo->rsrc_reg.start + 1);
+- iounmap(pinfo->frame_buffer);
+- iounmap(pinfo->platinum_regs);
++
+ release_mem_region(pinfo->cmap_regs_phys, 0x1000);
+- iounmap(pinfo->cmap_regs);
+
+ framebuffer_release(info);
+
+diff --git a/include/linux/ide.h b/include/linux/ide.h
+index b9f66c1..20528c0 100644
+--- a/include/linux/ide.h
++++ b/include/linux/ide.h
+@@ -1437,4 +1437,11 @@ static inline int hwif_to_node(ide_hwif_t *hwif)
+ return dev ? pcibus_to_node(dev->bus) : -1;
+ }
+
++static inline ide_drive_t *ide_get_paired_drive(ide_drive_t *drive)
++{
++ ide_hwif_t *hwif = HWIF(drive);
++
++ return &hwif->drives[(drive->dn ^ 1) & 1];
++}
++
+ #endif /* _IDE_H */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index a67bb90..9ccca8f 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -177,6 +177,8 @@ enum {
+ ATA_FLAG_IGN_SIMPLEX = (1 << 15), /* ignore SIMPLEX */
+ ATA_FLAG_NO_IORDY = (1 << 16), /* controller lacks iordy */
+ ATA_FLAG_ACPI_SATA = (1 << 17), /* need native SATA ACPI layout */
++ ATA_FLAG_NO_SRST = (1 << 18),
++ ATA_FLAG_ASSUME_ATA = (1 << 19),
+
+ /* The following flag belongs to ap->pflags but is kept in
+ * ap->flags because it's referenced in many LLDs and will be
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index 8da374c..2692ec9 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -4,11 +4,8 @@
+ * belong here.
+ */
+
+-/* device must not be autosuspended */
+-#define USB_QUIRK_NO_AUTOSUSPEND 0x00000001
+-
+ /* string descriptors must not be fetched using a 255-byte read */
+-#define USB_QUIRK_STRING_FETCH_255 0x00000002
++#define USB_QUIRK_STRING_FETCH_255 0x00000001
+
+ /* device can't resume correctly so reset it instead */
+-#define USB_QUIRK_RESET_RESUME 0x00000004
++#define USB_QUIRK_RESET_RESUME 0x00000002
+diff --git a/sound/core/Makefile b/sound/core/Makefile
+index 5a01c76..05f5cdc 100644
+--- a/sound/core/Makefile
++++ b/sound/core/Makefile
+@@ -14,7 +14,8 @@ endif
+ snd-pcm-objs := pcm.o pcm_native.o pcm_lib.o pcm_timer.o pcm_misc.o \
+ pcm_memory.o
+
+-snd-page-alloc-objs := memalloc.o sgbuf.o
++snd-page-alloc-y := memalloc.o
++snd-page-alloc-$(CONFIG_HAS_DMA) += sgbuf.o
+
+ snd-rawmidi-objs := rawmidi.o
+ snd-timer-objs := timer.o
+diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c
+index 9b5656d..6f99b6f 100644
+--- a/sound/core/memalloc.c
++++ b/sound/core/memalloc.c
+@@ -206,6 +206,7 @@ void snd_free_pages(void *ptr, size_t size)
+ *
+ */
+
++#ifdef CONFIG_HAS_DMA
+ /* allocate the coherent DMA pages */
+ static void *snd_malloc_dev_pages(struct device *dev, size_t size, dma_addr_t *dma)
+ {
+@@ -239,6 +240,7 @@ static void snd_free_dev_pages(struct device *dev, size_t size, void *ptr,
+ dec_snd_pages(pg);
+ dma_free_coherent(dev, PAGE_SIZE << pg, ptr, dma);
+ }
++#endif /* CONFIG_HAS_DMA */
+
+ #ifdef CONFIG_SBUS
+
+@@ -312,12 +314,14 @@ int snd_dma_alloc_pages(int type, struct device *device, size_t size,
+ dmab->area = snd_malloc_sbus_pages(device, size, &dmab->addr);
+ break;
+ #endif
++#ifdef CONFIG_HAS_DMA
+ case SNDRV_DMA_TYPE_DEV:
