[patch 00/54] 2.6.21-stable review

[patch 00/54] 2.6.21-stable review

[Chris Wright]

This is the start of the stable review cycle for the 2.6.21.5 release.
There are 54 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let us know.  If anyone is a maintainer of the proper subsystem, and
wants to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the
Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
to add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Sun Jun 10 07:20 UTC.
Anything received after that time might be too late.

thanks,

the -stable release team
-- 

[patch 01/54] i386: HPET, check if the counter works

[Chris Wright]

[-- Attachment #1: i386-hpet-check-if-the-counter-works.patch --]
[-- Type: text/plain, Size: 1499 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Thomas Gleixner <tglx@linutronix.de>

Some systems have a HPET which is not incrementing, which leads to a
complete hang. Detect it during HPET setup.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
[chrisw: again, this time with feeling ;-)  expected upstream soon]

 arch/i386/kernel/hpet.c |   24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/arch/i386/kernel/hpet.c
+++ linux-2.6.21.4/arch/i386/kernel/hpet.c
@@ -226,7 +226,8 @@ int __init hpet_enable(void)
 {
 	unsigned long id;
 	uint64_t hpet_freq;
-	u64 tmp;
+	u64 tmp, start, now;
+	cycle_t t1;
 
 	if (!is_hpet_capable())
 		return 0;
@@ -273,6 +274,27 @@ int __init hpet_enable(void)
 	/* Start the counter */
 	hpet_start_counter();
 
+	/* Verify whether hpet counter works */
+	t1 = read_hpet();
+	rdtscll(start);
+
+	/*
+	 * We don't know the TSC frequency yet, but waiting for
+	 * 200000 TSC cycles is safe:
+	 * 4 GHz == 50us
+	 * 1 GHz == 200us
+	 */
+	do {
+		rep_nop();
+		rdtscll(now);
+	} while ((now - start) < 200000UL);
+
+	if (t1 == read_hpet()) {
+		printk(KERN_WARNING
+		       "HPET counter not counting. HPET disabled\n");
+		goto out_nohpet;
+	}
+
 	/* Initialize and register HPET clocksource
 	 *
 	 * hpet period is in femto seconds per cycle

-- 

[patch 02/54] Ignore bogus ACPI info for offline CPUs

[Chris Wright]

[-- Attachment #1: ignore-bogus-acpi-info-for-offline-cpus.patch --]
[-- Type: text/plain, Size: 1467 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Thomas Gleixner <tglx@linutronix.de>

Booting a SMP kernel with maxcpus=1 on a SMP system leads to a hard
hang, because ACPI ignores the maxcpus setting and sends timer broadcast
info for the offline CPUs. This results in a stuck for ever call to
smp_call_function_single() on an offline CPU.

Ignore the bogus information and print a kernel error to remind ACPI
folks to fix it.

Affects 2.6.21 / 2.6.22-rc

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 kernel/time/tick-broadcast.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

--- linux-2.6.21.4.orig/kernel/time/tick-broadcast.c
+++ linux-2.6.21.4/kernel/time/tick-broadcast.c
@@ -243,11 +243,18 @@ void tick_broadcast_on_off(unsigned long
 {
 	int cpu = get_cpu();
 
-	if (cpu == *oncpu)
-		tick_do_broadcast_on_off(&reason);
-	else
-		smp_call_function_single(*oncpu, tick_do_broadcast_on_off,
-					 &reason, 1, 1);
+	if (!cpu_isset(*oncpu, cpu_online_map)) {
+		printk(KERN_ERR "tick-braodcast: ignoring broadcast for "
+		       "offline CPU #%d\n", *oncpu);
+	} else {
+
+		if (cpu == *oncpu)
+			tick_do_broadcast_on_off(&reason);
+		else
+			smp_call_function_single(*oncpu,
+						 tick_do_broadcast_on_off,
+						 &reason, 1, 1);
+	}
 	put_cpu();
 }
 

-- 

[patch 03/54] NOHZ: Rate limit the local softirq pending warning output

[Chris Wright]

[-- Attachment #1: nohz-rate-limit-the-local-softirq-pending-warning-output.patch --]
[-- Type: text/plain, Size: 1223 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Thomas Gleixner <tglx@linutronix.de>

The warning in the NOHZ code, which triggers when a CPU goes idle with
softirqs pending can fill up the logs quite quickly.  Rate limit the output
until we found the root cause of that problem.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 kernel/time/tick-sched.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/kernel/time/tick-sched.c
+++ linux-2.6.21.4/kernel/time/tick-sched.c
@@ -167,9 +167,15 @@ void tick_nohz_stop_sched_tick(void)
 		goto end;
 
 	cpu = smp_processor_id();
-	if (unlikely(local_softirq_pending()))
-		printk(KERN_ERR "NOHZ: local_softirq_pending %02x\n",
-		       local_softirq_pending());
+	if (unlikely(local_softirq_pending())) {
+		static int ratelimit;
+
+		if (ratelimit < 10) {
+			printk(KERN_ERR "NOHZ: local_softirq_pending %02x\n",
+			       local_softirq_pending());
+			ratelimit++;
+		}
+	}
 
 	now = ktime_get();
 	/*

-- 

[patch 04/54] i386: Fix K8/core2 oprofile on multiple CPUs

[Chris Wright]

[-- Attachment #1: i386-fix-k8-core2-oprofile-on-multiple-cpus.patch --]
[-- Type: text/plain, Size: 1633 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Andi Kleen <ak@suse.de>

Only try to allocate MSRs once instead of for every CPU.

This assumes the MSRs are the same on all CPUs which is currently
true. P4-HT is a special case for different SMT threads, but the code
always saves/restores all MSRs so it works identical.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/i386/oprofile/nmi_int.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/arch/i386/oprofile/nmi_int.c
+++ linux-2.6.21.4/arch/i386/oprofile/nmi_int.c
@@ -131,7 +131,6 @@ static void nmi_save_registers(void * du
 {
 	int cpu = smp_processor_id();
 	struct op_msrs * msrs = &cpu_msrs[cpu];
-	model->fill_in_addresses(msrs);
 	nmi_cpu_save_registers(msrs);
 }
 
@@ -195,6 +194,7 @@ static struct notifier_block profile_exc
 static int nmi_setup(void)
 {
 	int err=0;
+	int cpu;
 
 	if (!allocate_msrs())
 		return -ENOMEM;
@@ -207,6 +207,13 @@ static int nmi_setup(void)
 	/* We need to serialize save and setup for HT because the subset
 	 * of msrs are distinct for save and setup operations
 	 */
+
+	/* Assume saved/restored counters are the same on all CPUs */
+	model->fill_in_addresses(&cpu_msrs[0]);
+	for_each_possible_cpu (cpu) {
+		if (cpu != 0)
+			cpu_msrs[cpu] = cpu_msrs[0];
+	}
 	on_each_cpu(nmi_save_registers, NULL, 0, 1);
 	on_each_cpu(nmi_cpu_setup, NULL, 0, 1);
 	nmi_enabled = 1;

-- 

[patch 05/54] md: Avoid overflow in raid0 calculation with large components.

[Chris Wright]

[-- Attachment #1: md-avoid-overflow-in-raid0-calculation-with-large-components.patch --]
[-- Type: text/plain, Size: 1395 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: NeilBrown <neilb@suse.de>

If a raid0 has a component device larger than 4TB, and is accessed on
a 32bit machines, then as 'chunk' is unsigned lock,
   chunk << chunksize_bits
can overflow (this can be as high as the size of the device in KB).
chunk itself will not overflow (without triggering a BUG).

So change 'chunk' to be 'sector_t, and get rid of the 'BUG' as it becomes
impossible to hit.

Cc: "Jeff Zheng" <Jeff.Zheng@endace.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/md/raid0.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff .prev/drivers/md/raid0.c ./drivers/md/raid0.c
--- linux-2.6.21.4.orig/drivers/md/raid0.c
+++ linux-2.6.21.4/drivers/md/raid0.c
@@ -415,7 +415,7 @@ static int raid0_make_request (request_q
 	raid0_conf_t *conf = mddev_to_conf(mddev);
 	struct strip_zone *zone;
 	mdk_rdev_t *tmp_dev;
-	unsigned long chunk;
+	sector_t chunk;
 	sector_t block, rsect;
 	const int rw = bio_data_dir(bio);
 
@@ -470,7 +470,6 @@ static int raid0_make_request (request_q
 
 		sector_div(x, zone->nb_dev);
 		chunk = x;
-		BUG_ON(x != (sector_t)chunk);
 
 		x = block >> chunksize_bits;
 		tmp_dev = zone->dev[sector_div(x, zone->nb_dev)];

-- 

[patch 06/54] md: Dont write more than is required of the last page of a bitmap

[Chris Wright]

[-- Attachment #1: md-don-t-write-more-than-is-required-of-the-last-page-of-a-bitmap.patch --]
[-- Type: text/plain, Size: 2596 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: NeilBrown <neilb@suse.de>

It is possible that real data or metadata follows the bitmap
without full page alignment.
So limit the last write to be only the required number of bytes,
rounded up to the hard sector size of the device.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/md/bitmap.c         |   17 ++++++++++++-----
 include/linux/raid/bitmap.h |    1 +
 2 files changed, 13 insertions(+), 5 deletions(-)

diff .prev/drivers/md/bitmap.c ./drivers/md/bitmap.c
--- linux-2.6.21.4.orig/drivers/md/bitmap.c
+++ linux-2.6.21.4/drivers/md/bitmap.c
@@ -255,19 +255,25 @@ static struct page *read_sb_page(mddev_t
 
 }
 
-static int write_sb_page(mddev_t *mddev, long offset, struct page *page, int wait)
+static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 {
 	mdk_rdev_t *rdev;
 	struct list_head *tmp;
+	mddev_t *mddev = bitmap->mddev;
 
 	ITERATE_RDEV(mddev, rdev, tmp)
 		if (test_bit(In_sync, &rdev->flags)
-		    && !test_bit(Faulty, &rdev->flags))
+		    && !test_bit(Faulty, &rdev->flags)) {
+			int size = PAGE_SIZE;
+			if (page->index == bitmap->file_pages-1)
+				size = roundup(bitmap->last_page_size,
+					       bdev_hardsect_size(rdev->bdev));
 			md_super_write(mddev, rdev,
-				       (rdev->sb_offset<<1) + offset
+				       (rdev->sb_offset<<1) + bitmap->offset
 				       + page->index * (PAGE_SIZE/512),
-				       PAGE_SIZE,
+				       size,
 				       page);
+		}
 
 	if (wait)
 		md_super_wait(mddev);
@@ -282,7 +288,7 @@ static int write_page(struct bitmap *bit
 	struct buffer_head *bh;
 
 	if (bitmap->file == NULL)
-		return write_sb_page(bitmap->mddev, bitmap->offset, page, wait);
+		return write_sb_page(bitmap, page, wait);
 
 	bh = page_buffers(page);
 
@@ -923,6 +929,7 @@ static int bitmap_init_from_disk(struct 
 			}
 
 			bitmap->filemap[bitmap->file_pages++] = page;
+			bitmap->last_page_size = count;
 		}
 		paddr = kmap_atomic(page, KM_USER0);
 		if (bitmap->flags & BITMAP_HOSTENDIAN)
--- linux-2.6.21.4.orig/include/linux/raid/bitmap.h
+++ linux-2.6.21.4/include/linux/raid/bitmap.h
@@ -232,6 +232,7 @@ struct bitmap {
 	struct page **filemap; /* list of cache pages for the file */
 	unsigned long *filemap_attr; /* attributes associated w/ filemap pages */
 	unsigned long file_pages; /* number of pages in the file */
+	int last_page_size; /* bytes in the last page */
 
 	unsigned long flags;
 

-- 

[patch 07/54] fuse: fix mknod of regular file

[Chris Wright]

[-- Attachment #1: fuse-fix-mknod-of-regular-file.patch --]
[-- Type: text/plain, Size: 1050 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Miklos Szeredi <mszeredi@suse.cz>

The wrong lookup flag was tested in ->create() causing havoc (error or
Oops) when a regular file was created with mknod() in a fuse
filesystem.

Thanks to J. Cameijo Cerdeira for the report.

Kernels 2.6.18 onward are affected.  Please apply to -stable as well.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 fs/fuse/dir.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/fs/fuse/dir.c
+++ linux-2.6.21.4/fs/fuse/dir.c
@@ -485,7 +485,7 @@ static int fuse_mknod(struct inode *dir,
 static int fuse_create(struct inode *dir, struct dentry *entry, int mode,
 		       struct nameidata *nd)
 {
-	if (nd && (nd->flags & LOOKUP_CREATE)) {
+	if (nd && (nd->flags & LOOKUP_OPEN)) {
 		int err = fuse_create_open(dir, entry, mode, nd);
 		if (err != -ENOSYS)
 			return err;

-- 

[patch 08/54] make freezeable workqueues singlethread

[Chris Wright]

[-- Attachment #1: make-freezeable-workqueues-singlethread.patch --]
[-- Type: text/plain, Size: 1374 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Oleg Nesterov <oleg@tv-sign.ru>

It is a known fact that freezeable multithreaded workqueues doesn't like
CPU_DEAD. We keep them only for the incoming CPU-hotplug rework.

Sadly, we can't just kill create_freezeable_workqueue() right now, make
them singlethread.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Gautham R Shenoy <ego@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 include/linux/workqueue.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/include/linux/workqueue.h
+++ linux-2.6.21.4/include/linux/workqueue.h
@@ -162,7 +162,7 @@ extern struct workqueue_struct *__create
 						    int singlethread,
 						    int freezeable);
 #define create_workqueue(name) __create_workqueue((name), 0, 0)
-#define create_freezeable_workqueue(name) __create_workqueue((name), 0, 1)
+#define create_freezeable_workqueue(name) __create_workqueue((name), 1, 1)
 #define create_singlethread_workqueue(name) __create_workqueue((name), 1, 0)
 
 extern void destroy_workqueue(struct workqueue_struct *wq);

-- 

[patch 09/54] Prevent going idle with softirq pending

[Chris Wright]

[-- Attachment #1: prevent-going-idle-with-softirq-pending.patch --]
[-- Type: text/plain, Size: 1858 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Thomas Gleixner <tglx@linutronix.de>

 
The NOHZ patch contains a check for softirqs pending when a CPU goes 
idle. The BUG is unrelated to NOHZ, it just was made visible by the NOHZ 
patch. The BUG showed up mainly on P4 / hyperthreading enabled machines 
which lead the investigations into the wrong direction in the first 
place.  The real cause is in cond_resched_softirq():
 
cond_resched_softirq() is enabling softirqs without invoking the softirq 
daemon when softirqs are pending.  This leads to the warning message in 
the NOHZ idle code:
 
t1 runs softirq disabled code on CPU#0
interrupt happens, softirq is raised, but deferred (softirqs disabled)
t1 calls cond_resched_softirq()
	enables softirqs via _local_bh_enable()
	calls schedule()
t2 runs
t1 is migrated to CPU#1
t2 is done and invokes idle()
NOHZ detects the pending softirq
 
Fix: change _local_bh_enable() to local_bh_enable() so the softirq
daemon is invoked.
 
Thanks to Anant Nitya for debugging this with great patience !
 
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Anant Nitya <kernel@prachanda.info>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 kernel/sched.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- linux-2.6.21.4.orig/kernel/sched.c
+++ linux-2.6.21.4/kernel/sched.c
@@ -4545,9 +4545,7 @@ int __sched cond_resched_softirq(void)
 	BUG_ON(!in_softirq());
 
 	if (need_resched() && system_state == SYSTEM_RUNNING) {
-		raw_local_irq_disable();
-		_local_bh_enable();
-		raw_local_irq_enable();
+		local_bh_enable();
 		__cond_resched();
 		local_bh_disable();
 		return 1;

-- 

[patch 10/54] ALSA: hda-intel - Probe additional slots only if necessary

[Chris Wright]

[-- Attachment #1: alsa-hda-intel-probe-additional-slots-only-if-necessary.patch --]
[-- Type: text/plain, Size: 2006 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Takashi Iwai <tiwai@suse.de>

Probing the codec slots on ATI controller causes problems on some
devices like Acer laptops.  On these devices, reading from codec
slot 3 results in the communication failure with the codec chip.
Meanwhile, some laptops (e.g. Gateway) have the codec connection
only on slot 3, and probing this slot is mandatory for them.
The patch improves the probing robustness.  The additional slots
are now checked only when no codecs are found in the primary three
slots.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/hda_intel.c |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/sound/pci/hda/hda_intel.c
+++ linux-2.6.21.4/sound/pci/hda/hda_intel.c
@@ -198,6 +198,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO
 #define RIRB_INT_MASK		0x05
 
 /* STATESTS int mask: SD2,SD1,SD0 */
+#define AZX_MAX_CODECS		3
 #define STATESTS_INT_MASK	0x07
 
 /* SD_CTL bits */
@@ -991,7 +992,7 @@ static int __devinit azx_codec_create(st
 		return err;
 
 	codecs = 0;
-	for (c = 0; c < azx_max_codecs[chip->driver_type]; c++) {
+	for (c = 0; c < AZX_MAX_CODECS; c++) {
 		if ((chip->codec_mask & (1 << c)) & probe_mask) {
 			err = snd_hda_codec_new(chip->bus, c, NULL);
 			if (err < 0)
@@ -999,7 +1000,18 @@ static int __devinit azx_codec_create(st
 			codecs++;
 		}
 	}
-	if (! codecs) {
+	if (!codecs) {
+		/* probe additional slots if no codec is found */
+		for (; c < azx_max_codecs[chip->driver_type]; c++) {
+			if ((chip->codec_mask & (1 << c)) & probe_mask) {
+				err = snd_hda_codec_new(chip->bus, c, NULL);
+				if (err < 0)
+					continue;
+				codecs++;
+			}
+		}
+	}
+	if (!codecs) {
 		snd_printk(KERN_ERR SFX "no codecs initialized\n");
 		return -ENXIO;
 	}

-- 

[patch 11/54] ALSA: hda-intel - Fix detection of audio codec on Toshiba A100

[Chris Wright]

[-- Attachment #1: alsa-hda-intel-fix-detection-of-audio-codec-on-toshiba-a100.patch --]
[-- Type: text/plain, Size: 1793 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Takashi Iwai <tiwai@suse.de>

Some boards have the audio codec on slot #3 while the modem codec
on slot #0.  The driver should continue to probe the slots when
no audio codec is found.
This fixes the problem of no device on Toshiba A100 (and some other
ATI SB450 devices).

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/hda_intel.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- linux-2.6.21.4.orig/sound/pci/hda/hda_intel.c
+++ linux-2.6.21.4/sound/pci/hda/hda_intel.c
@@ -979,7 +979,7 @@ static unsigned int azx_max_codecs[] __d
 static int __devinit azx_codec_create(struct azx *chip, const char *model)
 {
 	struct hda_bus_template bus_temp;
-	int c, codecs, err;
+	int c, codecs, audio_codecs, err;
 
 	memset(&bus_temp, 0, sizeof(bus_temp));
 	bus_temp.private_data = chip;
@@ -991,16 +991,19 @@ static int __devinit azx_codec_create(st
 	if ((err = snd_hda_bus_new(chip->card, &bus_temp, &chip->bus)) < 0)
 		return err;
 
-	codecs = 0;
+	codecs = audio_codecs = 0;
 	for (c = 0; c < AZX_MAX_CODECS; c++) {
 		if ((chip->codec_mask & (1 << c)) & probe_mask) {
-			err = snd_hda_codec_new(chip->bus, c, NULL);
+			struct hda_codec *codec;
+			err = snd_hda_codec_new(chip->bus, c, &codec);
 			if (err < 0)
 				continue;
 			codecs++;
+			if (codec->afg)
+				audio_codecs++;
 		}
 	}
-	if (!codecs) {
+	if (!audio_codecs) {
 		/* probe additional slots if no codec is found */
 		for (; c < azx_max_codecs[chip->driver_type]; c++) {
 			if ((chip->codec_mask & (1 << c)) & probe_mask) {

-- 

[patch 12/54] Char: cyclades, fix deadlock

[Chris Wright]

[-- Attachment #1: char-cyclades-fix-deadlock.patch --]
[-- Type: text/plain, Size: 767 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Jiri Slaby <jirislaby@gmail.com>

An omitted unlock.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/char/cyclades.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.21.4.orig/drivers/char/cyclades.c
+++ linux-2.6.21.4/drivers/char/cyclades.c
@@ -1103,6 +1103,7 @@ static void cyy_intr_chip(struct cyclade
 
 				if (data & info->ignore_status_mask) {
 					info->icount.rx++;
+					spin_unlock(&cinfo->card_lock);
 					return;
 				}
 				if (tty_buffer_request_room(tty, 1)) {

-- 

[patch 13/54] hpt366: dont check enablebits for HPT36x

[Chris Wright]

[-- Attachment #1: hpt366-don-t-check-enablebits-for-hpt36x.patch --]
[-- Type: text/plain, Size: 1290 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Sergei Shtylyov <sshtylyov@ru.mvista.com>

HPT36x chip don't seem to have the channel enable bits, so prevent the IDE core
from checking them...

