--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:54:06 2008
+Date: Wed, 16 Apr 2008 02:45:05 GMT
+Message-Id: <200804160245.m3G2j5nl012377@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: acpi: bus: check once more for an empty list after locking it
+
+From: Chuck Ebbert <cebbert@redhat.com>
+
+upstream commit: f0a37e008750ead1751b7d5e89d220a260a46147
+
+List could have become empty after the unlocked check that was made earlier,
+so check again inside the lock.
+
+Should fix https://bugzilla.redhat.com/show_bug.cgi?id=427765
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Cc: <stable@kernel.org>
+Cc: Len Brown <lenb@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/acpi/bus.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -350,10 +350,11 @@ int acpi_bus_receive_event(struct acpi_b
+ }
+
+ spin_lock_irqsave(&acpi_bus_event_lock, flags);
+- entry =
+- list_entry(acpi_bus_event_list.next, struct acpi_bus_event, node);
+- if (entry)
++ if (!list_empty(&acpi_bus_event_list)) {
++ entry = list_entry(acpi_bus_event_list.next,
++ struct acpi_bus_event, node);
+ list_del(&entry->node);
++ }
+ spin_unlock_irqrestore(&acpi_bus_event_lock, flags);
+
+ if (!entry)
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:30:31 2008
+Date: Thu, 10 Apr 2008 01:50:05 GMT
+Message-Id: <200804100150.m3A1o5Xd032532@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: acpi: fix "buggy BIOS check" when CPUs are hot removed
+
+From: Alok Kataria <akataria@vmware.com>
+
+upstream commit: ba62b077871a5255e271f4fdae57167651839277
+
+Fixes a BUG in ACPI hotplugging.
+
+processor_device_array[pr->id] needs to be set to NULL when removing a CPU.
+Else the "buggy BIOS check" in acpi_processor_start mistakenly fires when a
+CPU is removed from the system and then later re-added.
+
+Signed-off-by: Alok N Kataria <akataria@vmware.com>
+Signed-off-by: Dan Arai <arai@vmware.com>
+Cc: Len Brown <lenb@kernel.org>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/acpi/processor_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/processor_core.c
++++ b/drivers/acpi/processor_core.c
+@@ -792,7 +792,7 @@ static int acpi_processor_remove(struct
+ acpi_processor_remove_fs(device);
+
+ processors[pr->id] = NULL;
+-
++ processor_device_array[pr->id] = NULL;
+ kfree(pr);
+
+ return 0;
--- /dev/null
+From 490fb153b2a45b8b4aef52374a063a34061e2619 Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Sun, 6 Apr 2008 23:35:31 -0700
+Subject: AX25 ax25_out: check skb for NULL in ax25_kick()
+
+Upstream commit: f47b7257c7368698eabff6fd7b340071932af640
+
+According to some OOPS reports ax25_kick tries to clone NULL skbs
+sometimes. It looks like a race with ax25_clear_queues(). Probably
+there is no need to add more than a simple check for this yet.
+Another report suggested there are probably also cases where ax25
+->paclen == 0 can happen in ax25_output(); this wasn't confirmed
+during testing but let's leave this debugging check for some time.
+
+Reported-and-tested-by: Jann Traschewski <jann@gmx.de>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/ax25/ax25_out.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/net/ax25/ax25_out.c
++++ b/net/ax25/ax25_out.c
+@@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int pacl
+ unsigned char *p;
+ int frontlen, len, fragno, ka9qfrag, first = 1;
+
++ if (paclen < 16) {
++ WARN_ON_ONCE(1);
++ kfree_skb(skb);
++ return;
++ }
++
+ if ((skb->len - 1) > paclen) {
+ if (*skb->data == AX25_P_TEXT) {
+ skb_pull(skb, 1); /* skip PID */
+@@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
+ if (start == end)
+ return;
+
+- ax25->vs = start;
+-
+ /*
+ * Transmit data until either we're out of data to send or
+ * the window is full. Send a poll on the final I frame if
+@@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
+
+ /*
+ * Dequeue the frame and copy it.
++ * Check for race with ax25_clear_queues().
+ */
+ skb = skb_dequeue(&ax25->write_queue);
++ if (!skb)
++ return;
++
++ ax25->vs = start;
+
+ do {
+ if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {
--- /dev/null
+From 147e2d59833e994cc99341806a88b9e59be41391 Mon Sep 17 00:00:00 2001
+From: Dave Young <hidave.darkstar@gmail.com>
+Date: Wed, 5 Mar 2008 18:45:59 -0800
+Message-ID: <47FA109D.2030203@gentoo.org>
+Subject: bluetooth: hci_core: defer hci_unregister_sysfs()
+
+upstream commit: 147e2d59833e994cc99341806a88b9e59be41391
+
+Alon Bar-Lev reports:
+
+ Feb 16 23:41:33 alon1 usb 3-1: configuration #1 chosen from 1 choice
+Feb 16 23:41:33 alon1 BUG: unable to handle kernel NULL pointer
+dereference at virtual address 00000008
+Feb 16 23:41:33 alon1 printing eip: c01b2db6 *pde = 00000000
+Feb 16 23:41:33 alon1 Oops: 0000 [#1] PREEMPT
+Feb 16 23:41:33 alon1 Modules linked in: ppp_deflate zlib_deflate
+zlib_inflate bsd_comp ppp_async rfcomm l2cap hci_usb vmnet(P)
+vmmon(P) tun radeon drm autofs4 ipv6 aes_generic crypto_algapi
+ieee80211_crypt_ccmp nf_nat_irc nf_nat_ftp nf_conntrack_irc
+nf_conntrack_ftp ipt_MASQUERADE iptable_nat nf_nat ipt_REJECT
+xt_tcpudp ipt_LOG xt_limit xt_state nf_conntrack_ipv4 nf_conntrack
+iptable_filter ip_tables x_tables snd_pcm_oss snd_mixer_oss
+snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
+bluetooth ppp_generic slhc ioatdma dca cfq_iosched cpufreq_powersave
+cpufreq_ondemand cpufreq_conservative acpi_cpufreq freq_table uinput
+fan af_packet nls_cp1255 nls_iso8859_1 nls_utf8 nls_base pcmcia
+snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm nsc_ircc snd_timer
+ipw2200 thinkpad_acpi irda snd ehci_hcd yenta_socket uhci_hcd
+psmouse ieee80211 soundcore intel_agp hwmon rsrc_nonstatic pcspkr
+e1000 crc_ccitt snd_page_alloc i2c_i801 ieee80211_crypt pcmcia_core
+agpgart thermal bat!
+tery nvram rtc sr_mod ac sg firmware_class button processor cdrom
+unix usbcore evdev ext3 jbd ext2 mbcache loop ata_piix libata sd_mod
+scsi_mod
+Feb 16 23:41:33 alon1
+Feb 16 23:41:33 alon1 Pid: 4, comm: events/0 Tainted: P
+(2.6.24-gentoo-r2 #1)
+Feb 16 23:41:33 alon1 EIP: 0060:[<c01b2db6>] EFLAGS: 00010282 CPU: 0
+Feb 16 23:41:33 alon1 EIP is at sysfs_get_dentry+0x26/0x80
+Feb 16 23:41:33 alon1 EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX:
+f48a2210
+Feb 16 23:41:33 alon1 ESI: f72eb900 EDI: f4803ae0 EBP: f4803ae0 ESP:
+f7c49efc
+Feb 16 23:41:33 alon1 hcid[7004]: HCI dev 0 registered
+Feb 16 23:41:33 alon1 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
+Feb 16 23:41:33 alon1 Process events/0 (pid: 4, ti=f7c48000
+task=f7c3efc0 task.ti=f7c48000)
+Feb 16 23:41:33 alon1 Stack: f7cb6140 f4822668 f7e71e10 c01b304d
+ffffffff ffffffff fffffffe c030ba9c
+Feb 16 23:41:33 alon1 f7cb6140 f4822668 f6da6720 f7cb6140 f4822668
+f6da6720 c030ba8e c01ce20b
+Feb 16 23:41:33 alon1 f6e9dd00 c030ba8e f6da6720 f6e9dd00 f6e9dd00
+00000000 f4822600 00000000
+Feb 16 23:41:33 alon1 Call Trace:
+Feb 16 23:41:33 alon1 [<c01b304d>] sysfs_move_dir+0x3d/0x1f0
+Feb 16 23:41:33 alon1 [<c01ce20b>] kobject_move+0x9b/0x120
+Feb 16 23:41:33 alon1 [<c0241711>] device_move+0x51/0x110
+Feb 16 23:41:33 alon1 [<f9aaed80>] del_conn+0x0/0x70 [bluetooth]
+Feb 16 23:41:33 alon1 [<f9aaed99>] del_conn+0x19/0x70 [bluetooth]
+Feb 16 23:41:33 alon1 [<c012c1a1>] run_workqueue+0x81/0x140
+Feb 16 23:41:33 alon1 [<c02c0c88>] schedule+0x168/0x2e0
+Feb 16 23:41:33 alon1 [<c012fc70>] autoremove_wake_function+0x0/0x50
+Feb 16 23:41:33 alon1 [<c012c9cb>] worker_thread+0x9b/0xf0
+Feb 16 23:41:33 alon1 [<c012fc70>] autoremove_wake_function+0x0/0x50
+Feb 16 23:41:33 alon1 [<c012c930>] worker_thread+0x0/0xf0
+Feb 16 23:41:33 alon1 [<c012f962>] kthread+0x42/0x70
+Feb 16 23:41:33 alon1 [<c012f920>] kthread+0x0/0x70
+Feb 16 23:41:33 alon1 [<c0104c2f>] kernel_thread_helper+0x7/0x18
+Feb 16 23:41:33 alon1 =======================
+Feb 16 23:41:33 alon1 Code: 26 00 00 00 00 57 89 c7 a1 50 1b 3a c0
+56 53 8b 70 38 85 f6 74 08 8b 0e 85 c9 74 58 ff 06 8b 56 50 39 fa 74
+47 89 fb eb 02 89 c3 <8b> 43 08 39 c2 75 f7 8b 46 08 83 c0 68 e8 98
+e7 10 00 8b 43 10
+Feb 16 23:41:33 alon1 EIP: [<c01b2db6>] sysfs_get_dentry+0x26/0x80
+SS:ESP 0068:f7c49efc
+Feb 16 23:41:33 alon1 ---[ end trace aae864e9592acc1d ]---
+
+Defer hci_unregister_sysfs because hci device could be destructed
+while hci conn devices still there.
+
+Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
+Tested-by: Stefan Seyfried <seife@suse.de>
+Acked-by: Alon Bar-Lev <alon.barlev@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+
+dsd@gentoo.org notes:
+
+This patch fixes http://bugs.gentoo.org/211179
+
+Cc: Daniel Drake <dsd@gentoo.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/bluetooth/hci_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -901,8 +901,6 @@ int hci_unregister_dev(struct hci_dev *h
+
+ BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
+
+- hci_unregister_sysfs(hdev);
+-
+ write_lock_bh(&hci_dev_list_lock);
+ list_del(&hdev->list);
+ write_unlock_bh(&hci_dev_list_lock);
+@@ -914,6 +912,8 @@ int hci_unregister_dev(struct hci_dev *h
+
+ hci_notify(hdev, HCI_DEV_UNREG);
+
++ hci_unregister_sysfs(hdev);
++
+ __hci_dev_put(hdev);
+
+ return 0;
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 15:31:15 2008
+Date: Fri, 4 Apr 2008 20:05:02 +0800
+From: Herbert Xu <herbert@gondor.apana.org.au>
+To: stable@kernel.org
+Message-ID: <20080404120502.GA28868@gondor.apana.org.au>
+Subject: CRYPTO xcbc: Fix crash when ipsec uses xcbc-mac with big data chunk
+
+From: Joy Latten <latten@austin.ibm.com>
+
+upstream commit: 1edcf2e1ee2babb011cfca80ad9d202e9c491669
+
+The kernel crashes when ipsec passes a udp packet of about 14XX bytes
+of data to aes-xcbc-mac.
+
+It seems the first xxxx bytes of the data are in first sg entry,
+and remaining xx bytes are in next sg entry. But we don't
+check next sg entry to see if we need to go look the page up.
+
+I noticed in hmac.c, we do a scatterwalk_sg_next(), to do this check
+and possible lookup, thus xcbc.c needs to use this routine too.
+
+A 15-hour run of an ipsec stress test sending streams of tcp and
+udp packets of various sizes, using this patch and
+aes-xcbc-mac completed successfully, so hopefully this fixes the
+problem.
+
+Signed-off-by: Joy Latten <latten@austin.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ crypto/xcbc.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/crypto/xcbc.c
++++ b/crypto/xcbc.c
+@@ -116,13 +116,11 @@ static int crypto_xcbc_digest_update2(st
+ struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(parent);
+ struct crypto_cipher *tfm = ctx->child;
+ int bs = crypto_hash_blocksize(parent);
+- unsigned int i = 0;
+
+- do {
+-
+- struct page *pg = sg_page(&sg[i]);
+- unsigned int offset = sg[i].offset;
+- unsigned int slen = sg[i].length;
++ for (;;) {
++ struct page *pg = sg_page(sg);
++ unsigned int offset = sg->offset;
++ unsigned int slen = sg->length;
+
+ if (unlikely(slen > nbytes))
+ slen = nbytes;
+@@ -182,8 +180,11 @@ static int crypto_xcbc_digest_update2(st
+ offset = 0;
+ pg++;
+ }
+- i++;
+- } while (nbytes>0);
++
++ if (!nbytes)
++ break;
++ sg = scatterwalk_sg_next(sg);
++ }
+
+ return 0;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:24:17 2008
+Message-ID: <47FC1809.3000400@linuxtv.org>
+Date: Tue, 08 Apr 2008 21:12:41 -0400
+From: Michael Krufky <mkrufky@linuxtv.org>
+To: stable@kernel.org
+Cc: hartmut.hackmann@t-online.de, o.endriss@gmx.de, hermann-pitton@arcor.de, v4l-dvb-maintainer@linuxtv.org, mchehab@infradead.org
+Subject: DVB: tda10086: make the 22kHz tone for DISEQC a config option
+
+From: Hartmut Hackmann <hartmut.hackmann@t-online.de>
+
+(backported from commit ea75baf4b0f117564bd50827a49c4b14d61d24e9)
+
+Some cards need the diseqc signal modulated, while some just need
+the envelope to control the LNB supply.
