--- /dev/null
+From jejb@kernel.org Wed Oct 15 14:41:06 2008
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 11 Oct 2008 16:55:21 GMT
+Subject: b43legacy: Fix failure in rate-adjustment mechanism
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810111655.m9BGtL1M013741@hera.kernel.org>
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit c6a2afdacccd56cc0be8e9a7977f0ed1509069f6 upstream
+Date: Sat, 6 Sep 2008 16:51:22 -0500
+Subject: b43legacy: Fix failure in rate-adjustment mechanism
+
+A coding error present since b43legacy was incorporated into the
+kernel has prevented the driver from using the rate-setting mechanism
+of mac80211. The driver has been forced to remain at a 1 Mb/s rate.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43legacy/xmit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/b43legacy/xmit.c
++++ b/drivers/net/wireless/b43legacy/xmit.c
+@@ -626,7 +626,7 @@ void b43legacy_handle_hwtxstatus(struct
+ tmp = hw->count;
+ status.frame_count = (tmp >> 4);
+ status.rts_count = (tmp & 0x0F);
+- tmp = hw->flags;
++ tmp = hw->flags << 1;
+ status.supp_reason = ((tmp & 0x1C) >> 2);
+ status.pm_indicated = !!(tmp & 0x80);
+ status.intermediate = !!(tmp & 0x40);
--- /dev/null
+From jejb@kernel.org Wed Oct 15 14:39:45 2008
+From: Dan Williams <dcbw@redhat.com>
+Date: Sat, 11 Oct 2008 16:55:19 GMT
+Subject: libertas: clear current command on card removal
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810111655.m9BGtJ8b013700@hera.kernel.org>
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit 71b35f3abeb8f7f7e0afd7573424540cc5aae2d5 upstream
+
+If certain commands were in-flight when the card was pulled or the
+driver rmmod-ed, cleanup would block on the work queue stopping, but the
+work queue was in turn blocked on the current command being canceled,
+which didn't happen. Fix that.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/main.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/libertas/main.c
++++ b/drivers/net/wireless/libertas/main.c
+@@ -1196,7 +1196,13 @@ void lbs_remove_card(struct lbs_private
+ cancel_delayed_work_sync(&priv->scan_work);
+ cancel_delayed_work_sync(&priv->assoc_work);
+ cancel_work_sync(&priv->mcast_work);
++
++ /* worker thread destruction blocks on the in-flight command which
++ * should have been cleared already in lbs_stop_card().
++ */
++ lbs_deb_main("destroying worker thread\n");
+ destroy_workqueue(priv->work_thread);
++ lbs_deb_main("done destroying worker thread\n");
+
+ if (priv->psmode == LBS802_11POWERMODEMAX_PSP) {
+ priv->psmode = LBS802_11POWERMODECAM;
+@@ -1314,14 +1320,26 @@ void lbs_stop_card(struct lbs_private *p
+ device_remove_file(&dev->dev, &dev_attr_lbs_rtap);
+ }
+
+- /* Flush pending command nodes */
++ /* Delete the timeout of the currently processing command */
+ del_timer_sync(&priv->command_timer);
++
++ /* Flush pending command nodes */
+ spin_lock_irqsave(&priv->driver_lock, flags);
++ lbs_deb_main("clearing pending commands\n");
+ list_for_each_entry(cmdnode, &priv->cmdpendingq, list) {
+ cmdnode->result = -ENOENT;
+ cmdnode->cmdwaitqwoken = 1;
+ wake_up_interruptible(&cmdnode->cmdwait_q);
+ }
++
++ /* Flush the command the card is currently processing */
++ if (priv->cur_cmd) {
++ lbs_deb_main("clearing current command\n");
++ priv->cur_cmd->result = -ENOENT;
++ priv->cur_cmd->cmdwaitqwoken = 1;
++ wake_up_interruptible(&priv->cur_cmd->cmdwait_q);
++ }
++ lbs_deb_main("done clearing commands\n");
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+
+ unregister_netdev(dev);
tty-termios-locking-sort-out-real_tty-confusions-and-lock-reads.patch
cifs-make-sure-we-have-the-right-resume-info-before-calling-cifsfindnext.patch
rfkill-update-leds-for-all-state-changes.patch
+libertas-clear-current-command-on-card-removal.patch
+b43legacy-fix-failure-in-rate-adjustment-mechanism.patch
+x86-early_ioremap-fix-fencepost-error.patch
+x86-sb450-skip-irq0-override-if-it-is-not-routed-to-int2-of-ioapic.patch
+x86-improve-up-kernel-when-cpu-hotplug-and-smp-is-enabled.patch
+sky2-fix-wol-regression.patch
--- /dev/null
+From 9d731d77c9794bb0a264f58d35949a1ab6dcc41c Mon Sep 17 00:00:00 2001
+From: Rafael J. Wysocki <rjw@sisk.pl>
+Date: Sun, 12 Oct 2008 20:59:48 -0700
+Subject: sky2: Fix WOL regression
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 9d731d77c9794bb0a264f58d35949a1ab6dcc41c upstream
+
+Since dev->power.should_wakeup bit is used by the PCI core to
+decide whether the device should wake up the system from sleep
+states, set/unset this bit whenever WOL is enabled/disabled using
+sky2_set_wol().