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: <bzolnier@gmail.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
This has been an issue since 2.6.21-rc1...

 drivers/ide/pci/hpt366.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/drivers/ide/pci/hpt366.c
+++ linux-2.6.21.4/drivers/ide/pci/hpt366.c
@@ -1,5 +1,5 @@
 /*
- * linux/drivers/ide/pci/hpt366.c		Version 1.02	Apr 18, 2007
+ * linux/drivers/ide/pci/hpt366.c		Version 1.03	May 4, 2007
  *
  * Copyright (C) 1999-2003		Andre Hedrick <andre@linux-ide.org>
  * Portions Copyright (C) 2001	        Sun Microsystems, Inc.
@@ -1527,7 +1527,12 @@ static int __devinit init_setup_hpt366(s
 	if (rev > 2)
 		goto init_single;
 
+	/*
+	 * HPT36x chips are single channel and
+	 * do not seem to have the channel enable bit...
+	 */
 	d->channels = 1;
+	d->enablebits[0].reg = 0;
 
 	if ((dev2 = pci_get_slot(dev->bus, dev->devfn + 1)) != NULL) {
 	  	u8  pin1 = 0, pin2 = 0;

-- 

[patch 14/54] e1000: disable polling before registering netdevice

[Chris Wright]

[-- Attachment #1: e1000-disable-polling-before-registering-netdevice.patch --]
[-- Type: text/plain, Size: 1529 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Auke Kok <auke-jan.h.kok@intel.com>

To assure the symmetry of poll enable/disable in up/down, we should
initialize the netdevice to be poll_disabled at load time. Doing
this after register_netdevice leaves us open to another race, so
lets move all the netif_* calls above register_netdevice so the
stack starts out how we expect it to be.

Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Doug Chapman <doug.chapman@hp.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/net/e1000/e1000_main.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- linux-2.6.21.4.orig/drivers/net/e1000/e1000_main.c
+++ linux-2.6.21.4/drivers/net/e1000/e1000_main.c
@@ -1153,13 +1153,16 @@ e1000_probe(struct pci_dev *pdev,
 	    !e1000_check_mng_mode(&adapter->hw))
 		e1000_get_hw_control(adapter);
 
-	strcpy(netdev->name, "eth%d");
-	if ((err = register_netdev(netdev)))
-		goto err_register;
-
 	/* tell the stack to leave us alone until e1000_open() is called */
 	netif_carrier_off(netdev);
 	netif_stop_queue(netdev);
+#ifdef CONFIG_E1000_NAPI
+	netif_poll_disable(netdev);
+#endif
+
+	strcpy(netdev->name, "eth%d");
+	if ((err = register_netdev(netdev)))
+		goto err_register;
 
 	DPRINTK(PROBE, INFO, "Intel(R) PRO/1000 Network Connection\n");
 

-- 

[patch 15/54] ALSA: usb-audio: explicitly match Logitech QuickCam

[Chris Wright]

[-- Attachment #1: alsa-usb-audio-explicitly-match-logitech-quickcam.patch --]
[-- Type: text/plain, Size: 2129 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Daniel Drake <dsd@gentoo.org>

Commit 93c8bf45e083b89dffe3a708363c15c1b220c723 modified the USB device
matching behaviour to ignore interface class matches if the device class
is vendor-specific.
This patch adds explicit ID matches for Logitech QuickCam devices, which
have a vendor specific device class (but standards-compliant audio
interfaces).
This fixes a 2.6.20 regression where the audio component of these
devices was no longer usable.
http://bugs.gentoo.org/show_bug.cgi?id=175715
https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.20/+bug/93822
https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3040
Based on a patch from sergiom

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a91214589e6527b18f52bc0b31253f9dfb4665e6

 sound/usb/usbquirks.h |   23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

--- linux-2.6.21.4.orig/sound/usb/usbquirks.h
+++ linux-2.6.21.4/sound/usb/usbquirks.h
@@ -40,6 +40,29 @@
 	.bInterfaceClass = USB_CLASS_VENDOR_SPEC
 
 /*
+ * Logitech QuickCam: bDeviceClass is vendor-specific, so generic interface
+ * class matches do not take effect without an explicit ID match.
+ */
+{
+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+		       USB_DEVICE_ID_MATCH_INT_CLASS |
+		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+	.idVendor = 0x046d,
+	.idProduct = 0x08f0,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = USB_SUBCLASS_AUDIO_CONTROL
+},
+{
+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+		       USB_DEVICE_ID_MATCH_INT_CLASS |
+		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+	.idVendor = 0x046d,
+	.idProduct = 0x08f6,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = USB_SUBCLASS_AUDIO_CONTROL
+},
+
+/*
  * Yamaha devices
  */
 

-- 

[patch 16/54] Input: i8042 - fix AUX port detection with some chips

[Chris Wright]

[-- Attachment #1: input-i8042-fix-aux-port-detection-with-some-chips.patch --]
[-- Type: text/plain, Size: 2623 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Roland Scheidegger <sroland@tungstengraphics.com>

The i8042 driver fails detection of the AUX port with some chips,
because they apparently do not change the I8042_CTR_AUXDIS bit
immediately. This is known to affect at least HP500/HP510 notebooks,
consequently the built-in touchpad will not work. The patch will simply
reread the value until it gets the expected value or a retry limit is
hit, without touching other workaround code in the same area.

Signed-off-by: Roland Scheidegger <sroland@tungstengraphics.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=d2ada5597d33a9108acb2caf912f85cbc9caab1e

 drivers/input/serio/i8042.c |   35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

--- linux-2.6.21.4.orig/drivers/input/serio/i8042.c
+++ linux-2.6.21.4/drivers/input/serio/i8042.c
@@ -526,6 +526,33 @@ static irqreturn_t __devinit i8042_aux_t
 	return IRQ_HANDLED;
 }
 
+/*
+ * i8042_toggle_aux - enables or disables AUX port on i8042 via command and
+ * verifies success by readinng CTR. Used when testing for presence of AUX
+ * port.
+ */
+static int __devinit i8042_toggle_aux(int on)
+{
+	unsigned char param;
+	int i;
+
+	if (i8042_command(&param,
+			on ? I8042_CMD_AUX_ENABLE : I8042_CMD_AUX_DISABLE))
+		return -1;
+
+	/* some chips need some time to set the I8042_CTR_AUXDIS bit */
+	for (i = 0; i < 100; i++) {
+		udelay(50);
+
+		if (i8042_command(&param, I8042_CMD_CTL_RCTR))
+			return -1;
+
+		if (!(param & I8042_CTR_AUXDIS) == on)
+			return 0;
+	}
+
+	return -1;
+}
 
 /*
  * i8042_check_aux() applies as much paranoia as it can at detecting
@@ -580,16 +607,12 @@ static int __devinit i8042_check_aux(voi
  * Bit assignment test - filters out PS/2 i8042's in AT mode
  */
 
-	if (i8042_command(&param, I8042_CMD_AUX_DISABLE))
-		return -1;
-	if (i8042_command(&param, I8042_CMD_CTL_RCTR) || (~param & I8042_CTR_AUXDIS)) {
+	if (i8042_toggle_aux(0)) {
 		printk(KERN_WARNING "Failed to disable AUX port, but continuing anyway... Is this a SiS?\n");
 		printk(KERN_WARNING "If AUX port is really absent please use the 'i8042.noaux' option.\n");
 	}
 
-	if (i8042_command(&param, I8042_CMD_AUX_ENABLE))
-		return -1;
-	if (i8042_command(&param, I8042_CMD_CTL_RCTR) || (param & I8042_CTR_AUXDIS))
+	if (i8042_toggle_aux(1))
 		return -1;
 
 /*

-- 

[patch 17/54] ieee1394: eth1394: bring back a parent device

[Chris Wright]

[-- Attachment #1: ieee1394-eth1394-bring-back-a-parent-device.patch --]
[-- Type: text/plain, Size: 1435 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Stefan Richter <stefanr@s5r6.in-berlin.de>

This adds a real parent device to eth1394's ethX device like in Linux
2.6.20 and older.  However, due to unfinished conversion of the ieee1394
away from class_device, we now refer to the FireWire controller's PCI
device as the parent, not to the ieee1394 driver's fw-host device.

Having a real parent device instead of a virtual one allows udev scripts
to distinguish eth1394 interfaces from networking bridges, bondings and
the likes.

Fixes a regression since 2.6.21:
https://bugs.gentoo.org/show_bug.cgi?id=177199

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
Same as commit ef50a6c59dc66f22eba67704e291d709f21e0456.

 drivers/ieee1394/eth1394.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- linux-2.6.21.4.orig/drivers/ieee1394/eth1394.c
+++ linux-2.6.21.4/drivers/ieee1394/eth1394.c
@@ -584,10 +584,9 @@ static void ether1394_add_host (struct h
         }
 
 	SET_MODULE_OWNER(dev);
-#if 0
-	/* FIXME - Is this the correct parent device anyway? */
-	SET_NETDEV_DEV(dev, &host->device);
-#endif
+
+	/* This used to be &host->device in Linux 2.6.20 and before. */
+	SET_NETDEV_DEV(dev, host->device.parent);
 
 	priv = netdev_priv(dev);
 

-- 

[patch 18/54] V4L/DVB (5593): Budget-ci: Fix tuning for TDM 1316 (160..200 MHz)

[Chris Wright]

[-- Attachment #1: v4l-dvb-budget-ci-fix-tuning-for-tdm-1316.patch --]
[-- Type: text/plain, Size: 1446 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Oliver Endriss <o.endriss@gmx.de>

Revert changeset
  http://linuxtv.org/hg/v4l-dvb?cmd=changeset;node=e7c424bbf9aa;style=gitweb

Petri Helin found that this changeset broke tuning:

'Well, after going through the changes that might have had effect on
tuning, I found out the one which had caused this problem. I do not know
the actual reason behind the change, but the changelog says that it
was meant to "Fix TD1316 tuner for DVBC". But at least in my case it
seams to have broken the tuner instead.'

Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
Thanks-to: Petri Helin <phelin@googlemail.com>
Acked-by: e9hack <e9hack@googlemail.com>
Acked-by: Thomas Kaiser <linux-dvb@kaiser-linux.li>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Acked-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/media/dvb/ttpci/budget-ci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/drivers/media/dvb/ttpci/budget-ci.c
+++ linux-2.6.21.4/drivers/media/dvb/ttpci/budget-ci.c
@@ -926,7 +926,7 @@ static int dvbc_philips_tdm1316l_tuner_s
 		band = 1;
 	} else if (tuner_frequency < 200000000) {
 		cp = 6;
-		band = 2;
+		band = 1;
 	} else if (tuner_frequency < 290000000) {
 		cp = 3;
 		band = 2;

-- 

[patch 19/54] zd1211rw: Add AL2230S RF support

[Chris Wright]

[-- Attachment #1: zd1211rw-add-al2230s-rf-support.patch --]
[-- Type: text/plain, Size: 7795 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Daniel Drake <dsd@gentoo.org>

ZD1211 appears to be back in production: a number of new devices have
been appearing! Some of them are using new radios.

This patch adds support for the next generation AL2230 RF chip which has
been spotted in a few new devices.

[As this patch was too late for 2.6.21, the kernel was modified to reject
AL2230S devices because for me and others, the devices silently failed (and
this looked like a driver bug). After doing so, a few people reported that
AL2230S devices were working correctly for them even before AL2230S support was
present. I'd like to propose that we fix both situations by backporting
the AL2230S support into 2.6.21-stable]

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/net/wireless/zd1211rw/zd_chip.c      |    5 -
 drivers/net/wireless/zd1211rw/zd_rf.c        |    2 
 drivers/net/wireless/zd1211rw/zd_rf.h        |    2 
 drivers/net/wireless/zd1211rw/zd_rf_al2230.c |   89 ++++++++++++++++++++++-----
 4 files changed, 78 insertions(+), 20 deletions(-)

--- linux-2.6.21.4.orig/drivers/net/wireless/zd1211rw/zd_chip.c
+++ linux-2.6.21.4/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -67,11 +67,12 @@ static int scnprint_id(struct zd_chip *c
 	i += scnprint_mac_oui(chip->e2p_mac, buffer+i, size-i);
 	i += scnprintf(buffer+i, size-i, " ");
 	i += zd_rf_scnprint_id(&chip->rf, buffer+i, size-i);
-	i += scnprintf(buffer+i, size-i, " pa%1x %c%c%c%c", chip->pa_type,
+	i += scnprintf(buffer+i, size-i, " pa%1x %c%c%c%c%c", chip->pa_type,
 		chip->patch_cck_gain ? 'g' : '-',
 		chip->patch_cr157 ? '7' : '-',
 		chip->patch_6m_band_edge ? '6' : '-',
-		chip->new_phy_layout ? 'N' : '-');
+		chip->new_phy_layout ? 'N' : '-',
+		chip->al2230s_bit ? 'S' : '-');
 	return i;
 }
 
--- linux-2.6.21.4.orig/drivers/net/wireless/zd1211rw/zd_rf.c
+++ linux-2.6.21.4/drivers/net/wireless/zd1211rw/zd_rf.c
@@ -34,7 +34,7 @@ static const char *rfs[] = {
 	[AL2210_RF]	= "AL2210_RF",
 	[MAXIM_NEW_RF]	= "MAXIM_NEW_RF",
 	[UW2453_RF]	= "UW2453_RF",
-	[AL2230S_RF]	= "AL2230S_RF",
+	[UNKNOWN_A_RF]	= "UNKNOWN_A_RF",
 	[RALINK_RF]	= "RALINK_RF",
 	[INTERSIL_RF]	= "INTERSIL_RF",
 	[RF2959_RF]	= "RF2959_RF",
--- linux-2.6.21.4.orig/drivers/net/wireless/zd1211rw/zd_rf.h
+++ linux-2.6.21.4/drivers/net/wireless/zd1211rw/zd_rf.h
@@ -26,7 +26,7 @@
 #define AL2210_RF			0x7
 #define MAXIM_NEW_RF			0x8
 #define UW2453_RF			0x9
-#define AL2230S_RF			0xa
+#define UNKNOWN_A_RF			0xa
 #define RALINK_RF			0xb
 #define INTERSIL_RF			0xc
 #define RF2959_RF			0xd
--- linux-2.6.21.4.orig/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
+++ linux-2.6.21.4/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
@@ -59,6 +59,18 @@ static const struct zd_ioreq16 zd1211b_i
 	{ CR240, 0x57 }, { CR9,   0xe0 },
 };
 
+static const struct zd_ioreq16 ioreqs_init_al2230s[] = {
+	{ CR47,   0x1e }, /* MARK_002 */
+	{ CR106,  0x22 },
+	{ CR107,  0x2a }, /* MARK_002 */
+	{ CR109,  0x13 }, /* MARK_002 */
+	{ CR118,  0xf8 }, /* MARK_002 */
+	{ CR119,  0x12 }, { CR122,  0xe0 },
+	{ CR128,  0x10 }, /* MARK_001 from 0xe->0x10 */
+	{ CR129,  0x0e }, /* MARK_001 from 0xd->0x0e */
+	{ CR130,  0x10 }, /* MARK_001 from 0xb->0x0d */
+};
+
 static int zd1211b_al2230_finalize_rf(struct zd_chip *chip)
 {
 	int r;
@@ -90,7 +102,7 @@ static int zd1211_al2230_init_hw(struct 
 	int r;
 	struct zd_chip *chip = zd_rf_to_chip(rf);
 
-	static const struct zd_ioreq16 ioreqs[] = {
+	static const struct zd_ioreq16 ioreqs_init[] = {
 		{ CR15,   0x20 }, { CR23,   0x40 }, { CR24,  0x20 },
 		{ CR26,   0x11 }, { CR28,   0x3e }, { CR29,  0x00 },
 		{ CR44,   0x33 }, { CR106,  0x2a }, { CR107, 0x1a },
@@ -117,10 +129,9 @@ static int zd1211_al2230_init_hw(struct 
 		{ CR119,  0x10 }, { CR120,  0x4f }, { CR121, 0x77 },
 		{ CR122,  0xe0 }, { CR137,  0x88 }, { CR252, 0xff },
 		{ CR253,  0xff },
+	};
 
-		/* These following happen separately in the vendor driver */
-		{ },
-
+	static const struct zd_ioreq16 ioreqs_pll[] = {
 		/* shdnb(PLL_ON)=0 */
 		{ CR251,  0x2f },
 		/* shdnb(PLL_ON)=1 */
@@ -128,7 +139,7 @@ static int zd1211_al2230_init_hw(struct 
 		{ CR138,  0x28 }, { CR203,  0x06 },
 	};
 
-	static const u32 rv[] = {
+	static const u32 rv1[] = {
 		/* Channel 1 */
 		0x03f790,
 		0x033331,
@@ -137,6 +148,9 @@ static int zd1211_al2230_init_hw(struct 
 		0x0b3331,
 		0x03b812,
 		0x00fff3,
+	};
+
+	static const u32 rv2[] = {
 		0x000da4,
 		0x0f4dc5, /* fix freq shift, 0x04edc5 */
 		0x0805b6,
@@ -148,8 +162,9 @@ static int zd1211_al2230_init_hw(struct 
 		0x0bdffc,
 		0x00000d,
 		0x00500f,
+	};
 
-		/* These writes happen separately in the vendor driver */
+	static const u32 rv3[] = {
 		0x00d00f,
 		0x004c0f,
 		0x00540f,
@@ -157,11 +172,38 @@ static int zd1211_al2230_init_hw(struct 
 		0x00500f,
 	};
 
-	r = zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+	r = zd_iowrite16a_locked(chip, ioreqs_init, ARRAY_SIZE(ioreqs_init));
 	if (r)
 		return r;
 
-	r = zd_rfwritev_locked(chip, rv, ARRAY_SIZE(rv), RF_RV_BITS);
+	if (chip->al2230s_bit) {
+		r = zd_iowrite16a_locked(chip, ioreqs_init_al2230s,
+			ARRAY_SIZE(ioreqs_init_al2230s));
+		if (r)
+			return r;
+	}
+
+	r = zd_rfwritev_locked(chip, rv1, ARRAY_SIZE(rv1), RF_RV_BITS);
+	if (r)
+		return r;
+
+	/* improve band edge for AL2230S */
+	if (chip->al2230s_bit)
+		r = zd_rfwrite_locked(chip, 0x000824, RF_RV_BITS);
+	else
+		r = zd_rfwrite_locked(chip, 0x0005a4, RF_RV_BITS);
+	if (r)
+		return r;
+
+	r = zd_rfwritev_locked(chip, rv2, ARRAY_SIZE(rv2), RF_RV_BITS);
+	if (r)
+		return r;
+
+	r = zd_iowrite16a_locked(chip, ioreqs_pll, ARRAY_SIZE(ioreqs_pll));
+	if (r)
+		return r;
+
+	r = zd_rfwritev_locked(chip, rv3, ARRAY_SIZE(rv3), RF_RV_BITS);
 	if (r)
 		return r;
 
@@ -227,7 +269,9 @@ static int zd1211b_al2230_init_hw(struct
 		0x481dc0,
 		0xcfff00,
 		0x25a000,
+	};
 
+	static const u32 rv2[] = {
 		/* To improve AL2230 yield, improve phase noise, 4713 */
 		0x25a000,
 		0xa3b2f0,
@@ -250,7 +294,7 @@ static int zd1211b_al2230_init_hw(struct
 		{ CR251, 0x7f }, /* shdnb(PLL_ON)=1 */
 	};
 
-	static const u32 rv2[] = {
+	static const u32 rv3[] = {
 		/* To improve AL2230 yield, 4713 */
 		0xf01b00,
 		0xf01e00,
@@ -269,18 +313,37 @@ static int zd1211b_al2230_init_hw(struct
 	r = zd_iowrite16a_locked(chip, ioreqs1, ARRAY_SIZE(ioreqs1));
 	if (r)
 		return r;
+
+	if (chip->al2230s_bit) {
+		r = zd_iowrite16a_locked(chip, ioreqs_init_al2230s,
+			ARRAY_SIZE(ioreqs_init_al2230s));
+		if (r)
+			return r;
+	}
+
 	r = zd_rfwritev_cr_locked(chip, zd1211b_al2230_table[0], 3);
 	if (r)
 		return r;
 	r = zd_rfwritev_cr_locked(chip, rv1, ARRAY_SIZE(rv1));
 	if (r)
 		return r;
-	r = zd_iowrite16a_locked(chip, ioreqs2, ARRAY_SIZE(ioreqs2));
+
+	if (chip->al2230s_bit)
+		r = zd_rfwrite_locked(chip, 0x241000, RF_RV_BITS);
+	else
+		r = zd_rfwrite_locked(chip, 0x25a000, RF_RV_BITS);
 	if (r)
 		return r;
+
 	r = zd_rfwritev_cr_locked(chip, rv2, ARRAY_SIZE(rv2));
 	if (r)
 		return r;
+	r = zd_iowrite16a_locked(chip, ioreqs2, ARRAY_SIZE(ioreqs2));
+	if (r)
+		return r;
+	r = zd_rfwritev_cr_locked(chip, rv3, ARRAY_SIZE(rv3));
+	if (r)
+		return r;
 	r = zd_iowrite16a_locked(chip, ioreqs3, ARRAY_SIZE(ioreqs3));
 	if (r)
 		return r;
@@ -358,12 +421,6 @@ int zd_rf_init_al2230(struct zd_rf *rf)
 {
 	struct zd_chip *chip = zd_rf_to_chip(rf);
 
-	if (chip->al2230s_bit) {
-		dev_err(zd_chip_dev(chip), "AL2230S devices are not yet "
-			"supported by this driver.\n");
-		return -ENODEV;
-	}
-
 	rf->switch_radio_off = al2230_switch_radio_off;
 	if (chip->is_zd1211b) {
 		rf->init_hw = zd1211b_al2230_init_hw;

-- 

[patch 20/54] fix compat console unimap regression

[Chris Wright]

[-- Attachment #1: fix-compat-console-unimap-regression.patch --]
[-- Type: text/plain, Size: 3469 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Hugh Dickins <hugh@veritas.com>

Why is it that since the 2f1a2ccb9c0de632ab07193becf5f7121794f6ae console
UTF-8 fixes went into 2.6.22-rc1, the PowerMac G5 shows only inverse video
question marks for the text on tty2-6? whereas tty1 is fine, and so is x86.

