--- /dev/null
+From jejb@kernel.org Wed Sep 3 08:05:27 2008
+From: Clemens Ladisch <clemens@ladisch.de>
+From: James Bottomley <jejb@kernel.org>
+Date: Tue, 26 Aug 2008 18:05:03 GMT
+Subject: ALSA: oxygen: prevent muting of nonexistent AC97 controls
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808261805.m7QI53xf028143@hera.kernel.org>
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 3d839e5b87a70effc629c1cdbf77d837ef141919 upstream
+
+Date: Tue, 26 Aug 2008 11:06:26 +0200
+Subject: ALSA: oxygen: prevent muting of nonexistent AC97 controls
+
+The Xonar DX does not have CD Capture controls, so we have to check that
+a control actually exists before muting it.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/oxygen_mixer.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/oxygen/oxygen_mixer.c
++++ b/sound/pci/oxygen/oxygen_mixer.c
+@@ -512,9 +512,12 @@ static int ac97_switch_get(struct snd_kc
+
+ static void mute_ac97_ctl(struct oxygen *chip, unsigned int control)
+ {
+- unsigned int priv_idx = chip->controls[control]->private_value & 0xff;
++ unsigned int priv_idx;
+ u16 value;
+
++ if (!chip->controls[control])
++ return;
++ priv_idx = chip->controls[control]->private_value & 0xff;
+ value = oxygen_read_ac97(chip, 0, priv_idx);
+ if (!(value & 0x8000)) {
+ oxygen_write_ac97(chip, 0, priv_idx, value | 0x8000);
--- /dev/null
+From jejb@kernel.org Wed Sep 3 08:09:54 2008
+From: Jay Cliburn <jacliburn@bellsouth.net>
+Date: Thu, 28 Aug 2008 19:40:05 GMT
+Subject: atl1: disable TSO by default
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808281940.m7SJe5F0029552@hera.kernel.org>
+
+From: Jay Cliburn <jacliburn@bellsouth.net>
+
+commit 82c26a9d117f0178b8c1b33429014b6d99c470f6 upstream
+
+The atl1 driver is causing stalled connections and file corruption
+whenever TSO is enabled. Two examples are here:
+
+http://lkml.org/lkml/2008/7/15/325
+http://lkml.org/lkml/2008/8/18/543
+
+Disable TSO by default until we can determine the source of the
+problem.
+
+Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/atlx/atl1.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/atlx/atl1.c
++++ b/drivers/net/atlx/atl1.c
+@@ -3019,7 +3019,6 @@ static int __devinit atl1_probe(struct p
+ netdev->features = NETIF_F_HW_CSUM;
+ netdev->features |= NETIF_F_SG;
+ netdev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX);
+- netdev->features |= NETIF_F_TSO;
+ netdev->features |= NETIF_F_LLTX;
+
+ /*
--- /dev/null
+From jejb@kernel.org Wed Sep 3 08:06:36 2008
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Date: Wed, 27 Aug 2008 22:25:36 GMT
+Subject: bio: fix __bio_copy_iov() handling of bio->bv_len
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808272225.m7RMPaO2004941@hera.kernel.org>
+
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+
+commit aefcc28a3a63ac33a298777aa50ba43641c75241 upstream
+
+The commit c5dec1c3034f1ae3503efbf641ff3b0273b64797 introduced
+__bio_copy_iov() to add bounce support to blk_rq_map_user_iov.
+
+__bio_copy_iov() uses bio->bv_len to copy data for READ commands after
+the completion but it doesn't work with a request that partially
+completed. SCSI always completes a PC request as a whole but seems
+some don't.