+
+This fixes Bug 9887
+
+Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
+Acked-by: Oliver Endriss <o.endriss@gmx.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Cc: Hermann Pitton <hermann-pitton@arcor.de>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/media/dvb/dvb-usb/ttusb2.c | 1 +
+ drivers/media/dvb/frontends/tda10086.c | 28 ++++++++++++++++++++++------
+ drivers/media/dvb/frontends/tda10086.h | 3 +++
+ drivers/media/dvb/ttpci/budget.c | 1 +
+ drivers/media/video/saa7134/saa7134-dvb.c | 1 +
+ 5 files changed, 28 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/dvb/dvb-usb/ttusb2.c
++++ b/drivers/media/dvb/dvb-usb/ttusb2.c
+@@ -144,6 +144,7 @@ static int ttusb2_power_ctrl(struct dvb_
+ static struct tda10086_config tda10086_config = {
+ .demod_address = 0x0e,
+ .invert = 0,
++ .diseqc_tone = 1,
+ };
+
+ static int ttusb2_frontend_attach(struct dvb_usb_adapter *adap)
+--- a/drivers/media/dvb/frontends/tda10086.c
++++ b/drivers/media/dvb/frontends/tda10086.c
+@@ -106,9 +106,12 @@ static int tda10086_write_mask(struct td
+ static int tda10086_init(struct dvb_frontend* fe)
+ {
+ struct tda10086_state* state = fe->demodulator_priv;
++ u8 t22k_off = 0x80;
+
+ dprintk ("%s\n", __FUNCTION__);
+
++ if (state->config->diseqc_tone)
++ t22k_off = 0;
+ // reset
+ tda10086_write_byte(state, 0x00, 0x00);
+ msleep(10);
+@@ -158,7 +161,7 @@ static int tda10086_init(struct dvb_fron
+ tda10086_write_byte(state, 0x3d, 0x80);
+
+ // setup SEC
+- tda10086_write_byte(state, 0x36, 0x80); // all SEC off, no 22k tone
++ tda10086_write_byte(state, 0x36, t22k_off); // all SEC off, 22k tone
+ tda10086_write_byte(state, 0x34, (((1<<19) * (22000/1000)) / (SACLK/1000))); // } tone frequency
+ tda10086_write_byte(state, 0x35, (((1<<19) * (22000/1000)) / (SACLK/1000)) >> 8); // }
+
+@@ -180,16 +183,20 @@ static void tda10086_diseqc_wait(struct
+ static int tda10086_set_tone (struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
+ {
+ struct tda10086_state* state = fe->demodulator_priv;
++ u8 t22k_off = 0x80;
+
+ dprintk ("%s\n", __FUNCTION__);
+
++ if (state->config->diseqc_tone)
++ t22k_off = 0;
++
+ switch (tone) {
+ case SEC_TONE_OFF:
+- tda10086_write_byte(state, 0x36, 0x80);
++ tda10086_write_byte(state, 0x36, t22k_off);
+ break;
+
+ case SEC_TONE_ON:
+- tda10086_write_byte(state, 0x36, 0x81);
++ tda10086_write_byte(state, 0x36, 0x01 + t22k_off);
+ break;
+ }
+
+@@ -202,9 +209,13 @@ static int tda10086_send_master_cmd (str
+ struct tda10086_state* state = fe->demodulator_priv;
+ int i;
+ u8 oldval;
++ u8 t22k_off = 0x80;
+
+ dprintk ("%s\n", __FUNCTION__);
+
++ if (state->config->diseqc_tone)
++ t22k_off = 0;
++
+ if (cmd->msg_len > 6)
+ return -EINVAL;
+ oldval = tda10086_read_byte(state, 0x36);
+@@ -212,7 +223,8 @@ static int tda10086_send_master_cmd (str
+ for(i=0; i< cmd->msg_len; i++) {
+ tda10086_write_byte(state, 0x48+i, cmd->msg[i]);
+ }
+- tda10086_write_byte(state, 0x36, 0x88 | ((cmd->msg_len - 1) << 4));
++ tda10086_write_byte(state, 0x36, (0x08 + t22k_off)
++ | ((cmd->msg_len - 1) << 4));
+
+ tda10086_diseqc_wait(state);
+
+@@ -225,16 +237,20 @@ static int tda10086_send_burst (struct d
+ {
+ struct tda10086_state* state = fe->demodulator_priv;
+ u8 oldval = tda10086_read_byte(state, 0x36);
++ u8 t22k_off = 0x80;
+
+ dprintk ("%s\n", __FUNCTION__);
+
++ if (state->config->diseqc_tone)
++ t22k_off = 0;
++
+ switch(minicmd) {
+ case SEC_MINI_A:
+- tda10086_write_byte(state, 0x36, 0x84);
++ tda10086_write_byte(state, 0x36, 0x04 + t22k_off);
+ break;
+
+ case SEC_MINI_B:
+- tda10086_write_byte(state, 0x36, 0x86);
++ tda10086_write_byte(state, 0x36, 0x06 + t22k_off);
+ break;
+ }
+
+--- a/drivers/media/dvb/frontends/tda10086.h
++++ b/drivers/media/dvb/frontends/tda10086.h
+@@ -33,6 +33,9 @@ struct tda10086_config
+
+ /* does the "inversion" need inverted? */
+ u8 invert;
++
++ /* do we need the diseqc signal with carrier? */
++ u8 diseqc_tone;
+ };
+
+ #if defined(CONFIG_DVB_TDA10086) || (defined(CONFIG_DVB_TDA10086_MODULE) && defined(MODULE))
+--- a/drivers/media/dvb/ttpci/budget.c
++++ b/drivers/media/dvb/ttpci/budget.c
+@@ -351,6 +351,7 @@ static struct s5h1420_config s5h1420_con
+ static struct tda10086_config tda10086_config = {
+ .demod_address = 0x0e,
+ .invert = 0,
++ .diseqc_tone = 1,
+ };
+
+ static u8 read_pwm(struct budget* budget)
+--- a/drivers/media/video/saa7134/saa7134-dvb.c
++++ b/drivers/media/video/saa7134/saa7134-dvb.c
+@@ -826,6 +826,7 @@ static struct tda1004x_config ads_tech_d
+ static struct tda10086_config flydvbs = {
+ .demod_address = 0x0e,
+ .invert = 0,
++ .diseqc_tone = 0,
+ };
+
+ /* ==================================================================
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:54:46 2008
+Date: Wed, 16 Apr 2008 02:45:07 GMT
+Message-Id: <200804160245.m3G2j7fG012490@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: fbdev: fix /proc/fb oops after module removal
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+upstream commit: c43f89c2084f46e3ec59ddcbc52ecf4b1e9b015a
+
+/proc/fb is not removed during rmmod.
+
+Steps to reproduce:
+
+ modprobe fb
+ rmmod fb
+ ls /proc
+
+BUG: unable to handle kernel paging request at ffffffffa0094370
+IP: [<ffffffff802b92a1>] proc_get_inode+0x101/0x130
+PGD 203067 PUD 207063 PMD 17e758067 PTE 0
+Oops: 0000 [1] SMP
+last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:02.0/resource
+CPU 1
+Modules linked in: nf_conntrack_irc xt_state iptable_filter ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack ip_tables x_tables vfat fat usbhid ehci_hcd uhci_hcd usbcore sr_mod cdrom [last unloaded: fb]
+Pid: 21205, comm: ls Not tainted 2.6.25-rc8-mm2 #14
+RIP: 0010:[<ffffffff802b92a1>] [<ffffffff802b92a1>] proc_get_inode+0x101/0x130
+RSP: 0018:ffff81017c4bfc78 EFLAGS: 00010246
+RAX: 0000000000008000 RBX: ffff8101787f5470 RCX: 0000000048011ccc
+RDX: ffffffffa0094320 RSI: ffff810006ad43b0 RDI: ffff81017fc2cc00
+RBP: ffff81017e450300 R08: 0000000000000002 R09: ffff81017c5d1000
+R10: 0000000000000000 R11: 0000000000000246 R12: ffff81016b903a28
+R13: ffff81017f822020 R14: ffff81017c4bfd58 R15: ffff81017f822020
+FS: 00007f08e71696f0(0000) GS:ffff81017fc06480(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: ffffffffa0094370 CR3: 000000017e54a000 CR4: 00000000000006e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process ls (pid: 21205, threadinfo ffff81017c4be000, task ffff81017de48770)
+Stack: ffff81017c5d1000 00000000ffffffea ffff81017e450300 ffffffff802bdd1e
+ ffff81017f802258 ffff81017c4bfe48 ffff81016b903a28 ffff81017f822020
+ ffff81017c4bfd48 ffffffff802b9ba0 ffff81016b903a28 ffff81017f802258
+Call Trace:
+ [<ffffffff802bdd1e>] ? proc_lookup_de+0x8e/0x100
+ [<ffffffff802b9ba0>] ? proc_root_lookup+0x20/0x60
+ [<ffffffff802882a7>] ? do_lookup+0x1b7/0x210
+ [<ffffffff8028883d>] ? __link_path_walk+0x53d/0x7f0
+ [<ffffffff80295eb8>] ? mntput_no_expire+0x28/0x130
+ [<ffffffff80288b4a>] ? path_walk+0x5a/0xc0
+ [<ffffffff80288dd3>] ? do_path_lookup+0x83/0x1c0
+ [<ffffffff80287785>] ? getname+0xe5/0x210
+ [<ffffffff80289adb>] ? __user_walk_fd+0x4b/0x80
+ [<ffffffff8028236c>] ? vfs_lstat_fd+0x2c/0x70
+ [<ffffffff8028bf1e>] ? filldir+0xae/0xf0
+ [<ffffffff802b92e9>] ? de_put+0x9/0x50
+ [<ffffffff8029633d>] ? mnt_want_write+0x2d/0x80
+ [<ffffffff8029339f>] ? touch_atime+0x1f/0x170
+ [<ffffffff802b9b1d>] ? proc_root_readdir+0x7d/0xa0
+ [<ffffffff802825e7>] ? sys_newlstat+0x27/0x50
+ [<ffffffff8028bffb>] ? vfs_readdir+0x9b/0xd0
+ [<ffffffff8028c0fe>] ? sys_getdents+0xce/0xe0
+ [<ffffffff8020b39b>] ? system_call_after_swapgs+0x7b/0x80
+
+Code: b7 83 b2 00 00 00 25 00 f0 00 00 3d 00 80 00 00 74 19 48 89 93 f0 00 00 00 48 89 df e8 39 9a fd ff 48 89 d8 48 83 c4 08 5b 5d c3 <48> 83 7a 50 00 48 c7 c0 60 16 45 80 48 c7 c2 40 17 45 80 48 0f
+RIP [<ffffffff802b92a1>] proc_get_inode+0x101/0x130
+ RSP <ffff81017c4bfc78>
+CR2: ffffffffa0094370
+---[ end trace c71hiarjan8ab739 ]---
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+"Antonino A. Daplas" <adaplas@pol.net>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/video/fbmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1521,6 +1521,7 @@ module_init(fbmem_init);
+ static void __exit
+ fbmem_exit(void)
+ {
++ remove_proc_entry("fb", NULL);
+ class_destroy(fb_class);
+ unregister_chrdev(FB_MAJOR, "fb");
+ }
--- /dev/null
+From aedb60a67c10a0861af179725d060765262ba0fb Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge@hallyn.com>
+Date: Fri, 29 Feb 2008 15:14:57 +0000
+Subject: file capabilities: remove cap_task_kill()
+
+upstream commit: aedb60a67c10a0861af179725d060765262ba0fb
+
+The original justification for cap_task_kill() was as follows:
+
+ check_kill_permission() does appropriate uid equivalence checks.
+ However with file capabilities it becomes possible for an
+ unprivileged user to execute a file with file capabilities
+ resulting in a more privileged task with the same uid.
+
+However now that cap_task_kill() always returns 0 (permission
+granted) when p->uid==current->uid, the whole hook is worthless,
+and only likely to create more subtle problems in the corner cases
+where it might still be called but return -EPERM. Those cases
+are basically when uids are different but euid/suid is equivalent
+as per the check in check_kill_permission().
+
+One example of a still-broken application is 'at' for non-root users.
+
+This patch removes cap_task_kill().
+
+Signed-off-by: Serge Hallyn <serge@hallyn.com>
+Acked-by: Andrew G. Morgan <morgan@kernel.org>
+Earlier-version-tested-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
+Acked-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+[chrisw@sous-sol.org: backport to 2.6.24.4]
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ include/linux/security.h | 3 +--
+ security/capability.c | 1 -
+ security/commoncap.c | 39 ---------------------------------------
+ 3 files changed, 1 insertion(+), 42 deletions(-)
+
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -62,7 +62,6 @@ extern int cap_inode_need_killpriv(struc
+ extern int cap_inode_killpriv(struct dentry *dentry);
+ extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
+ extern void cap_task_reparent_to_init (struct task_struct *p);
+-extern int cap_task_kill(struct task_struct *p, struct siginfo *info, int sig, u32 secid);
+ extern int cap_task_setscheduler (struct task_struct *p, int policy, struct sched_param *lp);
+ extern int cap_task_setioprio (struct task_struct *p, int ioprio);
+ extern int cap_task_setnice (struct task_struct *p, int nice);
+@@ -2112,7 +2111,7 @@ static inline int security_task_kill (st
+ struct siginfo *info, int sig,
+ u32 secid)
+ {
+- return cap_task_kill(p, info, sig, secid);
++ return 0;
+ }
+
+ static inline int security_task_wait (struct task_struct *p)
+--- a/security/capability.c
++++ b/security/capability.c
+@@ -40,7 +40,6 @@ static struct security_operations capabi
+ .inode_need_killpriv = cap_inode_need_killpriv,
+ .inode_killpriv = cap_inode_killpriv,
+
+- .task_kill = cap_task_kill,
+ .task_setscheduler = cap_task_setscheduler,
+ .task_setioprio = cap_task_setioprio,
+ .task_setnice = cap_task_setnice,
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -527,40 +527,6 @@ int cap_task_setnice (struct task_struct
+ return cap_safe_nice(p);
+ }
+
+-int cap_task_kill(struct task_struct *p, struct siginfo *info,
+- int sig, u32 secid)
+-{
+- if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
+- return 0;
+-
+- /*
+- * Running a setuid root program raises your capabilities.
+- * Killing your own setuid root processes was previously
+- * allowed.
+- * We must preserve legacy signal behavior in this case.
+- */
+- if (p->uid == current->uid)
+- return 0;
+-
+- /* sigcont is permitted within same session */
+- if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
+- return 0;
+-
+- if (secid)
+- /*
+- * Signal sent as a particular user.
+- * Capabilities are ignored. May be wrong, but it's the
+- * only thing we can do at the moment.
+- * Used only by usb drivers?