No fault of that patch: by removing the old fallback behaviour, it reveals
that 32-bit setfont running on 64-bit kernels has only really worked on
the current console, the rest getting faked by that inadequate fallback.

Bring the compat do_unimap_ioctl into line with the main one: PIO_UNIMAP
and GIO_UNIMAP apply to the specified tty, not redirected to fg_console.
Use the same checks, and most particularly, remember to check access_ok:
con_set_unimap and con_get_unimap are using __get_user and __put_user.

And the compat vt_check should ask for the same capability as the main
one, CAP_SYS_TTY_CONFIG rather than CAP_SYS_ADMIN.  Added in vt_ioctl's
vc_cons_allocated check for safety, though failure may well be impossible.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 fs/compat_ioctl.c |   33 +++++++++++++++++++++++++--------
 1 file changed, 25 insertions(+), 8 deletions(-)

--- linux-2.6.21.4.orig/fs/compat_ioctl.c
+++ linux-2.6.21.4/fs/compat_ioctl.c
@@ -1178,6 +1178,7 @@ static int vt_check(struct file *file)
 {
 	struct tty_struct *tty;
 	struct inode *inode = file->f_path.dentry->d_inode;
+	struct vc_data *vc;
 	
 	if (file->f_op->ioctl != tty_ioctl)
 		return -EINVAL;
@@ -1188,12 +1189,16 @@ static int vt_check(struct file *file)
 	                                                
 	if (tty->driver->ioctl != vt_ioctl)
 		return -EINVAL;
-	
+
+	vc = (struct vc_data *)tty->driver_data;
+	if (!vc_cons_allocated(vc->vc_num)) 	/* impossible? */
+		return -ENOIOCTLCMD;
+
 	/*
 	 * To have permissions to do most of the vt ioctls, we either have
-	 * to be the owner of the tty, or super-user.
+	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
 	 */
-	if (current->signal->tty == tty || capable(CAP_SYS_ADMIN))
+	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
 		return 1;
 	return 0;                                                    
 }
@@ -1294,16 +1299,28 @@ static int do_unimap_ioctl(unsigned int 
 	struct unimapdesc32 tmp;
 	struct unimapdesc32 __user *user_ud = compat_ptr(arg);
 	int perm = vt_check(file);
-	
-	if (perm < 0) return perm;
+	struct vc_data *vc;
+
+	if (perm < 0)
+		return perm;
 	if (copy_from_user(&tmp, user_ud, sizeof tmp))
 		return -EFAULT;
+	if (tmp.entries)
+		if (!access_ok(VERIFY_WRITE, compat_ptr(tmp.entries),
+				tmp.entry_ct*sizeof(struct unipair)))
+			return -EFAULT;
+	vc = ((struct tty_struct *)file->private_data)->driver_data;
 	switch (cmd) {
 	case PIO_UNIMAP:
-		if (!perm) return -EPERM;
-		return con_set_unimap(vc_cons[fg_console].d, tmp.entry_ct, compat_ptr(tmp.entries));
+		if (!perm)
+			return -EPERM;
+		return con_set_unimap(vc, tmp.entry_ct,
+						compat_ptr(tmp.entries));
 	case GIO_UNIMAP:
-		return con_get_unimap(vc_cons[fg_console].d, tmp.entry_ct, &(user_ud->entry_ct), compat_ptr(tmp.entries));
+		if (!perm && fg_console != vc->vc_num)
+			return -EPERM;
+		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct),
+						compat_ptr(tmp.entries));
 	}
 	return 0;
 }

-- 

[patch 21/54] ahci: disable 64bit dma on sb600

[Chris Wright]

[-- Attachment #1: ahci-disable-64bit-dma-on-sb600.patch --]
[-- Type: text/plain, Size: 1953 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Tejun Heo <htejun@gmail.com>

SB600 claims it can do 64bit DMA but it can't.  Disable it.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
This is backport of commit c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c.
Due to initialization changes in devel branch, it looks a bit
different but does the same thing.  This problem makes sb600 ahci
controller malfunction if some memory is over 4G.  Please consider for
-stable.  Thanks.

 drivers/ata/ahci.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/drivers/ata/ahci.c
+++ linux-2.6.21.4/drivers/ata/ahci.c
@@ -170,6 +170,7 @@ enum {
 	AHCI_FLAG_IGN_IRQ_IF_ERR	= (1 << 25), /* ignore IRQ_IF_ERR */
 	AHCI_FLAG_HONOR_PI		= (1 << 26), /* honor PORTS_IMPL */
 	AHCI_FLAG_IGN_SERR_INTERNAL	= (1 << 27), /* ignore SERR_INTERNAL */
+	AHCI_FLAG_32BIT_ONLY		= (1 << 28), /* force 32bit */
 };
 
 struct ahci_cmd_hdr {
@@ -370,7 +371,8 @@ static const struct ata_port_info ahci_p
 		.flags		= ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
 				  ATA_FLAG_MMIO | ATA_FLAG_PIO_DMA |
 				  ATA_FLAG_SKIP_D2H_BSY |
-				  AHCI_FLAG_IGN_SERR_INTERNAL,
+				  AHCI_FLAG_IGN_SERR_INTERNAL |
+				  AHCI_FLAG_32BIT_ONLY,
 		.pio_mask	= 0x1f, /* pio0-4 */
 		.udma_mask	= 0x7f, /* udma0-6 ; FIXME */
 		.port_ops	= &ahci_ops,
@@ -1579,6 +1581,12 @@ static int ahci_host_init(struct ata_pro
 		probe_ent->n_ports = cap_n_ports;
 
 	using_dac = hpriv->cap & HOST_CAP_64;
+	if (using_dac && (probe_ent->port_flags & AHCI_FLAG_32BIT_ONLY)) {
+		dev_printk(KERN_INFO, &pdev->dev,
+			   "controller can't do 64bit DMA, forcing 32bit\n");
+		using_dac = 0;
+	}
+
 	if (using_dac &&
 	    !pci_set_dma_mask(pdev, DMA_64BIT_MASK)) {
 		rc = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK);

-- 

[patch 22/54] ntfs_init_locked_inode(): fix array indexing

[Chris Wright]

[-- Attachment #1: ntfs_init_locked_inode-fix-array-indexing.patch --]
[-- Type: text/plain, Size: 1019 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Andrew Morton <akpm@linux-foundation.org>

Local variable `i' is a byte-counter.  Don't use it as an index into an array
of le32's.

Reported-by: "young dave" <hidave.darkstar@gmail.com>
Cc: "Christoph Lameter" <clameter@sgi.com>
Acked-by: Anton Altaparmakov <aia21@cantab.net>
Cc: <stable@kernel.org>
Cc: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 fs/ntfs/inode.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/fs/ntfs/inode.c
+++ linux-2.6.21.4/fs/ntfs/inode.c
@@ -141,7 +141,7 @@ static int ntfs_init_locked_inode(struct
 		if (!ni->name)
 			return -ENOMEM;
 		memcpy(ni->name, na->name, i);
-		ni->name[i] = 0;
+		ni->name[na->name_len] = 0;
 	}
 	return 0;
 }

-- 

[patch 23/54] PCI: quirk disable MSI on via vt3351

[Chris Wright]

[-- Attachment #1: pci-quirk-disable-msi-on-via-vt3351.patch --]
[-- Type: text/plain, Size: 1874 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Jay Cliburn <jacliburn@bellsouth.net>

The Via VT3351 APIC does not play well with MSI and unleashes a flood
of APIC errors when MSI is used to deliver interrupts.  The problem
was recently exposed when the atl1 network device driver, which enables
MSI by default, stimulated APIC errors on an Asus M2V mainboard, which
employs the Via VT3351.
See http://bugzilla.kernel.org/show_bug.cgi?id=8472 for additional
details on this bug.

Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/pci/quirks.c    |    1 +
 include/linux/pci_ids.h |    1 +
 2 files changed, 2 insertions(+)

--- linux-2.6.21.4.orig/drivers/pci/quirks.c
+++ linux-2.6.21.4/drivers/pci/quirks.c
@@ -1751,6 +1751,7 @@ static void __init quirk_disable_all_msi
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_GCNB_LE, quirk_disable_all_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS400_200, quirk_disable_all_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS480, quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3351, quirk_disable_all_msi);
 
 /* Disable MSI on chipsets that are known to not support it */
 static void __devinit quirk_disable_msi(struct pci_dev *dev)
--- linux-2.6.21.4.orig/include/linux/pci_ids.h
+++ linux-2.6.21.4/include/linux/pci_ids.h
@@ -1287,6 +1287,7 @@
 #define PCI_DEVICE_ID_VIA_P4M800CE	0x0314
 #define PCI_DEVICE_ID_VIA_P4M890	0x0327
 #define PCI_DEVICE_ID_VIA_VT3336	0x0336
+#define PCI_DEVICE_ID_VIA_VT3351	0x0351
 #define PCI_DEVICE_ID_VIA_8371_0	0x0391
 #define PCI_DEVICE_ID_VIA_8501_0	0x0501
 #define PCI_DEVICE_ID_VIA_82C561	0x0561

-- 

[patch 24/54] pci_ids: update patch for Intel ICH9M

[Chris Wright]

[-- Attachment #1: pci_ids-update-patch-for-intel-ich9m.patch --]
[-- Type: text/plain, Size: 1336 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Jason Gaston <jason.d.gaston@intel.com>

This patch updates the Intel ICH9M LPC Controller DID's, due to a
specification change.

Signed-off-by: Jason Gaston <jason.d.gaston@intel.com>
Cc: <stable@kernel.org>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 include/linux/pci_ids.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/include/linux/pci_ids.h
+++ linux-2.6.21.4/include/linux/pci_ids.h
@@ -2260,11 +2260,11 @@
 #define PCI_DEVICE_ID_INTEL_ICH8_5	0x283e
 #define PCI_DEVICE_ID_INTEL_ICH8_6	0x2850
 #define PCI_DEVICE_ID_INTEL_ICH9_0	0x2910
-#define PCI_DEVICE_ID_INTEL_ICH9_1	0x2911
+#define PCI_DEVICE_ID_INTEL_ICH9_1	0x2917
 #define PCI_DEVICE_ID_INTEL_ICH9_2	0x2912
 #define PCI_DEVICE_ID_INTEL_ICH9_3	0x2913
 #define PCI_DEVICE_ID_INTEL_ICH9_4	0x2914
-#define PCI_DEVICE_ID_INTEL_ICH9_5	0x2915
+#define PCI_DEVICE_ID_INTEL_ICH9_5	0x2919
 #define PCI_DEVICE_ID_INTEL_ICH9_6	0x2930
 #define PCI_DEVICE_ID_INTEL_82855PM_HB	0x3340
 #define PCI_DEVICE_ID_INTEL_82830_HB	0x3575

-- 

[patch 25/54] x86_64: allocate sparsemem memmap above 4G

[Chris Wright]

[-- Attachment #1: x86_64-allocate-sparsemem-memmap-above-4g.patch --]
[-- Type: text/plain, Size: 2564 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Zou Nan hai <nanhai.zou@intel.com>

On systems with huge amount of physical memory, VFS cache and memory memmap
may eat all available system memory under 4G, then the system may fail to
allocate swiotlb bounce buffer.

There was a fix for this issue in arch/x86_64/mm/numa.c, but that fix dose
not cover sparsemem model.

This patch add fix to sparsemem model by first try to allocate memmap above
4G.

Signed-off-by: Zou Nan hai <nanhai.zou@intel.com>
Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
Cc: Andi Kleen <ak@suse.de>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[chrisw: trivial backport]
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/x86_64/mm/init.c   |    6 ++++++
 include/linux/bootmem.h |    1 +
 mm/sparse.c             |   11 +++++++++++
 3 files changed, 18 insertions(+)

--- linux-2.6.21.4.orig/arch/x86_64/mm/init.c
+++ linux-2.6.21.4/arch/x86_64/mm/init.c
@@ -776,3 +776,9 @@ int in_gate_area_no_task(unsigned long a
 {
 	return (addr >= VSYSCALL_START) && (addr < VSYSCALL_END);
 }
+
+void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+{
+	return __alloc_bootmem_core(pgdat->bdata, size,
+			SMP_CACHE_BYTES, (4UL*1024*1024*1024), 0);
+}
--- linux-2.6.21.4.orig/include/linux/bootmem.h
+++ linux-2.6.21.4/include/linux/bootmem.h
@@ -59,6 +59,7 @@ extern void *__alloc_bootmem_core(struct
 				  unsigned long align,
 				  unsigned long goal,
 				  unsigned long limit);
+extern void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size);
 
 #ifndef CONFIG_HAVE_ARCH_BOOTMEM_NODE
 extern void reserve_bootmem(unsigned long addr, unsigned long size);
--- linux-2.6.21.4.orig/mm/sparse.c
+++ linux-2.6.21.4/mm/sparse.c
@@ -209,6 +209,12 @@ static int sparse_init_one_section(struc
 	return 1;
 }
 
+__attribute__((weak))
+void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+{
+	return NULL;
+}
+
 static struct page *sparse_early_mem_map_alloc(unsigned long pnum)
 {
 	struct page *map;
@@ -219,6 +225,11 @@ static struct page *sparse_early_mem_map
 	if (map)
 		return map;
 
+  	map = alloc_bootmem_high_node(NODE_DATA(nid),
+                       sizeof(struct page) * PAGES_PER_SECTION);
+	if (map)
+		return map;
+
 	map = alloc_bootmem_node(NODE_DATA(nid),
 			sizeof(struct page) * PAGES_PER_SECTION);
 	if (map)

-- 

[patch 26/54] tty: fix leakage of -ERESTARTSYS to userland

[Chris Wright]

[-- Attachment #1: tty-fix-leakage-of-erestartsys-to-userland.patch --]
[-- Type: text/plain, Size: 1591 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Oleg Nesterov <oleg@tv-sign.ru>

Spotted by Satoru Takeuchi.

kill_pgrp(task_pgrp(current)) sends the signal to the current's thread
group, but can choose any sub-thread as a target for signal_wake_up(). 
This means that job_control() and tty_check_change() may return
-ERESTARTSYS without signal_pending().

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Satoru Takeuchi <takeuchi_satoru@jp.fujitsu.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/char/n_tty.c  |    1 +
 drivers/char/tty_io.c |    3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/drivers/char/n_tty.c
+++ linux-2.6.21.4/drivers/char/n_tty.c
@@ -1191,6 +1191,7 @@ static int job_control(struct tty_struct
 			    is_current_pgrp_orphaned())
 				return -EIO;
 			kill_pgrp(task_pgrp(current), SIGTTIN, 1);
+			set_thread_flag(TIF_SIGPENDING);
 			return -ERESTARTSYS;
 		}
 	}
--- linux-2.6.21.4.orig/drivers/char/tty_io.c
+++ linux-2.6.21.4/drivers/char/tty_io.c
@@ -1121,7 +1121,8 @@ int tty_check_change(struct tty_struct *
 		return 0;
 	if (is_current_pgrp_orphaned())
 		return -EIO;
-	(void) kill_pgrp(task_pgrp(current), SIGTTOU, 1);
+	kill_pgrp(task_pgrp(current), SIGTTOU, 1);
+	set_thread_flag(TIF_SIGPENDING);
 	return -ERESTARTSYS;
 }
 

-- 

[patch 27/54] timer statistics: fix race

[Chris Wright]

[-- Attachment #1: timer-statistics-fix-race.patch --]
[-- Type: text/plain, Size: 2704 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Bjorn Steinbrink <B.Steinbrink@gmx.de>

Fix two races in the timer stats lookup code.  One by ensuring that the
initialization of a new entry is finished upon insertion of that entry.
The other by cleaning up the hash table when the entries array is cleared,
so that we don't have any "pre-inserted" entries.

Thanks to Eric Dumazet for reminding me of the memory barriers.

Signed-off-by: Bjorn Steinbrink <B.Steinbrink@gmx.de>
Signed-off-by: Ian Kumlien <pomac@vapor.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Eric Dumazet <dada1@cosmosbay.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 kernel/time/timer_stats.c |   37 +++++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 16 deletions(-)

--- linux-2.6.21.4.orig/kernel/time/timer_stats.c
+++ linux-2.6.21.4/kernel/time/timer_stats.c
@@ -117,21 +117,6 @@ static struct entry entries[MAX_ENTRIES]
 
 static atomic_t overflow_count;
 
-static void reset_entries(void)
-{
-	nr_entries = 0;
-	memset(entries, 0, sizeof(entries));
-	atomic_set(&overflow_count, 0);
-}
-
-static struct entry *alloc_entry(void)
-{
-	if (nr_entries >= MAX_ENTRIES)
-		return NULL;
-
-	return entries + nr_entries++;
-}
-
 /*
  * The entries are in a hash-table, for fast lookup:
  */
@@ -149,6 +134,22 @@ static struct entry *alloc_entry(void)
 
 static struct entry *tstat_hash_table[TSTAT_HASH_SIZE] __read_mostly;
 
+static void reset_entries(void)
+{
+	nr_entries = 0;
+	memset(entries, 0, sizeof(entries));
+	memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
+	atomic_set(&overflow_count, 0);
+}
+
+static struct entry *alloc_entry(void)
+{
+	if (nr_entries >= MAX_ENTRIES)
+		return NULL;
+
+	return entries + nr_entries++;
+}
+
 static int match_entries(struct entry *entry1, struct entry *entry2)
 {
 	return entry1->timer       == entry2->timer	  &&
@@ -202,12 +203,15 @@ static struct entry *tstat_lookup(struct
 	if (curr) {
 		*curr = *entry;
 		curr->count = 0;
+		curr->next = NULL;
 		memcpy(curr->comm, comm, TASK_COMM_LEN);
+
+		smp_mb(); /* Ensure that curr is initialized before insert */
+
 		if (prev)
 			prev->next = curr;
 		else
 			*head = curr;
-		curr->next = NULL;
 	}
  out_unlock:
 	spin_unlock(&table_lock);
@@ -364,6 +368,7 @@ static ssize_t tstats_write(struct file 
 		if (!active) {
 			reset_entries();
 			time_start = ktime_get();
+			smp_mb();
 			active = 1;
 		}
 		break;

-- 

[patch 28/54] timer stats: speedups

[Chris Wright]

[-- Attachment #1: timer-stats-speedups.patch --]
[-- Type: text/plain, Size: 3420 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Ingo Molnar <mingo@elte.hu>

Make timer-stats have almost zero overhead when enabled in the config but
not used.  (this way distros can enable it more easily)

Also update the documentation about overhead of timer_stats - it was
written for the first version which had a global lock and a linear list
walk based lookup ;-)

Andrew says:
And this.  Not a bugfix, but trivial and obvious and apparently some
distros don't want to enable timer_stats because of the performance
issue, but powertop uses timer_stats.

