'added speedtouch fix and stable patch queue'

2 files changed, 1433 insertions, 0 deletions

diff --git a/patches/fix-speedtouch.patch b/patches/fix-speedtouch.patch
new file mode 100644
index 0000000..618f3d1
--- /dev/null
+++ b/patches/fix-speedtouch.patch
@@ -0,0 +1,29 @@
+Index: usb-2.6/drivers/usb/atm/speedtch.c
+===================================================================
+--- usb-2.6.orig/drivers/usb/atm/speedtch.c
++++ usb-2.6/drivers/usb/atm/speedtch.c
+@@ -722,6 +722,16 @@ static void speedtch_atm_stop(struct usb
+        flush_scheduled_work();
+ }
+
++static int speedtch_pre_reset(struct usb_interface *intf)
++{
++       return 0;
++}
++
++static int speedtch_post_reset(struct usb_interface *intf)
++{
++       return 0;
++}
++
+
+ /**********
+ **  USB  **
+@@ -740,6 +750,8 @@ static struct usb_driver speedtch_usb_dr
+ 	.name		= speedtch_driver_name,
+ 	.probe		= speedtch_usb_probe,
+ 	.disconnect	= usbatm_usb_disconnect,
++	.pre_reset	= speedtch_pre_reset,
++	.post_reset	= speedtch_post_reset,
+ 	.id_table	= speedtch_usb_ids
+ };
diff --git a/patches/pre-2.6.27.2.patch b/patches/pre-2.6.27.2.patch
new file mode 100644
index 0000000..2b6a5fa
--- /dev/null
+++ b/patches/pre-2.6.27.2.patch
@@ -0,0 +1,1404 @@
+From jejb@kernel.org  Wed Oct 15 14:19:33 2008
+From: Dario Faggioli <raistlin@linux.it>
+Date: Fri, 10 Oct 2008 20:15:02 GMT
+Subject: sched_rt.c: resch needed in rt_rq_enqueue() for the root rt_rq
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810102015.m9AKF27B014753@hera.kernel.org>
+
+From: Dario Faggioli <raistlin@linux.it>
+
+commit f6121f4f8708195e88cbdf8dd8d171b226b3f858 upstream
+
+While working on the new version of the code for SCHED_SPORADIC I
+noticed something strange in the present throttling mechanism. More
+specifically in the throttling timer handler in sched_rt.c
+(do_sched_rt_period_timer()) and in rt_rq_enqueue().
+
+The problem is that, when unthrottling a runqueue, rt_rq_enqueue() only
+asks for rescheduling if the runqueue has a sched_entity associated to
+it (i.e., rt_rq->rt_se != NULL).
+Now, if the runqueue is the root rq (which has a rt_se = NULL)
+rescheduling does not take place, and it is delayed to some undefined
+instant in the future.
+
+This imply some random bandwidth usage by the RT tasks under throttling.
+For instance, setting rt_runtime_us/rt_period_us = 950ms/1000ms an RT
+task will get less than 95%. In our tests we got something varying
+between 70% to 95%.
+Using smaller time values, e.g., 95ms/100ms, things are even worse, and
+I can see values also going down to 20-25%!!
+
+The tests we performed are simply running 'yes' as a SCHED_FIFO task,
+and checking the CPU usage with top, but we can investigate thoroughly
+if you think it is needed.
+
+Things go much better, for us, with the attached patch... Don't know if
+it is the best approach, but it solved the issue for us.
