--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jun 18 20:12:08 2008
+From: Bob Moore <robert.moore@intel.com>
+Date: Wed, 18 Jun 2008 22:11:31 -0400 (EDT)
+Subject: ACPICA: Ignore ACPI table signature for Load() operator
+To: stable@kernel.org
+Cc: linux-acpi@vger.kernel.org
+Message-ID: <alpine.LFD.1.10.0806182151270.3074@localhost.localdomain>
+
+
+From: Bob Moore <robert.moore@intel.com>
+
+upstream bc45b1d39a925b56796bebf8a397a0491489d85c
+
+Without this patch booting with acpi_osi="!Windows 2006" is required
+for several machines to function properly with cpufreq
+due to failure to load a Vista specific table with a bad signature.
+
+Only "SSDT" is acceptable to the ACPI spec, but tables are
+seen with OEMx and null sigs. Therefore, signature validation
+is worthless. Apparently MS ACPI accepts such signatures, ACPICA
+must be compatible.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=9919
+http://bugzilla.kernel.org/show_bug.cgi?id=10383
+http://bugzilla.kernel.org/show_bug.cgi?id=10454
+https://bugzilla.novell.com/show_bug.cgi?id=396311
+
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Lin Ming <ming.m.lin@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/tables/tbinstal.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+--- a/drivers/acpi/tables/tbinstal.c
++++ b/drivers/acpi/tables/tbinstal.c
+@@ -123,17 +123,13 @@ acpi_tb_add_table(struct acpi_table_desc
+ }
+ }
+
+- /* The table must be either an SSDT or a PSDT or an OEMx */
+-
+- if ((!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_PSDT))
+- &&
+- (!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_SSDT))
+- && (strncmp(table_desc->pointer->signature, "OEM", 3))) {
+- ACPI_ERROR((AE_INFO,
+- "Table has invalid signature [%4.4s], must be SSDT, PSDT or OEMx",
+- table_desc->pointer->signature));
+- return_ACPI_STATUS(AE_BAD_SIGNATURE);
+- }
++ /*
++ * Originally, we checked the table signature for "SSDT" or "PSDT" here.
++ * Next, we added support for OEMx tables, signature "OEM".
++ * Valid tables were encountered with a null signature, so we've just
++ * given up on validating the signature, since it seems to be a waste
++ * of code. The original code was removed (05/2008).
++ */
+
+ (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Jun 14 14:48:30 2008
+From: Michael Buesch <mb@bu3sch.de>
+Date: Sat, 14 Jun 2008 23:00:14 +0200
+Subject: b43: Fix noise calculation WARN_ON
+To: stable@kernel.org
+Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de
+Message-ID: <200806142300.15391.mb@bu3sch.de>
+Content-Disposition: inline
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit 98a3b2fe435ae76170936c14f5c9e6a87548e3ef upstream.
+
+This removes a WARN_ON that is responsible for the following koops:
+http://www.kerneloops.org/searchweek.php?search=b43_generate_noise_sample
+
+The comment in the patch describes why it's safe to simply remove
+the check.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/net/wireless/b43/b43.h | 1 -
+ drivers/net/wireless/b43/main.c | 16 ++++++++++------
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/b43/b43.h
++++ b/drivers/net/wireless/b43/b43.h
+@@ -596,7 +596,6 @@ struct b43_dma {
+
+ /* Context information for a noise calculation (Link Quality). */
+ struct b43_noise_calculation {
+- u8 channel_at_start;
+ bool calculation_running;
+ u8 nr_samples;
+ s8 samples[8][4];
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -1027,7 +1027,6 @@ static void b43_generate_noise_sample(st
+ b43_jssi_write(dev, 0x7F7F7F7F);
+ b43_write32(dev, B43_MMIO_MACCMD,
+ b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
+- B43_WARN_ON(dev->noisecalc.channel_at_start != dev->phy.channel);
+ }
+
+ static void b43_calculate_link_quality(struct b43_wldev *dev)
+@@ -1036,7 +1035,6 @@ static void b43_calculate_link_quality(s
+
+ if (dev->noisecalc.calculation_running)
+ return;