Ingo replies:
seconded. I have tested this with and without CONFIG_TIMER_STATS, with
and without timer_stats collection activated.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 Documentation/hrtimer/timer_stats.txt |    7 ++++---
 kernel/time/timer_stats.c             |    7 ++++++-
 lib/Kconfig.debug                     |    5 ++++-
 3 files changed, 14 insertions(+), 5 deletions(-)

--- linux-2.6.21.4.orig/Documentation/hrtimer/timer_stats.txt
+++ linux-2.6.21.4/Documentation/hrtimer/timer_stats.txt
@@ -2,9 +2,10 @@ timer_stats - timer usage statistics
 ------------------------------------
 
 timer_stats is a debugging facility to make the timer (ab)usage in a Linux
-system visible to kernel and userspace developers. It is not intended for
-production usage as it adds significant overhead to the (hr)timer code and the
-(hr)timer data structures.
+system visible to kernel and userspace developers. If enabled in the config
+but not used it has almost zero runtime overhead, and a relatively small
+data structure overhead. Even if collection is enabled runtime all the
+locking is per-CPU and lookup is hashed.
 
 timer_stats should be used by kernel and userspace developers to verify that
 their code does not make unduly use of timers. This helps to avoid unnecessary
--- linux-2.6.21.4.orig/kernel/time/timer_stats.c
+++ linux-2.6.21.4/kernel/time/timer_stats.c
@@ -236,10 +236,15 @@ void timer_stats_update_stats(void *time
 	/*
 	 * It doesnt matter which lock we take:
 	 */
-	spinlock_t *lock = &per_cpu(lookup_lock, raw_smp_processor_id());
+	spinlock_t *lock;
 	struct entry *entry, input;
 	unsigned long flags;
 
+	if (likely(!active))
+		return;
+
+	lock = &per_cpu(lookup_lock, raw_smp_processor_id());
+
 	input.timer = timer;
 	input.start_func = startf;
 	input.expire_func = timerf;
--- linux-2.6.21.4.orig/lib/Kconfig.debug
+++ linux-2.6.21.4/lib/Kconfig.debug
@@ -143,7 +143,10 @@ config TIMER_STATS
 	  reprogrammed. The statistics can be read from /proc/timer_stats.
 	  The statistics collection is started by writing 1 to /proc/timer_stats,
 	  writing 0 stops it. This feature is useful to collect information
-	  about timer usage patterns in kernel and userspace.
+	  about timer usage patterns in kernel and userspace. This feature
+	  is lightweight if enabled in the kernel config but not activated
+	  (it defaults to deactivated on bootup and will only be activated
+	  if some application like powertop activates it explicitly).
 
 config DEBUG_SLAB
 	bool "Debug slab memory allocations"

-- 

[patch 29/54] ALSA: wm8750 typo fix

[Chris Wright]

[-- Attachment #1: alsa-wm8750-typo-fix.patch --]
[-- Type: text/plain, Size: 988 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Andrew Morton <akpm@linux-foundation.org>

I quuestion the testing status of that patch!

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/soc/codecs/wm8750.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/sound/soc/codecs/wm8750.c
+++ linux-2.6.21.4/sound/soc/codecs/wm8750.c
@@ -808,7 +808,7 @@ static int wm8750_init(struct snd_soc_de
 	codec->dai = &wm8750_dai;
 	codec->num_dai = 1;
 	codec->reg_cache_size = sizeof(wm8750_reg);
-	codec->reg_cache = kmemdup(wm8750_reg, sizeof(wm8750_reg), GFP_KRENEL);
+	codec->reg_cache = kmemdup(wm8750_reg, sizeof(wm8750_reg), GFP_KERNEL);
 	if (codec->reg_cache == NULL)
 		return -ENOMEM;
 

-- 

[patch 30/54] neofb: Fix pseudo_palette array overrun in neofb_setcolreg

[Chris Wright]

[-- Attachment #1: neofb-fix-pseudo_palette-array-overrun-in-neofb_setcolreg.patch --]
[-- Type: text/plain, Size: 2167 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Antonino A Daplas <adaplas@gmail.com>

The pseudo_palette has room for 16 entries only, but in truecolor mode, it
attempts to write 256.

Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Acked-by: Tero Roponen <teanropo@jyu.fi>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
This fixes the following regression/bug reported as follows:

Subject    : tty-related oops in latest kernel(s)
References : http://lkml.org/lkml/2007/5/27/104
Submitter  : Tero Roponen <teanropo@jyu.fi>
Status     : problem is being debugged

According to Tero, this is also reproducible with 2.6.21.3.

(Resending, wrong email address for stable@kernel.org)

Tony

 drivers/video/neofb.c |   30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

--- linux-2.6.21.4.orig/drivers/video/neofb.c
+++ linux-2.6.21.4/drivers/video/neofb.c
@@ -1285,34 +1285,36 @@ static int neofb_setcolreg(u_int regno, 
 	if (regno >= fb->cmap.len || regno > 255)
 		return -EINVAL;
 
-	switch (fb->var.bits_per_pixel) {
-	case 8:
+	if (fb->var.bits_per_pixel <= 8) {
 		outb(regno, 0x3c8);
 
 		outb(red >> 10, 0x3c9);
 		outb(green >> 10, 0x3c9);
 		outb(blue >> 10, 0x3c9);
-		break;
-	case 16:
-		((u32 *) fb->pseudo_palette)[regno] =
+	} else if (regno < 16) {
+		switch (fb->var.bits_per_pixel) {
+		case 16:
+			((u32 *) fb->pseudo_palette)[regno] =
 				((red & 0xf800)) | ((green & 0xfc00) >> 5) |
 				((blue & 0xf800) >> 11);
-		break;
-	case 24:
-		((u32 *) fb->pseudo_palette)[regno] =
+			break;
+		case 24:
+			((u32 *) fb->pseudo_palette)[regno] =
 				((red & 0xff00) << 8) | ((green & 0xff00)) |
 				((blue & 0xff00) >> 8);
-		break;
+			break;
 #ifdef NO_32BIT_SUPPORT_YET
-	case 32:
-		((u32 *) fb->pseudo_palette)[regno] =
+		case 32:
+			((u32 *) fb->pseudo_palette)[regno] =
 				((transp & 0xff00) << 16) | ((red & 0xff00) << 8) |
 				((green & 0xff00)) | ((blue & 0xff00) >> 8);
-		break;
+			break;
 #endif
-	default:
-		return 1;
+		default:
+			return 1;
+		}
 	}
+
 	return 0;
 }
 

-- 

[patch 31/54] TG3: Fix link problem on Dells onboard 5906.

[Chris Wright]

[-- Attachment #1: tg3-fix-link-problem-on-dell-s-onboard-5906.patch --]
[-- Type: text/plain, Size: 1783 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From:  <mchan@broadcom.com>

The bug is caused by code that always set
(TG3_FLAG_USE_MI_INTERRUPT | TG3_FLAG_USE_LINKCHG_REG) on all Dell's
onboard devices.  With these 2 flags set, the link status is polled
by tg3_timer() and will only work when the PHY is set up to interrupt
the MAC on link changes.  This breaks 5906 because the 5906 PHY does
not support TG3_FLAG_USE_MI_INTERRUPT the same as other PHYs.

For correctness, only 5701 on Dell systems needs these 2 flags to be
set.  This change will fix the 5906 problem and will change other
Dell devices except 5700 and 5701 to use the more efficient
interrupt-driven link changes.

Update version to 3.75.2.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/tg3.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/drivers/net/tg3.c
+++ linux-2.6.21.4/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME		"tg3"
 #define PFX DRV_MODULE_NAME	": "
-#define DRV_MODULE_VERSION	"3.75.1"
-#define DRV_MODULE_RELDATE	"May 7, 2007"
+#define DRV_MODULE_VERSION	"3.75.2"
+#define DRV_MODULE_RELDATE	"June 5, 2007"
 
 #define TG3_DEF_MAC_MODE	0
 #define TG3_DEF_RX_MODE		0
@@ -10942,6 +10942,7 @@ static int __devinit tg3_get_invariants(
 	 * upon subsystem IDs.
 	 */
 	if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
+	    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 &&
 	    !(tp->tg3_flags2 & TG3_FLG2_PHY_SERDES)) {
 		tp->tg3_flags |= (TG3_FLAG_USE_MI_INTERRUPT |
 				  TG3_FLAG_USE_LINKCHG_REG);

-- 

[patch 32/54] UML - Improve host PTRACE_SYSEMU check

[Chris Wright]

[-- Attachment #1: uml-improve-host-ptrace_sysemu-check.patch --]
[-- Type: text/plain, Size: 2354 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Jeff Dike <jdike@addtoit.com>

Make the PTRACE_SYSEMU checking more robust.  It will make sure that
system call numbers are reported correctly.  If there is a problem, it
will disable PTRACE_SYSEMU use and use PTRACE_SYSCALL instead.

This fixes a hang on boot on FC6 hosts with a broken PTRACE_SYSEMU.

Signed-off-by: Jeff Dike <jdike@linux.intel.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--
 arch/um/os-Linux/start_up.c |   24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

--- linux-2.6.21.4.orig/arch/um/os-Linux/start_up.c
+++ linux-2.6.21.4/arch/um/os-Linux/start_up.c
@@ -144,9 +144,7 @@ static int stop_ptraced_child(int pid, v
 		int exit_with = WEXITSTATUS(status);
 		if (exit_with == 2)
 			non_fatal("check_ptrace : child exited with status 2. "
-				  "Serious trouble happening! Try updating "
-				  "your host skas patch!\nDisabling SYSEMU "
-				  "support.");
+				  "\nDisabling SYSEMU support.\n");
 		non_fatal("check_ptrace : child exited with exitcode %d, while "
 			  "expecting %d; status 0x%x\n", exit_with,
 			  exitcode, status);
@@ -209,6 +207,7 @@ __uml_setup("nosysemu", nosysemu_cmd_par
 static void __init check_sysemu(void)
 {
 	void *stack;
+	unsigned long regs[MAX_REG_NR];
 	int pid, n, status, count=0;
 
 	non_fatal("Checking syscall emulation patch for ptrace...");
@@ -225,11 +224,20 @@ static void __init check_sysemu(void)
 		fatal("check_sysemu : expected SIGTRAP, got status = %d",
 		      status);
 
-	n = ptrace(PTRACE_POKEUSR, pid, PT_SYSCALL_RET_OFFSET,
-		   os_getpid());
-	if(n < 0)
-		fatal_perror("check_sysemu : failed to modify system call "
-			     "return");
+	if(ptrace(PTRACE_GETREGS, pid, 0, regs) < 0)
+		fatal_perror("check_sysemu : PTRACE_GETREGS failed");
+	if(PT_SYSCALL_NR(regs) != __NR_getpid){
+		non_fatal("check_sysemu got system call number %d, "
+			  "expected %d...", PT_SYSCALL_NR(regs), __NR_getpid);
+		goto fail;
+	}
+
+	n = ptrace(PTRACE_POKEUSR, pid, PT_SYSCALL_RET_OFFSET, os_getpid());
+	if(n < 0){
+		non_fatal("check_sysemu : failed to modify system call "
+			  "return");
+		goto fail;
+	}
 
 	if (stop_ptraced_child(pid, stack, 0, 0) < 0)
 		goto fail_stopped;

-- 

[patch 33/54] x86: fix oprofile double free

[Chris Wright]

[-- Attachment #1: x86-fix-oprofile-double-free.patch --]
[-- Type: text/plain, Size: 1946 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Chris Wright <chrisw@sous-sol.org>

Chuck reports that the recent fix from Andi to oprofile
6c977aad03a18019015035958c65b6729cd0574c introduces a double free.  Each
cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free
cpu 0's pointers for_each_possible_cpu.  Rather than copy the pointers, do
a deep copy instead.

[acme@redhat.com: allocate_msrs() was using for_each_online_cpu()]
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Cc: Andi Kleen <ak@suse.de>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Dave Jones <davej@redhat.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 arch/i386/oprofile/nmi_int.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/arch/i386/oprofile/nmi_int.c
+++ linux-2.6.21.4/arch/i386/oprofile/nmi_int.c
@@ -154,7 +154,7 @@ static int allocate_msrs(void)
 	size_t counters_size = sizeof(struct op_msr) * model->num_counters;
 
 	int i;
-	for_each_online_cpu(i) {
+	for_each_possible_cpu(i) {
 		cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL);
 		if (!cpu_msrs[i].counters) {
 			success = 0;
@@ -211,8 +211,14 @@ static int nmi_setup(void)
 	/* Assume saved/restored counters are the same on all CPUs */
 	model->fill_in_addresses(&cpu_msrs[0]);
 	for_each_possible_cpu (cpu) {
-		if (cpu != 0)
-			cpu_msrs[cpu] = cpu_msrs[0];
+		if (cpu != 0) {
+			memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters,
+				sizeof(struct op_msr) * model->num_counters);
+
+			memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls,
+				sizeof(struct op_msr) * model->num_controls);
+		}
+
 	}
 	on_each_cpu(nmi_save_registers, NULL, 0, 1);
 	on_each_cpu(nmi_cpu_setup, NULL, 0, 1);

-- 

[patch 34/54] Fix roundup_pow_of_two(1)

[Chris Wright]

[-- Attachment #1: fix-roundup_pow_of_two.patch --]
[-- Type: text/plain, Size: 991 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Rolf Eike Beer <eike-kernel@sf-tec.de>

Fix roundup_pow_of_two(1)

1 is a power of two, therefore roundup_pow_of_two(1) should return 1. It does
in case the argument is a variable but in case it's a constant it behaves
wrong and returns 0. Probably nobody ever did it so this was never noticed.

Signed-off-by: Rolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 include/linux/log2.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/include/linux/log2.h
+++ linux-2.6.21.4/include/linux/log2.h
@@ -159,7 +159,7 @@ unsigned long __roundup_pow_of_two(unsig
 #define roundup_pow_of_two(n)			\
 (						\
 	__builtin_constant_p(n) ? (		\
-		(n == 1) ? 0 :			\
+		(n == 1) ? 1 :			\
 		(1UL << (ilog2((n) - 1) + 1))	\
 				   ) :		\
 	__roundup_pow_of_two(n)			\

-- 

[patch 35/54] USB: set the correct Interrupt interval in usb_bulk_msg

[Chris Wright]

[-- Attachment #1: usb-set-the-correct-interrupt-interval-in-usb_bulk_msg.patch --]
[-- Type: text/plain, Size: 1332 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Alan Stern <stern@rowland.harvard.edu>

This patch (as902) fixes a mistake I introduced into usb_bulk_msg().
usb_fill_int_urb() already does the bit-shifting calculation for
high-speed Interrupt intervals; it shouldn't be done twice.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/usb/core/message.c |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

--- linux-2.6.21.4.orig/drivers/usb/core/message.c
+++ linux-2.6.21.4/drivers/usb/core/message.c
@@ -221,15 +221,10 @@ int usb_bulk_msg(struct usb_device *usb_
 
 	if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
 			USB_ENDPOINT_XFER_INT) {
-		int interval;
-
-		if (usb_dev->speed == USB_SPEED_HIGH)
-			interval = 1 << min(15, ep->desc.bInterval - 1);
-		else
-			interval = ep->desc.bInterval;
 		pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
 		usb_fill_int_urb(urb, usb_dev, pipe, data, len,
-				usb_api_blocking_completion, NULL, interval);
+				usb_api_blocking_completion, NULL,
+				ep->desc.bInterval);
 	} else
 		usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
 				usb_api_blocking_completion, NULL);

-- 

[patch 36/54] acpi: fix potential call to a freed memory section.

[Chris Wright]

[-- Attachment #1: acpi-fix-potential-call-to-a-freed-memory-section.patch --]
[-- Type: text/plain, Size: 2323 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Aaron Durbin <adurbin@google.com>

Strip __cpuinit[data] from Node <-> PXM routines and supporting data
structures.  Also make pxm_to_node_map and node_to_pxm_map local to the
numa acpi module.

This fixes a bug triggered by the following conditions:
- boot on a machine with a SLIT table defined
- kernel is configured w/ CONFIG_HOTPLUG_CPU=n
- cat /sys/devices/system/node/node*/distance
This will cause an oops by calling into a freed memory section.

In particular, on x86_64, __node_distance calls node_to_pxm().

Signed-off-by: Aaron Durbin <adurbin@google.com>
Cc: Len Brown <lenb@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/acpi/numa.c      |    8 ++++----
 include/acpi/acpi_numa.h |    7 ++-----
 2 files changed, 6 insertions(+), 9 deletions(-)

--- linux-2.6.21.4.orig/drivers/acpi/numa.c
+++ linux-2.6.21.4/drivers/acpi/numa.c
@@ -40,19 +40,19 @@ static nodemask_t nodes_found_map = NODE
 #define NID_INVAL	-1
 
 /* maps to convert between proximity domain and logical node ID */
-int __cpuinitdata pxm_to_node_map[MAX_PXM_DOMAINS]
+static int pxm_to_node_map[MAX_PXM_DOMAINS]
 				= { [0 ... MAX_PXM_DOMAINS - 1] = NID_INVAL };
-int __cpuinitdata node_to_pxm_map[MAX_NUMNODES]
+static int node_to_pxm_map[MAX_NUMNODES]
 				= { [0 ... MAX_NUMNODES - 1] = PXM_INVAL };
 
-int __cpuinit pxm_to_node(int pxm)
+int pxm_to_node(int pxm)
 {
 	if (pxm < 0)
 		return NID_INVAL;
 	return pxm_to_node_map[pxm];
 }
 
-int __cpuinit node_to_pxm(int node)
+int node_to_pxm(int node)
 {
 	if (node < 0)
 		return PXM_INVAL;
--- linux-2.6.21.4.orig/include/acpi/acpi_numa.h
+++ linux-2.6.21.4/include/acpi/acpi_numa.h
@@ -11,11 +11,8 @@
 #define MAX_PXM_DOMAINS (256) /* Old pxm spec is defined 8 bit */
 #endif
 
-extern int __cpuinitdata pxm_to_node_map[MAX_PXM_DOMAINS];
-extern int __cpuinitdata node_to_pxm_map[MAX_NUMNODES];
-
-extern int __cpuinit pxm_to_node(int);
-extern int __cpuinit node_to_pxm(int);
+extern int pxm_to_node(int);
+extern int node_to_pxm(int);
 extern int __cpuinit acpi_map_pxm_to_node(int);
 extern void __cpuinit acpi_unmap_pxm_to_node(int);
 

-- 

[patch 37/54] SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)

[Chris Wright]

[-- Attachment #1: aacraid-correct-sa-platform-support.patch --]
[-- Type: text/plain, Size: 3147 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Mark Salyzyn <mark_salyzyn@adaptec.com>

As discussed in the bugzilla outlined below, we have an sa based
(Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
5400S. This problem  coincides with the introduction of the adapter_comm
and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
rework communication support code, January 23 2007, which initially
migrated to 2.6.21)

The panic occurs with an uninitialized adapter_deliver platform function
pointer. The enclosed patch, unmodified as tested by Rainer, solves the
problem.

Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/scsi/aacraid/aacraid.h |    1 +
 drivers/scsi/aacraid/rx.c      |    2 +-
 drivers/scsi/aacraid/sa.c      |    9 ++++++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
+++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
@@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
 int aac_get_adapter_info(struct aac_dev* dev);
 int aac_send_shutdown(struct aac_dev *dev);
 int aac_probe_container(struct aac_dev *dev, int cid);
+int aac_rx_deliver_producer(struct fib * fib);
 extern int numacb;
 extern int acbsize;
 extern char aac_driver_version[];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
@@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
  *
  *	Will send a fib, returning 0 if successful.
  */
-static int aac_rx_deliver_producer(struct fib * fib)
+int aac_rx_deliver_producer(struct fib * fib)
 {
 	struct aac_dev *dev = fib->dev;
 	struct aac_queue *q = &dev->queues->queue[AdapNormCmdQueue];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
@@ -5,7 +5,7 @@
  * based on the old aacraid driver that is..
  * Adaptec aacraid device driver for Linux.
  *
- * Copyright (c) 2000 Adaptec, Inc. (aacraid@adaptec.com)
+ * Copyright (c) 2000-2007 Adaptec, Inc. (aacraid@adaptec.com)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -258,6 +258,11 @@ static void aac_sa_start_adapter(struct 
 			NULL, NULL, NULL, NULL, NULL);
 }
 
+static int aac_sa_restart_adapter(struct aac_dev *dev, int bled)
+{
+	return -EINVAL;
+}
+
 /**
  *	aac_sa_check_health
  *	@dev: device to check if healthy
@@ -367,7 +372,9 @@ int aac_sa_init(struct aac_dev *dev)
 	dev->a_ops.adapter_notify = aac_sa_notify_adapter;
 	dev->a_ops.adapter_sync_cmd = sa_sync_cmd;
 	dev->a_ops.adapter_check_health = aac_sa_check_health;
+	dev->a_ops.adapter_restart = aac_sa_restart_adapter;
 	dev->a_ops.adapter_intr = aac_sa_intr;
+	dev->a_ops.adapter_deliver = aac_rx_deliver_producer;
 	dev->a_ops.adapter_ioremap = aac_sa_ioremap;
 
 	/*

-- 

[patch 38/54] cciss: fix pci_driver.shutdown while device is still active

[Chris Wright]

[-- Attachment #1: cciss-fix-pci_driver.shutdown-while-device-is-still-active.patch --]
[-- Type: text/plain, Size: 3401 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Gerald Britton <gbritton@alum.mit.edu>

Fix an Oops in the cciss driver caused by system shutdown while a
filesystem on a cciss device is still active.  The cciss_remove_one
function only properly removes the device if the device has been cleanly
released by its users, which is not the case when the pci_driver.shutdown
method is called.