+
+Signed-off-by: Dario Faggioli <raistlin@linux.it>
+Signed-off-by: Michael Trimarchi <trimarchimichael@yahoo.it>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched_rt.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/kernel/sched_rt.c
++++ b/kernel/sched_rt.c
+@@ -102,12 +102,12 @@ static void dequeue_rt_entity(struct sch
+ 
+ static void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
+ {
++	struct task_struct *curr = rq_of_rt_rq(rt_rq)->curr;
+ 	struct sched_rt_entity *rt_se = rt_rq->rt_se;
+ 
+-	if (rt_se && !on_rt_rq(rt_se) && rt_rq->rt_nr_running) {
+-		struct task_struct *curr = rq_of_rt_rq(rt_rq)->curr;
+-
+-		enqueue_rt_entity(rt_se);
++	if (rt_rq->rt_nr_running) {
++		if (rt_se && !on_rt_rq(rt_se))
++			enqueue_rt_entity(rt_se);
+ 		if (rt_rq->highest_prio < curr->prio)
+ 			resched_task(curr);
+ 	}
+From a272a28f520c58a84853e098b4ee565486ca5062 Mon Sep 17 00:00:00 2001
+From: Stefan Bader <stefan.bader@canonical.com>
+Date: Sat, 27 Sep 2008 11:07:30 -0400
+Subject: x86: Reserve FIRST_DEVICE_VECTOR in used_vectors bitmap.
+
+From: Stefan Bader <stefan.bader@canonical.com>
+
+Not in upstream above 2.6.27 due to change in the way this code works
+(has been fixed differently there.)
+
+Someone from the community found out, that after repeatedly unloading
+and loading a device driver that uses MSI IRQs, the system eventually
+assigned the vector initially reserved for IRQ0 to the device driver.
+
+The reason for this is, that although IRQ0 is tied to the
+FIRST_DEVICE_VECTOR when declaring the irq_vector table, the
+corresponding bit in the used_vectors map is not set. So, if vectors are
+released and assigned often enough, the vector will get assigned to
+another interrupt. This happens more often with MSI interrupts as those
+are exclusively using a vector.
+
+Fix this by setting the bit for the FIRST_DEVICE_VECTOR in the bitmap.
+
+Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+Acked-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/io_apic_32.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kernel/io_apic_32.c
++++ b/arch/x86/kernel/io_apic_32.c
+@@ -2314,6 +2314,9 @@ void __init setup_IO_APIC(void)
+ 	for (i = first_system_vector; i < NR_VECTORS; i++)
+ 		set_bit(i, used_vectors);
+ 
++	/* Mark FIRST_DEVICE_VECTOR which is assigned to IRQ0 as used. */
++	set_bit(FIRST_DEVICE_VECTOR, used_vectors);
++
+ 	enable_IO_APIC();
+ 
+ 	io_apic_irqs = ~PIC_IRQS;
+From johannes@sipsolutions.net  Wed Oct 15 14:25:41 2008
+From: Johannes Berg <johannes@sipsolutions.net>
+Date: Fri, 10 Oct 2008 17:52:49 +0200
+Subject: mac80211: fix two issues in debugfs
+To: stable <stable@kernel.org>
+Cc: linux-wireless <linux-wireless@vger.kernel.org>, John Linville <linville@tuxdriver.com>
+Message-ID: <1223653970.3748.23.camel@johannes.berg>
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+Not in trees above 2.6.27 as it is fixed differently in .28.
+
+This fixes RHBZ 466264, whenever the master interface is
+renamed this code would BUG_ON. Also fixes a separately
+reported bug with the debugfs dir being NULL.
+
+This patch is not applicable to the next kernel version
+because both these issues have been fixed, the first one
+by not having the master interface have a ieee80211_ptr
+at all, and the second one by also leaving the function
+early.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Cc: John Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/debugfs_netdev.c |   14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -537,6 +537,7 @@ static int netdev_notify(struct notifier
+ {
+ 	struct net_device *dev = ndev;
+ 	struct dentry *dir;
++	struct ieee80211_local *local;
+ 	struct ieee80211_sub_if_data *sdata;
+ 	char buf[10+IFNAMSIZ];
+ 
+@@ -549,10 +550,19 @@ static int netdev_notify(struct notifier
+ 	if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
+ 		return 0;
+ 
+-	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++	/*
++	 * Do not use IEEE80211_DEV_TO_SUB_IF because that
++	 * BUG_ONs for the master netdev which we need to
++	 * handle here.