+
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/bio.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -486,8 +486,8 @@ static struct bio_map_data *bio_alloc_ma
+ return NULL;
+ }
+
+-static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count,
+- int uncopy)
++static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
++ struct sg_iovec *iov, int iov_count, int uncopy)
+ {
+ int ret = 0, i;
+ struct bio_vec *bvec;
+@@ -497,7 +497,7 @@ static int __bio_copy_iov(struct bio *bi
+
+ __bio_for_each_segment(bvec, bio, i, 0) {
+ char *bv_addr = page_address(bvec->bv_page);
+- unsigned int bv_len = bvec->bv_len;
++ unsigned int bv_len = iovecs[i].bv_len;
+
+ while (bv_len && iov_idx < iov_count) {
+ unsigned int bytes;
+@@ -549,7 +549,7 @@ int bio_uncopy_user(struct bio *bio)
+ struct bio_map_data *bmd = bio->bi_private;
+ int ret;
+
+- ret = __bio_copy_iov(bio, bmd->sgvecs, bmd->nr_sgvecs, 1);
++ ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs, bmd->nr_sgvecs, 1);
+
+ bio_free_map_data(bmd);
+ bio_put(bio);
+@@ -628,7 +628,7 @@ struct bio *bio_copy_user_iov(struct req
+ * success
+ */
+ if (!write_to_vm) {
+- ret = __bio_copy_iov(bio, iov, iov_count, 0);
++ ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0);
+ if (ret)
+ goto cleanup;
+ }
--- /dev/null
+From jejb@kernel.org Wed Sep 3 08:07:27 2008
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Date: Wed, 27 Aug 2008 22:25:47 GMT
+Subject: bio: fix bio_copy_kern() handling of bio->bv_len
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808272225.m7RMPlfB004994@hera.kernel.org>
+
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+
+commit 76029ff37f31dad64641489c610d98955217bb68 upstream
+
+The commit 68154e90c9d1492d570671ae181d9a8f8530da55 introduced
+bio_copy_kern() to add bounce support to blk_rq_map_kern.
+
+bio_copy_kern() uses bio->bv_len to copy data for READ commands after
+the completion but it doesn't work with a request that partially
+completed. SCSI always completes a PC request as a whole but seems
+some don't.
+
+This patch fixes bio_copy_kern to handle the above case. As
+bio_copy_user does, bio_copy_kern uses struct bio_map_data to store
+struct bio_vec.
+
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Reported-by: Nix <nix@esperi.org.uk>
+Tested-by: Nix <nix@esperi.org.uk>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/bio.c | 38 ++++++++++++++++++++++++++++----------
+ 1 file changed, 28 insertions(+), 10 deletions(-)
+
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -464,20 +464,21 @@ static void bio_free_map_data(struct bio
+ kfree(bmd);
+ }
+
+-static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count)
++static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count,
++ gfp_t gfp_mask)
+ {
+- struct bio_map_data *bmd = kmalloc(sizeof(*bmd), GFP_KERNEL);
++ struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask);
+
+ if (!bmd)
+ return NULL;
+
+- bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, GFP_KERNEL);
++ bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, gfp_mask);
+ if (!bmd->iovecs) {
+ kfree(bmd);
+ return NULL;
+ }
+
+- bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, GFP_KERNEL);
++ bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, gfp_mask);
+ if (bmd->sgvecs)
+ return bmd;
+
+@@ -591,7 +592,7 @@ struct bio *bio_copy_user_iov(struct req
+ len += iov[i].iov_len;
+ }
+
+- bmd = bio_alloc_map_data(nr_pages, iov_count);
++ bmd = bio_alloc_map_data(nr_pages, iov_count, GFP_KERNEL);
+ if (!bmd)
+ return ERR_PTR(-ENOMEM);
+
+@@ -941,19 +942,22 @@ static void bio_copy_kern_endio(struct b
+ {
+ struct bio_vec *bvec;
+ const int read = bio_data_dir(bio) == READ;
+- char *p = bio->bi_private;
++ struct bio_map_data *bmd = bio->bi_private;
+ int i;
++ char *p = bmd->sgvecs[0].iov_base;
+
+ __bio_for_each_segment(bvec, bio, i, 0) {