+- */
+- return 0;
+- if (cap_issubset(p->cap_permitted, current->cap_permitted))
+- return 0;
+- if (capable(CAP_KILL))
+- return 0;
+-
+- return -EPERM;
+-}
+ #else
+ int cap_task_setscheduler (struct task_struct *p, int policy,
+ struct sched_param *lp)
+@@ -575,11 +541,6 @@ int cap_task_setnice (struct task_struct
+ {
+ return 0;
+ }
+-int cap_task_kill(struct task_struct *p, struct siginfo *info,
+- int sig, u32 secid)
+-{
+- return 0;
+-}
+ #endif
+
+ void cap_task_reparent_to_init (struct task_struct *p)
--- /dev/null
+From cf39cc3b56bc4a562db6242d3069f65034ec7549 Mon Sep 17 00:00:00 2001
+From: Kyle McMartin <kyle@mcmartin.ca>
+Date: Tue, 15 Apr 2008 18:36:38 -0400
+Message-ID: <20080415223638.GD17646@phobos.i.cabal.ca>
+Subject: PARISC fix signal trampoline cache flushing
+
+upstream commit: cf39cc3b56bc4a562db6242d3069f65034ec7549
+
+The signal trampolines were accidently flushing the kernel I$ instead of
+the users. Fix that up, and also add a missing user D$ flush while
+we're at it.
+
+Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/parisc/kernel/signal.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/parisc/kernel/signal.c
++++ b/arch/parisc/kernel/signal.c
+@@ -534,7 +534,8 @@ insert_restart_trampoline(struct pt_regs
+ * Flushing one cacheline is cheap.
+ * "sync" on bigger (> 4 way) boxes is not.
+ */
+- flush_icache_range(regs->gr[30], regs->gr[30] + 4);
++ flush_user_dcache_range(regs->gr[30], regs->gr[30] + 4);
++ flush_user_icache_range(regs->gr[30], regs->gr[30] + 4);
+
+ regs->gr[31] = regs->gr[30] + 8;
+ /* Preserve original r28. */
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:28:46 2008
+Date: Wed, 9 Apr 2008 17:44:07 +0200 (CEST)
+From: Roman Zippel <zippel@linux-m68k.org>
+To: Linus Torvalds <torvalds@linux-foundation.org>
+Message-ID: <Pine.LNX.4.64.0804091727200.8547@scrub.home>
+Cc: stable@kernel.org
+Subject: HFS+: fix unlink of links
+
+upstream commit: 76b0c26af2736b7e5b87e6ed7ab63901483d5736
+
+Some time ago while attempting to handle invalid link counts, I botched
+the unlink of links itself, so this patch fixes this now correctly, so
+that only the link count of nodes that don't point to links is ignored.
+Thanks to Vlado Plaga <rechner@vlado-do.de> to notify me of this
+problem.
+
+Signed-off-by: Roman Zippel <zippel@linux-m68k.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ fs/hfsplus/dir.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -340,16 +340,23 @@ static int hfsplus_unlink(struct inode *
+
+ if (inode->i_nlink > 0)
+ drop_nlink(inode);
+- hfsplus_delete_inode(inode);
+- if (inode->i_ino != cnid && !inode->i_nlink) {
+- if (!atomic_read(&HFSPLUS_I(inode).opencnt)) {
+- res = hfsplus_delete_cat(inode->i_ino, HFSPLUS_SB(sb).hidden_dir, NULL);
+- if (!res)
+- hfsplus_delete_inode(inode);
++ if (inode->i_ino == cnid)
++ clear_nlink(inode);
++ if (!inode->i_nlink) {
++ if (inode->i_ino != cnid) {
++ HFSPLUS_SB(sb).file_count--;
++ if (!atomic_read(&HFSPLUS_I(inode).opencnt)) {
++ res = hfsplus_delete_cat(inode->i_ino,
++ HFSPLUS_SB(sb).hidden_dir,
++ NULL);
++ if (!res)
++ hfsplus_delete_inode(inode);
++ } else
++ inode->i_flags |= S_DEAD;
+ } else
+- inode->i_flags |= S_DEAD;
++ hfsplus_delete_inode(inode);
+ } else
+- clear_nlink(inode);
++ HFSPLUS_SB(sb).file_count--;
+ inode->i_ctime = CURRENT_TIME_SEC;
+ mark_inode_dirty(inode);
+
--- /dev/null
+From 2961cb22ef02850d90e7a12c28a14d74e327df8d Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Sun, 9 Mar 2008 13:34:28 +0100
+Message-ID: <20080402160609.292ae0db@hyperion.delvare>
+Subject: hwmon: (w83781d) Fix I/O resource conflict with PNP
+
+upstream commit: 2961cb22ef02850d90e7a12c28a14d74e327df8d
+
+Only request I/O ports 0x295-0x296 instead of the full I/O address
+range. This solves a conflict with PNP resources on a few motherboards.
+
+Also request the I/O ports in two parts (4 low ports, 4 high ports)
+during device detection, otherwise the PNP resource makes the request
+(and thus the detection) fail.
+
+This fixes lm-sensors ticket #2306:
+http://www.lm-sensors.org/ticket/2306
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/hwmon/w83781d.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/hwmon/w83781d.c
++++ b/drivers/hwmon/w83781d.c
+@@ -1380,7 +1380,8 @@ w83781d_isa_probe(struct platform_device
+
+ /* Reserve the ISA region */
+ res = platform_get_resource(pdev, IORESOURCE_IO, 0);
+- if (!request_region(res->start, W83781D_EXTENT, "w83781d")) {
++ if (!request_region(res->start + W83781D_ADDR_REG_OFFSET, 2,
++ "w83781d")) {
+ err = -EBUSY;
+ goto exit;
+ }
+@@ -1432,7 +1433,7 @@ w83781d_isa_probe(struct platform_device
+ device_remove_file(&pdev->dev, &dev_attr_name);
+ kfree(data);
+ exit_release_region:
+- release_region(res->start, W83781D_EXTENT);
++ release_region(res->start + W83781D_ADDR_REG_OFFSET, 2);
+ exit:
+ return err;
+ }
+@@ -1446,7 +1447,7 @@ w83781d_isa_remove(struct platform_devic
+ sysfs_remove_group(&pdev->dev.kobj, &w83781d_group);
+ sysfs_remove_group(&pdev->dev.kobj, &w83781d_group_opt);
+ device_remove_file(&pdev->dev, &dev_attr_name);
+- release_region(data->client.addr, W83781D_EXTENT);
++ release_region(data->client.addr + W83781D_ADDR_REG_OFFSET, 2);
+ kfree(data);
+
+ return 0;
+@@ -1820,8 +1821,17 @@ w83781d_isa_found(unsigned short address
+ {
+ int val, save, found = 0;
+
+- if (!request_region(address, W83781D_EXTENT, "w83781d"))
++ /* We have to request the region in two parts because some
++ boards declare base+4 to base+7 as a PNP device */
++ if (!request_region(address, 4, "w83781d")) {
++ pr_debug("w83781d: Failed to request low part of region\n");
+ return 0;
++ }
++ if (!request_region(address + 4, 4, "w83781d")) {
++ pr_debug("w83781d: Failed to request high part of region\n");
++ release_region(address, 4);
++ return 0;
++ }
+
+ #define REALLY_SLOW_IO
+ /* We need the timeouts for at least some W83781D-like
+@@ -1896,7 +1906,8 @@ w83781d_isa_found(unsigned short address
+ val == 0x30 ? "W83782D" : "W83781D", (int)address);
+
+ release:
+- release_region(address, W83781D_EXTENT);
++ release_region(address + 4, 4);
++ release_region(address, 4);
+ return found;
+ }
+
--- /dev/null
+From 3e037097fd10d7074693b12aaac84f368ee20136 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Sun, 6 Apr 2008 23:40:06 -0700
+Subject: INET: inet_frag_evictor() must run with BH disabled
+
+Part of upstream commit: e8e16b706e8406f1ab3bccab16932ebc513896d8
+
+Based upon a lockdep trace from Dave Jones.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/ipv6/netfilter/nf_conntrack_reasm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -147,7 +147,9 @@ static __inline__ void fq_kill(struct nf
+
+ static void nf_ct_frag6_evictor(void)
+ {
++ local_bh_disable();
+ inet_frag_evictor(&nf_frags);
++ local_bh_enable();
+ }
+
+ static void nf_ct_frag6_expire(unsigned long data)
--- /dev/null
+From abd24df828f1a72971db29d1b74fefae104ea9e2 Mon Sep 17 00:00:00 2001
+From: Carol Hebert <cah@us.ibm.com>
+Date: Fri, 4 Apr 2008 14:30:03 -0700
+Subject: ipmi: change device node ordering to reflect probe order
+
+upstream commit: abd24df828f1a72971db29d1b74fefae104ea9e2
+
+In 2.6.14 a patch was merged which switching the order of the ipmi device
+naming from in-order-of-discovery over to reverse-order-of-discovery.
+
+So on systems with multiple BMC interfaces, the ipmi device names are being
+created in reverse order relative to how they are discovered on the system
+(e.g. on an IBM x3950 multinode server with N nodes, the device name for the
+BMC in the first node is /dev/ipmiN-1 and the device name for the BMC in the
+last node is /dev/ipmi0, etc.).
+
+The problem is caused by the list handling routines chosen in dmi_scan.c.
+Using list_add() causes the multiple ipmi devices to be added to the device
+list using a stack-paradigm and so the ipmi driver subsequently pulls them off
+during initialization in LIFO order. This patch changes the
+dmi_save_ipmi_device() list handling paradigm to a queue, thereby allowing the
+ipmi driver to build the ipmi device names in the order in which they are
+found on the system.
+
+Signed-off-by: Carol Hebert <cah@us.ibm.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/firmware/dmi_scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -219,7 +219,7 @@ static void __init dmi_save_ipmi_device(
+ dev->name = "IPMI controller";
+ dev->device_data = data;
+
+- list_add(&dev->list, &dmi_devices);
++ list_add_tail(&dev->list, &dmi_devices);
+ }
+
+ /*
--- /dev/null
+From 1ffc151fcddf524d0c76709d7e7a2af0255acb6b Mon Sep 17 00:00:00 2001
+From: Tejun Heo <htejun@gmail.com>
+Date: Sun, 23 Mar 2008 15:16:53 +0900
+Message-ID: <47FA0FF3.3060907@gentoo.org>
+Subject: libata: assume no device is attached if both IDENTIFYs are aborted
+
+upstream commit: 1ffc151fcddf524d0c76709d7e7a2af0255acb6b
+
+This is to fix bugzilla #10254. QSI cdrom attached to pata_sis as
+secondary master appears as phantom device for the slave.
+Interestingly, instead of not setting DRQ after IDENTIFY which
+triggers NODEV_HINT, it aborts both IDENTIFY and IDENTIFY PACKET which
+makes EH retry.
+
+Modify EH such that it assumes no device is attached if both flavors
+of IDENTIFY are aborted by the device. There really isn't much point
+in retrying when the device actively aborts the commands.
+
+While at it, convert NODEV detection message to ata_dev_printk() to
+help debugging obscure detection problems.
+
+This problem was reported by Jan Bücken.
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Cc: Jan Bücken <jb.faq@gmx.de>
+Acked-by: Alan Cox <alan@redhat.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+
+dsd@gentoo.org notes:
+
+This patch fixes http://bugs.gentoo.org/211369
+
+Cc: Daniel Drake <dsd@gentoo.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/ata/libata-core.c | 38 ++++++++++++++++++++++++--------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -1936,24 +1936,34 @@ int ata_dev_read_id(struct ata_device *d
+ id, sizeof(id[0]) * ATA_ID_WORDS, 0);
+ if (err_mask) {
+ if (err_mask & AC_ERR_NODEV_HINT) {
+- DPRINTK("ata%u.%d: NODEV after polling detection\n",
+- ap->print_id, dev->devno);
++ ata_dev_printk(dev, KERN_DEBUG,
++ "NODEV after polling detection\n");
+ return -ENOENT;
+ }
+
+- /* Device or controller might have reported the wrong
+- * device class. Give a shot at the other IDENTIFY if
+- * the current one is aborted by the device.
+- */
+- if (may_fallback &&
+- (err_mask == AC_ERR_DEV) && (tf.feature & ATA_ABORTED)) {
+- may_fallback = 0;
++ if ((err_mask == AC_ERR_DEV) && (tf.feature & ATA_ABORTED)) {
++ /* Device or controller might have reported
++ * the wrong device class. Give a shot at the
++ * other IDENTIFY if the current one is
++ * aborted by the device.
++ */
++ if (may_fallback) {
++ may_fallback = 0;
+
+- if (class == ATA_DEV_ATA)
+- class = ATA_DEV_ATAPI;
+- else
+- class = ATA_DEV_ATA;
+- goto retry;
++ if (class == ATA_DEV_ATA)
++ class = ATA_DEV_ATAPI;
++ else
++ class = ATA_DEV_ATA;
++ goto retry;
++ }
++
++ /* Control reaches here iff the device aborted
++ * both flavors of IDENTIFYs which happens
++ * sometimes with phantom devices.
++ */
++ ata_dev_printk(dev, KERN_DEBUG,
++ "both IDENTIFYs aborted, assuming NODEV\n");
++ return -ENOENT;
+ }
+
+ rc = -EIO;
--- /dev/null
+From 53db734abacd787a829661896c1cc044452c37de Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Sun, 6 Apr 2008 23:40:33 -0700
+Subject: LLC: Restrict LLC sockets to root
+
+Upstream commit: 3480c63bdf008e9289aab94418f43b9592978fff
+
+LLC currently allows users to inject raw frames, including IP packets
+encapsulated in SNAP. While Linux doesn't handle IP over SNAP, other
+systems do. Restrict LLC sockets to root similar to packet sockets.
+
+[ Modified Patrick's patch to use CAP_NEW_RAW --DaveM ]
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/llc/af_llc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -155,6 +155,9 @@ static int llc_ui_create(struct net *net
+ struct sock *sk;
+ int rc = -ESOCKTNOSUPPORT;
+
++ if (!capable(CAP_NET_RAW))
++ return -EPERM;
++
+ if (net != &init_net)
+ return -EAFNOSUPPORT;
+
--- /dev/null
+From 84b7901f8d5a17536ef2df7fd628ab865df8fe3a Mon Sep 17 00:00:00 2001
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Date: Thu, 10 Apr 2008 23:30:07 +0900
+Message-Id: <20080416.013520.74752756.anemo@mba.ocn.ne.jp>
+Subject: macb: Call phy_disconnect on removing
+
+upstream commit: 84b7901f8d5a17536ef2df7fd628ab865df8fe3a
+
+Call phy_disconnect() on remove routine. Otherwise the phy timer
+causes a kernel crash when unloading.