This patch adds a new cciss_shutdown function to better match the pattern
used by various SCSI drivers: deactivate device interrupts and flush
caches.  It also alters the cciss_remove_one function to match and readds
the __devexit annotation that was removed when cciss_remove_one was serving
as the pci_driver.shutdown method.

Signed-off-by: Gerald Britton <gbritton@alum.mit.edu>
Acked-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>


---
 drivers/block/cciss.c |   45 ++++++++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 15 deletions(-)

--- linux-2.6.21.4.orig/drivers/block/cciss.c
+++ linux-2.6.21.4/drivers/block/cciss.c
@@ -3405,13 +3405,39 @@ static int __devinit cciss_init_one(stru
 	return -1;
 }
 
-static void cciss_remove_one(struct pci_dev *pdev)
+static void cciss_shutdown(struct pci_dev *pdev)
 {
 	ctlr_info_t *tmp_ptr;
-	int i, j;
+	int i;
 	char flush_buf[4];
 	int return_code;
 
+	tmp_ptr = pci_get_drvdata(pdev);
+	if (tmp_ptr == NULL)
+		return;
+	i = tmp_ptr->ctlr;
+	if (hba[i] == NULL)
+		return;
+
+	/* Turn board interrupts off  and send the flush cache command */
+	/* sendcmd will turn off interrupt, and send the flush...
+	 * To write all data in the battery backed cache to disks */
+	memset(flush_buf, 0, 4);
+	return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0, 0, 0, NULL,
+			      TYPE_CMD);
+	if (return_code == IO_OK) {
+		printk(KERN_INFO "Completed flushing cache on controller %d\n", i);
+	} else {
+		printk(KERN_WARNING "Error flushing cache on controller %d\n", i);
+	}
+	free_irq(hba[i]->intr[2], hba[i]);
+}
+
+static void __devexit cciss_remove_one(struct pci_dev *pdev)
+{
+	ctlr_info_t *tmp_ptr;
+	int i, j;
+
 	if (pci_get_drvdata(pdev) == NULL) {
 		printk(KERN_ERR "cciss: Unable to remove device \n");
 		return;
@@ -3442,18 +3468,7 @@ static void cciss_remove_one(struct pci_
 
 	cciss_unregister_scsi(i);	/* unhook from SCSI subsystem */
 
-	/* Turn board interrupts off  and send the flush cache command */
-	/* sendcmd will turn off interrupt, and send the flush...
-	 * To write all data in the battery backed cache to disks */
-	memset(flush_buf, 0, 4);
-	return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0, 0, 0, NULL,
-			      TYPE_CMD);
-	if (return_code == IO_OK) {
-		printk(KERN_INFO "Completed flushing cache on controller %d\n", i);
-	} else {
-		printk(KERN_WARNING "Error flushing cache on controller %d\n", i);
-	}
-	free_irq(hba[i]->intr[2], hba[i]);
+	cciss_shutdown(pdev);
 
 #ifdef CONFIG_PCI_MSI
 	if (hba[i]->msix_vector)
@@ -3486,7 +3501,7 @@ static struct pci_driver cciss_pci_drive
 	.probe = cciss_init_one,
 	.remove = __devexit_p(cciss_remove_one),
 	.id_table = cciss_pci_device_id,	/* id_table */
-	.shutdown = cciss_remove_one,
+	.shutdown = cciss_shutdown,
 };
 
 /*

-- 

[patch 39/54] Work around Dell E520 BIOS reboot bug

[Chris Wright]

[-- Attachment #1: work-around-dell-e520-bios-reboot-bug.patch --]
[-- Type: text/plain, Size: 1361 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Tim Gardner <tim.gardner@ubuntu.com>

Force Dell E520 to use the BIOS to shutdown/reboot.

I have at least one report that this patch fixes shutdown/reboot
problems on the Dell E520 platform.

(Andi says: People can always set the boot option.  It hardly seems like a
critical issue needing a backport.)

Signed-off-by: Tim Gardner <tim.gardner@ubuntu.com>
Acked-by: Andi Kleen <ak@suse.de>
Acked-by: Matt Domsch <Matt_Domsch@dell.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>


---
 arch/i386/kernel/reboot.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- linux-2.6.21.4.orig/arch/i386/kernel/reboot.c
+++ linux-2.6.21.4/arch/i386/kernel/reboot.c
@@ -88,6 +88,14 @@ static int __init set_bios_reboot(struct
 }
 
 static struct dmi_system_id __initdata reboot_dmi_table[] = {
+	{	/* Handle problems with rebooting on Dell E520's */
+		.callback = set_bios_reboot,
+		.ident = "Dell E520",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Dell DM061"),
+		},
+	},
 	{	/* Handle problems with rebooting on Dell 1300's */
 		.callback = set_bios_reboot,
 		.ident = "Dell PowerEdge 1300",

-- 

[patch 40/54] Fix AF_UNIX OOPS

[Chris Wright]

[-- Attachment #1: fix-af_unix-oops.patch --]
[-- Type: text/plain, Size: 12839 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: David Miller <davem@davemloft.net>

This combines two upstream commits to fix an OOPS with
AF_UNIX and SELINUX.

Basically, sk->sk_socket can become NULL because we access
a peer socket without any locking, so it can be shut down and
released in another thread.

Commit: d410b81b4eef2e4409f9c38ef201253fbbcc7d94
[AF_UNIX]: Make socket locking much less confusing.

The unix_state_*() locking macros imply that there is some
rwlock kind of thing going on, but the implementation is
actually a spinlock which makes the code more confusing than
it needs to be.

So use plain unix_state_lock and unix_state_unlock.

Signed-off-by: David S. Miller <davem@davemloft.net>

Commit: 19fec3e807a487415e77113cb9dbdaa2da739836
[AF_UNIX]: Fix datagram connect race causing an OOPS.

Based upon an excellent bug report and initial patch by
Frederik Deweerdt.

The UNIX datagram connect code blindly dereferences other->sk_socket
via the call down to the security_unix_may_send() function.

Without locking 'other' that pointer can go NULL via unix_release_sock()
which does sock_orphan() which also marks the socket SOCK_DEAD.

So we have to lock both 'sk' and 'other' yet avoid all kinds of
potential deadlocks (connect to self is OK for datagram sockets and it
is possible for two datagram sockets to perform a simultaneous connect
to each other).  So what we do is have a "double lock" function similar
to how we handle this situation in other areas of the kernel.  We take
the lock of the socket pointer with the smallest address first in
order to avoid ABBA style deadlocks.

Once we have them both locked, we check to see if SOCK_DEAD is set
for 'other' and if so, drop everything and retry the lookup.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 include/net/af_unix.h |    8 +--
 net/unix/af_unix.c    |  127 +++++++++++++++++++++++++++++++-------------------
 2 files changed, 83 insertions(+), 52 deletions(-)

--- linux-2.6.21.4.orig/include/net/af_unix.h
+++ linux-2.6.21.4/include/net/af_unix.h
@@ -62,13 +62,11 @@ struct unix_skb_parms {
 #define UNIXCREDS(skb)	(&UNIXCB((skb)).creds)
 #define UNIXSID(skb)	(&UNIXCB((skb)).secid)
 
-#define unix_state_rlock(s)	spin_lock(&unix_sk(s)->lock)
-#define unix_state_runlock(s)	spin_unlock(&unix_sk(s)->lock)
-#define unix_state_wlock(s)	spin_lock(&unix_sk(s)->lock)
-#define unix_state_wlock_nested(s) \
+#define unix_state_lock(s)	spin_lock(&unix_sk(s)->lock)
+#define unix_state_unlock(s)	spin_unlock(&unix_sk(s)->lock)
+#define unix_state_lock_nested(s) \
 				spin_lock_nested(&unix_sk(s)->lock, \
 				SINGLE_DEPTH_NESTING)
-#define unix_state_wunlock(s)	spin_unlock(&unix_sk(s)->lock)
 
 #ifdef __KERNEL__
 /* The AF_UNIX socket */
--- linux-2.6.21.4.orig/net/unix/af_unix.c
+++ linux-2.6.21.4/net/unix/af_unix.c
@@ -175,11 +175,11 @@ static struct sock *unix_peer_get(struct
 {
 	struct sock *peer;
 
-	unix_state_rlock(s);
+	unix_state_lock(s);
 	peer = unix_peer(s);
 	if (peer)
 		sock_hold(peer);
-	unix_state_runlock(s);
+	unix_state_unlock(s);
 	return peer;
 }
 
@@ -370,7 +370,7 @@ static int unix_release_sock (struct soc
 	unix_remove_socket(sk);
 
 	/* Clear state */
-	unix_state_wlock(sk);
+	unix_state_lock(sk);
 	sock_orphan(sk);
 	sk->sk_shutdown = SHUTDOWN_MASK;
 	dentry	     = u->dentry;
@@ -379,7 +379,7 @@ static int unix_release_sock (struct soc
 	u->mnt	     = NULL;
 	state = sk->sk_state;
 	sk->sk_state = TCP_CLOSE;
-	unix_state_wunlock(sk);
+	unix_state_unlock(sk);
 
 	wake_up_interruptible_all(&u->peer_wait);
 
@@ -387,12 +387,12 @@ static int unix_release_sock (struct soc
 
 	if (skpair!=NULL) {
 		if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
-			unix_state_wlock(skpair);
+			unix_state_lock(skpair);
 			/* No more writes */
 			skpair->sk_shutdown = SHUTDOWN_MASK;
 			if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)
 				skpair->sk_err = ECONNRESET;
-			unix_state_wunlock(skpair);
+			unix_state_unlock(skpair);
 			skpair->sk_state_change(skpair);
 			read_lock(&skpair->sk_callback_lock);
 			sk_wake_async(skpair,1,POLL_HUP);
@@ -449,7 +449,7 @@ static int unix_listen(struct socket *so
 	err = -EINVAL;
 	if (!u->addr)
 		goto out;			/* No listens on an unbound socket */
-	unix_state_wlock(sk);
+	unix_state_lock(sk);
 	if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
 		goto out_unlock;
 	if (backlog > sk->sk_max_ack_backlog)
@@ -463,7 +463,7 @@ static int unix_listen(struct socket *so
 	err = 0;
 
 out_unlock:
-	unix_state_wunlock(sk);
+	unix_state_unlock(sk);
 out:
 	return err;
 }
@@ -859,6 +859,31 @@ out_mknod_parent:
 	goto out_up;
 }
 
+static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
+{
+	if (unlikely(sk1 == sk2) || !sk2) {
+		unix_state_lock(sk1);
+		return;
+	}
+	if (sk1 < sk2) {
+		unix_state_lock(sk1);
+		unix_state_lock_nested(sk2);
+	} else {
+		unix_state_lock(sk2);
+		unix_state_lock_nested(sk1);
+	}
+}
+
+static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
+{
+	if (unlikely(sk1 == sk2) || !sk2) {
+		unix_state_unlock(sk1);
+		return;
+	}
+	unix_state_unlock(sk1);
+	unix_state_unlock(sk2);
+}
+
 static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
 			      int alen, int flags)
 {
@@ -878,11 +903,19 @@ static int unix_dgram_connect(struct soc
 		    !unix_sk(sk)->addr && (err = unix_autobind(sock)) != 0)
 			goto out;
 
+restart:
 		other=unix_find_other(sunaddr, alen, sock->type, hash, &err);
 		if (!other)
 			goto out;
 
-		unix_state_wlock(sk);
+		unix_state_double_lock(sk, other);
+
+		/* Apparently VFS overslept socket death. Retry. */
+		if (sock_flag(other, SOCK_DEAD)) {
+			unix_state_double_unlock(sk, other);
+			sock_put(other);
+			goto restart;
+		}
 
 		err = -EPERM;
 		if (!unix_may_send(sk, other))
@@ -897,7 +930,7 @@ static int unix_dgram_connect(struct soc
 		 *	1003.1g breaking connected state with AF_UNSPEC
 		 */
 		other = NULL;
-		unix_state_wlock(sk);
+		unix_state_double_lock(sk, other);
 	}
 
 	/*
@@ -906,19 +939,19 @@ static int unix_dgram_connect(struct soc
 	if (unix_peer(sk)) {
 		struct sock *old_peer = unix_peer(sk);
 		unix_peer(sk)=other;
-		unix_state_wunlock(sk);
+		unix_state_double_unlock(sk, other);
 
 		if (other != old_peer)
 			unix_dgram_disconnected(sk, old_peer);
 		sock_put(old_peer);
 	} else {
 		unix_peer(sk)=other;
-		unix_state_wunlock(sk);
+		unix_state_double_unlock(sk, other);
 	}
 	return 0;
 
 out_unlock:
-	unix_state_wunlock(sk);
+	unix_state_double_unlock(sk, other);
 	sock_put(other);
 out:
 	return err;
@@ -937,7 +970,7 @@ static long unix_wait_for_peer(struct so
 		(skb_queue_len(&other->sk_receive_queue) >
 		 other->sk_max_ack_backlog);
 
-	unix_state_runlock(other);
+	unix_state_unlock(other);
 
 	if (sched)
 		timeo = schedule_timeout(timeo);
@@ -995,11 +1028,11 @@ restart:
 		goto out;
 
 	/* Latch state of peer */
-	unix_state_rlock(other);
+	unix_state_lock(other);
 
 	/* Apparently VFS overslept socket death. Retry. */
 	if (sock_flag(other, SOCK_DEAD)) {
-		unix_state_runlock(other);
+		unix_state_unlock(other);
 		sock_put(other);
 		goto restart;
 	}
@@ -1049,18 +1082,18 @@ restart:
 		goto out_unlock;
 	}
 
-	unix_state_wlock_nested(sk);
+	unix_state_lock_nested(sk);
 
 	if (sk->sk_state != st) {
-		unix_state_wunlock(sk);
-		unix_state_runlock(other);
+		unix_state_unlock(sk);
+		unix_state_unlock(other);
 		sock_put(other);
 		goto restart;
 	}
 
 	err = security_unix_stream_connect(sock, other->sk_socket, newsk);
 	if (err) {
-		unix_state_wunlock(sk);
+		unix_state_unlock(sk);
 		goto out_unlock;
 	}
 
@@ -1097,7 +1130,7 @@ restart:
 	smp_mb__after_atomic_inc();	/* sock_hold() does an atomic_inc() */
 	unix_peer(sk)	= newsk;
 
-	unix_state_wunlock(sk);
+	unix_state_unlock(sk);
 
 	/* take ten and and send info to listening sock */
 	spin_lock(&other->sk_receive_queue.lock);
@@ -1106,14 +1139,14 @@ restart:
 	 * is installed to listening socket. */
 	atomic_inc(&newu->inflight);
 	spin_unlock(&other->sk_receive_queue.lock);
-	unix_state_runlock(other);
+	unix_state_unlock(other);
 	other->sk_data_ready(other, 0);
 	sock_put(other);
 	return 0;
 
 out_unlock:
 	if (other)
-		unix_state_runlock(other);
+		unix_state_unlock(other);
 
 out:
 	if (skb)
@@ -1179,10 +1212,10 @@ static int unix_accept(struct socket *so
 	wake_up_interruptible(&unix_sk(sk)->peer_wait);
 
 	/* attach accepted sock to socket */
-	unix_state_wlock(tsk);
+	unix_state_lock(tsk);
 	newsock->state = SS_CONNECTED;
 	sock_graft(tsk, newsock);
-	unix_state_wunlock(tsk);
+	unix_state_unlock(tsk);
 	return 0;
 
 out:
@@ -1209,7 +1242,7 @@ static int unix_getname(struct socket *s
 	}
 
 	u = unix_sk(sk);
-	unix_state_rlock(sk);
+	unix_state_lock(sk);
 	if (!u->addr) {
 		sunaddr->sun_family = AF_UNIX;
 		sunaddr->sun_path[0] = 0;
@@ -1220,7 +1253,7 @@ static int unix_getname(struct socket *s
 		*uaddr_len = addr->len;
 		memcpy(sunaddr, addr->name, *uaddr_len);
 	}
-	unix_state_runlock(sk);
+	unix_state_unlock(sk);
 	sock_put(sk);
 out:
 	return err;
@@ -1338,7 +1371,7 @@ restart:
 			goto out_free;
 	}
 
-	unix_state_rlock(other);
+	unix_state_lock(other);
 	err = -EPERM;
 	if (!unix_may_send(sk, other))
 		goto out_unlock;
@@ -1348,20 +1381,20 @@ restart:
 		 *	Check with 1003.1g - what should
 		 *	datagram error
 		 */
-		unix_state_runlock(other);
+		unix_state_unlock(other);
 		sock_put(other);
 
 		err = 0;
-		unix_state_wlock(sk);
+		unix_state_lock(sk);
 		if (unix_peer(sk) == other) {
 			unix_peer(sk)=NULL;
-			unix_state_wunlock(sk);
+			unix_state_unlock(sk);
 
 			unix_dgram_disconnected(sk, other);
 			sock_put(other);
 			err = -ECONNREFUSED;
 		} else {
-			unix_state_wunlock(sk);
+			unix_state_unlock(sk);
 		}
 
 		other = NULL;
@@ -1398,14 +1431,14 @@ restart:
 	}
 
 	skb_queue_tail(&other->sk_receive_queue, skb);
-	unix_state_runlock(other);
+	unix_state_unlock(other);
 	other->sk_data_ready(other, len);
 	sock_put(other);
 	scm_destroy(siocb->scm);
 	return len;
 
 out_unlock:
-	unix_state_runlock(other);
+	unix_state_unlock(other);
 out_free:
 	kfree_skb(skb);
 out:
@@ -1495,14 +1528,14 @@ static int unix_stream_sendmsg(struct ki
 			goto out_err;
 		}
 
-		unix_state_rlock(other);
+		unix_state_lock(other);
 
 		if (sock_flag(other, SOCK_DEAD) ||
 		    (other->sk_shutdown & RCV_SHUTDOWN))
 			goto pipe_err_free;
 
 		skb_queue_tail(&other->sk_receive_queue, skb);
-		unix_state_runlock(other);
+		unix_state_unlock(other);
 		other->sk_data_ready(other, size);
 		sent+=size;
 	}
@@ -1513,7 +1546,7 @@ static int unix_stream_sendmsg(struct ki
 	return sent;
 
 pipe_err_free:
-	unix_state_runlock(other);
+	unix_state_unlock(other);
 	kfree_skb(skb);
 pipe_err:
 	if (sent==0 && !(msg->msg_flags&MSG_NOSIGNAL))
@@ -1642,7 +1675,7 @@ static long unix_stream_data_wait(struct
 {
 	DEFINE_WAIT(wait);
 
-	unix_state_rlock(sk);
+	unix_state_lock(sk);
 
 	for (;;) {
 		prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
@@ -1655,14 +1688,14 @@ static long unix_stream_data_wait(struct
 			break;
 
 		set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-		unix_state_runlock(sk);
+		unix_state_unlock(sk);
 		timeo = schedule_timeout(timeo);
-		unix_state_rlock(sk);
+		unix_state_lock(sk);
 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 	}
 
 	finish_wait(sk->sk_sleep, &wait);
-	unix_state_runlock(sk);
+	unix_state_unlock(sk);
 	return timeo;
 }
 
@@ -1817,12 +1850,12 @@ static int unix_shutdown(struct socket *
 	mode = (mode+1)&(RCV_SHUTDOWN|SEND_SHUTDOWN);
 
 	if (mode) {
-		unix_state_wlock(sk);
+		unix_state_lock(sk);
 		sk->sk_shutdown |= mode;
 		other=unix_peer(sk);
 		if (other)
 			sock_hold(other);
-		unix_state_wunlock(sk);
+		unix_state_unlock(sk);
 		sk->sk_state_change(sk);
 
 		if (other &&
@@ -1834,9 +1867,9 @@ static int unix_shutdown(struct socket *
 				peer_mode |= SEND_SHUTDOWN;
 			if (mode&SEND_SHUTDOWN)
 				peer_mode |= RCV_SHUTDOWN;
-			unix_state_wlock(other);
+			unix_state_lock(other);
 			other->sk_shutdown |= peer_mode;
-			unix_state_wunlock(other);
+			unix_state_unlock(other);
 			other->sk_state_change(other);
 			read_lock(&other->sk_callback_lock);
 			if (peer_mode == SHUTDOWN_MASK)
@@ -1974,7 +2007,7 @@ static int unix_seq_show(struct seq_file
 	else {
 		struct sock *s = v;
 		struct unix_sock *u = unix_sk(s);
-		unix_state_rlock(s);
+		unix_state_lock(s);
 
 		seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
 			s,
@@ -2002,7 +2035,7 @@ static int unix_seq_show(struct seq_file
 			for ( ; i < len; i++)
 				seq_putc(seq, u->addr->name->sun_path[i]);
 		}
-		unix_state_runlock(s);
+		unix_state_unlock(s);
 		seq_putc(seq, '\n');
 	}
 

-- 

[patch 41/54] ICMP: Fix icmp_errors_use_inbound_ifaddr sysctl

[Chris Wright]

[-- Attachment #1: icmp-fix-icmp_errors_use_inbound_ifaddr-sysctl.patch --]
[-- Type: text/plain, Size: 1344 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: David Miller <davem@davemloft.net>

Currently when icmp_errors_use_inbound_ifaddr is set and an ICMP error is
sent after the packet passed through ip_output(), an address from the
outgoing interface is chosen as ICMP source address since skb->dev doesn't
point to the incoming interface anymore.