+- dev->noisecalc.channel_at_start = dev->phy.channel;
+ dev->noisecalc.calculation_running = 1;
+ dev->noisecalc.nr_samples = 0;
+
+@@ -1053,9 +1051,16 @@ static void handle_irq_noise(struct b43_
+
+ /* Bottom half of Link Quality calculation. */
+
++ /* Possible race condition: It might be possible that the user
++ * changed to a different channel in the meantime since we
++ * started the calculation. We ignore that fact, since it's
++ * not really that much of a problem. The background noise is
++ * an estimation only anyway. Slightly wrong results will get damped
++ * by the averaging of the 8 sample rounds. Additionally the
++ * value is shortlived. So it will be replaced by the next noise
++ * calculation round soon. */
++
+ B43_WARN_ON(!dev->noisecalc.calculation_running);
+- if (dev->noisecalc.channel_at_start != phy->channel)
+- goto drop_calculation;
+ *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
+ if (noise[0] == 0x7F || noise[1] == 0x7F ||
+ noise[2] == 0x7F || noise[3] == 0x7F)
+@@ -1096,11 +1101,10 @@ static void handle_irq_noise(struct b43_
+ average -= 48;
+
+ dev->stats.link_noise = average;
+- drop_calculation:
+ dev->noisecalc.calculation_running = 0;
+ return;
+ }
+- generate_new:
++generate_new:
+ b43_generate_noise_sample(dev);
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Jun 14 14:46:55 2008
+From: Michael Buesch <mb@bu3sch.de>
+Date: Sat, 14 Jun 2008 22:57:55 +0200
+Subject: b43: Fix possible NULL pointer dereference in DMA code
+To: stable@kernel.org
+Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de
+Message-ID: <200806142257.55946.mb@bu3sch.de>
+Content-Disposition: inline
+
+From: Michael Buesch <mb@bu3sch.de>
+
+a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream
+
+This fixes a possible NULL pointer dereference in an error path of the
+DMA allocation error checking code. In case the DMA allocation address is invalid,
+the dev pointer is dereferenced for unmapping of the buffer.
+
+Reported-by: Miles Lane <miles.lane@gmail.com>
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(st
+ if (!ring)
+ goto out;
+ ring->type = type;
++ ring->dev = dev;
+
+ nr_slots = B43_RXRING_SLOTS;
+ if (for_tx)
+@@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(st
+ DMA_TO_DEVICE);
+ }
+
+- ring->dev = dev;
+ ring->nr_slots = nr_slots;
+ ring->mmio_base = b43_dmacontroller_base(type, controller_index);
+ ring->index = controller_index;
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jun 18 15:50:59 2008
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Date: Wed, 18 Jun 2008 23:54:53 +0200
+Subject: opti621: disable read prefetch
+To: stable@kernel.org
+Cc: Juergen Kosel <juergen.kosel@gmx.de>
+Message-ID: <200806182354.55057.bzolnier@gmail.com>
+Content-Disposition: inline
+
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+
+commit 62128b2ca812c1266f4ff7bac068bf0b626c6179 upstream
+
+This fixes 2.6.25 regression (kernel.org bugzilla bug #10723) caused by:
+
+commit 912fb29a36a7269ac1c4a4df45bc0ac1d2637972
+Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Date: Fri Oct 19 00:30:11 2007 +0200
+
+ opti621: always tune PIO
+...
+
+Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code.
+
+Bisected-by: Juergen Kosel <juergen.kosel@gmx.de>
+Tested-by: Juergen Kosel <juergen.kosel@gmx.de>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/pci/opti621.c | 15 ++-------------
+ 1 file changed, 2 insertions(+), 13 deletions(-)
+
+--- a/drivers/ide/pci/opti621.c
++++ b/drivers/ide/pci/opti621.c
+@@ -103,18 +103,6 @@
+ * address: 50 ns, data: 50 ns, recovery: 100 ns.
+ */
+
+-/* #define READ_PREFETCH 0 */
+-/* Uncomment for disable read prefetch.
+- * There is some readprefetch capatibility in hdparm,
+- * but when I type hdparm -P 1 /dev/hda, I got errors
+- * and till reset drive is inaccessible.
+- * This (hw) read prefetch is safe on my drive.