+
+Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Cc: Haavard Skinnemoen <hskinnemoen@atmel.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/net/macb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/macb.c
++++ b/drivers/net/macb.c
+@@ -1257,6 +1257,8 @@ static int __devexit macb_remove(struct
+
+ if (dev) {
+ bp = netdev_priv(dev);
++ if (bp->phy_dev)
++ phy_disconnect(bp->phy_dev);
+ mdiobus_unregister(&bp->mii_bus);
+ kfree(bp->mii_bus.irq);
+ unregister_netdev(dev);
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:37:52 2008
+Date: Fri, 11 Apr 2008 16:55:06 GMT
+Message-Id: <200804111655.m3BGt6ns031493@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: md: close a livelock window in handle_parity_checks5
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+upstream commit: bd2ab67030e9116f1e4aae1289220255412b37fd
+
+If a failure is detected after a parity check operation has been initiated,
+but before it completes handle_parity_checks5 will never quiesce operations on
+the stripe.
+
+Explicitly handle this case by "canceling" the parity check, i.e. clear the
+STRIPE_OP_CHECK flags and queue the stripe on the handle list again to refresh
+any non-uptodate blocks.
+
+Kernel versions >= 2.6.23 are susceptible.
+
+Cc: <stable@kernel.org>
+Cc: NeilBrown <neilb@suse.de>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/md/raid5.c | 53 ++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 30 insertions(+), 23 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2348,25 +2348,15 @@ static void handle_issuing_new_write_req
+ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
+ struct stripe_head_state *s, int disks)
+ {
++ int canceled_check = 0;
++
+ set_bit(STRIPE_HANDLE, &sh->state);
+- /* Take one of the following actions:
+- * 1/ start a check parity operation if (uptodate == disks)
+- * 2/ finish a check parity operation and act on the result
+- * 3/ skip to the writeback section if we previously
+- * initiated a recovery operation
+- */
+- if (s->failed == 0 &&
+- !test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
+- if (!test_and_set_bit(STRIPE_OP_CHECK, &sh->ops.pending)) {
+- BUG_ON(s->uptodate != disks);
+- clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
+- sh->ops.count++;
+- s->uptodate--;
+- } else if (
+- test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
+- clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
+- clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
+
++ /* complete a check operation */
++ if (test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
++ clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
++ clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
++ if (s->failed == 0) {
+ if (sh->ops.zero_sum_result == 0)
+ /* parity is correct (on disc,
+ * not in buffer any more)
+@@ -2391,7 +2381,8 @@ static void handle_parity_checks5(raid5_
+ s->uptodate++;
+ }
+ }
+- }
++ } else
++ canceled_check = 1; /* STRIPE_INSYNC is not set */
+ }
+
+ /* check if we can clear a parity disk reconstruct */
+@@ -2404,12 +2395,28 @@ static void handle_parity_checks5(raid5_
+ clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
+ }
+
+- /* Wait for check parity and compute block operations to complete
+- * before write-back
++ /* start a new check operation if there are no failures, the stripe is
++ * not insync, and a repair is not in flight
+ */
+- if (!test_bit(STRIPE_INSYNC, &sh->state) &&
+- !test_bit(STRIPE_OP_CHECK, &sh->ops.pending) &&
+- !test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending)) {
++ if (s->failed == 0 &&
++ !test_bit(STRIPE_INSYNC, &sh->state) &&
++ !test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
++ if (!test_and_set_bit(STRIPE_OP_CHECK, &sh->ops.pending)) {
++ BUG_ON(s->uptodate != disks);
++ clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
++ sh->ops.count++;
++ s->uptodate--;
++ }
++ }
++
++ /* Wait for check parity and compute block operations to complete
++ * before write-back. If a failure occurred while the check operation
++ * was in flight we need to cycle this stripe through handle_stripe
++ * since the parity block may not be uptodate
++ */
++ if (!canceled_check && !test_bit(STRIPE_INSYNC, &sh->state) &&
++ !test_bit(STRIPE_OP_CHECK, &sh->ops.pending) &&
++ !test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending)) {
+ struct r5dev *dev;
+ /* either failed parity check, or recovery is happening */
+ if (s->failed == 0)
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 15:32:12 2008
+Date: Fri, 4 Apr 2008 22:15:06 GMT
+Message-Id: <200804042215.m34MF6wx006768@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: mtd: fix broken state in CFI driver caused by FL_SHUTDOWN
+
+From: Alexey Korolev <akorolev@infradead.org>
+
+upstream commit: fb6d080c6f75dfd7e23d5a3575334785aa8738eb
+
+THe CFI driver in 2.6.24 kernel is broken. Not so intensive read/write
+operations cause incomplete writes which lead to kernel panics in JFFS2.
+
+We investigated the issue - it is caused by bug in FL_SHUTDOWN parsing code.
+Sometimes chip returns -EIO as if it is in FL_SHUTDOWN state when it should
+wait in FL_PONT (error in order of conditions).
+
+The following patch fixes the bug in state parsing code of CFI. Also I've
+added comments to notify developers if they want to add new case in future.
+
+Signed-off-by: Alexey Korolev <akorolev@infradead.org>
+Reviewed-by: Joern Engel <joern@logfs.org>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/mtd/chips/cfi_cmdset_0001.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/mtd/chips/cfi_cmdset_0001.c
++++ b/drivers/mtd/chips/cfi_cmdset_0001.c
+@@ -669,7 +669,7 @@ static int chip_ready (struct map_info *
+ /* Someone else might have been playing with it. */
+ return -EAGAIN;
+ }
+-
++ /* Fall through */
+ case FL_READY:
+ case FL_CFI_QUERY:
+ case FL_JEDEC_QUERY:
+@@ -729,14 +729,14 @@ static int chip_ready (struct map_info *
+ chip->state = FL_READY;
+ return 0;
+
++ case FL_SHUTDOWN:
++ /* The machine is rebooting now,so no one can get chip anymore */
++ return -EIO;
+ case FL_POINT:
+ /* Only if there's no operation suspended... */
+ if (mode == FL_READY && chip->oldstate == FL_READY)
+ return 0;
+-
+- case FL_SHUTDOWN:
+- /* The machine is rebooting now,so no one can get chip anymore */
+- return -EIO;
++ /* Fall through */
+ default:
+ sleep:
+ set_current_state(TASK_UNINTERRUPTIBLE);
--- /dev/null
+From 0af48f0fd316f4c6388e4a202009a68096a80cdb Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Sun, 6 Apr 2008 23:41:50 -0700
+Subject: NET: Add preemption point in qdisc_run
+
+Upstream commit: 2ba2506ca7ca62c56edaa334b0fe61eb5eab6ab0
+
+The qdisc_run loop is currently unbounded and runs entirely in a
+softirq. This is bad as it may create an unbounded softirq run.
+
+This patch fixes this by calling need_resched and breaking out if
+necessary.
+
+It also adds a break out if the jiffies value changes since that would
+indicate we've been transmitting for too long which starves other
+softirqs.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/sched/sch_generic.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -178,10 +178,22 @@ static inline int qdisc_restart(struct n
+
+ void __qdisc_run(struct net_device *dev)
+ {
+- do {
+- if (!qdisc_restart(dev))
++ unsigned long start_time = jiffies;
++
++ while (qdisc_restart(dev)) {
++ if (netif_queue_stopped(dev))
++ break;
++
++ /*
++ * Postpone processing if
++ * 1. another process needs the CPU;
++ * 2. we've been doing it for too long.
++ */
++ if (need_resched() || jiffies != start_time) {
++ netif_schedule(dev);
+ break;
+- } while (!netif_queue_stopped(dev));
++ }
++ }
+
+ clear_bit(__LINK_STATE_QDISC_RUNNING, &dev->state);
+ }
--- /dev/null
+From 256736e3a05d87048ed72b7ec87447f79fcac64b Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Sun, 6 Apr 2008 23:42:55 -0700
+Subject: NET: Fix multicast device ioctl checks
+
+Upstream commit: 61ee6bd487b9cc160e533034eb338f2085dc7922
+
+SIOCADDMULTI/SIOCDELMULTI check whether the driver has a set_multicast_list
+method to determine whether it supports multicast. Drivers implementing
+secondary unicast support use set_rx_mode however.
+
+Check for both dev->set_multicast_mode and dev->set_rx_mode to determine
+multicast capabilities.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/core/dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3240,7 +3240,7 @@ static int dev_ifsioc(struct net *net, s
+ return -EOPNOTSUPP;
+
+ case SIOCADDMULTI:
+- if (!dev->set_multicast_list ||
++ if ((!dev->set_multicast_list && !dev->set_rx_mode) ||
+ ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
+ return -EINVAL;
+ if (!netif_device_present(dev))
+@@ -3249,7 +3249,7 @@ static int dev_ifsioc(struct net *net, s
+ dev->addr_len, 1);
+
+ case SIOCDELMULTI:
+- if (!dev->set_multicast_list ||
++ if ((!dev->set_multicast_list && !dev->set_rx_mode) ||
+ ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
+ return -EINVAL;
+ if (!netif_device_present(dev))
--- /dev/null
+From ed60bf506c63729b80f1d44b4834657bfe215a32 Mon Sep 17 00:00:00 2001
+From: Kirill A. Shutemov <k.shutemov@gmail.com>
+Date: Sun, 6 Apr 2008 23:35:53 -0700
+Subject: NET: include <linux/types.h> into linux/ethtool.h for __u* typedef
+
+Upstream commit: e621e69137b24fdbbe7ad28214e8d81e614c25b7
+
+Signed-off-by: Kirill A. Shutemov <k.shutemov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ include/linux/ethtool.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/ethtool.h
++++ b/include/linux/ethtool.h
+@@ -12,6 +12,7 @@
+ #ifndef _LINUX_ETHTOOL_H
+ #define _LINUX_ETHTOOL_H
+
++#include <linux/types.h>
+
+ /* This should work for both 32 and 64 bit userland. */
+ struct ethtool_cmd {
--- /dev/null
+From 2a2af65a6b7330f1291bfe446d29593b7833c81b Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Sun, 6 Apr 2008 23:40:53 -0700
+Subject: netpoll: zap_completion_queue: adjust skb->users counter
+
+Upstream commit: 8a455b087c9629b3ae3b521b4f1ed16672f978cc
+
+zap_completion_queue() retrieves skbs from completion_queue where they have
+zero skb->users counter. Before dev_kfree_skb_any() it should be non-zero
+yet, so it's increased now.
+
+Reported-and-tested-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/core/netpoll.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -219,10 +219,12 @@ static void zap_completion_queue(void)
+ while (clist != NULL) {
+ struct sk_buff *skb = clist;
+ clist = clist->next;
+- if (skb->destructor)
++ if (skb->destructor) {
++ atomic_inc(&skb->users);
+ dev_kfree_skb_any(skb); /* put this one back */
+- else
++ } else {
+ __kfree_skb(skb);
++ }
+ }
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:44:42 2008
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+To: stable@kernel.org
+Date: Tue, 15 Apr 2008 10:45:11 -0500
+Message-Id: <1208274312.3131.11.camel@localhost.localdomain>
+Cc: Parisc List <linux-parisc@vger.kernel.org>
+Subject: PARISC futex: special case cmpxchg NULL in kernel space
+
+From: Kyle McMartin <kyle@shortfin.cabal.ca>
+
+upstream commit: c20a84c91048c76c1379011c96b1a5cee5c7d9a0
+
+commit f9e77acd4060fefbb60a351cdb8d30fca27fe194
+Author: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun Feb 24 02:10:05 2008 +0000
+
+ futex: runtime enable pi and robust functionality
+
+
+which was backported to stable based on mainline Commit
+a0c1e9073ef7428a14309cba010633a6cd6719ea added code to futex.c
+to detect whether futex_atomic_cmpxchg_inatomic was implemented at run
+time:
+
++ curval = cmpxchg_futex_value_locked(NULL, 0, 0);
++ if (curval == -EFAULT)
++ futex_cmpxchg_enabled = 1;
+
+This is bogus on parisc, since page zero in kernel virtual space is the
+gateway page for syscall entry, and should not be read from the kernel.
+(That, and we really don't like the kernel faulting on its own address
+ space...)
+
+Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ include/asm-parisc/futex.h | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/include/asm-parisc/futex.h
++++ b/include/asm-parisc/futex.h
+@@ -56,6 +56,12 @@ futex_atomic_cmpxchg_inatomic(int __user
+ int err = 0;
+ int uval;
+
++ /* futex.c wants to do a cmpxchg_inatomic on kernel NULL, which is
++ * our gateway page, and causes no end of trouble...
++ */
++ if (segment_eq(KERNEL_DS, get_fs()) && !uaddr)
++ return -EFAULT;
++
+ if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
+ return -EFAULT;
+
+@@ -67,5 +73,5 @@ futex_atomic_cmpxchg_inatomic(int __user
+ return uval;
+ }
+
+-#endif
+-#endif
++#endif /*__KERNEL__*/
++#endif /*_ASM_PARISC_FUTEX_H*/
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:51:47 2008
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+To: stable@kernel.org
+Date: Tue, 15 Apr 2008 11:46:03 -0500
+Message-Id: <1208277963.3131.18.camel@localhost.localdomain>
+Cc: Parisc List <linux-parisc@vger.kernel.org>
+Subject: PARISC pdc_console: fix bizarre panic on boot
+
+From: Kyle McMartin <kyle@shortfin.cabal.ca>
+
+upstream commit ef1afd4d79f0479960ff36bb5fe6ec6eba1ebff2
+
+commit 721fdf34167580ff98263c74cead8871d76936e6
+Author: Kyle McMartin <kyle@shortfin.cabal.ca>
+Date: Thu Dec 6 09:32:15 2007 -0800
+
+ [PARISC] print more than one character at a time for pdc console
+
+introduced a subtle bug by accidentally removing the "static" from
+iodc_dbuf. This resulted in, what appeared to be, a trap without
+*current set to a task. Probably the result of a trap in real mode
+while calling firmware.
+
+Also do other misc clean ups. Since the only input from firmware is non
+blocking, share iodc_dbuf between input and output, and spinlock the
+only callers.
+
+[jejb: fixed up rejections against the stable tree]
+
+Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/parisc/kernel/firmware.c | 27 +++++++++++++++++----------
+ arch/parisc/kernel/pdc_cons.c | 19 +++++++++++++++++--
+ include/asm-parisc/pdc.h | 3 +--
+ 3 files changed, 35 insertions(+), 14 deletions(-)
+
+--- a/arch/parisc/kernel/firmware.c
++++ b/arch/parisc/kernel/firmware.c
+@@ -1080,6 +1080,9 @@ void pdc_io_reset_devices(void)
+ spin_unlock_irqrestore(&pdc_lock, flags);
+ }
+
++/* locked by pdc_console_lock */
++static int __attribute__((aligned(8))) iodc_retbuf[32];
++static char __attribute__((aligned(64))) iodc_dbuf[4096];
+
+ /**
+ * pdc_iodc_print - Console print using IODC.