++	 */
++	sdata = netdev_priv(dev);
+ 
+-	sprintf(buf, "netdev:%s", dev->name);
+ 	dir = sdata->debugfsdir;
++
++	if (!dir)
++		return 0;
++
++	sprintf(buf, "netdev:%s", dev->name);
+ 	if (!debugfs_rename(dir->d_parent, dir, dir->d_parent, buf))
+ 		printk(KERN_ERR "mac80211: debugfs: failed to rename debugfs "
+ 		       "dir to %s\n", buf);
+From 73f6aa4d44ab6157badc456ddfa05b31e58de5f0 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Fri, 10 Oct 2008 17:28:29 +1100
+Subject: Fix barrier fail detection in XFS
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 73f6aa4d44ab6157badc456ddfa05b31e58de5f0 upstream.
+
+Currently we disable barriers as soon as we get a buffer in xlog_iodone
+that has the XBF_ORDERED flag cleared.  But this can be the case not only
+for buffers where the barrier failed, but also the first buffer of a
+split log write in case of a log wraparound.  Due to the disabled
+barriers we can easily get directory corruption on unclean shutdowns.
+So instead of using this check add a new buffer flag for failed barrier
+writes.
+
+This is a regression vs 2.6.26 caused by patch to use the right macro
+to check for the ORDERED flag, as we previously got true returned for
+every buffer.
+
+Thanks to Toei Rei for reporting the bug.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Eric Sandeen <sandeen@sandeen.net>
+Reviewed-by: David Chinner <david@fromorbit.com>
+Signed-off-by: Tim Shimmin <tes@sgi.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/xfs/linux-2.6/xfs_buf.c |    3 ++-
+ fs/xfs/linux-2.6/xfs_buf.h |    8 ++++++++
+ fs/xfs/xfs_log.c           |    7 ++++---
+ 3 files changed, 14 insertions(+), 4 deletions(-)
+
+--- a/fs/xfs/linux-2.6/xfs_buf.c
++++ b/fs/xfs/linux-2.6/xfs_buf.c
+@@ -1001,12 +1001,13 @@ xfs_buf_iodone_work(
+ 	 * We can get an EOPNOTSUPP to ordered writes.  Here we clear the
+ 	 * ordered flag and reissue them.  Because we can't tell the higher
+ 	 * layers directly that they should not issue ordered I/O anymore, they
+-	 * need to check if the ordered flag was cleared during I/O completion.
++	 * need to check if the _XFS_BARRIER_FAILED flag was set during I/O completion.
+ 	 */
+ 	if ((bp->b_error == EOPNOTSUPP) &&
+ 	    (bp->b_flags & (XBF_ORDERED|XBF_ASYNC)) == (XBF_ORDERED|XBF_ASYNC)) {
+ 		XB_TRACE(bp, "ordered_retry", bp->b_iodone);
+ 		bp->b_flags &= ~XBF_ORDERED;
++		bp->b_flags |= _XFS_BARRIER_FAILED;
+ 		xfs_buf_iorequest(bp);
+ 	} else if (bp->b_iodone)
+ 		(*(bp->b_iodone))(bp);
+--- a/fs/xfs/linux-2.6/xfs_buf.h
++++ b/fs/xfs/linux-2.6/xfs_buf.h
+@@ -85,6 +85,14 @@ typedef enum {
+ 	 * modifications being lost.
+ 	 */
+ 	_XBF_PAGE_LOCKED = (1 << 22),
++
++	/*
++	 * If we try a barrier write, but it fails we have to communicate
++	 * this to the upper layers.  Unfortunately b_error gets overwritten
++	 * when the buffer is re-issued so we have to add another flag to
++	 * keep this information.
++	 */
++	_XFS_BARRIER_FAILED = (1 << 23),
+ } xfs_buf_flags_t;
+ 
+ typedef enum {
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -1033,11 +1033,12 @@ xlog_iodone(xfs_buf_t *bp)
+ 	l = iclog->ic_log;
+ 
+ 	/*
+-	 * If the ordered flag has been removed by a lower
+-	 * layer, it means the underlyin device no longer supports
++	 * If the _XFS_BARRIER_FAILED flag was set by a lower
++	 * layer, it means the underlying device no longer supports
+ 	 * barrier I/O. Warn loudly and turn off barriers.