Fix this by doing an interface lookup on rt->dst.iif and using that device.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/ipv4/icmp.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/net/ipv4/icmp.c
+++ linux-2.6.21.4/net/ipv4/icmp.c
@@ -513,9 +513,15 @@ void icmp_send(struct sk_buff *skb_in, i
 
 	saddr = iph->daddr;
 	if (!(rt->rt_flags & RTCF_LOCAL)) {
-		if (sysctl_icmp_errors_use_inbound_ifaddr)
-			saddr = inet_select_addr(skb_in->dev, 0, RT_SCOPE_LINK);
-		else
+		struct net_device *dev = NULL;
+
+		if (rt->fl.iif && sysctl_icmp_errors_use_inbound_ifaddr)
+			dev = dev_get_by_index(rt->fl.iif);
+
+		if (dev) {
+			saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
+			dev_put(dev);
+		} else
 			saddr = 0;
 	}
 

-- 

[patch 42/54] NET: parse ip:port strings correctly in in4_pton

[Chris Wright]

[-- Attachment #1: net-parse-ip-port-strings-correctly-in-in4_pton.patch --]
[-- Type: text/plain, Size: 1766 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Jerome Borsboom <j.borsboom@erasmusmc.nl>

in4_pton converts a textual representation of an ip4 address
into an integer representation. However, when the textual representation
is of in the form ip:port, e.g. 192.168.1.1:5060, and 'delim' is set to
-1, the function bails out with an error when reading the colon.

It makes sense to allow the colon as a delimiting character without
explicitly having to set it through the 'delim' variable as there can be
no ambiguity in the point where the ip address is completely parsed. This
function is indeed called from nf_conntrack_sip.c in this way to parse
textual ip:port combinations which fails due to the reason stated above.

Signed-off-by: Jerome Borsboom <j.borsboom@erasmusmc.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/core/utils.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/net/core/utils.c
+++ linux-2.6.21.4/net/core/utils.c
@@ -137,16 +137,16 @@ int in4_pton(const char *src, int srclen
 	while(1) {
 		int c;
 		c = xdigit2bin(srclen > 0 ? *s : '\0', delim);
-		if (!(c & (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM))) {
+		if (!(c & (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM | IN6PTON_COLON_MASK))) {
 			goto out;
 		}
-		if (c & (IN6PTON_DOT | IN6PTON_DELIM)) {
+		if (c & (IN6PTON_DOT | IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
 			if (w == 0)
 				goto out;
 			*d++ = w & 0xff;
 			w = 0;
 			i++;
-			if (c & IN6PTON_DELIM) {
+			if (c & (IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
 				if (i != 4)
 					goto out;
 				break;

-- 

[patch 43/54] IPSEC: Fix panic when using inter address familiy IPsec on loopback.

[Chris Wright]

[-- Attachment #1: ipsec-fix-panic-when-using-inter-address-familiy-ipsec-on-loopback.patch --]
[-- Type: text/plain, Size: 1872 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Kazunori MIYAZAWA <kazunori@miyazawa.org>

---
 net/ipv4/xfrm4_input.c       |    6 ++----
 net/ipv4/xfrm4_mode_tunnel.c |    2 ++
 net/ipv6/xfrm6_input.c       |    6 ++----
 net/ipv6/xfrm6_mode_tunnel.c |    1 +
 4 files changed, 7 insertions(+), 8 deletions(-)

--- linux-2.6.21.4.orig/net/ipv4/xfrm4_input.c
+++ linux-2.6.21.4/net/ipv4/xfrm4_input.c
@@ -138,10 +138,8 @@ int xfrm4_rcv_encap(struct sk_buff *skb,
 	nf_reset(skb);
 
 	if (decaps) {
-		if (!(skb->dev->flags&IFF_LOOPBACK)) {
-			dst_release(skb->dst);
-			skb->dst = NULL;
-		}
+		dst_release(skb->dst);
+		skb->dst = NULL;
 		netif_rx(skb);
 		return 0;
 	} else {
--- linux-2.6.21.4.orig/net/ipv4/xfrm4_mode_tunnel.c
+++ linux-2.6.21.4/net/ipv4/xfrm4_mode_tunnel.c
@@ -84,6 +84,8 @@ static int xfrm4_tunnel_output(struct xf
 	top_iph->saddr = x->props.saddr.a4;
 	top_iph->daddr = x->id.daddr.a4;
 
+	skb->protocol = htons(ETH_P_IP);
+
 	memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
 	return 0;
 }
--- linux-2.6.21.4.orig/net/ipv6/xfrm6_input.c
+++ linux-2.6.21.4/net/ipv6/xfrm6_input.c
@@ -104,10 +104,8 @@ int xfrm6_rcv_spi(struct sk_buff *skb, _
 	nf_reset(skb);
 
 	if (decaps) {
-		if (!(skb->dev->flags&IFF_LOOPBACK)) {
-			dst_release(skb->dst);
-			skb->dst = NULL;
-		}
+		dst_release(skb->dst);
+		skb->dst = NULL;
 		netif_rx(skb);
 		return -1;
 	} else {
--- linux-2.6.21.4.orig/net/ipv6/xfrm6_mode_tunnel.c
+++ linux-2.6.21.4/net/ipv6/xfrm6_mode_tunnel.c
@@ -80,6 +80,7 @@ static int xfrm6_tunnel_output(struct xf
 	top_iph->hop_limit = dst_metric(dst->child, RTAX_HOPLIMIT);
 	ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
 	ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
+	skb->protocol = htons(ETH_P_IPV6);
 	return 0;
 }
 

-- 

[patch 44/54] IPV6 ROUTE: No longer handle ::/0 specially.

[Chris Wright]

[-- Attachment #1: ipv6-route-no-longer-handle-0-specially.patch --]
[-- Type: text/plain, Size: 1023 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

We do not need to handle ::/0 routes specially any longer.
This should fix BUG #8349.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Yuji Sekiya <sekiya@wide.ad.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/ipv6/ip6_fib.c |    8 --------
 1 file changed, 8 deletions(-)

--- linux-2.6.21.4.orig/net/ipv6/ip6_fib.c
+++ linux-2.6.21.4/net/ipv6/ip6_fib.c
@@ -619,14 +619,6 @@ static int fib6_add_rt2node(struct fib6_
 
 	ins = &fn->leaf;
 
-	if (fn->fn_flags&RTN_TL_ROOT &&
-	    fn->leaf == &ip6_null_entry &&
-	    !(rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ){
-		fn->leaf = rt;
-		rt->u.dst.rt6_next = NULL;
-		goto out;
-	}
-
 	for (iter = fn->leaf; iter; iter=iter->u.dst.rt6_next) {
 		/*
 		 *	Search for duplicates

-- 

[patch 45/54] NET: Fix BMSR_100{HALF,FULL}2 defines in linux/mii.h

[Chris Wright]

[-- Attachment #1: net-fix-bmsr_100-half-full-2-defines-in-linux-mii.h.patch --]
[-- Type: text/plain, Size: 1207 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: David Miller <davem@davemloft.net>

Noticed by Matvejchikov Ilya.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 include/linux/mii.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/include/linux/mii.h
+++ linux-2.6.21.4/include/linux/mii.h
@@ -56,8 +56,8 @@
 #define BMSR_ANEGCOMPLETE       0x0020  /* Auto-negotiation complete   */
 #define BMSR_RESV               0x00c0  /* Unused...                   */
 #define BMSR_ESTATEN		0x0100	/* Extended Status in R15 */
-#define BMSR_100FULL2		0x0200	/* Can do 100BASE-T2 HDX */
-#define BMSR_100HALF2		0x0400	/* Can do 100BASE-T2 FDX */
+#define BMSR_100HALF2           0x0200  /* Can do 100BASE-T2 HDX */
+#define BMSR_100FULL2           0x0400  /* Can do 100BASE-T2 FDX */
 #define BMSR_10HALF             0x0800  /* Can do 10mbps, half-duplex  */
 #define BMSR_10FULL             0x1000  /* Can do 10mbps, full-duplex  */
 #define BMSR_100HALF            0x2000  /* Can do 100mbps, half-duplex */

-- 

[patch 46/54] NET: Fix race condition about network device name allocation.

[Chris Wright]

[-- Attachment #1: net-fix-race-condition-about-network-device-name-allocation.patch --]
[-- Type: text/plain, Size: 2335 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Stephen Hemminger <shemminger@linux-foundation.org>

Kenji Kaneshige found this race between device removal and
registration.  On unregister it is possible for the old device to
exist, because sysfs file is still open.  A new device with 'eth%d'
will select the same name, but sysfs kobject register will fial.

The following changes the shutdown order slightly. It hold a removes
the sysfs entries earlier (on unregister_netdevice), but holds a
kobject reference.  Then when todo runs the actual last put free
happens.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/core/dev.c       |   10 ++++++----
 net/core/net-sysfs.c |    8 +++++++-
 2 files changed, 13 insertions(+), 5 deletions(-)

--- linux-2.6.21.4.orig/net/core/dev.c
+++ linux-2.6.21.4/net/core/dev.c
@@ -3135,7 +3135,6 @@ void netdev_run_todo(void)
 			continue;
 		}
 
-		netdev_unregister_sysfs(dev);
 		dev->reg_state = NETREG_UNREGISTERED;
 
 		netdev_wait_allrefs(dev);
@@ -3146,11 +3145,11 @@ void netdev_run_todo(void)
 		BUG_TRAP(!dev->ip6_ptr);
 		BUG_TRAP(!dev->dn_ptr);
 
-		/* It must be the very last action,
-		 * after this 'dev' may point to freed up memory.
-		 */
 		if (dev->destructor)
 			dev->destructor(dev);
+
+		/* Free network device */
+		kobject_put(&dev->dev.kobj);
 	}
 
 out:
@@ -3305,6 +3304,9 @@ void unregister_netdevice(struct net_dev
 	/* Notifier chain MUST detach us from master device. */
 	BUG_TRAP(!dev->master);
 
+	/* Remove entries from sysfs */
+	netdev_unregister_sysfs(dev);
+
 	/* Finish processing unregister after unlock */
 	net_set_todo(dev);
 
--- linux-2.6.21.4.orig/net/core/net-sysfs.c
+++ linux-2.6.21.4/net/core/net-sysfs.c
@@ -451,9 +451,15 @@ static struct class net_class = {
 #endif
 };
 
+/* Delete sysfs entries but hold kobject reference until after all
+ * netdev references are gone.
+ */
 void netdev_unregister_sysfs(struct net_device * net)
 {
-	device_del(&(net->dev));
+	struct device *dev = &(net->dev);
+
+	kobject_get(&dev->kobj);
+	device_del(dev);
 }
 
 /* Create sysfs entries for network device. */

-- 

[patch 47/54] IPV4: Correct rp_filter help text.

[Chris Wright]

[-- Attachment #1: ipv4-correct-rp_filter-help-text.patch --]
[-- Type: text/plain, Size: 1297 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Dave Jones <davej@redhat.com>

As mentioned in http://bugzilla.kernel.org/show_bug.cgi?id=5015
The helptext implies that this is on by default.
This may be true on some distros (Fedora/RHEL have it enabled
in /etc/sysctl.conf), but the kernel defaults to it off.

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/ipv4/Kconfig |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/net/ipv4/Kconfig
+++ linux-2.6.21.4/net/ipv4/Kconfig
@@ -43,11 +43,11 @@ config IP_ADVANCED_ROUTER
 	  asymmetric routing (packets from you to a host take a different path
 	  than packets from that host to you) or if you operate a non-routing
 	  host which has several IP addresses on different interfaces. To turn
-	  rp_filter off use:
+	  rp_filter on use:
 
-	  echo 0 > /proc/sys/net/ipv4/conf/<device>/rp_filter
+	  echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter
 	  or
-	  echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
+	  echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
 
 	  If unsure, say N here.
 

-- 

[patch 48/54] SPARC: Linux always started with 9600 8N1

[Chris Wright]

[-- Attachment #1: sparc-linux-always-started-with-9600-8n1.patch --]
[-- Type: text/plain, Size: 1484 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Jan Engelhardt <jengelh@gmx.de>

The Linux kernel ignored the PROM's serial settings (115200,n,8,1 in
my case). This was because mode_prop remained "ttyX-mode" (expected:
"ttya-mode") due to the constness of string literals when used with
"char *". Since there is no "ttyX-mode" property in the PROM, Linux
always used the default 9600.

[ Investigation of the suncore.s assembler reveals that gcc optimizied
  away the stores, yet did not emit a warning, which is a pretty
  anti-social thing to do and is the only reason this bug lived for
  so long -DaveM ]

Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/serial/suncore.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/drivers/serial/suncore.c
+++ linux-2.6.21.4/drivers/serial/suncore.c
@@ -30,9 +30,9 @@ void
 sunserial_console_termios(struct console *con)
 {
 	char mode[16], buf[16], *s;
-	char *mode_prop = "ttyX-mode";
-	char *cd_prop = "ttyX-ignore-cd";
-	char *dtr_prop = "ttyX-rts-dtr-off";
+	char mode_prop[] = "ttyX-mode";
+	char cd_prop[]   = "ttyX-ignore-cd";
+	char dtr_prop[]  = "ttyX-rts-dtr-off";
 	char *ssp_console_modes_prop = "ssp-console-modes";
 	int baud, bits, stop, cflag;
 	char parity;

-- 

[patch 49/54] NET: "wrong timeout value" in sk_wait_data() v2

[Chris Wright]

[-- Attachment #1: net-wrong-timeout-value-in-sk_wait_data-v2.patch --]
[-- Type: text/plain, Size: 1759 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Vasily Averin <vvs@sw.ru>

sys_setsockopt() do not check properly timeout values for
SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout
values. POSIX do not defines behaviour for sys_setsockopt in case negative
timeouts, but requires that setsockopt() shall fail with -EDOM if the send and
receive timeout values are too big to fit into the timeout fields in the socket
structure.
In current implementation negative timeout can lead to error messages like
"schedule_timeout: wrong timeout value".

Proposed patch:
- checks tv_usec and returns -EDOM if it is wrong
- do not allows to set negative timeout values (sets 0 instead) and outputs
ratelimited information message about such attempts.

Signed-off-By: Vasily Averin <vvs@sw.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/core/sock.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- linux-2.6.21.4.orig/net/core/sock.c
+++ linux-2.6.21.4/net/core/sock.c
@@ -204,7 +204,19 @@ static int sock_set_timeout(long *timeo_
 		return -EINVAL;
 	if (copy_from_user(&tv, optval, sizeof(tv)))
 		return -EFAULT;
+	if (tv.tv_usec < 0 || tv.tv_usec >= USEC_PER_SEC)
+		return -EDOM;
 
+	if (tv.tv_sec < 0) {
+		static int warned = 0;
+		*timeo_p = 0;
+		if (warned < 10 && net_ratelimit())
+			warned++;
+			printk(KERN_INFO "sock_set_timeout: `%s' (pid %d) "
+			       "tries to set negative timeout\n",
+			        current->comm, current->pid);
+		return 0;
+	}
 	*timeo_p = MAX_SCHEDULE_TIMEOUT;
 	if (tv.tv_sec == 0 && tv.tv_usec == 0)
 		return 0;

-- 

[patch 50/54] SPARC64: Fix two bugs wrt. kernel 4MB TSB.

[Chris Wright]

[-- Attachment #1: sparc64-fix-two-bugs-wrt.-kernel-4mb-tsb.patch --]
[-- Type: text/plain, Size: 3499 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: David S. Miller <davem@sunset.davemloft.net>

1) The TSB lookup was not using the correct hash mask.

2) It was not aligned on a boundary equal to it's size,
   which is required by the sun4v Hypervisor.

wasn't having it's return value checked, and that bug will be fixed up
as well in a subsequent changeset.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc64/kernel/head.S |   31 ++++++++++++++++++++++++++-----
 arch/sparc64/mm/init.c     |    7 +++++--
 include/asm-sparc64/tsb.h  |    2 +-
 3 files changed, 32 insertions(+), 8 deletions(-)

--- linux-2.6.21.4.orig/arch/sparc64/kernel/head.S
+++ linux-2.6.21.4/arch/sparc64/kernel/head.S
@@ -653,33 +653,54 @@ setup_tba:
 	 restore
 sparc64_boot_end:
 
-#include "ktlb.S"
-#include "tsb.S"
 #include "etrap.S"
 #include "rtrap.S"
 #include "winfixup.S"
 #include "entry.S"
 #include "sun4v_tlb_miss.S"
 #include "sun4v_ivec.S"
+#include "ktlb.S"
+#include "tsb.S"
 
 /*
  * The following skip makes sure the trap table in ttable.S is aligned
  * on a 32K boundary as required by the v9 specs for TBA register.
  *
  * We align to a 32K boundary, then we have the 32K kernel TSB,
- * then the 32K aligned trap table.
+ * the 64K kernel 4MB TSB, and then the 32K aligned trap table.
  */
 1:
 	.skip	0x4000 + _start - 1b
 
+! 0x0000000000408000
+
 	.globl	swapper_tsb
 swapper_tsb:
 	.skip	(32 * 1024)
 
-! 0x0000000000408000
-
+	.globl	swapper_4m_tsb
+swapper_4m_tsb:
+	.skip	(64 * 1024)
+
+! 0x0000000000420000
+
+	/* Some care needs to be exercised if you try to move the
+	 * location of the trap table relative to other things.  For
+	 * one thing there are br* instructions in some of the
+	 * trap table entires which branch back to code in ktlb.S
+	 * Those instructions can only handle a signed 16-bit
+	 * displacement.
+	 *
+	 * There is a binutils bug (bugzilla #4558) which causes
+	 * the relocation overflow checks for such instructions to
+	 * not be done correctly.  So bintuils will not notice the
+	 * error and will instead write junk into the relocation and
+	 * you'll have an unbootable kernel.
+	 */
 #include "ttable.S"
 
+! 0x0000000000428000
+
 #include "systbls.S"
 
 	.data
--- linux-2.6.21.4.orig/arch/sparc64/mm/init.c
+++ linux-2.6.21.4/arch/sparc64/mm/init.c
@@ -60,8 +60,11 @@ unsigned long kern_linear_pte_xor[2] __r
 unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
 
 #ifndef CONFIG_DEBUG_PAGEALLOC
-/* A special kernel TSB for 4MB and 256MB linear mappings.  */
-struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
+/* A special kernel TSB for 4MB and 256MB linear mappings.
+ * Space is allocated for this right after the trap table
+ * in arch/sparc64/kernel/head.S
+ */
+extern struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
 #endif
 
 #define MAX_BANKS	32
--- linux-2.6.21.4.orig/include/asm-sparc64/tsb.h
+++ linux-2.6.21.4/include/asm-sparc64/tsb.h
@@ -271,7 +271,7 @@ extern struct tsb_phys_patch_entry __tsb
 #define KERN_TSB4M_LOOKUP_TL1(TAG, REG1, REG2, REG3, REG4, OK_LABEL) \
 	sethi		%hi(swapper_4m_tsb), REG1; \
 	or		REG1, %lo(swapper_4m_tsb), REG1; \
-	and		TAG, (KERNEL_TSB_NENTRIES - 1), REG2; \
+	and		TAG, (KERNEL_TSB4M_NENTRIES - 1), REG2; \
 	sllx		REG2, 4, REG2; \
 	add		REG1, REG2, REG2; \
 	KTSB_LOAD_QUAD(REG2, REG3); \

-- 

[patch 51/54] SPARC64: Fix _PAGE_EXEC_4U check in sun4u I-TLB miss handler.