+@@ -1091,24 +1094,20 @@ void pdc_io_reset_devices(void)
+ * Since the HP console requires CR+LF to perform a 'newline', we translate
+ * "\n" to "\r\n".
+ */
+-int pdc_iodc_print(unsigned char *str, unsigned count)
++int pdc_iodc_print(const unsigned char *str, unsigned count)
+ {
+- /* XXX Should we spinlock posx usage */
+ static int posx; /* for simple TAB-Simulation... */
+- int __attribute__((aligned(8))) iodc_retbuf[32];
+- char __attribute__((aligned(64))) iodc_dbuf[4096];
+ unsigned int i;
+ unsigned long flags;
+
+- memset(iodc_dbuf, 0, 4096);
+- for (i = 0; i < count && i < 2048;) {
++ for (i = 0; i < count && i < 79;) {
+ switch(str[i]) {
+ case '\n':
+ iodc_dbuf[i+0] = '\r';
+ iodc_dbuf[i+1] = '\n';
+ i += 2;
+ posx = 0;
+- break;
++ goto print;
+ case '\t':
+ while (posx & 7) {
+ iodc_dbuf[i] = ' ';
+@@ -1124,6 +1123,16 @@ int pdc_iodc_print(unsigned char *str, u
+ }
+ }
+
++ /* if we're at the end of line, and not already inserting a newline,
++ * insert one anyway. iodc console doesn't claim to support >79 char
++ * lines. don't account for this in the return value.
++ */
++ if (i == 79 && iodc_dbuf[i-1] != '\n') {
++ iodc_dbuf[i+0] = '\r';
++ iodc_dbuf[i+1] = '\n';
++ }
++
++print:
+ spin_lock_irqsave(&pdc_lock, flags);
+ real32_call(PAGE0->mem_cons.iodc_io,
+ (unsigned long)PAGE0->mem_cons.hpa, ENTRY_IO_COUT,
+@@ -1142,11 +1151,9 @@ int pdc_iodc_print(unsigned char *str, u
+ */
+ int pdc_iodc_getc(void)
+ {
+- unsigned long flags;
+- static int __attribute__((aligned(8))) iodc_retbuf[32];
+- static char __attribute__((aligned(64))) iodc_dbuf[4096];
+ int ch;
+ int status;
++ unsigned long flags;
+
+ /* Bail if no console input device. */
+ if (!PAGE0->mem_kbd.iodc_io)
+--- a/arch/parisc/kernel/pdc_cons.c
++++ b/arch/parisc/kernel/pdc_cons.c
+@@ -52,10 +52,18 @@
+ #include <linux/tty.h>
+ #include <asm/pdc.h> /* for iodc_call() proto and friends */
+
++static spinlock_t pdc_console_lock = SPIN_LOCK_UNLOCKED;
+
+ static void pdc_console_write(struct console *co, const char *s, unsigned count)
+ {
+- pdc_iodc_print(s, count);
++ int i = 0;
++ unsigned long flags;
++
++ spin_lock_irqsave(&pdc_console_lock, flags);
++ do {
++ i += pdc_iodc_print(s + i, count - i);
++ } while (i < count);
++ spin_unlock_irqrestore(&pdc_console_lock, flags);
+ }
+
+ void pdc_printf(const char *fmt, ...)
+@@ -73,7 +81,14 @@ void pdc_printf(const char *fmt, ...)
+
+ int pdc_console_poll_key(struct console *co)
+ {
+- return pdc_iodc_getc();
++ int c;
++ unsigned long flags;
++
++ spin_lock_irqsave(&pdc_console_lock, flags);
++ c = pdc_iodc_getc();
++ spin_unlock_irqrestore(&pdc_console_lock, flags);
++
++ return c;
+ }
+
+ static int pdc_console_setup(struct console *co, char *options)
+--- a/include/asm-parisc/pdc.h
++++ b/include/asm-parisc/pdc.h
+@@ -645,8 +645,7 @@ int pdc_soft_power_button(int sw_control
+ void pdc_io_reset(void);
+ void pdc_io_reset_devices(void);
+ int pdc_iodc_getc(void);
+-int pdc_iodc_print(unsigned char *str, unsigned count);
+-void pdc_printf(const char *fmt, ...);
++int pdc_iodc_print(const unsigned char *str, unsigned count);
+
+ void pdc_emergency_unlock(void);
+ int pdc_sti_call(unsigned long func, unsigned long flags,
--- /dev/null
+From a99acc832de1104afaba02d7c2576fd9b9fd6422 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 28 Mar 2008 14:16:04 -0700
+Message-ID: <20080329222330.323d0404@hyperion.delvare>
+Subject: pci: revert SMBus unhide on HP Compaq nx6110
+
+upstream commit: a99acc832de1104afaba02d7c2576fd9b9fd6422
+
+This reverts commit 3c0a654e390d00fef9d8faed758f5e1e8078adb5 and
+fixes kernel bug #10245:
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=10245
+
+The HP Compaq nc6120 has the same PCI sub-device ID as the nx6110, and the
+SMBus is used by ACPI for thermal management on the nc6120, so Linux should
+not attach a native driver to it. This means that this quirk is unsafe and
+has to be removed.
+
+I also added a comment to help developers realize that adding new IDs to this
+SMBus unhiding quirk table should be done only with great care, and in
+particular only after checking that ACPI is not making use of the SMBus.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Cc: Tomasz Koprowski <tomek@koprowski.org>
+Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/pci/quirks.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -950,6 +950,12 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+ * accesses to the SMBus registers, with potentially bad effects. Thus you
+ * should be very careful when adding new entries: if SMM is accessing the
+ * Intel SMBus, this is a very good reason to leave it hidden.
++ *
++ * Likewise, many recent laptops use ACPI for thermal management. If the
++ * ACPI DSDT code accesses the SMBus, then Linux should not access it
++ * natively, and keeping the SMBus hidden is the right thing to do. If you
++ * are about to add an entry in the table below, please first disassemble
++ * the DSDT and double-check that there is no code accessing the SMBus.
+ */
+ static int asus_hides_smbus;
+
+@@ -1022,11 +1028,6 @@ static void __init asus_hides_smbus_host
+ case 0x12bd: /* HP D530 */
+ asus_hides_smbus = 1;
+ }
+- else if (dev->device == PCI_DEVICE_ID_INTEL_82915GM_HB)
+- switch (dev->subsystem_device) {
+- case 0x099c: /* HP Compaq nx6110 */
+- asus_hides_smbus = 1;
+- }
+ } else if (unlikely(dev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG)) {
+ if (dev->device == PCI_DEVICE_ID_INTEL_82855PM_HB)
+ switch(dev->subsystem_device) {
--- /dev/null
+From cabce28ec0a0ae3d0ddfa4461f0e8be94ade9e46 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
+Date: Tue, 1 Apr 2008 01:22:45 +0200
+Message-Id: <20080410094723.49f79c57.akpm@linux-foundation.org>
+Subject: plip: replace spin_lock_irq with spin_lock_irqsave in irq context
+
+upstream commit: cabce28ec0a0ae3d0ddfa4461f0e8be94ade9e46
+
+Plip uses spin_lock_irq/spin_unlock_irq in its IRQ handler (called from
+parport IRQ handler), the latter enables interrupts without parport
+subsystem IRQ handler expecting it.
+
+The bug can be seen if you compile kernel with lock dependency checking
+and use plip --- it produces a warning.
+
+This patch changes it to spin_lock_irqsave/spin_lock_irqrestore, so that
+it doesn't enable interrupts when already disabled.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/net/plip.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/plip.c
++++ b/drivers/net/plip.c
+@@ -903,17 +903,18 @@ plip_interrupt(void *dev_id)
+ struct net_local *nl;
+ struct plip_local *rcv;
+ unsigned char c0;
++ unsigned long flags;
+
+ nl = netdev_priv(dev);
+ rcv = &nl->rcv_data;
+
+- spin_lock_irq (&nl->lock);
++ spin_lock_irqsave (&nl->lock, flags);
+
+ c0 = read_status(dev);
+ if ((c0 & 0xf8) != 0xc0) {
+ if ((dev->irq != -1) && (net_debug > 1))
+ printk(KERN_DEBUG "%s: spurious interrupt\n", dev->name);
+- spin_unlock_irq (&nl->lock);
++ spin_unlock_irqrestore (&nl->lock, flags);
+ return;
+ }
+
+@@ -942,7 +943,7 @@ plip_interrupt(void *dev_id)
+ break;
+ }
+
+- spin_unlock_irq(&nl->lock);
++ spin_unlock_irqrestore(&nl->lock, flags);
+ }
+
+ static int
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:47:31 2008
+From: Len Brown <lenb@kernel.org>
+To: stable@kernel.org, Linux-acpi@vger.kernel.org
+Date: Tue, 15 Apr 2008 03:16:56 -0400
+Content-Disposition: inline
+Message-Id: <200804150316.56814.lenb@kernel.org>
+Subject: pnpacpi: reduce printk severity for "pnpacpi: exceeded the max number of ..."
+
+From: Len Brown <len.brown@intel.com>
+
+upstream commit 33fd7afd66ffdc6addf1b085fe6403b6af532f8e
+
+We have been printing these messages at KERN_ERR since 2.6.24,
+per http://bugzilla.kernel.org/show_bug.cgi?id=9535
+
+But KERN_ERR pops up on a console booted with "quiet"
+and causes users to get alarmed and file bugs
+about the message itself:
+https://bugzilla.redhat.com/show_bug.cgi?id=436589
+
+So reduce the severity of these messages to
+KERN_WARNING, which is not printed by "quiet".
+
+This message will still be seen without "quiet",
+but a lot of messages are printed in that mode
+and it will be less likely to cause undue alarm.
+
+We could go all the way to KERN_DEBUG, but this
+is a real warning after all, so it seems prudent
+not to require "debug" to see it.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/pnp/pnpacpi/rsparser.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/pnp/pnpacpi/rsparser.c
++++ b/drivers/pnp/pnpacpi/rsparser.c
+@@ -85,7 +85,7 @@ static void pnpacpi_parse_allocated_irqr
+ i < PNP_MAX_IRQ)
+ i++;
+ if (i >= PNP_MAX_IRQ && !warned) {
+- printk(KERN_ERR "pnpacpi: exceeded the max number of IRQ "
++ printk(KERN_WARNING "pnpacpi: exceeded the max number of IRQ "
+ "resources: %d \n", PNP_MAX_IRQ);
+ warned = 1;
+ return;
+@@ -187,7 +187,7 @@ static void pnpacpi_parse_allocated_dmar
+ res->dma_resource[i].start = dma;
+ res->dma_resource[i].end = dma;
+ } else if (!warned) {
+- printk(KERN_ERR "pnpacpi: exceeded the max number of DMA "
++ printk(KERN_WARNING "pnpacpi: exceeded the max number of DMA "
+ "resources: %d \n", PNP_MAX_DMA);
+ warned = 1;
+ }
+@@ -213,7 +213,7 @@ static void pnpacpi_parse_allocated_iore
+ res->port_resource[i].start = io;
+ res->port_resource[i].end = io + len - 1;
+ } else if (!warned) {
+- printk(KERN_ERR "pnpacpi: exceeded the max number of IO "
++ printk(KERN_WARNING "pnpacpi: exceeded the max number of IO "
+ "resources: %d \n", PNP_MAX_PORT);
+ warned = 1;
+ }
+@@ -241,7 +241,7 @@ static void pnpacpi_parse_allocated_memr
+ res->mem_resource[i].start = mem;
+ res->mem_resource[i].end = mem + len - 1;
+ } else if (!warned) {
+- printk(KERN_ERR "pnpacpi: exceeded the max number of mem "
++ printk(KERN_WARNING "pnpacpi: exceeded the max number of mem "
+ "resources: %d\n", PNP_MAX_MEM);
+ warned = 1;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:40:02 2008
+Date: Tue, 15 Apr 2008 13:45:51 +0000
+From: Mike Pagano <mpagano@gentoo.org>
+To: stable@kernel.org
+Message-ID: <20080415134551.GA20351@woodpecker.gentoo.org>
+Cc: kernel@gentoo.org, agx@sigxcpu.org
+Subject: POWERPC: Fix build of modular drivers/macintosh/apm_emu.c
+
+From: Guido Guenther <agx@sigxcpu.org>
+
+upstream commit: 620a245978d007279bc5c7c64e15f5f63af9af98
+
+Currently, if drivers/macintosh/apm_emu is a module and the config
+doesn't have CONFIG_SUSPEND we get:
+
+ERROR: "pmu_batteries" [drivers/macintosh/apm_emu.ko] undefined!
+ERROR: "pmu_battery_count" [drivers/macintosh/apm_emu.ko] undefined!
+ERROR: "pmu_power_flags" [drivers/macintosh/apm_emu.ko] undefined!
+
+on PPC32. The variables aren't wrapped in '#if defined(CONFIG_SUSPEND)'
+so we probably shouldn't wrap the exports either. This removes the
+CONFIG_SUSPEND part of the export, which fixes compilation on ppc32.
+
+Signed-off-by: Guido Guenther <agx@sigxcpu.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+
+mpagano@gentoo.org notes:
+
+The details can be found at http://bugs.gentoo.org/show_bug.cgi?id=217629.
+
+Cc: Mike Pagano <mpagano@gentoo.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/macintosh/via-pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/macintosh/via-pmu.c
++++ b/drivers/macintosh/via-pmu.c
+@@ -2842,7 +2842,7 @@ EXPORT_SYMBOL(pmu_wait_complete);
+ EXPORT_SYMBOL(pmu_suspend);
+ EXPORT_SYMBOL(pmu_resume);
+ EXPORT_SYMBOL(pmu_unlock);
+-#if defined(CONFIG_PM_SLEEP) && defined(CONFIG_PPC32)
++#if defined(CONFIG_PPC32)
+ EXPORT_SYMBOL(pmu_enable_irled);
+ EXPORT_SYMBOL(pmu_battery_count);
+ EXPORT_SYMBOL(pmu_batteries);
--- /dev/null
+From d4249258c92e7f11c69f18e5f60c7f8298e1a3b4 Mon Sep 17 00:00:00 2001
+From: James Chapman <jchapman@katalix.com>
+Date: Sun, 6 Apr 2008 23:41:29 -0700
+Subject: PPPOL2TP: Fix SMP issues in skb reorder queue handling
+
+Upstream commit: e653181dd6b3ad38ce14904351b03a5388f4b0f7
+
+When walking a session's packet reorder queue, use
+skb_queue_walk_safe() since the list could be modified inside the
+loop.
+
+Rearrange the unlinking skbs from the reorder queue such that it is
+done while the queue lock is held in pppol2tp_recv_dequeue() when
+walking the skb list.
+
+A version of this patch was suggested by Jarek Poplawski.