+
+Remove an open-coded reference to the standard PCI PM registers that
+is not used any more.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Cc: Tino Keitel <tino.keitel@gmx.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -3034,7 +3034,8 @@ static int sky2_set_wol(struct net_devic
+ struct sky2_port *sky2 = netdev_priv(dev);
+ struct sky2_hw *hw = sky2->hw;
+
+- if (wol->wolopts & ~sky2_wol_supported(sky2->hw))
++ if ((wol->wolopts & ~sky2_wol_supported(sky2->hw))
++ || !device_can_wakeup(&hw->pdev->dev))
+ return -EOPNOTSUPP;
+
+ sky2->wol = wol->wolopts;
+@@ -3045,6 +3046,8 @@ static int sky2_set_wol(struct net_devic
+ sky2_write32(hw, B0_CTST, sky2->wol
+ ? Y2_HW_WOL_ON : Y2_HW_WOL_OFF);
+
++ device_set_wakeup_enable(&hw->pdev->dev, sky2->wol);
++
+ if (!netif_running(dev))
+ sky2_wol_init(sky2);
+ return 0;
+@@ -4166,18 +4169,6 @@ static int __devinit sky2_test_msi(struc
+ return err;
+ }
+
+-static int __devinit pci_wake_enabled(struct pci_dev *dev)
+-{
+- int pm = pci_find_capability(dev, PCI_CAP_ID_PM);
+- u16 value;
+-
+- if (!pm)
+- return 0;
+- if (pci_read_config_word(dev, pm + PCI_PM_CTRL, &value))
+- return 0;
+- return value & PCI_PM_CTRL_PME_ENABLE;
+-}
+-
+ /* This driver supports yukon2 chipset only */
+ static const char *sky2_name(u8 chipid, char *buf, int sz)
+ {
+@@ -4238,7 +4229,7 @@ static int __devinit sky2_probe(struct p
+ }
+ }
+
+- wol_default = pci_wake_enabled(pdev) ? WAKE_MAGIC : 0;
++ wol_default = device_may_wakeup(&pdev->dev) ? WAKE_MAGIC : 0;
+
+ err = -ENOMEM;
+ hw = kzalloc(sizeof(*hw), GFP_KERNEL);
--- /dev/null
+From jejb@kernel.org Wed Oct 15 14:42:49 2008
+From: Alan Cox <alan@redhat.com>
+Date: Sun, 12 Oct 2008 19:40:08 GMT
+Subject: x86, early_ioremap: fix fencepost error
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810121940.m9CJe8k3024539@hera.kernel.org>
+
+From: Alan Cox <alan@redhat.com>
+
+commit c613ec1a7ff3714da11c7c48a13bab03beb5c376 upstream
+
+The x86 implementation of early_ioremap has an off by one error. If we get
+an object which ends on the first byte of a page we undermap by one page and
+this causes a crash on boot with the ASUS P5QL whose DMI table happens to fit
+this alignment.
+
+The size computation is currently
+
+ last_addr = phys_addr + size - 1;
+ npages = (PAGE_ALIGN(last_addr) - phys_addr)
+
+(Consider a request for 1 byte at alignment 0...)
+
+Closes #11693
+
+Debugging work by Ian Campbell/Felix Geyer
+
+Signed-off-by: Alan Cox <alan@rehat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/ioremap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -595,7 +595,7 @@ void __init *early_ioremap(unsigned long
+ */
+ offset = phys_addr & ~PAGE_MASK;
+ phys_addr &= PAGE_MASK;
+- size = PAGE_ALIGN(last_addr) - phys_addr;
++ size = PAGE_ALIGN(last_addr + 1) - phys_addr;
+
+ /*
+ * Mappings have to fit in the FIX_BTMAP area.