+ dmab->area = snd_malloc_dev_pages(device, size, &dmab->addr);
+ break;
+ case SNDRV_DMA_TYPE_DEV_SG:
+ snd_malloc_sgbuf_pages(device, size, dmab, NULL);
+ break;
++#endif
+ default:
+ printk(KERN_ERR "snd-malloc: invalid device type %d\n", type);
+ dmab->area = NULL;
+@@ -383,12 +387,14 @@ void snd_dma_free_pages(struct snd_dma_buffer *dmab)
+ snd_free_sbus_pages(dmab->dev.dev, dmab->bytes, dmab->area, dmab->addr);
+ break;
+ #endif
++#ifdef CONFIG_HAS_DMA
+ case SNDRV_DMA_TYPE_DEV:
+ snd_free_dev_pages(dmab->dev.dev, dmab->bytes, dmab->area, dmab->addr);
+ break;
+ case SNDRV_DMA_TYPE_DEV_SG:
+ snd_free_sgbuf_pages(dmab);
+ break;
++#endif
+ default:
+ printk(KERN_ERR "snd-malloc: invalid device type %d\n", dmab->dev.type);
+ }
+diff --git a/sound/pci/emu10k1/emumixer.c b/sound/pci/emu10k1/emumixer.c
+index 7b2c1dc..5bff700 100644
+--- a/sound/pci/emu10k1/emumixer.c
++++ b/sound/pci/emu10k1/emumixer.c
+@@ -871,7 +871,7 @@ static struct snd_kcontrol_new snd_emu10k1_spdif_mask_control =
+ .access = SNDRV_CTL_ELEM_ACCESS_READ,
+ .iface = SNDRV_CTL_ELEM_IFACE_PCM,
+ .name = SNDRV_CTL_NAME_IEC958("",PLAYBACK,MASK),
+- .count = 4,
++ .count = 3,
+ .info = snd_emu10k1_spdif_info,
+ .get = snd_emu10k1_spdif_get_mask
+ };
+@@ -880,7 +880,7 @@ static struct snd_kcontrol_new snd_emu10k1_spdif_control =
+ {
+ .iface = SNDRV_CTL_ELEM_IFACE_PCM,
+ .name = SNDRV_CTL_NAME_IEC958("",PLAYBACK,DEFAULT),
+- .count = 4,
++ .count = 3,
+ .info = snd_emu10k1_spdif_info,
+ .get = snd_emu10k1_spdif_get,
+ .put = snd_emu10k1_spdif_put
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 3f25de7..d46e7e4 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -162,8 +162,9 @@ static hda_nid_t stac925x_dac_nids[1] = {
+ 0x02,
+ };
+
+-static hda_nid_t stac925x_dmic_nids[1] = {
+- 0x15,
++#define STAC925X_NUM_DMICS 1
++static hda_nid_t stac925x_dmic_nids[STAC925X_NUM_DMICS + 1] = {
++ 0x15, 0
+ };
+
+ static hda_nid_t stac922x_adc_nids[2] = {
+@@ -190,8 +191,9 @@ static hda_nid_t stac9205_mux_nids[2] = {
+ 0x19, 0x1a
+ };
+
+-static hda_nid_t stac9205_dmic_nids[2] = {
+- 0x17, 0x18,
++#define STAC9205_NUM_DMICS 2
++static hda_nid_t stac9205_dmic_nids[STAC9205_NUM_DMICS + 1] = {
++ 0x17, 0x18, 0
+ };
+
+ static hda_nid_t stac9200_pin_nids[8] = {
+@@ -1182,7 +1184,8 @@ static int stac92xx_add_dyn_out_pins(struct hda_codec *codec, struct auto_pin_cf
+ case 3:
+ /* add line-in as side */
+ if (cfg->input_pins[AUTO_PIN_LINE] && num_dacs > 3) {
+- cfg->line_out_pins[3] = cfg->input_pins[AUTO_PIN_LINE];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_LINE];
+ spec->line_switch = 1;
+ cfg->line_outs++;
+ }
+@@ -1190,12 +1193,14 @@ static int stac92xx_add_dyn_out_pins(struct hda_codec *codec, struct auto_pin_cf
+ case 2:
+ /* add line-in as clfe and mic as side */
+ if (cfg->input_pins[AUTO_PIN_LINE] && num_dacs > 2) {
+- cfg->line_out_pins[2] = cfg->input_pins[AUTO_PIN_LINE];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_LINE];
+ spec->line_switch = 1;
+ cfg->line_outs++;
+ }
+ if (cfg->input_pins[AUTO_PIN_MIC] && num_dacs > 3) {