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/net/pppol2tp.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -342,10 +342,11 @@ static struct pppol2tp_tunnel *pppol2tp_
+ static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
+ {
+ struct sk_buff *skbp;
++ struct sk_buff *tmp;
+ u16 ns = PPPOL2TP_SKB_CB(skb)->ns;
+
+ spin_lock_bh(&session->reorder_q.lock);
+- skb_queue_walk(&session->reorder_q, skbp) {
++ skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
+ if (PPPOL2TP_SKB_CB(skbp)->ns > ns) {
+ __skb_insert(skb, skbp->prev, skbp, &session->reorder_q);
+ PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+@@ -371,10 +372,9 @@ static void pppol2tp_recv_dequeue_skb(st
+ int length = PPPOL2TP_SKB_CB(skb)->length;
+ struct sock *session_sock = NULL;
+
+- /* We're about to requeue the skb, so unlink it and return resources
++ /* We're about to requeue the skb, so return resources
+ * to its current owner (a socket receive buffer).
+ */
+- skb_unlink(skb, &session->reorder_q);
+ skb_orphan(skb);
+
+ tunnel->stats.rx_packets++;
+@@ -469,6 +469,11 @@ static void pppol2tp_recv_dequeue(struct
+ goto out;
+ }
+ }
++ __skb_unlink(skb, &session->reorder_q);
++
++ /* Process the skb. We release the queue lock while we
++ * do so to let other contexts process the queue.
++ */
+ spin_unlock_bh(&session->reorder_q.lock);
+ pppol2tp_recv_dequeue_skb(session, skb);
+ spin_lock_bh(&session->reorder_q.lock);
--- /dev/null
+From 1d8a373e61bea33fe68a8edbad2e70fb34e63ffe Mon Sep 17 00:00:00 2001
+From: James Chapman <jchapman@katalix.com>
+Date: Sun, 6 Apr 2008 23:41:18 -0700
+Subject: PPPOL2TP: Make locking calls softirq-safe
+
+Upstream commit: cf3752e2d203bbbfc88d29e362e6938cef4339b3
+
+Fix locking issues in the pppol2tp driver which can cause a kernel
+crash on SMP boxes. There were two problems:-
+
+1. The driver was violating read_lock() and write_lock() scheduling
+ rules because it wasn't using softirq-safe locks in softirq
+ contexts. So we now consistently use the _bh variants of the lock
+ functions.
+
+2. The driver was calling sk_dst_get() in pppol2tp_xmit() which was
+ taking sk_dst_lock in softirq context. We now call __sk_dst_get().
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/net/pppol2tp.c | 58 ++++++++++++++++++++++++------------------------
+ 1 files changed, 29 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index a7556cd..ff4a94b 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -302,14 +302,14 @@ pppol2tp_session_find(struct pppol2tp_tunnel *tunnel, u16 session_id)
+ struct pppol2tp_session *session;
+ struct hlist_node *walk;
+
+- read_lock(&tunnel->hlist_lock);
++ read_lock_bh(&tunnel->hlist_lock);
+ hlist_for_each_entry(session, walk, session_list, hlist) {
+ if (session->tunnel_addr.s_session == session_id) {
+- read_unlock(&tunnel->hlist_lock);
++ read_unlock_bh(&tunnel->hlist_lock);
+ return session;
+ }
+ }
+- read_unlock(&tunnel->hlist_lock);
++ read_unlock_bh(&tunnel->hlist_lock);
+
+ return NULL;
+ }
+@@ -320,14 +320,14 @@ static struct pppol2tp_tunnel *pppol2tp_tunnel_find(u16 tunnel_id)
+ {
+ struct pppol2tp_tunnel *tunnel = NULL;
+
+- read_lock(&pppol2tp_tunnel_list_lock);
++ read_lock_bh(&pppol2tp_tunnel_list_lock);
+ list_for_each_entry(tunnel, &pppol2tp_tunnel_list, list) {
+ if (tunnel->stats.tunnel_id == tunnel_id) {
+- read_unlock(&pppol2tp_tunnel_list_lock);
++ read_unlock_bh(&pppol2tp_tunnel_list_lock);
+ return tunnel;
+ }
+ }
+- read_unlock(&pppol2tp_tunnel_list_lock);
++ read_unlock_bh(&pppol2tp_tunnel_list_lock);
+
+ return NULL;
+ }
+@@ -344,7 +344,7 @@ static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_
+ struct sk_buff *skbp;
+ u16 ns = PPPOL2TP_SKB_CB(skb)->ns;
+
+- spin_lock(&session->reorder_q.lock);
++ spin_lock_bh(&session->reorder_q.lock);
+ skb_queue_walk(&session->reorder_q, skbp) {
+ if (PPPOL2TP_SKB_CB(skbp)->ns > ns) {
+ __skb_insert(skb, skbp->prev, skbp, &session->reorder_q);
+@@ -360,7 +360,7 @@ static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_
+ __skb_queue_tail(&session->reorder_q, skb);
+
+ out:
+- spin_unlock(&session->reorder_q.lock);
++ spin_unlock_bh(&session->reorder_q.lock);
+ }
+
+ /* Dequeue a single skb.
+@@ -442,7 +442,7 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
+ * expect to send up next, dequeue it and any other
+ * in-sequence packets behind it.
+ */
+- spin_lock(&session->reorder_q.lock);
++ spin_lock_bh(&session->reorder_q.lock);
+ skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
+ if (time_after(jiffies, PPPOL2TP_SKB_CB(skb)->expires)) {
+ session->stats.rx_seq_discards++;
+@@ -469,13 +469,13 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
+ goto out;
+ }
+ }
+- spin_unlock(&session->reorder_q.lock);
++ spin_unlock_bh(&session->reorder_q.lock);
+ pppol2tp_recv_dequeue_skb(session, skb);
+- spin_lock(&session->reorder_q.lock);
++ spin_lock_bh(&session->reorder_q.lock);
+ }
+
+ out:
+- spin_unlock(&session->reorder_q.lock);
++ spin_unlock_bh(&session->reorder_q.lock);
+ }
+
+ /* Internal receive frame. Do the real work of receiving an L2TP data frame
+@@ -1058,7 +1058,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+
+ /* Get routing info from the tunnel socket */
+ dst_release(skb->dst);
+- skb->dst = sk_dst_get(sk_tun);
++ skb->dst = dst_clone(__sk_dst_get(sk_tun));
+ skb_orphan(skb);
+ skb->sk = sk_tun;
+
+@@ -1106,7 +1106,7 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
+ PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+ "%s: closing all sessions...\n", tunnel->name);
+
+- write_lock(&tunnel->hlist_lock);
++ write_lock_bh(&tunnel->hlist_lock);
+ for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
+ again:
+ hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
+@@ -1126,7 +1126,7 @@ again:
+ * disappear as we're jumping between locks.
+ */
+ sock_hold(sk);
+- write_unlock(&tunnel->hlist_lock);
++ write_unlock_bh(&tunnel->hlist_lock);
+ lock_sock(sk);
+
+ if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+@@ -1148,11 +1148,11 @@ again:
+ * list so we are guaranteed to make forward
+ * progress.
+ */
+- write_lock(&tunnel->hlist_lock);
++ write_lock_bh(&tunnel->hlist_lock);
+ goto again;
+ }
+ }
+- write_unlock(&tunnel->hlist_lock);
++ write_unlock_bh(&tunnel->hlist_lock);
+ }
+
+ /* Really kill the tunnel.
+@@ -1161,9 +1161,9 @@ again:
+ static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel)
+ {
+ /* Remove from socket list */
+- write_lock(&pppol2tp_tunnel_list_lock);
++ write_lock_bh(&pppol2tp_tunnel_list_lock);
+ list_del_init(&tunnel->list);
+- write_unlock(&pppol2tp_tunnel_list_lock);
++ write_unlock_bh(&pppol2tp_tunnel_list_lock);
+
+ atomic_dec(&pppol2tp_tunnel_count);
+ kfree(tunnel);
+@@ -1239,9 +1239,9 @@ static void pppol2tp_session_destruct(struct sock *sk)
+ /* Delete the session socket from the
+ * hash
+ */
+- write_lock(&tunnel->hlist_lock);
++ write_lock_bh(&tunnel->hlist_lock);
+ hlist_del_init(&session->hlist);
+- write_unlock(&tunnel->hlist_lock);
++ write_unlock_bh(&tunnel->hlist_lock);
+
+ atomic_dec(&pppol2tp_session_count);
+ }
+@@ -1386,9 +1386,9 @@ static struct sock *pppol2tp_prepare_tunnel_socket(int fd, u16 tunnel_id,
+
+ /* Add tunnel to our list */
+ INIT_LIST_HEAD(&tunnel->list);
+- write_lock(&pppol2tp_tunnel_list_lock);
++ write_lock_bh(&pppol2tp_tunnel_list_lock);
+ list_add(&tunnel->list, &pppol2tp_tunnel_list);
+- write_unlock(&pppol2tp_tunnel_list_lock);
++ write_unlock_bh(&pppol2tp_tunnel_list_lock);
+ atomic_inc(&pppol2tp_tunnel_count);
+
+ /* Bump the reference count. The tunnel context is deleted
+@@ -1593,11 +1593,11 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ sk->sk_user_data = session;
+
+ /* Add session to the tunnel's hash list */
+- write_lock(&tunnel->hlist_lock);
++ write_lock_bh(&tunnel->hlist_lock);
+ hlist_add_head(&session->hlist,
+ pppol2tp_session_id_hash(tunnel,
+ session->tunnel_addr.s_session));
+- write_unlock(&tunnel->hlist_lock);
++ write_unlock_bh(&tunnel->hlist_lock);
+
+ atomic_inc(&pppol2tp_session_count);
+
+@@ -2199,7 +2199,7 @@ static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, str
+ int next = 0;
+ int i;
+
+- read_lock(&tunnel->hlist_lock);
++ read_lock_bh(&tunnel->hlist_lock);
+ for (i = 0; i < PPPOL2TP_HASH_SIZE; i++) {
+ hlist_for_each_entry(session, walk, &tunnel->session_hlist[i], hlist) {
+ if (curr == NULL) {
+@@ -2217,7 +2217,7 @@ static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, str
+ }
+ }
+ out:
+- read_unlock(&tunnel->hlist_lock);
++ read_unlock_bh(&tunnel->hlist_lock);
+ if (!found)
+ session = NULL;
+
+@@ -2228,13 +2228,13 @@ static struct pppol2tp_tunnel *next_tunnel(struct pppol2tp_tunnel *curr)
+ {
+ struct pppol2tp_tunnel *tunnel = NULL;
+
+- read_lock(&pppol2tp_tunnel_list_lock);
++ read_lock_bh(&pppol2tp_tunnel_list_lock);
+ if (list_is_last(&curr->list, &pppol2tp_tunnel_list)) {
+ goto out;
+ }
+ tunnel = list_entry(curr->list.next, struct pppol2tp_tunnel, list);
+ out:
+- read_unlock(&pppol2tp_tunnel_list_lock);
++ read_unlock_bh(&pppol2tp_tunnel_list_lock);
+
+ return tunnel;
+ }
--- /dev/null
+From d6438f325ab12948258eb485d03ec2d694f2c6e7 Mon Sep 17 00:00:00 2001
+From: Martin Devera <devik@cdi.cz>
+Date: Sun, 6 Apr 2008 23:42:10 -0700
+Subject: sch_htb: fix "too many events" situation
+
+Upstream commit: 8f3ea33a5078a09eba12bfe57424507809367756
+
+HTB is event driven algorithm and part of its work is to apply
+scheduled events at proper times. It tried to defend itself from
+livelock by processing only limited number of events per dequeue.
+Because of faster computers some users already hit this hardcoded
+limit.
+
+This patch limits processing up to 2 jiffies (why not 1 jiffie ?
+because it might stop prematurely when only fraction of jiffie
+remains).
+
+Signed-off-by: Martin Devera <devik@cdi.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/sched/sch_htb.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -708,9 +708,11 @@ static void htb_charge_class(struct htb_
+ */
+ static psched_time_t htb_do_events(struct htb_sched *q, int level)
+ {
+- int i;
+-
+- for (i = 0; i < 500; i++) {
++ /* don't run for longer than 2 jiffies; 2 is used instead of
++ 1 to simplify things when jiffy is going to be incremented
++ too soon */
++ unsigned long stop_at = jiffies + 2;
++ while (time_before(jiffies, stop_at)) {
+ struct htb_class *cl;
+ long diff;
+ struct rb_node *p = rb_first(&q->wait_pq[level]);
+@@ -728,9 +730,8 @@ static psched_time_t htb_do_events(struc
+ if (cl->cmode != HTB_CAN_SEND)
+ htb_add_to_wait_tree(q, cl, diff);
+ }
+- if (net_ratelimit())
+- printk(KERN_WARNING "htb: too many events !\n");
+- return q->now + PSCHED_TICKS_PER_SEC / 10;
++ /* too much load - let's continue on next jiffie */
++ return q->now + PSCHED_TICKS_PER_SEC / HZ;
+ }
+
+ /* Returns class->node+prio from id-tree where classe's id is >= id. NULL
--- /dev/null
+From 0f79c96ec23e987e71e550eb6aee6fbf667ae1ea Mon Sep 17 00:00:00 2001
+From: Chidambar 'ilLogict' Zinnoury <illogict@online.fr>
+Date: Sun, 6 Apr 2008 23:42:35 -0700
+Subject: SCTP: Fix local_addr deletions during list traversals.
+
+Upstream commit: 22626216c46f2ec86287e75ea86dd9ac3df54265
+
+Since the lists are circular, we need to explicitely tag
+the address to be deleted since we might end up freeing
+the list head instead. This fixes some interesting SCTP
+crashes.
+
+Signed-off-by: Chidambar 'ilLogict' Zinnoury <illogict@online.fr>
+Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/sctp/bind_addr.c | 4 +++-
+ net/sctp/ipv6.c | 4 +++-
+ net/sctp/protocol.c | 4 +++-
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/net/sctp/bind_addr.c
++++ b/net/sctp/bind_addr.c
+@@ -209,6 +209,7 @@ int sctp_add_bind_addr(struct sctp_bind_
+ int sctp_del_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *del_addr)
+ {
+ struct sctp_sockaddr_entry *addr, *temp;
++ int found = 0;
+
+ /* We hold the socket lock when calling this function,
+ * and that acts as a writer synchronizing lock.