+ char *addr = page_address(bvec->bv_page);
++ int len = bmd->iovecs[i].bv_len;
+
+ if (read && !err)
+- memcpy(p, addr, bvec->bv_len);
++ memcpy(p, addr, len);
+
+ __free_page(bvec->bv_page);
+- p += bvec->bv_len;
++ p += len;
+ }
+
++ bio_free_map_data(bmd);
+ bio_put(bio);
+ }
+
+@@ -977,11 +981,21 @@ struct bio *bio_copy_kern(struct request
+ const int nr_pages = end - start;
+ struct bio *bio;
+ struct bio_vec *bvec;
++ struct bio_map_data *bmd;
+ int i, ret;
++ struct sg_iovec iov;
+
++ iov.iov_base = data;
++ iov.iov_len = len;
++
++ bmd = bio_alloc_map_data(nr_pages, 1, gfp_mask);
++ if (!bmd)
++ return ERR_PTR(-ENOMEM);
++
++ ret = -ENOMEM;
+ bio = bio_alloc(gfp_mask, nr_pages);
+ if (!bio)
+- return ERR_PTR(-ENOMEM);
++ goto out_bmd;
+
+ while (len) {
+ struct page *page;
+@@ -1015,14 +1029,18 @@ struct bio *bio_copy_kern(struct request
+ }
+ }
+
+- bio->bi_private = data;
++ bio->bi_private = bmd;
+ bio->bi_end_io = bio_copy_kern_endio;
++
++ bio_set_map_data(bmd, bio, &iov, 1);
+ return bio;
+ cleanup:
+ bio_for_each_segment(bvec, bio, i)
+ __free_page(bvec->bv_page);
+
+ bio_put(bio);
++out_bmd:
++ bio_free_map_data(bmd);
+
+ return ERR_PTR(ret);
+ }
--- /dev/null
+From jejb@kernel.org Wed Sep 3 08:10:42 2008
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 2 Sep 2008 19:25:05 GMT
+Subject: cifs: fix O_APPEND on directio mounts
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809021925.m82JP5Xb008422@hera.kernel.org>
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 838726c4756813576078203eb7e1e219db0da870 upstream
+
+The direct I/O write codepath for CIFS is done through
+cifs_user_write(). That function does not currently call
+generic_write_checks() so the file position isn't being properly set
+when the file is opened with O_APPEND. It's also not doing the other
+"normal" checks that should be done for a write call.
+
+The problem is currently that when you open a file with O_APPEND on a
+mount with the directio mount option, the file position is set to the
+beginning of the file. This makes any subsequent writes clobber the data
+in the file starting at the beginning.
+
+This seems to fix the problem in cursory testing. It is, however
+important to note that NFS disallows the combination of
+(O_DIRECT|O_APPEND). If my understanding is correct, the concern is
+races with multiple clients appending to a file clobbering each others'
+data. Since the write model for CIFS and NFS is pretty similar in this
+regard, CIFS is probably subject to the same sort of races. What's
+unclear to me is why this is a particular problem with O_DIRECT and not
+with buffered writes...
+
+Regardless, disallowing O_APPEND on an entire mount is probably not
+reasonable, so we'll probably just have to deal with it and reevaluate
+this flag combination when we get proper support for O_DIRECT. In the
+meantime this patch at least fixes the existing problem.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/file.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -832,6 +832,10 @@ ssize_t cifs_user_write(struct file *fil
+ return -EBADF;
+ open_file = (struct cifsFileInfo *) file->private_data;
+
++ rc = generic_write_checks(file, poffset, &write_size, 0);
++ if (rc)
++ return rc;
++
+ xid = GetXid();
+
+ if (*poffset > file->f_path.dentry->d_inode->i_size)
--- /dev/null
+From jejb@kernel.org Wed Sep 3 08:08:26 2008
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+Date: Thu, 28 Aug 2008 19:40:03 GMT
+Subject: forcedeth: fix checksum flag
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808281940.m7SJe3SO029532@hera.kernel.org>
+
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+
+commit edcfe5f7e307846e578fb88d69fa27051fded0ab upstream
+
+Fix the checksum feature advertised in device flags. The hardware support
+TCP/UDP over IPv4 and TCP/UDP over IPv6 (without IPv6 extension headers).