+- */
+-
+-#ifndef READ_PREFETCH
+-#define READ_PREFETCH 0x40 /* read prefetch is enabled */
+-#endif /* else read prefetch is disabled */
+-
+ #define READ_REG 0 /* index of Read cycle timing register */
+ #define WRITE_REG 1 /* index of Write cycle timing register */
+ #define CNTRL_REG 3 /* index of Control register */
+@@ -260,7 +248,8 @@ static void opti621_set_pio_mode(ide_dri
+
+ cycle1 = ((first.data_time-1)<<4) | (first.recovery_time-2);
+ cycle2 = ((second.data_time-1)<<4) | (second.recovery_time-2);
+- misc = READ_PREFETCH | ((ax-1)<<4) | ((drdy-2)<<1);
++
++ misc = ((ax - 1) << 4) | ((drdy - 2) << 1);
+
+ #ifdef OPTI621_DEBUG
+ printk("%s: master: address: %d, data: %d, "
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jun 18 14:56:42 2008
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Date: Wed, 18 Jun 2008 23:56:06 +0200
+Subject: opti621: remove DMA support
+To: stable@kernel.org
+Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>, Juergen Kosel <juergen.kosel@gmx.de>
+Message-ID: <200806182356.06906.bzolnier@gmail.com>
+Content-Disposition: inline
+
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+
+commit f361037631ba547ea88adf8d2359d810c1b2605a upstream
+
+These controllers don't support DMA.
+
+Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code.
+
+Tested-by: Juergen Kosel <juergen.kosel@gmx.de>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/pci/opti621.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/ide/pci/opti621.c
++++ b/drivers/ide/pci/opti621.c
+@@ -324,20 +324,16 @@ static const struct ide_port_info opti62
+ .name = "OPTI621",
+ .init_hwif = init_hwif_opti621,
+ .enablebits = {{0x45,0x80,0x00}, {0x40,0x08,0x00}},
+- .host_flags = IDE_HFLAG_TRUST_BIOS_FOR_DMA |
++ .host_flags = IDE_HFLAG_NO_DMA |
+ IDE_HFLAG_BOOTABLE,
+ .pio_mask = ATA_PIO3,
+- .swdma_mask = ATA_SWDMA2,
+- .mwdma_mask = ATA_MWDMA2,
+ },{ /* 1 */
+ .name = "OPTI621X",
+ .init_hwif = init_hwif_opti621,
+ .enablebits = {{0x45,0x80,0x00}, {0x40,0x08,0x00}},
+- .host_flags = IDE_HFLAG_TRUST_BIOS_FOR_DMA |
++ .host_flags = IDE_HFLAG_NO_DMA |
+ IDE_HFLAG_BOOTABLE,
+ .pio_mask = ATA_PIO3,
+- .swdma_mask = ATA_SWDMA2,
+- .mwdma_mask = ATA_MWDMA2,
+ }
+ };
+
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jun 18 16:15:38 2008
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Wed, 18 Jun 2008 23:15:14 GMT
+Subject: SCSI: sr: fix corrupt CD data after media change and delay
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200806182315.m5INFEvO031323@hera.kernel.org>
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit: d1daeabf0da5bfa1943272ce508e2ba785730bf0 upstream
+
+Reported-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
+
+If you delay 30s or more before mounting a CD after inserting it then
+the kernel has the wrong value for the CD size.
+
+http://marc.info/?t=121276133000001
+
+The problem is in sr_test_unit_ready(): the function eats unit
+attentions without adjusting the sdev->changed status. This means
+that when the CD signals changed media via unit attention, we can
+ignore it. Fix by making sr_test_unit_ready() adjust the changed
+status.
+
+Reported-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
+Tested-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -178,6 +178,9 @@ int sr_test_unit_ready(struct scsi_devic
+ the_result = scsi_execute_req(sdev, cmd, DMA_NONE, NULL,
+ 0, sshdr, SR_TIMEOUT,
+ retries--);
++ if (scsi_sense_valid(sshdr) &&
++ sshdr->sense_key == UNIT_ATTENTION)
++ sdev->changed = 1;
+
+ } while (retries > 0 &&
+ (!scsi_status_is_good(the_result) ||
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jun 18 17:11:17 2008
+From: Mike Christie <michaelc@cs.wisc.edu>
+Date: Wed, 18 Jun 2008 18:31:44 -0500
+Subject: scsi_host regression: fix scsi host leak
+To: stable@kernel.org
+Message-ID: <1213831905.3515.102.camel@localhost.localdomain>
+
+From: Mike Christie <michaelc@cs.wisc.edu>
+
+The patch is upstream as commit 3ed7897242b7efe977f3a8d06d4e5a4ebe28b10e
+
+A different backport is necessary because of the class_device to device
+conversion post 2.6.25.