+@@ -216,13 +217,14 @@ int sctp_del_bind_addr(struct sctp_bind_
+ list_for_each_entry_safe(addr, temp, &bp->address_list, list) {
+ if (sctp_cmp_addr_exact(&addr->a, del_addr)) {
+ /* Found the exact match. */
++ found = 1;
+ addr->valid = 0;
+ list_del_rcu(&addr->list);
+ break;
+ }
+ }
+
+- if (addr && !addr->valid) {
++ if (found) {
+ call_rcu(&addr->rcu, sctp_local_addr_free);
+ SCTP_DBG_OBJCNT_DEC(addr);
+ return 0;
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -89,6 +89,7 @@ static int sctp_inet6addr_event(struct n
+ struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)ptr;
+ struct sctp_sockaddr_entry *addr = NULL;
+ struct sctp_sockaddr_entry *temp;
++ int found = 0;
+
+ switch (ev) {
+ case NETDEV_UP:
+@@ -111,13 +112,14 @@ static int sctp_inet6addr_event(struct n
+ &sctp_local_addr_list, list) {
+ if (ipv6_addr_equal(&addr->a.v6.sin6_addr,
+ &ifa->addr)) {
++ found = 1;
+ addr->valid = 0;
+ list_del_rcu(&addr->list);
+ break;
+ }
+ }
+ spin_unlock_bh(&sctp_local_addr_lock);
+- if (addr && !addr->valid)
++ if (found)
+ call_rcu(&addr->rcu, sctp_local_addr_free);
+ break;
+ }
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -626,6 +626,7 @@ static int sctp_inetaddr_event(struct no
+ struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+ struct sctp_sockaddr_entry *addr = NULL;
+ struct sctp_sockaddr_entry *temp;
++ int found = 0;
+
+ switch (ev) {
+ case NETDEV_UP:
+@@ -645,13 +646,14 @@ static int sctp_inetaddr_event(struct no
+ list_for_each_entry_safe(addr, temp,
+ &sctp_local_addr_list, list) {
+ if (addr->a.v4.sin_addr.s_addr == ifa->ifa_local) {
++ found = 1;
+ addr->valid = 0;
+ list_del_rcu(&addr->list);
+ break;
+ }
+ }
+ spin_unlock_bh(&sctp_local_addr_lock);
+- if (addr && !addr->valid)
++ if (found)
+ call_rcu(&addr->rcu, sctp_local_addr_free);
+ break;
+ }
percpu-__percpu_alloc_mask-can-dynamically-size-percpu_data-storage.patch
alloc_percpu-fails-to-allocate-percpu-data.patch
vfs-fix-data-leak-in-nobh_write_end.patch
+pci-revert-smbus-unhide-on-hp-compaq-nx6110.patch
+hwmon-fix-i-o-resource-conflict-with-pnp.patch
+vmcoreinfo-add-the-symbol-phys_base.patch
+usb-allow-initialization-of-broken-keyspan-serial-adapters.patch
+usb-serial-fix-regression-in-visor-palm-os-module-for-kernels-2.6.24.patch
+usb-serial-ti_usb_3410_5052-correct-tusb3410-endpoint-requirements.patch
+crypto-xcbc-fix-crash-when-ipsec-uses-xcbc-mac-with-big-data-chunk.patch
+mtd-fix-broken-state-in-cfi-driver-caused-by-fl_shutdown.patch
+ipmi-change-device-node-ordering-to-reflect-probe-order.patch
+ax25-ax25_out-check-skb-for-null-in-ax25_kick.patch
+net-include-linux-types.h-into-linux-ethtool.h-for-__u-typedef.patch
+sungem-fix-napi-assertion-failure.patch
+inet-inet_frag_evictor-must-run-with-bh-disabled.patch
+llc-restrict-llc-sockets-to-root.patch
+netpoll-zap_completion_queue-adjust-skb-users-counter.patch
+pppol2tp-make-locking-calls-softirq-safe.patch
+pppol2tp-fix-smp-issues-in-skb-reorder-queue-handling.patch
+net-add-preemption-point-in-qdisc_run.patch
+sch_htb-fix-too-many-events-situation.patch
+sctp-fix-local_addr-deletions-during-list-traversals.patch
+net-fix-multicast-device-ioctl-checks.patch
+tcp-fix-shrinking-windows-with-window-scaling.patch
+tcp-let-skbs-grow-over-a-page-on-fast-peers.patch
+vlan-don-t-copy-allmulti-promisc-flags-from-underlying-device.patch
+sparc64-fix-atomic-backoff-limit.patch
+sparc64-fix-__get_cpu_var-in-preemption-enabled-area.patch
+sparc64-flush_ptrace_access-needs-preemption-disable.patch
+libata-assume-no-device-is-attached-if-both-identifys-are-aborted.patch
+sis190-read-the-mac-address-from-the-eeprom-first.patch
+bluetooth-hci_core-defer-hci_unregister_sysfs.patch
+sparc64-fix-fpu-saving-in-64-bit-signal-handling.patch
+dvb-tda10086-make-the-22khz-tone-for-diseqc-a-config-option.patch
+sunrpc-fix-a-memory-leak-in-rpc_create.patch
+hfs-fix-unlink-of-links.patch
+acpi-fix-buggy-bios-check-when-cpus-are-hot-removed.patch
+plip-replace-spin_lock_irq-with-spin_lock_irqsave-in-irq-context.patch
+signalfd-fix-for-incorrect-si_queue-user-data-reporting.patch
+md-close-a-livelock-window-in-handle_parity_checks5.patch
+powerpc-fix-build-of-modular-drivers-macintosh-apm_emu.c.patch
+pnpacpi-reduce-printk-severity-for-pnpacpi-exceeded-the-max-number-of.patch
+parisc-futex-special-case-cmpxchg-null-in-kernel-space.patch
+parisc-pdc_console-fix-bizarre-panic-on-boot.patch
+fix-signal-trampoline-cache-flushing.patch
+acpi-bus-check-once-more-for-an-empty-list-after-locking-it.patch
+fbdev-fix-proc-fb-oops-after-module-removal.patch
+macb-call-phy_disconnect-on-removing.patch
+file-capabilities-remove-cap_task_kill.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:37:09 2008
+Date: Fri, 11 Apr 2008 16:55:04 GMT
+Message-Id: <200804111655.m3BGt4mw031482@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: signalfd: fix for incorrect SI_QUEUE user data reporting
+
+From: Davide Libenzi <davidel@xmailserver.org>
+
+upstream commit: 0859ab59a8a48d2a96b9d2b7100889bcb6bb5818
+
+Michael Kerrisk found out that signalfd was not reporting back user data
+pushed using sigqueue:
+
+ http://groups.google.com/group/linux.kernel/msg/9397cab8551e3123
+
+The following patch makes signalfd report back the ssi_ptr and ssi_int members
+of the signalfd_siginfo structure.
+
+Signed-off-by: Davide Libenzi <davidel@xmailserver.org>
+Acked-by: Michael Kerrisk <mtk.manpages@googlemail.com>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ fs/signalfd.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/signalfd.c
++++ b/fs/signalfd.c
+@@ -110,9 +110,14 @@ static int signalfd_copyinfo(struct sign
+ err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
+ err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
+ break;
+- default: /* this is just in case for now ... */
++ default:
++ /*
++ * This case catches also the signals queued by sigqueue().
++ */
+ err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
+ err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
++ err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
++ err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
+ break;
+ }
+
--- /dev/null
+From 563e0ae06ff18f0b280f11cf706ba0172255ce52 Mon Sep 17 00:00:00 2001
+From: Francois Romieu <romieu@fr.zoreil.com>
+Date: Mon, 18 Feb 2008 21:20:32 +0100
+Message-ID: <47FA112C.4040104@gentoo.org>
+Subject: sis190: read the mac address from the eeprom first
+
+upstream commit: 563e0ae06ff18f0b280f11cf706ba0172255ce52
+
+Reading a serie of zero from the cmos sram area do not work
+well with is_valid_ether_addr(). Let's read the mac address
+from the eeprom first as it seems more reliable.
+
+Fix for http://bugzilla.kernel.org/show_bug.cgi?id=9831
+
+Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+
+dsd@gentoo.org notes:
+This patch fixes http://bugs.gentoo.org/207706
+
+Cc: Daniel Drake <dsd@gentoo.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/net/sis190.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/sis190.c
++++ b/drivers/net/sis190.c
+@@ -1632,13 +1632,18 @@ static inline void sis190_init_rxfilter(
+
+ static int sis190_get_mac_addr(struct pci_dev *pdev, struct net_device *dev)
+ {
+- u8 from;
++ int rc;
++
++ rc = sis190_get_mac_addr_from_eeprom(pdev, dev);
++ if (rc < 0) {
++ u8 reg;
+
+- pci_read_config_byte(pdev, 0x73, &from);
++ pci_read_config_byte(pdev, 0x73, ®);
+
+- return (from & 0x00000001) ?
+- sis190_get_mac_addr_from_apc(pdev, dev) :
+- sis190_get_mac_addr_from_eeprom(pdev, dev);
++ if (reg & 0x00000001)
++ rc = sis190_get_mac_addr_from_apc(pdev, dev);
++ }
++ return rc;
+ }
+
+ static void sis190_set_speed_auto(struct net_device *dev)
--- /dev/null
+From 47cd0c4f35c6f71c794928f2c26b705144799b60 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Mon, 7 Apr 2008 00:25:35 -0700
+Subject: SPARC64: Fix __get_cpu_var in preemption-enabled area.
+
+Upstream commit: 69072f6e8e4bd4799d2a54e4ff8771d0657512c1
+
+Reported by Mariusz Kozlowski.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/sparc64/mm/tlb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/sparc64/mm/tlb.c
++++ b/arch/sparc64/mm/tlb.c
+@@ -23,10 +23,11 @@ DEFINE_PER_CPU(struct mmu_gather, mmu_ga
+
+ void flush_tlb_pending(void)
+ {
+- struct mmu_gather *mp = &__get_cpu_var(mmu_gathers);
++ struct mmu_gather *mp;
+
+ preempt_disable();
+
++ mp = &__get_cpu_var(mmu_gathers);
+ if (mp->tlb_nr) {
+ flush_tsb_user(mp);
+
--- /dev/null
+From 8625edb5b721526702c287e51094ac55468377d8 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Mon, 7 Apr 2008 00:25:20 -0700
+Subject: SPARC64: Fix atomic backoff limit.
+
+Upstream commit: 4cfea5a7dfcc2766251e50ca30271a782d5004ad
+
+4096 will not fit into the immediate field of a compare instruction,
+in fact it will end up being -4096 causing the check to fail every
+time and thus disabling backoff.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ include/asm-sparc64/backoff.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/asm-sparc64/backoff.h
++++ b/include/asm-sparc64/backoff.h
+@@ -12,7 +12,8 @@
+ mov reg, tmp; \
+ 88: brnz,pt tmp, 88b; \
+ sub tmp, 1, tmp; \
+- cmp reg, BACKOFF_LIMIT; \
++ set BACKOFF_LIMIT, tmp; \
++ cmp reg, tmp; \
+ bg,pn %xcc, label; \
+ nop; \
+ ba,pt %xcc, label; \
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:21:19 2008
+Date: Mon, 07 Apr 2008 22:24:24 -0700 (PDT)
+Message-Id: <20080407.222424.115729676.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Subject: SPARC64: Fix FPU saving in 64-bit signal handling.
+
+From: David S. Miller <davem@davemloft.net>
+
+Upstream commit: 7c3cce978e4f933ac13758ec5d2554fc8d0927d2
+
+The calculation of the FPU reg save area pointer
+was wrong.
+
+Based upon an OOPS report from Tom Callaway.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/sparc64/kernel/signal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc64/kernel/signal.c
++++ b/arch/sparc64/kernel/signal.c
+@@ -354,7 +354,7 @@ static int invalid_frame_pointer(void __
+ static inline int
+ save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+ {
+- unsigned long *fpregs = (unsigned long *)(regs+1);
++ unsigned long *fpregs = current_thread_info()->fpregs;
+ unsigned long fprs;
+ int err = 0;
+
--- /dev/null
+From 312302b69e3bdab30e1fe472d265d0ed08e21f18 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Mon, 7 Apr 2008 00:26:11 -0700
+Subject: SPARC64: flush_ptrace_access() needs preemption disable.
+
+Upstream commit: f6a843d939ade435e060d580f5c56d958464f8a5
+
+Based upon a report by Mariusz Kozlowski.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/sparc64/kernel/ptrace.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/sparc64/kernel/ptrace.c
++++ b/arch/sparc64/kernel/ptrace.c
+@@ -127,6 +127,8 @@ void flush_ptrace_access(struct vm_area_
+ if (tlb_type == hypervisor)
+ return;
+
++ preempt_disable();
++
+ #ifdef DCACHE_ALIASING_POSSIBLE
+ /* If bit 13 of the kernel address we used to access the
+ * user page is the same as the virtual address that page
+@@ -165,6 +167,8 @@ void flush_ptrace_access(struct vm_area_
+ for (; start < end; start += icache_line_size)
+ flushi(start);
+ }
++
++ preempt_enable();
+ }
+
+ asmlinkage void do_ptrace(struct pt_regs *regs)
--- /dev/null
+From e1eba625679bf859ab7f989f548f00fcea6c4c19 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Sun, 6 Apr 2008 23:37:08 -0700
+Subject: SUNGEM: Fix NAPI assertion failure.
+
+Upstream commit: da990a2402aeaee84837f29054c4628eb02f7493
+
+As reported by Johannes Berg:
+
+I started getting this warning with recent kernels:
+
+[ 773.908927] ------------[ cut here ]------------
+[ 773.908954] Badness at net/core/dev.c:2204
+ ...
+
+If we loop more than once in gem_poll(), we'll
+use more than the real budget in our gem_rx()
+calls, thus eventually trigger the caller's
+assertions in net_rx_action().
+
+Subtract "work_done" from "budget" for the second
+arg to gem_rx() to fix the bug.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/net/sungem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/sungem.c
++++ b/drivers/net/sungem.c
+@@ -910,7 +910,7 @@ static int gem_poll(struct napi_struct *
+ * rx ring - must call napi_disable(), which
+ * schedule_timeout()'s if polling is already disabled.
+ */
+- work_done += gem_rx(gp, budget);
++ work_done += gem_rx(gp, budget - work_done);
+
+ if (work_done >= budget)
+ return work_done;
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 16:27:25 2008
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+To: stable@kernel.org
+Date: Tue, 08 Apr 2008 21:15:33 -0400
+Message-ID: <20080409011532.22409.87741.stgit@c-69-242-210-120.hsd1.mi.comcast.net>
+Cc: Chuck Lever <chuck.lever@oracle.com>
+Subject: SUNRPC: Fix a memory leak in rpc_create()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+upstream commit: ed13c27e546667fb0967ae30f5070cd7f6455f90
+
+Commit 510deb0d was supposed to move the xprt_create_transport() call in
+rpc_create(), but neglected to remove the old call site. This resulted in
+a transport leak after every rpc_create() call.