+- cfg->line_out_pins[3] = cfg->input_pins[AUTO_PIN_MIC];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_MIC];
+ spec->mic_switch = 1;
+ cfg->line_outs++;
+ }
+@@ -1203,12 +1208,14 @@ static int stac92xx_add_dyn_out_pins(struct hda_codec *codec, struct auto_pin_cf
+ case 1:
+ /* add line-in as surr and mic as clfe */
+ if (cfg->input_pins[AUTO_PIN_LINE] && num_dacs > 1) {
+- cfg->line_out_pins[1] = cfg->input_pins[AUTO_PIN_LINE];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_LINE];
+ spec->line_switch = 1;
+ cfg->line_outs++;
+ }
+ if (cfg->input_pins[AUTO_PIN_MIC] && num_dacs > 2) {
+- cfg->line_out_pins[2] = cfg->input_pins[AUTO_PIN_MIC];
++ cfg->line_out_pins[cfg->line_outs] =
++ cfg->input_pins[AUTO_PIN_MIC];
+ spec->mic_switch = 1;
+ cfg->line_outs++;
+ }
+@@ -2058,7 +2065,7 @@ static int patch_stac925x(struct hda_codec *codec)
+ case 0x83847633: /* STAC9202D */
+ case 0x83847636: /* STAC9251 */
+ case 0x83847637: /* STAC9251D */
+- spec->num_dmics = 1;
++ spec->num_dmics = STAC925X_NUM_DMICS;
+ spec->dmic_nids = stac925x_dmic_nids;
+ break;
+ default:
+@@ -2302,7 +2309,7 @@ static int patch_stac9205(struct hda_codec *codec)
+ spec->mux_nids = stac9205_mux_nids;
+ spec->num_muxes = ARRAY_SIZE(stac9205_mux_nids);
+ spec->dmic_nids = stac9205_dmic_nids;
+- spec->num_dmics = ARRAY_SIZE(stac9205_dmic_nids);
++ spec->num_dmics = STAC9205_NUM_DMICS;
+ spec->dmux_nid = 0x1d;
+
+ spec->init = stac9205_core_init;
+diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
+index 3b3ef65..75dcb9a 100644
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -3108,6 +3108,9 @@ static int hdsp_dds_offset(struct hdsp *hdsp)
+ unsigned int dds_value = hdsp->dds_value;
+ int system_sample_rate = hdsp->system_sample_rate;
+
++ if (!dds_value)
++ return 0;
++
+ n = DDS_NUMERATOR;
+ /*
+ * dds_value = n / rate
+diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
+index 325d4b6..19776e7 100644
+--- a/sound/usb/usbmixer.c
++++ b/sound/usb/usbmixer.c
+@@ -1483,7 +1483,7 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, unsi
+ struct snd_kcontrol *kctl;
+ char **namelist;
+
+- if (! num_ins || desc[0] < 6 + num_ins) {
++ if (! num_ins || desc[0] < 5 + num_ins) {
+ snd_printk(KERN_ERR "invalid SELECTOR UNIT descriptor %d\n", unitid);
+ return -EINVAL;
+ }
--- /dev/null
+# other drivers
+powerpc-fix-platinumfb-framebuffer.patch
+i915-fix-vbl-swap-allocation-size.patch
+hwmon-w83627hf-fix-setting-fan-min-right-after-driver-load.patch
+hwmon-w83627hf-don-t-assume-bank-0.patch
+hwmon-lm87-fix-a-division-by-zero.patch
+hwmon-lm87-disable-vid-when-it-should-be.patch
+ib-uverbs-fix-checking-of-userspace-object-ownership.patch
+ib-mthca-use-mmiowb-to-avoid-firmware-commands-getting-jumbled-up.patch
+alsa-hda-codec-avoid-zero-nid-in-line_out_pins-of-stac-codecs.patch
+alsa-fix-selector-unit-bug-affecting-some-usb-speakerphones.patch
+alsa-fix-build-error-without-config_has_dma.patch
+alsa-emu10k1-fix-memory-corruption.patch
+alsa-hdsp-fix-zero-division.patch
+libata-sync-ncq-blacklist-with-upstream.patch
+dm-delay-fix-status.patch
+dm-fix-thaw_bdev.patch