+However, the kernel feature flags do not distinguish IPv6 with/without
+extension headers.
+
+Therefore, the driver needs to use NETIF_F_IP_CSUM instead of
+NETIF_F_HW_CSUM since the latter includes all IPv6 packets.
+
+A future patch can be created to check for extension headers and perform
+software checksum calculation.
+
+Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com>
+Cc: Jeff Garzik <jgarzik@pobox.com>
+Cc: Manfred Spraul <manfred@colorfullife.com
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -5420,7 +5420,7 @@ static int __devinit nv_probe(struct pci
+ if (id->driver_data & DEV_HAS_CHECKSUM) {
+ np->rx_csum = 1;
+ np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK;
+- dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
++ dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
+ dev->features |= NETIF_F_TSO;
+ }
+
+@@ -5728,7 +5728,7 @@ static int __devinit nv_probe(struct pci
+
+ dev_printk(KERN_INFO, &pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n",
+ dev->features & NETIF_F_HIGHDMA ? "highdma " : "",
+- dev->features & (NETIF_F_HW_CSUM | NETIF_F_SG) ?
++ dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ?
+ "csum " : "",
+ dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ?
+ "vlan " : "",
--- /dev/null
+From jejb@kernel.org Wed Sep 3 08:04:53 2008
+From: Stefan Weinhuber <wein@de.ibm.com>
+Date: Fri, 22 Aug 2008 17:40:08 GMT
+Subject: S390 dasd: fix data size for PSF/PRSSD command
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808221740.m7MHe8tp013741@hera.kernel.org>
+
+From: Stefan Weinhuber <wein@de.ibm.com>
+
+commit 49fd38bdaa96f093fcad3176a781a4d0de8f8602 upstream
+
+The Perform Subsystem Function/Prepare for Read Subsystem Data
+command requires 12 bytes of parameter data, but the respective data
+structure dasd_psf_prssd_data has a length of 16 bytes.
+Current storage servers ignore the obsolete bytes, but older models
+fail to execute the command and report an incorrect length error.
+This causes the device initilization for these devices to fail.
+To fix this problem we need to correct the dasd_psf_prssd_data
+structure and shorten it to the correct length.
+
+Reported-by: Ivan Warren <ivan@vmfacility.fr>
+Reviewed-by: Ivan Warren <ivan@vmfacility.fr>
+Tested-by: Ivan Warren <ivan@vmfacility.fr>
+Signed-off-by: Stefan Weinhuber <wein@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/s390/block/dasd_eckd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/block/dasd_eckd.h
++++ b/drivers/s390/block/dasd_eckd.h
+@@ -379,7 +379,7 @@ struct dasd_psf_prssd_data {
+ unsigned char flags;
+ unsigned char reserved[4];
+ unsigned char suborder;
+- unsigned char varies[9];
++ unsigned char varies[5];
+ } __attribute__ ((packed));
+
+ /*
usb-cdc-acm-don-t-unlock-acm-mutex-on-error-path.patch
x86-work-around-mtrr-mask-setting.patch
x86-fix-kernel-won-t-boot-on-a-cyrix-mediagxm.patch
+s390-dasd-fix-data-size-for-psf-prssd-command.patch
+alsa-oxygen-prevent-muting-of-nonexistent-ac97-controls.patch
+bio-fix-__bio_copy_iov-handling-of-bio-bv_len.patch
+bio-fix-bio_copy_kern-handling-of-bio-bv_len.patch
+forcedeth-fix-checksum-flag.patch
+atl1-disable-tso-by-default.patch
+cifs-fix-o_append-on-directio-mounts.patch