--- /dev/null
+From jejb@kernel.org Wed Oct 15 14:45:08 2008
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 13 Oct 2008 17:15:23 GMT
+Subject: x86: improve UP kernel when CPU-hotplug and SMP is enabled
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810131715.m9DHFNoT025122@hera.kernel.org>
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 649c6653fa94ec8f3ea32b19c97b790ec4e8e4ac upstream
+
+num_possible_cpus() can be > 1 when disabled CPUs have been accounted.
+
+Disabled CPUs are not in the cpu_present_map, so we can use
+num_present_cpus() as a safe indicator to switch to UP alternatives.
+
+Reported-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/alternative.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/alternative.c
++++ b/arch/x86/kernel/alternative.c
+@@ -444,7 +444,7 @@ void __init alternative_instructions(voi
+ _text, _etext);
+
+ /* Only switch to UP mode if we don't immediately boot others */
+- if (num_possible_cpus() == 1 || setup_max_cpus <= 1)
++ if (num_present_cpus() == 1 || setup_max_cpus <= 1)
+ alternatives_smp_switch(0);
+ }
+ #endif
--- /dev/null
+From jejb@kernel.org Wed Oct 15 14:44:01 2008
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Sun, 12 Oct 2008 19:40:11 GMT
+Subject: x86: SB450: skip IRQ0 override if it is not routed to INT2 of IOAPIC
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810121940.m9CJeBqq024591@hera.kernel.org>
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 33fb0e4eb53f16af312f9698f974e2e64af39c12 upstream
+
+On some HP nx6... laptops (e.g. nx6325) BIOS reports an IRQ0 override
+but the SB450 chipset is configured such that timer interrupts goe to
+INT0 of IOAPIC.
+
+Check IRQ0 routing and if it is routed to INT0 of IOAPIC skip the
+timer override.
+
+[ This more generic PCI ID based quirk should alleviate the need for
+ dmi_ignore_irq0_timer_override DMI quirks. ]
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Acked-by: "Maciej W. Rozycki" <macro@linux-mips.org>
+Tested-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/early-quirks.c | 48 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -95,6 +95,52 @@ static void __init nvidia_bugs(int num,
+
+ }
+
++static u32 ati_ixp4x0_rev(int num, int slot, int func)
++{
++ u32 d;
++ u8 b;
++
++ b = read_pci_config_byte(num, slot, func, 0xac);
++ b &= ~(1<<5);
++ write_pci_config_byte(num, slot, func, 0xac, b);
++
++ d = read_pci_config(num, slot, func, 0x70);
++ d |= 1<<8;
++ write_pci_config(num, slot, func, 0x70, d);
++
++ d = read_pci_config(num, slot, func, 0x8);
++ d &= 0xff;
++ return d;
++}
++
++static void __init ati_bugs(int num, int slot, int func)
++{
++#if defined(CONFIG_ACPI) && defined (CONFIG_X86_IO_APIC)
++ u32 d;
++ u8 b;
++
++ if (acpi_use_timer_override)
++ return;
++
++ d = ati_ixp4x0_rev(num, slot, func);
++ if (d < 0x82)
++ acpi_skip_timer_override = 1;
++ else {
++ /* check for IRQ0 interrupt swap */
++ outb(0x72, 0xcd6); b = inb(0xcd7);
++ if (!(b & 0x2))
++ acpi_skip_timer_override = 1;
++ }
++
++ if (acpi_skip_timer_override) {
++ printk(KERN_INFO "SB4X0 revision 0x%x\n", d);
++ printk(KERN_INFO "Ignoring ACPI timer override.\n");
++ printk(KERN_INFO "If you got timer trouble "
++ "try acpi_use_timer_override\n");
++ }
++#endif
++}
++
+ #define QFLAG_APPLY_ONCE 0x1
+ #define QFLAG_APPLIED 0x2
+ #define QFLAG_DONE (QFLAG_APPLY_ONCE|QFLAG_APPLIED)
+@@ -114,6 +160,8 @@ static struct chipset early_qrk[] __init
+ PCI_CLASS_BRIDGE_PCI, PCI_ANY_ID, QFLAG_APPLY_ONCE, via_bugs },
+ { PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB,
+ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, fix_hypertransport_config },
++ { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_SMBUS,
++ PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs },
+ {}
+ };
+