+md-fix-an-unsigned-compare-to-allow-creation-of-bitmaps-with-v1.0-metadata.patch
+md-raid5-not-raid6-fix-clearing-of-biofill-operations.patch
+msi-use-correct-data-offset-for-32-bit-msi-in-read_msi_msg.patch
+usb-remove-usb_quirk_no_autosuspend.patch
+usb-gadget-ether-prevent-oops-caused-by-error-interrupt-race.patch
+usb-mutual-exclusion-for-ehci-init-and-port-resets.patch
+usb-add-urb_free_buffer-to-permissible-flags.patch
+usb-usbserial-fix-potential-deadlock-between-write-and-irq.patch
+alsa-hda-codec-add-array-terminator-for-dmic-in-stac-codec.patch
+i4l-fix-random-hard-freeze-with-avm-c4-card.patch
+i4l-fix-random-freezes-with-avm-b1-drivers.patch
+ide-fix-serverworks.c-udma-regression.patch
+ide-add-ide_get_paired_drive-helper.patch
+ide-fix-siimage-driver-accessing-beyond-array-boundary.patch
+ide-fix-cs5535-driver-accessing-beyond-array-boundary.patch
+hptiop-avoid-buffer-overflow-when-returning-sense-data.patch
+char-rocket-fix-dynamic_dev-tty.patch
+char-moxa-fix-and-optimise-empty-timer.patch
+radeon-set-the-address-to-access-the-gart-table-on-the-cpu-side-correctly.patch
+libata-add-hts542525k9sa00-to-ncq-blacklist.patch
+libata-backport-ata_flag_no_srst-and-ata_flag_assume_ata.patch
+libata-backport-ata_flag_no_srst-and-ata_flag_assume_ata-part-2.patch
+acpi-sleep-fix-gpe-suspend-cleanup.patch
+acpi-suspend-wrong-order-of-gpe-restore.patch
--- /dev/null
+ fs/minix/itree_v1.c | 9 +++++++--
+ fs/minix/itree_v2.c | 9 +++++++--
+ fs/nfs/write.c | 17 +++++++++++++----
+ fs/ocfs2/aops.c | 22 ++++++++++++++++++++++
+ 4 files changed, 49 insertions(+), 8 deletions(-)
--- /dev/null
+From gregkh@mini.kroah.org Wed Nov 14 22:51:19 2007
+Message-Id: <20071115065014.785638308@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:50:14 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 0/3] 2.6.23-stable review, filesystem changes
+
+This is the start of the stable review cycle for the 2.6.23.X release.
+There are 3 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday 00:00:00 UTC. Anything received
+after that time might be too late.
+
+This set of patches focuses on filesystems.
+
+The diffstat of this review series is included below.
+
+thanks,
+
+greg k-h
+
+--
+
+ fs/minix/itree_v1.c | 9 +++++++--
+ fs/minix/itree_v2.c | 9 +++++++--
+ fs/nfs/write.c | 17 +++++++++++++----
+ fs/ocfs2/aops.c | 22 ++++++++++++++++++++++
+ 4 files changed, 49 insertions(+), 8 deletions(-)
+
+From gregkh@mini.kroah.org Wed Nov 14 22:51:19 2007
+Message-Id: <20071115065119.759244939@mini.kroah.org>
+References: <20071115065014.785638308@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:50:15 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Sandeen <sandeen@redhat.com>,
+ Bodo Eggert <7eggert@gmx.de>
+Subject: [patch 1/3] minixfs: limit minixfs printks on corrupted dir i_size (CVE-2006-6058)
+Content-Disposition: inline; filename=minixfs-limit-minixfs-printks-on-corrupted-dir-i_size.patch
+Content-Length: 2716
+Lines: 76
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+patch f44ec6f3f89889a469773b1fd894f8fcc07c29cf upstream.