[Chris Wright]

[-- Attachment #1: sparc64-fix-_page_exec_4u-check-in-sun4u-i-tlb-miss-handler.patch --]
[-- Type: text/plain, Size: 1205 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: David Miller <davem@davemloft.net>

It was using an immediate _PAGE_EXEC_4U value in an 'and'
instruction to perform the test.  This doesn't work because
the immediate field is signed 13-bit, this the mask being
tested against the PTE was 0x1000 sign-extended to 32-bits
instead of just plain 0x1000.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc64/kernel/itlb_miss.S |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/arch/sparc64/kernel/itlb_miss.S
+++ linux-2.6.21.4/arch/sparc64/kernel/itlb_miss.S
@@ -11,12 +11,12 @@
 /* ITLB ** ICACHE line 2: TSB compare and TLB load	*/
 	bne,pn	%xcc, tsb_miss_itlb		! Miss
 	 mov	FAULT_CODE_ITLB, %g3
-	andcc	%g5, _PAGE_EXEC_4U, %g0		! Executable?
+	sethi	%hi(_PAGE_EXEC_4U), %g4
+	andcc	%g5, %g4, %g0			! Executable?
 	be,pn	%xcc, tsb_do_fault
 	 nop					! Delay slot, fill me
 	stxa	%g5, [%g0] ASI_ITLB_DATA_IN	! Load TLB
 	retry					! Trap done
-	nop
 
 /* ITLB ** ICACHE line 3: 				*/
 	nop

-- 

[patch 52/54] SPARC64: Dont be picky about virtual-dma values on sun4v.

[Chris Wright]

[-- Attachment #1: sparc64-don-t-be-picky-about-virtual-dma-values-on-sun4v.patch --]
[-- Type: text/plain, Size: 2346 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: David Miller <davem@davemloft.net>

Handle arbitrary base and length values as long as they
are multiples of IO_PAGE_SIZE.

Bug found by Arun Kumar Rao.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc64/kernel/pci_sun4v.c |   36 ++++++++++--------------------------
 1 file changed, 10 insertions(+), 26 deletions(-)

--- linux-2.6.21.4.orig/arch/sparc64/kernel/pci_sun4v.c
+++ linux-2.6.21.4/arch/sparc64/kernel/pci_sun4v.c
@@ -12,6 +12,7 @@
 #include <linux/percpu.h>
 #include <linux/irq.h>
 #include <linux/msi.h>
+#include <linux/log2.h>
 
 #include <asm/pbm.h>
 #include <asm/iommu.h>
@@ -996,9 +997,8 @@ static void pci_sun4v_iommu_init(struct 
 {
 	struct pci_iommu *iommu = pbm->iommu;
 	struct property *prop;
-	unsigned long num_tsb_entries, sz;
+	unsigned long num_tsb_entries, sz, tsbsize;
 	u32 vdma[2], dma_mask, dma_offset;
-	int tsbsize;
 
 	prop = of_find_property(pbm->prom_node, "virtual-dma", NULL);
 	if (prop) {
@@ -1012,31 +1012,15 @@ static void pci_sun4v_iommu_init(struct 
 		vdma[1] = 0x80000000;
 	}
 
-	dma_mask = vdma[0];
-	switch (vdma[1]) {
-		case 0x20000000:
-			dma_mask |= 0x1fffffff;
-			tsbsize = 64;
-			break;
-
-		case 0x40000000:
-			dma_mask |= 0x3fffffff;
-			tsbsize = 128;
-			break;
-
-		case 0x80000000:
-			dma_mask |= 0x7fffffff;
-			tsbsize = 256;
-			break;
-
-		default:
-			prom_printf("PCI-SUN4V: strange virtual-dma size.\n");
-			prom_halt();
+	if ((vdma[0] | vdma[1]) & ~IO_PAGE_MASK) {
+		prom_printf("PCI-SUN4V: strange virtual-dma[%08x:%08x].\n",
+			    vdma[0], vdma[1]);
+		prom_halt();
 	};
 
-	tsbsize *= (8 * 1024);
-
-	num_tsb_entries = tsbsize / sizeof(iopte_t);
+	dma_mask = (roundup_pow_of_two(vdma[1]) - 1UL);
+	num_tsb_entries = vdma[1] / IO_PAGE_SIZE;
+	tsbsize = num_tsb_entries * sizeof(iopte_t);
 
 	dma_offset = vdma[0];
 
@@ -1047,7 +1031,7 @@ static void pci_sun4v_iommu_init(struct 
 	iommu->dma_addr_mask = dma_mask;
 
 	/* Allocate and initialize the free area map.  */
-	sz = num_tsb_entries / 8;
+	sz = (num_tsb_entries + 7) / 8;
 	sz = (sz + 7UL) & ~7UL;
 	iommu->arena.map = kzalloc(sz, GFP_KERNEL);
 	if (!iommu->arena.map) {

-- 

[patch 53/54] TCP: Use default 32768-61000 outgoing port range in all cases.

[Chris Wright]

[-- Attachment #1: tcp-use-default-32768-61000-outgoing-port-range-in-all-cases.patch --]
[-- Type: text/plain, Size: 1971 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Mark Glines <mark@glines.org>

This diff changes the default port range used for outgoing connections,
from "use 32768-61000 in most cases, but use N-4999 on small boxes
(where N is a multiple of 1024, depending on just *how* small the box
is)" to just "use 32768-61000 in all cases".

I don't believe there are any drawbacks to this change, and it keeps
outgoing connection ports farther away from the mess of
IANA-registered ports.

Signed-off-by: Mark Glines <mark@glines.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 net/ipv4/inet_connection_sock.c |    4 +---
 net/ipv4/tcp.c                  |    3 ---
 2 files changed, 1 insertion(+), 6 deletions(-)

--- linux-2.6.21.4.orig/net/ipv4/inet_connection_sock.c
+++ linux-2.6.21.4/net/ipv4/inet_connection_sock.c
@@ -31,10 +31,8 @@ EXPORT_SYMBOL(inet_csk_timer_bug_msg);
 
 /*
  * This array holds the first and last local port number.
- * For high-usage systems, use sysctl to change this to
- * 32768-61000
  */
-int sysctl_local_port_range[2] = { 1024, 4999 };
+int sysctl_local_port_range[2] = { 32768, 61000 };
 
 int inet_csk_bind_conflict(const struct sock *sk,
 			   const struct inet_bind_bucket *tb)
--- linux-2.6.21.4.orig/net/ipv4/tcp.c
+++ linux-2.6.21.4/net/ipv4/tcp.c
@@ -2445,13 +2445,10 @@ void __init tcp_init(void)
 			order++)
 		;
 	if (order >= 4) {
-		sysctl_local_port_range[0] = 32768;
-		sysctl_local_port_range[1] = 61000;
 		tcp_death_row.sysctl_max_tw_buckets = 180000;
 		sysctl_tcp_max_orphans = 4096 << (order - 4);
 		sysctl_max_syn_backlog = 1024;
 	} else if (order < 3) {
-		sysctl_local_port_range[0] = 1024 * (3 - order);
 		tcp_death_row.sysctl_max_tw_buckets >>= (3 - order);
 		sysctl_tcp_max_orphans >>= (3 - order);
 		sysctl_max_syn_backlog = 128;

-- 

[patch 54/54] BLUETOOTH: Fix locking in hci_sock_dev_event().

[Chris Wright]

[-- Attachment #1: bluetooth-fix-locking-in-hci_sock_dev_event.patch --]
[-- Type: text/plain, Size: 1784 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
---------------------

From: Satyam Sharma <ssatyam@cse.iitk.ac.in>

We presently use lock_sock() to acquire a lock on a socket in
hci_sock_dev_event(), but this goes BUG because lock_sock()
can sleep and we're already holding a read-write spinlock at
that point. So, we must use the non-sleeping BH version,
bh_lock_sock().

However, hci_sock_dev_event() is called from user context and
hence using simply bh_lock_sock() will deadlock against a
concurrent softirq that tries to acquire a lock on the same
socket. Hence, disabling BH's before acquiring the socket lock
and enable them afterwards, is the proper solution to fix
socket locking in hci_sock_dev_event().

Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 net/bluetooth/hci_sock.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/net/bluetooth/hci_sock.c
+++ linux-2.6.21.4/net/bluetooth/hci_sock.c
@@ -656,7 +656,8 @@ static int hci_sock_dev_event(struct not
 		/* Detach sockets from device */
 		read_lock(&hci_sk_list.lock);
 		sk_for_each(sk, node, &hci_sk_list.head) {
-			lock_sock(sk);
+			local_bh_disable();
+			bh_lock_sock_nested(sk);
 			if (hci_pi(sk)->hdev == hdev) {
 				hci_pi(sk)->hdev = NULL;
 				sk->sk_err = EPIPE;
@@ -665,7 +666,8 @@ static int hci_sock_dev_event(struct not
 
 				hci_dev_put(hdev);
 			}
-			release_sock(sk);
+			bh_unlock_sock(sk);
+			local_bh_enable();
 		}
 		read_unlock(&hci_sk_list.lock);
 	}

-- 

Re: [stable] [patch 00/54] 2.6.21-stable review

[Chris Wright]

* Chris Wright (chrisw@sous-sol.org) wrote:
> This is the start of the stable review cycle for the 2.6.21.5 release.
> There are 54 patches in this series, all will be posted as a response

Roll-up patch available at:
	http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.21.5-rc1.{gz,bz2}

thanks,                                                                                                             
-chris     

Re: [patch 34/54] Fix roundup_pow_of_two(1)

[Theodore Tso]

On Fri, Jun 08, 2007 at 12:22:01AM -0700, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ---------------------
> 
> From: Rolf Eike Beer <eike-kernel@sf-tec.de>
> 
> Fix roundup_pow_of_two(1)
> 
> 1 is a power of two, therefore roundup_pow_of_two(1) should return 1. It does
> in case the argument is a variable but in case it's a constant it behaves
> wrong and returns 0. Probably nobody ever did it so this was never noticed.

If this doesn't fix a user-visiable bug, should we be including it in
the stable patch series?  (Assuming that it doesn't, I wouldn't, but I
tend to be more conservative about what I would include in a stable
production release.)

Regards,

						- Ted

Re: [patch 03/54] NOHZ: Rate limit the local softirq pending warning output

[Daniel Thaler]

Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ---------------------
> 
> From: Thomas Gleixner <tglx@linutronix.de>
> 
> The warning in the NOHZ code, which triggers when a CPU goes idle with
> softirqs pending can fill up the logs quite quickly.  Rate limit the output
> until we found the root cause of that problem.

Isn't the root cause found and fixed with "[patch 09/54] Prevent going
idle with softirq pending"?

- Daniel

Re: [patch 03/54] NOHZ: Rate limit the local softirq pending warning output

[Thomas Gleixner]

On Fri, 2007-06-08 at 12:34 +0200, Daniel Thaler wrote:
> Chris Wright wrote:
> > -stable review patch.  If anyone has any objections, please let us know.
> > ---------------------
> > 
> > From: Thomas Gleixner <tglx@linutronix.de>
> > 
> > The warning in the NOHZ code, which triggers when a CPU goes idle with
> > softirqs pending can fill up the logs quite quickly.  Rate limit the output
> > until we found the root cause of that problem.
> 
> Isn't the root cause found and fixed with "[patch 09/54] Prevent going
> idle with softirq pending"?

Yes, still we want the printk there to find places, which go into idle
with softirqs pending. There is at least one problem in the SLIP code,
which triggers this. OTOH we do not want those messages to flood the
syslog.

	tglx

Re: [patch 16/54] Input: i8042 - fix AUX port detection with some chips

[Chuck Ebbert]

On 06/08/2007 03:21 AM, Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ---------------------
> 
> From: Roland Scheidegger <sroland@tungstengraphics.com>
> 
> The i8042 driver fails detection of the AUX port with some chips,
> because they apparently do not change the I8042_CTR_AUXDIS bit
> immediately. This is known to affect at least HP500/HP510 notebooks,
> consequently the built-in touchpad will not work. The patch will simply
> reread the value until it gets the expected value or a retry limit is
> hit, without touching other workaround code in the same area.
> 
> Signed-off-by: Roland Scheidegger <sroland@tungstengraphics.com>
> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
> X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=d2ada5597d33a9108acb2caf912f85cbc9caab1e
> 

Also needed for 2.6.20.

Re: [patch 37/54] SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)

[Stefan Lippers-Hollmann]

[-- Attachment #1.1: Type: text/plain, Size: 5010 bytes --]

Hi

On Freitag, 8. Juni 2007, you wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ---------------------
>
> From: Mark Salyzyn <mark_salyzyn@adaptec.com>
>
> As discussed in the bugzilla outlined below, we have an sa based
> (Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
> controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
> 5400S. This problem  coincides with the introduction of the adapter_comm
> and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
> rework communication support code, January 23 2007, which initially
> migrated to 2.6.21)
>
> The panic occurs with an uninitialized adapter_deliver platform function
> pointer. The enclosed patch, unmodified as tested by Rainer, solves the
> problem.
>
> Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
>
> ---
>  drivers/scsi/aacraid/aacraid.h |    1 +
>  drivers/scsi/aacraid/rx.c      |    2 +-
>  drivers/scsi/aacraid/sa.c      |    9 ++++++++-
>  3 files changed, 10 insertions(+), 2 deletions(-)


This patch fails to compile on amd64 and i386 with the attached config 
(CONFIG_SCSI_AACRAID=m, 2.6.21.5-rc1):
  CC [M]  drivers/scsi/aacraid/linit.o
  CC [M]  drivers/scsi/aacraid/aachba.o
  CC [M]  drivers/scsi/aacraid/commctrl.o
  CC [M]  drivers/scsi/aacraid/comminit.o
  CC [M]  drivers/scsi/aacraid/commsup.o
  CC [M]  drivers/scsi/aacraid/dpcsup.o
  CC [M]  drivers/scsi/aacraid/rx.o
  CC [M]  drivers/scsi/aacraid/sa.o
drivers/scsi/aacraid/sa.c: In function 'aac_sa_init':
drivers/scsi/aacraid/sa.c:375: error: 'struct adapter_ops' has no member 
named 'adapter_restart'
make[5]: *** [drivers/scsi/aacraid/sa.o] Error 1
make[4]: *** [drivers/scsi/aacraid] Error 2
make[3]: *** [drivers/scsi] Error 2
make[2]: *** [drivers] Error 2
make[2]: Leaving directory `/tmp/pkg/linux-2.6.21.5-rc1-slh64-smp-1'
make[1]: *** [debian/stamp-build-kernel] Error 2
make[1]: Leaving directory `/tmp/pkg/linux-2.6.21.5-rc1-slh64-smp-1'
make: *** [realfast] Fehler 2

Reverting this patch allows compiling 2.6.21.5-rc1 with the same config 
again.

Debian unstable/ current.
$ gcc --version
gcc (GCC) 4.1.3 20070601 (prerelease) (Debian 4.1.2-12)
Copyright (C) 2006 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ dpkg -l | grep -e gcc-4.1\  -e binutils
ii  binutils  2.17cvs20070426-8   The GNU assembler, linker and binary 
utiliti
ii  gcc-4.1   4.1.2-12            The GNU C compiler

> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
> +++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
> @@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
>  int aac_get_adapter_info(struct aac_dev* dev);
>  int aac_send_shutdown(struct aac_dev *dev);
>  int aac_probe_container(struct aac_dev *dev, int cid);
> +int aac_rx_deliver_producer(struct fib * fib);
>  extern int numacb;
>  extern int acbsize;
>  extern char aac_driver_version[];
> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
> +++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
> @@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
>   *
>   *	Will send a fib, returning 0 if successful.
>   */
> -static int aac_rx_deliver_producer(struct fib * fib)
> +int aac_rx_deliver_producer(struct fib * fib)
>  {
>  	struct aac_dev *dev = fib->dev;
>  	struct aac_queue *q = &dev->queues->queue[AdapNormCmdQueue];
> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
> +++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
> @@ -5,7 +5,7 @@
>   * based on the old aacraid driver that is..
>   * Adaptec aacraid device driver for Linux.
>   *
> - * Copyright (c) 2000 Adaptec, Inc. (aacraid@adaptec.com)
> + * Copyright (c) 2000-2007 Adaptec, Inc. (aacraid@adaptec.com)
>   *
>   * This program is free software; you can redistribute it and/or modify
>   * it under the terms of the GNU General Public License as published by
> @@ -258,6 +258,11 @@ static void aac_sa_start_adapter(struct
>  			NULL, NULL, NULL, NULL, NULL);
>  }
>
> +static int aac_sa_restart_adapter(struct aac_dev *dev, int bled)
> +{
> +	return -EINVAL;
> +}
> +
>  /**
>   *	aac_sa_check_health
>   *	@dev: device to check if healthy
> @@ -367,7 +372,9 @@ int aac_sa_init(struct aac_dev *dev)
>  	dev->a_ops.adapter_notify = aac_sa_notify_adapter;
>  	dev->a_ops.adapter_sync_cmd = sa_sync_cmd;
>  	dev->a_ops.adapter_check_health = aac_sa_check_health;
> +	dev->a_ops.adapter_restart = aac_sa_restart_adapter;
>  	dev->a_ops.adapter_intr = aac_sa_intr;
> +	dev->a_ops.adapter_deliver = aac_rx_deliver_producer;
>  	dev->a_ops.adapter_ioremap = aac_sa_ioremap;
>
>  	/*

Regards
	Stefan Lippers-Hollmann

[-- Attachment #1.2: config-2.6.21.5-rc1-slh64-smp-1.gz --]
[-- Type: application/x-gzip, Size: 18558 bytes --]

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [patch 00/54] 2.6.21-stable review

[Dave Jones]

On Fri, Jun 08, 2007 at 12:21:27AM -0700, Chris Wright wrote:
 > This is the start of the stable review cycle for the 2.6.21.5 release.
 > There are 54 patches in this series, all will be posted as a response
 > to this one.  If anyone has any issues with these being applied, please
 > let us know.  If anyone is a maintainer of the proper subsystem, and
 > wants to add a Signed-off-by: line to the patch, please respond with it.
 > 
 > These patches are sent out with a number of different people on the
 > Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
 > to add your name to the list.  If you want to be off the reviewer list,
 > also email us.

I'm wondering if it makes sense to do more regular releases of -stable
so that the patchqueue doesn't build up so much.   It's painful
to sit down and review lots of patches in one sitting.
Additionally, with lots of change, it's a real pain to figure out
"which one of the 50 patches that went into the last -stable
 makes my machine not boot"  (which I had to do recently).


Or maybe cc: the reviewer list when patches get added?

Or maybe both?

	Dave

-- 
http://www.codemonkey.org.uk

Re: [stable] [patch 00/54] 2.6.21-stable review

[Greg KH]

On Fri, Jun 08, 2007 at 01:28:52PM -0400, Dave Jones wrote:
> On Fri, Jun 08, 2007 at 12:21:27AM -0700, Chris Wright wrote:
>  > This is the start of the stable review cycle for the 2.6.21.5 release.
>  > There are 54 patches in this series, all will be posted as a response
>  > to this one.  If anyone has any issues with these being applied, please
>  > let us know.  If anyone is a maintainer of the proper subsystem, and
>  > wants to add a Signed-off-by: line to the patch, please respond with it.
>  > 
>  > These patches are sent out with a number of different people on the
>  > Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
>  > to add your name to the list.  If you want to be off the reviewer list,
>  > also email us.
> 
> I'm wondering if it makes sense to do more regular releases of -stable
> so that the patchqueue doesn't build up so much.   It's painful
> to sit down and review lots of patches in one sitting.
> Additionally, with lots of change, it's a real pain to figure out
> "which one of the 50 patches that went into the last -stable
>  makes my machine not boot"  (which I had to do recently).

It probably does.  Unfortunately I've been traveling _way_ too much
lately and got behind on the patch queue.  I'll try to remember to push
out a new release sooner, as it looks like the majority of my travel is
coming to an end (only 2 trips this month...)

thanks,

greg k-h

Re: [stable] [patch 00/54] 2.6.21-stable review

[Greg KH]

On Fri, Jun 08, 2007 at 01:28:52PM -0400, Dave Jones wrote:
> Or maybe cc: the reviewer list when patches get added?