+
+
+commit 9c7701088a61cc0cf8a6e1c68d1e74e3cc2ee0b7
+Author: Dave Young <hidave.darkstar@gmail.com>
+Date: Tue Jan 22 14:01:34 2008 +0800
+
+ scsi: use class iteration api
+
+Isn't a correct replacement for the original hand rolled host
+lookup. The problem is that class_find_child would get a reference to
+the host's class device which is never released. Since the host class
+device holds a reference to the host gendev, the host can never be
+freed.
+
+In 2.6.25 we started using class_find_device, and this function also
+gets a reference to the device, so we end up with an extra ref
+and the host will not get released.
+
+This patch adds a class_put_device to balance the class_find_device()
+get. I kept the scsi_host_get in scsi_host_lookup, because the target
+layer is using scsi_host_lookup and it looks like it needs the SHOST_DEL
+check.
+
+Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/scsi/hosts.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -455,9 +455,10 @@ struct Scsi_Host *scsi_host_lookup(unsig
+ struct Scsi_Host *shost = ERR_PTR(-ENXIO);
+
+ cdev = class_find_child(&shost_class, &hostnum, __scsi_host_match);
+- if (cdev)
++ if (cdev) {
+ shost = scsi_host_get(class_to_shost(cdev));
+-
++ class_device_put(cdev);
++ }
+ return shost;
+ }
+ EXPORT_SYMBOL(scsi_host_lookup);
x86-64-fix-bytes-left-to-copy-return-value-for-copy_from_user.patch
fix-tty-speed-handling-on-8250.patch
+opti621-disable-read-prefetch.patch
+opti621-remove-dma-support.patch
+virtio_net-fix-skb-csum_start-computation.patch
+b43-fix-noise-calculation-warn_on.patch
+b43-fix-possible-null-pointer-dereference-in-dma-code.patch
+scsi_host-regression-fix-scsi-host-leak.patch
+acpica-ignore-acpi-table-signature-for-load-operator.patch
+scsi-sr-fix-corrupt-cd-data-after-media-change-and-delay.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jun 15 22:10:40 2008
+From: Mark McLoughlin <markmc@redhat.com>
+Date: Mon, 16 Jun 2008 14:41:41 +1000
+Subject: virtio_net: Fix skb->csum_start computation
+To: stable@kernel.org
+Cc: virtualization@lists.linux-foundation.org
+Message-ID: <200806161441.41993.rusty@rustcorp.com.au>
+Content-Disposition: inline
+
+
+From: Mark McLoughlin <markmc@redhat.com>
+
+commit 23cde76d801246a702e7a84c3fe3d655b35c89a1 upstream.
+
+hdr->csum_start is the offset from the start of the ethernet
+header to the transport layer checksum field. skb->csum_start
+is the offset from skb->head.
+
+skb_partial_csum_set() assumes that skb->data points to the
+ethernet header - i.e. it computes skb->csum_start by adding
+the headroom to hdr->csum_start.
+
+Since eth_type_trans() skb_pull()s the ethernet header,
+skb_partial_csum_set() should be called before
+eth_type_trans().
+
+(Without this patch, GSO packets from a guest to the world outside the
+host are corrupted).
+
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/virtio_net.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -83,9 +83,7 @@ static void receive_skb(struct net_devic
+ BUG_ON(len > MAX_PACKET_LEN);
+
+ skb_trim(skb, len);
+- skb->protocol = eth_type_trans(skb, dev);
+- pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
+- ntohs(skb->protocol), skb->len, skb->pkt_type);
++
+ dev->stats.rx_bytes += skb->len;
+ dev->stats.rx_packets++;
+
+@@ -95,6 +93,10 @@ static void receive_skb(struct net_devic
+ goto frame_err;
+ }
+
++ skb->protocol = eth_type_trans(skb, dev);
++ pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
++ ntohs(skb->protocol), skb->len, skb->pkt_type);
++
+ if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ pr_debug("GSO!\n");
+ switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