+
+This attempts to address CVE-2006-6058
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6058
+
+first reported at http://projects.info-pull.com/mokb/MOKB-17-11-2006.html
+
+Essentially a corrupted minix dir inode reporting a very large
+i_size will loop for a very long time in minix_readdir, minix_find_entry,
+etc, because on EIO they just move on to try the next page. This is
+under the BKL, printk-storming as well. This can lock up the machine
+for a very long time. Simply ratelimiting the printks gets things back
+under control. Make the message a bit more informative while we're here.
+
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Cc: Bodo Eggert <7eggert@gmx.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/minix/itree_v1.c | 9 +++++++--
+ fs/minix/itree_v2.c | 9 +++++++--
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -23,11 +23,16 @@ static inline block_t *i_data(struct ino
+ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ {
+ int n = 0;
++ char b[BDEVNAME_SIZE];
+
+ if (block < 0) {
+- printk("minix_bmap: block<0\n");
++ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %s\n",
++ block, bdevname(inode->i_sb->s_bdev, b));
+ } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) {
+- printk("minix_bmap: block>big\n");
++ if (printk_ratelimit())
++ printk("MINIX-fs: block_to_path: "
++ "block %ld too big on dev %s\n",
++ block, bdevname(inode->i_sb->s_bdev, b));
+ } else if (block < 7) {
+ offsets[n++] = block;
+ } else if ((block -= 7) < 512) {
+--- a/fs/minix/itree_v2.c
++++ b/fs/minix/itree_v2.c
+@@ -23,12 +23,17 @@ static inline block_t *i_data(struct ino
+ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ {
+ int n = 0;
++ char b[BDEVNAME_SIZE];
+ struct super_block *sb = inode->i_sb;
+
+ if (block < 0) {
+- printk("minix_bmap: block<0\n");
++ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %s\n",
++ block, bdevname(sb->s_bdev, b));
+ } else if (block >= (minix_sb(inode->i_sb)->s_max_size/sb->s_blocksize)) {
+- printk("minix_bmap: block>big\n");
++ if (printk_ratelimit())
++ printk("MINIX-fs: block_to_path: "
++ "block %ld too big on dev %s\n",
++ block, bdevname(sb->s_bdev, b));
+ } else if (block < 7) {
+ offsets[n++] = block;
+ } else if ((block -= 7) < 256) {
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:51:20 2007
+Message-Id: <20071115065119.920749039@mini.kroah.org>
+References: <20071115065014.785638308@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:50:16 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark Fasheh <mark.fasheh@oracle.com>
+Subject: [patch 2/3] ocfs2: fix write() performance regression
+Content-Disposition: inline; filename=ocfs2-fix-write-performance-regression.patch
+Content-Length: 1943
+Lines: 62
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mark Fasheh <mark.fasheh@oracle.com>
+
+patch 4e9563fd55ff4479f2b118d0757d121dd0cfc39c in mainline.
+
+ocfs2: fix write() performance regression
+
+On file systems which don't support sparse files, Ocfs2_map_page_blocks()
+was reading blocks on appending writes. This caused write performance to
+suffer dramatically. Fix this by detecting an appending write on a nonsparse
+fs and skipping the read.
+
+Signed-off-by: Mark Fasheh <mark.fasheh@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/aops.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -661,6 +661,27 @@ static void ocfs2_clear_page_regions(str
+ }
+
+ /*
++ * Nonsparse file systems fully allocate before we get to the write
++ * code. This prevents ocfs2_write() from tagging the write as an
++ * allocating one, which means ocfs2_map_page_blocks() might try to
++ * read-in the blocks at the tail of our file. Avoid reading them by
++ * testing i_size against each block offset.
++ */
++static int ocfs2_should_read_blk(struct inode *inode, struct page *page,
++ unsigned int block_start)
++{
++ u64 offset = page_offset(page) + block_start;
++
++ if (ocfs2_sparse_alloc(OCFS2_SB(inode->i_sb)))
++ return 1;
++
++ if (i_size_read(inode) > offset)
++ return 1;
++
++ return 0;
++}
++
++/*
+ * Some of this taken from block_prepare_write(). We already have our
+ * mapping by now though, and the entire write will be allocating or
+ * it won't, so not much need to use BH_New.