Oh, we can easily do that as we have a script that notifys the submitter
that the patch has been added.  If you all don't mind getting the noise,
I'd be glad to make that change.

thanks,

greg k-h

Re: [stable] [patch 37/54] SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)

[Chris Wright]

* Stefan Lippers-Hollmann (s.L-H@gmx.de) wrote:
> This patch fails to compile on amd64 and i386 with the attached config 
> (CONFIG_SCSI_AACRAID=m, 2.6.21.5-rc1):
>   CC [M]  drivers/scsi/aacraid/linit.o
>   CC [M]  drivers/scsi/aacraid/aachba.o
>   CC [M]  drivers/scsi/aacraid/commctrl.o
>   CC [M]  drivers/scsi/aacraid/comminit.o
>   CC [M]  drivers/scsi/aacraid/commsup.o
>   CC [M]  drivers/scsi/aacraid/dpcsup.o
>   CC [M]  drivers/scsi/aacraid/rx.o
>   CC [M]  drivers/scsi/aacraid/sa.o
> drivers/scsi/aacraid/sa.c: In function 'aac_sa_init':
> drivers/scsi/aacraid/sa.c:375: error: 'struct adapter_ops' has no member 
> named 'adapter_restart'

Mark, this patch is apparently against a slightly newer kernel which
includes 8418852d11f0bbaeebeedd4243560d8fdc85410d:
	[SCSI] aacraid: add restart adapter platform function

See any issue with this against 2.6.21.4 (simply drops adapter_restart
bits).

thanks,
-chris
--

From: Salyzyn, Mark <mark_salyzyn@adaptec.com>
Subject: SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)

http://bugzilla.kernel.org/show_bug.cgi?id=8469

As discussed in the bugzilla outlined below, we have an sa based
(Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
5400S. This problem  coincides with the introduction of the adapter_comm
and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
rework communication support code, January 23 2007, which initially
migrated to 2.6.21)

The panic occurs with an uninitialized adapter_deliver platform function
pointer. The enclosed patch, unmodified as tested by Rainer, solves the
problem.

Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
[chrisw: backport to 2.6.21.4]
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/scsi/aacraid/aacraid.h |    1 +
 drivers/scsi/aacraid/rx.c      |    2 +-
 drivers/scsi/aacraid/sa.c      |    3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
+++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
@@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
 int aac_get_adapter_info(struct aac_dev* dev);
 int aac_send_shutdown(struct aac_dev *dev);
 int aac_probe_container(struct aac_dev *dev, int cid);
+int aac_rx_deliver_producer(struct fib * fib);
 extern int numacb;
 extern int acbsize;
 extern char aac_driver_version[];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
@@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
  *
  *	Will send a fib, returning 0 if successful.
  */
-static int aac_rx_deliver_producer(struct fib * fib)
+int aac_rx_deliver_producer(struct fib * fib)
 {
 	struct aac_dev *dev = fib->dev;
 	struct aac_queue *q = &dev->queues->queue[AdapNormCmdQueue];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
@@ -5,7 +5,7 @@
  * based on the old aacraid driver that is..
  * Adaptec aacraid device driver for Linux.
  *
- * Copyright (c) 2000 Adaptec, Inc. (aacraid@adaptec.com)
+ * Copyright (c) 2000-2007 Adaptec, Inc. (aacraid@adaptec.com)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -368,6 +368,7 @@ int aac_sa_init(struct aac_dev *dev)
 	dev->a_ops.adapter_sync_cmd = sa_sync_cmd;
 	dev->a_ops.adapter_check_health = aac_sa_check_health;
 	dev->a_ops.adapter_intr = aac_sa_intr;
+	dev->a_ops.adapter_deliver = aac_rx_deliver_producer;
 	dev->a_ops.adapter_ioremap = aac_sa_ioremap;
 
 	/*

Re: [stable] [patch 00/54] 2.6.21-stable review

[Chuck Ebbert]

On 06/08/2007 01:34 PM, Greg KH wrote:
> On Fri, Jun 08, 2007 at 01:28:52PM -0400, Dave Jones wrote:
>> Or maybe cc: the reviewer list when patches get added?
> 
> Oh, we can easily do that as we have a script that notifys the submitter
> that the patch has been added.  If you all don't mind getting the noise,
> I'd be glad to make that change.
> 

To keep up to date all you need to do is pull the GIT tree regularly.
Maybe a mailing list for stable-commits could be added, like mm-commits?

Re: [stable] [patch 00/54] 2.6.21-stable review

[Chris Wright]

* Chuck Ebbert (cebbert@redhat.com) wrote:
> Maybe a mailing list for stable-commits could be added, like mm-commits?

I was thinking the same thing.

thanks,
-chris

Re: [stable] [patch 00/54] 2.6.21-stable review

[Greg KH]

On Fri, Jun 08, 2007 at 10:47:29AM -0700, Chris Wright wrote:
> * Chuck Ebbert (cebbert@redhat.com) wrote:
> > Maybe a mailing list for stable-commits could be added, like mm-commits?
> 
> I was thinking the same thing.

Good idea, we can just CC: that list when we commit a patch.

thanks,

greg k-h

RE: [stable] [patch 37/54] SCSI: aacraid: Correct sa platformsupport. (Was: [Bug 8469] Bad EIP value on pentium3 SMPkernel-2.6.21.1)

[Salyzyn, Mark]

Yes, split the patch into the two pieces for 2.6.21.1/2.6.21.4

Sincerely -- Mark Salyzyn

> -----Original Message-----
> From: Chris Wright [mailto:chrisw@sous-sol.org] 
> Sent: Friday, June 08, 2007 1:46 PM
> To: Stefan Lippers-Hollmann
> Cc: Chris Wright; James Bottomley; AACRAID; Greg 
> Kroah-Hartman; linux-kernel@vger.kernel.org; stable@kernel.org
> Subject: Re: [stable] [patch 37/54] SCSI: aacraid: Correct sa 
> platformsupport. (Was: [Bug 8469] Bad EIP value on pentium3 
> SMPkernel-2.6.21.1)
> 
> 
> * Stefan Lippers-Hollmann (s.L-H@gmx.de) wrote:
> > This patch fails to compile on amd64 and i386 with the 
> attached config 
> > (CONFIG_SCSI_AACRAID=m, 2.6.21.5-rc1):
> >   CC [M]  drivers/scsi/aacraid/linit.o
> >   CC [M]  drivers/scsi/aacraid/aachba.o
> >   CC [M]  drivers/scsi/aacraid/commctrl.o
> >   CC [M]  drivers/scsi/aacraid/comminit.o
> >   CC [M]  drivers/scsi/aacraid/commsup.o
> >   CC [M]  drivers/scsi/aacraid/dpcsup.o
> >   CC [M]  drivers/scsi/aacraid/rx.o
> >   CC [M]  drivers/scsi/aacraid/sa.o
> > drivers/scsi/aacraid/sa.c: In function 'aac_sa_init':
> > drivers/scsi/aacraid/sa.c:375: error: 'struct adapter_ops' 
> has no member 
> > named 'adapter_restart'
> 
> Mark, this patch is apparently against a slightly newer kernel which
> includes 8418852d11f0bbaeebeedd4243560d8fdc85410d:
> 	[SCSI] aacraid: add restart adapter platform function
> 
> See any issue with this against 2.6.21.4 (simply drops adapter_restart
> bits).
> 
> thanks,
> -chris
> --
> 
> From: Salyzyn, Mark <mark_salyzyn@adaptec.com>
> Subject: SCSI: aacraid: Correct sa platform support. (Was: 
> [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)
> 
> http://bugzilla.kernel.org/show_bug.cgi?id=8469
> 
> As discussed in the bugzilla outlined below, we have an sa based
> (Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
> controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
> 5400S. This problem  coincides with the introduction of the 
> adapter_comm
> and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
> rework communication support code, January 23 2007, which initially
> migrated to 2.6.21)
> 
> The panic occurs with an uninitialized adapter_deliver 
> platform function
> pointer. The enclosed patch, unmodified as tested by Rainer, 
> solves the
> problem.
> 
> Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> [chrisw: backport to 2.6.21.4]
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> 
> ---
>  drivers/scsi/aacraid/aacraid.h |    1 +
>  drivers/scsi/aacraid/rx.c      |    2 +-
>  drivers/scsi/aacraid/sa.c      |    3 ++-
>  3 files changed, 4 insertions(+), 2 deletions(-)
> 
> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
> +++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
> @@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
>  int aac_get_adapter_info(struct aac_dev* dev);
>  int aac_send_shutdown(struct aac_dev *dev);
>  int aac_probe_container(struct aac_dev *dev, int cid);
> +int aac_rx_deliver_producer(struct fib * fib);
>  extern int numacb;
>  extern int acbsize;
>  extern char aac_driver_version[];
> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
> +++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
> @@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
>   *
>   *	Will send a fib, returning 0 if successful.
>   */
> -static int aac_rx_deliver_producer(struct fib * fib)
> +int aac_rx_deliver_producer(struct fib * fib)
>  {
>  	struct aac_dev *dev = fib->dev;
>  	struct aac_queue *q = &dev->queues->queue[AdapNormCmdQueue];
> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
> +++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
> @@ -5,7 +5,7 @@
>   * based on the old aacraid driver that is..
>   * Adaptec aacraid device driver for Linux.
>   *
> - * Copyright (c) 2000 Adaptec, Inc. (aacraid@adaptec.com)
> + * Copyright (c) 2000-2007 Adaptec, Inc. (aacraid@adaptec.com)
>   *
>   * This program is free software; you can redistribute it 
> and/or modify
>   * it under the terms of the GNU General Public License as 
> published by
> @@ -368,6 +368,7 @@ int aac_sa_init(struct aac_dev *dev)
>  	dev->a_ops.adapter_sync_cmd = sa_sync_cmd;
>  	dev->a_ops.adapter_check_health = aac_sa_check_health;
>  	dev->a_ops.adapter_intr = aac_sa_intr;
> +	dev->a_ops.adapter_deliver = aac_rx_deliver_producer;
>  	dev->a_ops.adapter_ioremap = aac_sa_ioremap;
>  
>  	/*
> 

Re: [patch 34/54] Fix roundup_pow_of_two(1)

[Chris Wright]

* Theodore Tso (tytso@mit.edu) wrote:
> If this doesn't fix a user-visiable bug, should we be including it in
> the stable patch series?  (Assuming that it doesn't, I wouldn't, but I
> tend to be more conservative about what I would include in a stable
> production release.)

Rolf, despite simplicity of patch, I'm inclined to agree with Ted.
Were you effected by this in the wild, or just noticed by code
inspection?

thanks,
-chris

Re: [stable] [patch 37/54] SCSI: aacraid: Correct sa platformsupport. (Was: [Bug 8469] Bad EIP value on pentium3 SMPkernel-2.6.21.1)

[Chris Wright]

* Salyzyn, Mark (mark_salyzyn@adaptec.com) wrote:
> Yes, split the patch into the two pieces for 2.6.21.1/2.6.21.4

Sorry, didn't parse.  Are you suggesting to use the patch I included
(which simply drops the ->adapter_restart init), or the original patch
plus Mark Havercamp's patch to add ->adapter_restart?

thanks,
-chris

Re: [patch 37/54] SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)

[Dave Jones]

On Fri, Jun 08, 2007 at 12:22:04AM -0700, Chris Wright wrote:
 > -stable review patch.  If anyone has any objections, please let us know.
 > ---------------------
 > 
 > From: Mark Salyzyn <mark_salyzyn@adaptec.com>
 > 
 > As discussed in the bugzilla outlined below, we have an sa based
 > (Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
 > controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
 > 5400S. This problem  coincides with the introduction of the adapter_comm
 > and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
 > rework communication support code, January 23 2007, which initially
 > migrated to 2.6.21)
 > 
 > The panic occurs with an uninitialized adapter_deliver platform function
 > pointer. The enclosed patch, unmodified as tested by Rainer, solves the
 > problem.
 > 
 > Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
 > Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
 > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
 > Signed-off-by: Chris Wright <chrisw@sous-sol.org>


drivers/scsi/aacraid/sa.c: In function 'aac_sa_init':
drivers/scsi/aacraid/sa.c:375: error: 'struct adapter_ops' has no member named 'adapter_restart'

	Dave

-- 
http://www.codemonkey.org.uk

RE: [stable] [patch 37/54] SCSI: aacraid: Correct saplatformsupport. (Was: [Bug 8469] Bad EIP value on pentium3SMPkernel-2.6.21.1)

[Salyzyn, Mark]

Drop the setting of restart, drop the dummy restart handler in sa.c.

I will send you what I mean later when I have time ...

Sincerely -- Mark Salyzyn

> -----Original Message-----
> From: Chris Wright [mailto:chrisw@sous-sol.org] 
> Sent: Friday, June 08, 2007 2:29 PM
> To: Salyzyn, Mark
> Cc: Chris Wright; Stefan Lippers-Hollmann; James Bottomley; 
> AACRAID; Greg Kroah-Hartman; linux-kernel@vger.kernel.org; 
> stable@kernel.org
> Subject: Re: [stable] [patch 37/54] SCSI: aacraid: Correct 
> saplatformsupport. (Was: [Bug 8469] Bad EIP value on 
> pentium3SMPkernel-2.6.21.1)
> 
> 
> * Salyzyn, Mark (mark_salyzyn@adaptec.com) wrote:
> > Yes, split the patch into the two pieces for 2.6.21.1/2.6.21.4
> 
> Sorry, didn't parse.  Are you suggesting to use the patch I included
> (which simply drops the ->adapter_restart init), or the original patch
> plus Mark Havercamp's patch to add ->adapter_restart?
> 
> thanks,
> -chris
> 

Re: [stable] [patch 37/54] SCSI: aacraid: Correct saplatformsupport. (Was: [Bug 8469] Bad EIP value on pentium3SMPkernel-2.6.21.1)

[Chris Wright]

* Salyzyn, Mark (mark_salyzyn@adaptec.com) wrote:
> Drop the setting of restart, drop the dummy restart handler in sa.c.

Yup, OK.  That's exactly the updated patch I included.  Here it is again:

From: Salyzyn, Mark <mark_salyzyn@adaptec.com>
Subject: SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)


http://bugzilla.kernel.org/show_bug.cgi?id=8469

As discussed in the bugzilla outlined below, we have an sa based
(Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
5400S. This problem  coincides with the introduction of the adapter_comm
and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
rework communication support code, January 23 2007, which initially
migrated to 2.6.21)

The panic occurs with an uninitialized adapter_deliver platform function
pointer. The enclosed patch, unmodified as tested by Rainer, solves the
problem.

Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
[chrisw: backport to 2.6.21.4]
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/scsi/aacraid/aacraid.h |    1 +
 drivers/scsi/aacraid/rx.c      |    2 +-
 drivers/scsi/aacraid/sa.c      |    3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
+++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
@@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
 int aac_get_adapter_info(struct aac_dev* dev);
 int aac_send_shutdown(struct aac_dev *dev);
 int aac_probe_container(struct aac_dev *dev, int cid);
+int aac_rx_deliver_producer(struct fib * fib);
 extern int numacb;
 extern int acbsize;
 extern char aac_driver_version[];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
@@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
  *
  *	Will send a fib, returning 0 if successful.
  */
-static int aac_rx_deliver_producer(struct fib * fib)
+int aac_rx_deliver_producer(struct fib * fib)
 {
 	struct aac_dev *dev = fib->dev;
 	struct aac_queue *q = &dev->queues->queue[AdapNormCmdQueue];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
@@ -5,7 +5,7 @@
  * based on the old aacraid driver that is..
  * Adaptec aacraid device driver for Linux.
  *
- * Copyright (c) 2000 Adaptec, Inc. (aacraid@adaptec.com)
+ * Copyright (c) 2000-2007 Adaptec, Inc. (aacraid@adaptec.com)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -368,6 +368,7 @@ int aac_sa_init(struct aac_dev *dev)
 	dev->a_ops.adapter_sync_cmd = sa_sync_cmd;
 	dev->a_ops.adapter_check_health = aac_sa_check_health;
 	dev->a_ops.adapter_intr = aac_sa_intr;
+	dev->a_ops.adapter_deliver = aac_rx_deliver_producer;
 	dev->a_ops.adapter_ioremap = aac_sa_ioremap;
 
 	/*

RE: [stable] [patch 37/54] SCSI: aacraid: Correctsaplatformsupport. (Was: [Bug 8469] Bad EIP value onpentium3SMPkernel-2.6.21.1)

[Salyzyn, Mark]

Poifect (for earlier kernels without the restart adapter function added)

Sincerely -- Mark Salyzyn

> -----Original Message-----
> From: Chris Wright [mailto:chrisw@sous-sol.org] 
> Sent: Friday, June 08, 2007 2:41 PM
> To: Salyzyn, Mark
> Cc: Chris Wright; Stefan Lippers-Hollmann; James Bottomley; 
> AACRAID; Greg Kroah-Hartman; linux-kernel@vger.kernel.org; 
> stable@kernel.org; davej@redhat.com
> Subject: Re: [stable] [patch 37/54] SCSI: aacraid: 
> Correctsaplatformsupport. (Was: [Bug 8469] Bad EIP value 
> onpentium3SMPkernel-2.6.21.1)
> 
> 
> * Salyzyn, Mark (mark_salyzyn@adaptec.com) wrote:
> > Drop the setting of restart, drop the dummy restart handler in sa.c.
> 
> Yup, OK.  That's exactly the updated patch I included.  Here 
> it is again:
> 
> From: Salyzyn, Mark <mark_salyzyn@adaptec.com>
> Subject: SCSI: aacraid: Correct sa platform support. (Was: 
> [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)
> 
> 
> http://bugzilla.kernel.org/show_bug.cgi?id=8469
> 
> As discussed in the bugzilla outlined below, we have an sa based
> (Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
> controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
> 5400S. This problem  coincides with the introduction of the 
> adapter_comm
> and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
> rework communication support code, January 23 2007, which initially
> migrated to 2.6.21)
> 
> The panic occurs with an uninitialized adapter_deliver 
> platform function
> pointer. The enclosed patch, unmodified as tested by Rainer, 
> solves the
> problem.
> 
> Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> [chrisw: backport to 2.6.21.4]
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> 
> ---
>  drivers/scsi/aacraid/aacraid.h |    1 +
>  drivers/scsi/aacraid/rx.c      |    2 +-
>  drivers/scsi/aacraid/sa.c      |    3 ++-
>  3 files changed, 4 insertions(+), 2 deletions(-)
> 
> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
> +++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
> @@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
>  int aac_get_adapter_info(struct aac_dev* dev);
>  int aac_send_shutdown(struct aac_dev *dev);
>  int aac_probe_container(struct aac_dev *dev, int cid);
> +int aac_rx_deliver_producer(struct fib * fib);
>  extern int numacb;
>  extern int acbsize;
>  extern char aac_driver_version[];
> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
> +++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
> @@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
>   *
>   *	Will send a fib, returning 0 if successful.
>   */
> -static int aac_rx_deliver_producer(struct fib * fib)
> +int aac_rx_deliver_producer(struct fib * fib)
>  {
>  	struct aac_dev *dev = fib->dev;
>  	struct aac_queue *q = &dev->queues->queue[AdapNormCmdQueue];
> --- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
> +++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
> @@ -5,7 +5,7 @@
>   * based on the old aacraid driver that is..
>   * Adaptec aacraid device driver for Linux.
>   *
> - * Copyright (c) 2000 Adaptec, Inc. (aacraid@adaptec.com)
> + * Copyright (c) 2000-2007 Adaptec, Inc. (aacraid@adaptec.com)
>   *
>   * This program is free software; you can redistribute it 
> and/or modify
>   * it under the terms of the GNU General Public License as 
> published by
> @@ -368,6 +368,7 @@ int aac_sa_init(struct aac_dev *dev)
>  	dev->a_ops.adapter_sync_cmd = sa_sync_cmd;
>  	dev->a_ops.adapter_check_health = aac_sa_check_health;
>  	dev->a_ops.adapter_intr = aac_sa_intr;
> +	dev->a_ops.adapter_deliver = aac_rx_deliver_producer;
>  	dev->a_ops.adapter_ioremap = aac_sa_ioremap;
>  
>  	/*
> 

Re: [stable] [patch 00/54] 2.6.21-stable review

[Chris Wright]

* Greg KH (greg@kroah.com) wrote:
> On Fri, Jun 08, 2007 at 10:47:29AM -0700, Chris Wright wrote:
> > * Chuck Ebbert (cebbert@redhat.com) wrote:
> > > Maybe a mailing list for stable-commits could be added, like mm-commits?
> > 
> > I was thinking the same thing.
> 
> Good idea, we can just CC: that list when we commit a patch.

OK, stable-commits@vger.kernel.org is set up and ready to roll.

Re: [stable] [patch 00/54] 2.6.21-stable review

[Chris Wright]

* Chris Wright (chrisw@sous-sol.org) wrote:
> Roll-up patch available at:
> 	http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.21.5-rc1.{gz,bz2}

Roll-up updated to fix broken aacraid patch:
	http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.21.5-rc2.{gz,bz2}

Re: [patch 34/54] Fix roundup_pow_of_two(1)

[Rolf Eike Beer]

[-- Attachment #1: Type: text/plain, Size: 521 bytes --]

Chris Wright wrote:
> * Theodore Tso (tytso@mit.edu) wrote:
> > If this doesn't fix a user-visiable bug, should we be including it in
> > the stable patch series?  (Assuming that it doesn't, I wouldn't, but I
> > tend to be more conservative about what I would include in a stable
> > production release.)
>
> Rolf, despite simplicity of patch, I'm inclined to agree with Ted.
> Were you effected by this in the wild, or just noticed by code
> inspection?

Code inspection. Drop it if you like, it's in mainline already.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]