+
+This leak is present in 2.6.24 and 2.6.25.
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ net/sunrpc/clnt.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -249,10 +249,6 @@ struct rpc_clnt *rpc_create(struct rpc_c
+ };
+ char servername[20];
+
+- xprt = xprt_create_transport(&xprtargs);
+- if (IS_ERR(xprt))
+- return (struct rpc_clnt *)xprt;
+-
+ /*
+ * If the caller chooses not to specify a hostname, whip
+ * up a string representation of the passed-in address.
--- /dev/null
+From 1cbc66860db5db06bcf7055326f3bdbabd86e013 Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Sun, 6 Apr 2008 23:43:18 -0700
+Subject: TCP: Fix shrinking windows with window scaling
+
+Upstream commit: 607bfbf2d55dd1cfe5368b41c2a81a8c9ccf4723
+
+When selecting a new window, tcp_select_window() tries not to shrink
+the offered window by using the maximum of the remaining offered window
+size and the newly calculated window size. The newly calculated window
+size is always a multiple of the window scaling factor, the remaining
+window size however might not be since it depends on rcv_wup/rcv_nxt.
+This means we're effectively shrinking the window when scaling it down.
+
+
+The dump below shows the problem (scaling factor 2^7):
+
+- Window size of 557 (71296) is advertised, up to 3111907257:
+
+IP 172.2.2.3.33000 > 172.2.2.2.33000: . ack 3111835961 win 557 <...>
+
+- New window size of 514 (65792) is advertised, up to 3111907217, 40 bytes
+ below the last end:
+
+IP 172.2.2.3.33000 > 172.2.2.2.33000: . 3113575668:3113577116(1448) ack 3111841425 win 514 <...>
+
+The number 40 results from downscaling the remaining window:
+
+3111907257 - 3111841425 = 65832
+65832 / 2^7 = 514
+65832 % 2^7 = 40
+
+If the sender uses up the entire window before it is shrunk, this can have
+chaotic effects on the connection. When sending ACKs, tcp_acceptable_seq()
+will notice that the window has been shrunk since tcp_wnd_end() is before
+tp->snd_nxt, which makes it choose tcp_wnd_end() as sequence number.
+This will fail the receivers checks in tcp_sequence() however since it
+is before it's tp->rcv_wup, making it respond with a dupack.
+
+If both sides are in this condition, this leads to a constant flood of
+ACKs until the connection times out.
+
+Make sure the window is never shrunk by aligning the remaining window to
+the window scaling factor.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/ipv4/tcp_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -258,7 +258,7 @@ static u16 tcp_select_window(struct sock
+ *
+ * Relax Will Robinson.
+ */
+- new_win = cur_win;
++ new_win = ALIGN(cur_win, 1 << tp->rx_opt.rcv_wscale);
+ }
+ tp->rcv_wnd = new_win;
+ tp->rcv_wup = tp->rcv_nxt;
--- /dev/null
+From 4006101b798187bf9e03c0991eba3ee8d88d7fe0 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Sun, 6 Apr 2008 23:43:38 -0700
+Subject: TCP: Let skbs grow over a page on fast peers
+
+Upstream commit: 69d1506731168d6845a76a303b2c45f7c05f3f2c
+
+While testing the virtio-net driver on KVM with TSO I noticed
+that TSO performance with a 1500 MTU is significantly worse
+compared to the performance of non-TSO with a 16436 MTU. The
+packet dump shows that most of the packets sent are smaller
+than a page.
+
+Looking at the code this actually is quite obvious as it always
+stop extending the packet if it's the first packet yet to be
+sent and if it's larger than the MSS. Since each extension is
+bound by the page size, this means that (given a 1500 MTU) we're
+very unlikely to construct packets greater than a page, provided
+that the receiver and the path is fast enough so that packets can
+always be sent immediately.
+
+The fix is also quite obvious. The push calls inside the loop
+is just an optimisation so that we don't end up doing all the
+sending at the end of the loop. Therefore there is no specific
+reason why it has to do so at MSS boundaries. For TSO, the
+most natural extension of this optimisation is to do the pushing
+once the skb exceeds the TSO size goal.
+
+This is what the patch does and testing with KVM shows that the
+TSO performance with a 1500 MTU easily surpasses that of a 16436
+MTU and indeed the packet sizes sent are generally larger than
+16436.
+
+I don't see any obvious downsides for slower peers or connections,
+but it would be prudent to test this extensively to ensure that
+those cases don't regress.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -583,7 +583,7 @@ new_segment:
+ if (!(psize -= copy))
+ goto out;
+
+- if (skb->len < mss_now || (flags & MSG_OOB))
++ if (skb->len < size_goal || (flags & MSG_OOB))
+ continue;
+
+ if (forced_push(tp)) {
+@@ -829,7 +829,7 @@ new_segment:
+ if ((seglen -= copy) == 0 && iovlen == 0)
+ goto out;
+
+- if (skb->len < mss_now || (flags & MSG_OOB))
++ if (skb->len < size_goal || (flags & MSG_OOB))
+ continue;
+
+ if (forced_push(tp)) {
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 15:29:10 2008
+Date: Wed, 2 Apr 2008 23:15:09 GMT
+Message-Id: <200804022315.m32NF9kx011042@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: USB: Allow initialization of broken keyspan serial adapters.
+
+From: Clark Rawlins <clark.rawlins@escient.com>
+
+upstream commit: 822470537d0fc1dee38a2a9c8b8c398bfbb332bb
+
+Fixes the keyspan driver after the addition of additional
+checking of driver requirements introduced in usb-serial.c
+commit 063a2da8f01806906f7d7b1a1424b9afddebc443. The initialization
+of the keyspan usb_serial_driver structs were not initializing the
+num_interrupt_out field and the additional checking was rejecting
+the end point so the driver wouldn't finish initializing.
+
+This commit initializes the fields to NUM_DONT_CARE.
+It works for the keyspan USA-49WG and doesn't break the USA-19HS
+which are the two keyspan devices I have to test with.
+
+Signed-off-by: Clark Rawlins <clark.rawlins@escient.com>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/usb/serial/keyspan.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/keyspan.h
++++ b/drivers/usb/serial/keyspan.h
+@@ -637,6 +637,7 @@ static struct usb_serial_driver keyspan_
+ .description = "Keyspan - (without firmware)",
+ .id_table = keyspan_pre_ids,
+ .num_interrupt_in = NUM_DONT_CARE,
++ .num_interrupt_out = NUM_DONT_CARE,
+ .num_bulk_in = NUM_DONT_CARE,
+ .num_bulk_out = NUM_DONT_CARE,
+ .num_ports = 1,
+@@ -651,6 +652,7 @@ static struct usb_serial_driver keyspan_
+ .description = "Keyspan 1 port adapter",
+ .id_table = keyspan_1port_ids,
+ .num_interrupt_in = NUM_DONT_CARE,
++ .num_interrupt_out = NUM_DONT_CARE,
+ .num_bulk_in = NUM_DONT_CARE,
+ .num_bulk_out = NUM_DONT_CARE,
+ .num_ports = 1,
+@@ -678,6 +680,7 @@ static struct usb_serial_driver keyspan_
+ .description = "Keyspan 2 port adapter",
+ .id_table = keyspan_2port_ids,
+ .num_interrupt_in = NUM_DONT_CARE,
++ .num_interrupt_out = NUM_DONT_CARE,
+ .num_bulk_in = NUM_DONT_CARE,
+ .num_bulk_out = NUM_DONT_CARE,
+ .num_ports = 2,
+@@ -705,6 +708,7 @@ static struct usb_serial_driver keyspan_
+ .description = "Keyspan 4 port adapter",
+ .id_table = keyspan_4port_ids,
+ .num_interrupt_in = NUM_DONT_CARE,
++ .num_interrupt_out = NUM_DONT_CARE,
+ .num_bulk_in = NUM_DONT_CARE,
+ .num_bulk_out = NUM_DONT_CARE,
+ .num_ports = 4,
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 15:29:44 2008
+Date: Wed, 2 Apr 2008 23:15:13 GMT
+Message-Id: <200804022315.m32NFDiN011077@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: USB: serial: fix regression in Visor/Palm OS module for kernels >= 2.6.24
+
+From: Brad Sawatzky <brad+kernel@swatter.net>
+
+upstream commit: d04863e9e65767feff7807c8f693ac2719dd1944
+
+Fixes a bug/inconsistency revealed by the additional sanity checking in
+ commit 063a2da8f01806906f7d7b1a1424b9afddebc443
+introduced in the original 2.6.24 branch.
+
+The Handspring Visor / PalmOS 4 device structure defines .num_bulk_out=2
+but the usb-serial probe returns num_bulk_out=3, triggering the check in
+the above commit and forcing a bail out when the device (a Garmin iQue in
+my case) attempts to connect. The patch bumps the expected number of
+endpoints to 3.
+
+FWIW, this patch will probably solve the following kernel bug report for
+Treo users (identical symptoms, different model PalmOS units):
+ <http://bugzilla.kernel.org/show_bug.cgi?id=10118>
+
+
+Signed-off-by: Brad Sawatzky <brad+kernel@swatter.net>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/usb/serial/visor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -191,7 +191,7 @@ static struct usb_serial_driver handspri
+ .id_table = id_table,
+ .num_interrupt_in = NUM_DONT_CARE,
+ .num_bulk_in = 2,
+- .num_bulk_out = 2,
++ .num_bulk_out = NUM_DONT_CARE,
+ .num_ports = 2,
+ .open = visor_open,
+ .close = visor_close,
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 15:30:20 2008
+Date: Wed, 2 Apr 2008 23:15:15 GMT
+Message-Id: <200804022315.m32NFFG1011103@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: USB: serial: ti_usb_3410_5052: Correct TUSB3410 endpoint requirements.
+
+From: Robert Spanton <rspanton@zepler.net>
+
+upstream commit: 1bfd6693cd66f1e79abce62d3e8c3647e1f59a55
+
+The changes introduced in commit
+063a2da8f01806906f7d7b1a1424b9afddebc443 changed the semantics of the
+num_interrupt_in, num_interrupt_out, num_bulk_in and num_bulk_out
+entries of the usb_serial_driver struct to be the number of endpoints
+the device has when probed.
+
+This patch changes the ti_1port_device usb_serial_driver struct to
+reflect this change. The single port devices only have 1
+bulk_out endpoint in their initial configuration, and so this patch
+changes the number of other types to NUM_DONT_CARE.
+
+The same change probably needs doing to the ti_2port_device struct,
+but I don't have a two port device at hand.
+
+Signed-off-by: Robert Spanton <rspanton@zepler.net>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/usb/serial/ti_usb_3410_5052.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -264,8 +264,8 @@ static struct usb_serial_driver ti_1port
+ .description = "TI USB 3410 1 port adapter",
+ .usb_driver = &ti_usb_driver,
+ .id_table = ti_id_table_3410,
+- .num_interrupt_in = 1,
+- .num_bulk_in = 1,
++ .num_interrupt_in = NUM_DONT_CARE,
++ .num_bulk_in = NUM_DONT_CARE,
+ .num_bulk_out = 1,
+ .num_ports = 1,
+ .attach = ti_startup,
--- /dev/null
+From 0dcd5859eed3c804cb05a68c921ac47fa8b2f04a Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Sun, 6 Apr 2008 23:46:45 -0700
+Subject: VLAN: Don't copy ALLMULTI/PROMISC flags from underlying device
+
+Upstream commit: 0ed21b321a13421e2dfeaa70a6c324e05e3e91e6
+
+Changing these flags requires to use dev_set_allmulti/dev_set_promiscuity
+or dev_change_flags. Setting it directly causes two unwanted effects:
+
+- the next dev_change_flags call will notice a difference between
+ dev->gflags and the actual flags, enable promisc/allmulti
+ mode and incorrectly update dev->gflags
+
+- this keeps the underlying device in promisc/allmulti mode until
+ the VLAN device is deleted
+
+[ Ported back to 2.6.24 VLAN code. -DaveM ]
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/8021q/vlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -326,7 +326,7 @@ static int vlan_dev_init(struct net_devi
+ int subclass = 0;
+
+ /* IFF_BROADCAST|IFF_MULTICAST; ??? */
+- dev->flags = real_dev->flags & ~IFF_UP;
++ dev->flags = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI);
+ dev->iflink = real_dev->ifindex;
+ dev->state = (real_dev->state & ((1<<__LINK_STATE_NOCARRIER) |
+ (1<<__LINK_STATE_DORMANT))) |
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Apr 16 15:28:17 2008
+Date: Wed, 2 Apr 2008 23:15:03 GMT
+Message-Id: <200804022315.m32NF314010808@hera.kernel.org>
+From: jejb@kernel.org
+To: jejb@kernel.org, stable@kernel.org
+Subject: vmcoreinfo: add the symbol "phys_base"
+
+From: Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
+
+upstream commit: 629c8b4cdb354518308663aff2f719e02f69ffbe
+
+Fix the problem that makedumpfile sometimes fails on x86_64 machine.
+
+This patch adds the symbol "phys_base" to a vmcoreinfo data. The
+vmcoreinfo data has the minimum debugging information only for dump
+filtering. makedumpfile (dump filtering command) gets it to distinguish
+unnecessary pages, and makedumpfile creates a small dumpfile.
+
+On x86_64 kernel which compiled with CONFIG_PHYSICAL_START=0x0 and
+CONFIG_RELOCATABLE=y, makedumpfile fails like the following:
+
+ # makedumpfile -d31 /proc/vmcore dumpfile
+ The kernel version is not supported.
+ The created dumpfile may be incomplete.
+ _exclude_free_page: Can't get next online node.
+
+ makedumpfile Failed.
+ #
+
+The cause is the lack of the symbol "phys_base" in a vmcoreinfo data.
+If the symbol "phys_base" does not exist, makedumpfile considers an
+x86_64 kernel as non relocatable. As the result, makedumpfile
+misunderstands the physical address where the kernel is loaded, and it
+cannot translate a kernel virtual address to physical address correctly.
+
+To fix this problem, this patch adds the symbol "phys_base" to a
+vmcoreinfo data.
+
+Signed-off-by: Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Cc: <stable@kernel.org>
+Acked-by: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/x86/kernel/machine_kexec_64.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/machine_kexec_64.c
++++ b/arch/x86/kernel/machine_kexec_64.c
+@@ -233,6 +233,7 @@ NORET_TYPE void machine_kexec(struct kim
+
+ void arch_crash_save_vmcoreinfo(void)
+ {
++ VMCOREINFO_SYMBOL(phys_base);
+ VMCOREINFO_SYMBOL(init_level4_pgt);
+
+ #ifdef CONFIG_ARCH_DISCONTIGMEM_ENABLE
projects / thirdparty / kernel / stable-queue.git / commitdiff