+@@ -713,6 +734,7 @@ int ocfs2_map_page_blocks(struct page *p
+ set_buffer_uptodate(bh);
+ } else if (!buffer_uptodate(bh) && !buffer_delay(bh) &&
+ !buffer_new(bh) &&
++ ocfs2_should_read_blk(inode, page, block_start) &&
+ (block_start < from || block_end > to)) {
+ ll_rw_block(READ, 1, &bh);
+ *wait_bh++=bh;
+
+--
+
+From gregkh@mini.kroah.org Wed Nov 14 22:51:20 2007
+Message-Id: <20071115065120.077365019@mini.kroah.org>
+References: <20071115065014.785638308@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Wed, 14 Nov 2007 22:50:17 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [patch 3/3] NFS: Fix a writeback race...
+Content-Disposition: inline; filename=nfs-fix-a-writeback-race.patch
+Content-Length: 2266
+Lines: 77
+
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+patch 61e930a904966cc37e0a3404276f0b73037e57ca in mainline
+
+This patch fixes a regression that was introduced by commit
+44dd151d5c21234cc534c47d7382f5c28c3143cd
+
+We cannot zero the user page in nfs_mark_uptodate() any more, since
+
+ a) We'd be modifying the page without holding the page lock
+ b) We can race with other updates of the page, most notably
+ because of the call to nfs_wb_page() in nfs_writepage_setup().
+
+Instead, we do the zeroing in nfs_update_request() if we see that we're
+creating a request that might potentially be marked as up to date.
+
+Thanks to Olivier Paquet for reporting the bug and providing a test-case.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/write.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -167,8 +167,6 @@ static void nfs_mark_uptodate(struct pag
+ return;
+ if (count != nfs_page_length(page))
+ return;
+- if (count != PAGE_CACHE_SIZE)
+- zero_user_page(page, count, PAGE_CACHE_SIZE - count, KM_USER0);
+ SetPageUptodate(page);
+ }
+
+@@ -643,7 +641,8 @@ static struct nfs_page * nfs_update_requ
+ return ERR_PTR(error);
+ }
+ spin_unlock(&inode->i_lock);
+- return new;
++ req = new;
++ goto zero_page;
+ }
+ spin_unlock(&inode->i_lock);
+
+@@ -671,13 +670,23 @@ static struct nfs_page * nfs_update_requ
+ if (offset < req->wb_offset) {
+ req->wb_offset = offset;
+ req->wb_pgbase = offset;
+- req->wb_bytes = rqend - req->wb_offset;
++ req->wb_bytes = max(end, rqend) - req->wb_offset;
++ goto zero_page;
+ }
+
+ if (end > rqend)
+ req->wb_bytes = end - req->wb_offset;
+
+ return req;
++zero_page:
++ /* If this page might potentially be marked as up to date,
++ * then we need to zero any uninitalised data. */
++ if (req->wb_pgbase == 0 && req->wb_bytes != PAGE_CACHE_SIZE
++ && !PageUptodate(req->wb_page))
++ zero_user_page(req->wb_page, req->wb_bytes,
++ PAGE_CACHE_SIZE - req->wb_bytes,
++ KM_USER0);
++ return req;
+ }
+
+ int nfs_flush_incompatible(struct file *file, struct page *page)
+
+--
+
--- /dev/null
+diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
+index 1a5f3bf..82d6554 100644
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -23,11 +23,16 @@ static inline block_t *i_data(struct inode *inode)
+ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ {
+ int n = 0;
++ char b[BDEVNAME_SIZE];
+
+ if (block < 0) {
+- printk("minix_bmap: block<0\n");
++ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %s\n",
++ block, bdevname(inode->i_sb->s_bdev, b));
+ } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) {
+- printk("minix_bmap: block>big\n");
++ if (printk_ratelimit())
++ printk("MINIX-fs: block_to_path: "
++ "block %ld too big on dev %s\n",
++ block, bdevname(inode->i_sb->s_bdev, b));
+ } else if (block < 7) {
+ offsets[n++] = block;
+ } else if ((block -= 7) < 512) {
+diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
+index ad8f0de..f230109 100644
+--- a/fs/minix/itree_v2.c
++++ b/fs/minix/itree_v2.c
+@@ -23,12 +23,17 @@ static inline block_t *i_data(struct inode *inode)
+ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ {
+ int n = 0;
++ char b[BDEVNAME_SIZE];
+ struct super_block *sb = inode->i_sb;
+
+ if (block < 0) {
+- printk("minix_bmap: block<0\n");
++ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %s\n",
++ block, bdevname(sb->s_bdev, b));
+ } else if (block >= (minix_sb(inode->i_sb)->s_max_size/sb->s_blocksize)) {
+- printk("minix_bmap: block>big\n");
++ if (printk_ratelimit())
++ printk("MINIX-fs: block_to_path: "
++ "block %ld too big on dev %s\n",
++ block, bdevname(sb->s_bdev, b));
+ } else if (block < 7) {
+ offsets[n++] = block;
+ } else if ((block -= 7) < 256) {
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 0d7a77c..a2a4865 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -167,8 +167,6 @@ static void nfs_mark_uptodate(struct page *page, unsigned int base, unsigned int
+ return;
+ if (count != nfs_page_length(page))
+ return;
+- if (count != PAGE_CACHE_SIZE)
+- zero_user_page(page, count, PAGE_CACHE_SIZE - count, KM_USER0);
+ SetPageUptodate(page);
+ }
+
+@@ -643,7 +641,8 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
+ return ERR_PTR(error);
+ }
+ spin_unlock(&inode->i_lock);
+- return new;
++ req = new;
++ goto zero_page;
+ }
+ spin_unlock(&inode->i_lock);
+
+@@ -671,13 +670,23 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
+ if (offset < req->wb_offset) {
+ req->wb_offset = offset;
+ req->wb_pgbase = offset;
+- req->wb_bytes = rqend - req->wb_offset;
++ req->wb_bytes = max(end, rqend) - req->wb_offset;
++ goto zero_page;
+ }
+
+ if (end > rqend)
+ req->wb_bytes = end - req->wb_offset;
+
+ return req;
++zero_page:
++ /* If this page might potentially be marked as up to date,
++ * then we need to zero any uninitalised data. */
++ if (req->wb_pgbase == 0 && req->wb_bytes != PAGE_CACHE_SIZE
++ && !PageUptodate(req->wb_page))
++ zero_user_page(req->wb_page, req->wb_bytes,
++ PAGE_CACHE_SIZE - req->wb_bytes,
++ KM_USER0);
++ return req;
+ }
+
+ int nfs_flush_incompatible(struct file *file, struct page *page)
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index f37f25c..0b5e35f 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -661,6 +661,27 @@ static void ocfs2_clear_page_regions(struct page *page,
+ }
+
+ /*
++ * Nonsparse file systems fully allocate before we get to the write
++ * code. This prevents ocfs2_write() from tagging the write as an
++ * allocating one, which means ocfs2_map_page_blocks() might try to
++ * read-in the blocks at the tail of our file. Avoid reading them by
++ * testing i_size against each block offset.
++ */
++static int ocfs2_should_read_blk(struct inode *inode, struct page *page,
++ unsigned int block_start)
++{
++ u64 offset = page_offset(page) + block_start;
++
++ if (ocfs2_sparse_alloc(OCFS2_SB(inode->i_sb)))
++ return 1;
++
++ if (i_size_read(inode) > offset)
++ return 1;
++
++ return 0;
++}
++
++/*
+ * Some of this taken from block_prepare_write(). We already have our
+ * mapping by now though, and the entire write will be allocating or
+ * it won't, so not much need to use BH_New.
+@@ -713,6 +734,7 @@ int ocfs2_map_page_blocks(struct page *page, u64 *p_blkno,
+ set_buffer_uptodate(bh);
+ } else if (!buffer_uptodate(bh) && !buffer_delay(bh) &&
+ !buffer_new(bh) &&
++ ocfs2_should_read_blk(inode, page, block_start) &&
+ (block_start < from || block_end > to)) {
+ ll_rw_block(READ, 1, &bh);
+ *wait_bh++=bh;
--- /dev/null
+# file systems
+minixfs-limit-minixfs-printks-on-corrupted-dir-i_size.patch
+ocfs2-fix-write-performance-regression.patch
+nfs-fix-a-writeback-race.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