+ 	 */
+-	if ((l->l_mp->m_flags & XFS_MOUNT_BARRIER) && !XFS_BUF_ISORDERED(bp)) {
++	if (bp->b_flags & _XFS_BARRIER_FAILED) {
++		bp->b_flags &= ~_XFS_BARRIER_FAILED;
+ 		l->l_mp->m_flags &= ~XFS_MOUNT_BARRIER;
+ 		xfs_fs_cmn_err(CE_WARN, l->l_mp,
+ 				"xlog_iodone: Barriers are no longer supported"
+From 8f520021837d45c47d0ab57e7271f8d88bf7f3a4 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@redhat.com>
+Date: Mon, 13 Oct 2008 10:38:46 +0100
+Subject: tty: Termios locking - sort out real_tty confusions and lock reads
+
+From: Alan Cox <alan@redhat.com>
+
+commit 8f520021837d45c47d0ab57e7271f8d88bf7f3a4 upstream
+
+(only the tty_io.c portion of this commit)
+
+This moves us towards sanity and should mean our termios locking is now
+complete and comprehensive.
+
+Signed-off-by: Alan Cox <alan@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tty_io.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tty_io.c
++++ b/drivers/char/tty_io.c
+@@ -2996,7 +2996,7 @@ long tty_ioctl(struct file *file, unsign
+ 	case TIOCSTI:
+ 		return tiocsti(tty, p);
+ 	case TIOCGWINSZ:
+-		return tiocgwinsz(tty, p);
++		return tiocgwinsz(real_tty, p);
+ 	case TIOCSWINSZ:
+ 		return tiocswinsz(tty, real_tty, p);
+ 	case TIOCCONS:
+From jejb@kernel.org  Wed Oct 15 14:35:35 2008
+From: Steve French <sfrench@us.ibm.com>
+Date: Sat, 11 Oct 2008 16:55:11 GMT
+Subject: CIFS: make sure we have the right resume info before calling CIFSFindNext
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810111655.m9BGtBTL013214@hera.kernel.org>
+
+From: Steve French <sfrench@us.ibm.com>
+
+commit 0752f1522a9120f731232919f7ad904e9e22b8ce upstream
+
+When we do a seekdir() or equivalent, we usually end up doing a
+FindFirst call and then call FindNext until we get to the offset that we
+want. The problem is that when we call FindNext, the code usually
+doesn't have the proper info (mostly, the filename of the entry from the
+last search) to resume the search.
+
+Add a "last_entry" field to the cifs_search_info that points to the last
+entry in the search. We calculate this pointer by using the
+LastNameOffset field from the search parms that are returned. We then
+use that info to do a cifs_save_resume_key before we call CIFSFindNext.
+
+This patch allows CIFS to reliably pass the "telldir" connectathon test.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsglob.h |    1 
+ fs/cifs/cifssmb.c  |    4 +
+ fs/cifs/readdir.c  |  128 ++++++++++++++++++++++++++---------------------------
+ 3 files changed, 70 insertions(+), 63 deletions(-)
+
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -309,6 +309,7 @@ struct cifs_search_info {
+ 	__u32 resume_key;
+ 	char *ntwrk_buf_start;
+ 	char *srch_entries_start;
++	char *last_entry;
+ 	char *presume_name;
+ 	unsigned int resume_name_len;
+ 	bool endOfSearch:1;
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -3636,6 +3636,8 @@ findFirstRetry:
+ 					le16_to_cpu(parms->SearchCount);
+ 			psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
+ 				psrch_inf->entries_in_buffer;
++			psrch_inf->last_entry = psrch_inf->srch_entries_start +
++					le16_to_cpu(parms->LastNameOffset);
+ 			*pnetfid = parms->SearchHandle;
+ 		} else {
+ 			cifs_buf_release(pSMB);
+@@ -3751,6 +3753,8 @@ int CIFSFindNext(const int xid, struct c
+ 						le16_to_cpu(parms->SearchCount);
+ 			psrch_inf->index_of_last_entry +=
+ 				psrch_inf->entries_in_buffer;
++			psrch_inf->last_entry = psrch_inf->srch_entries_start +
++					le16_to_cpu(parms->LastNameOffset);
+ /*  cFYI(1,("fnxt2 entries in buf %d index_of_last %d",
+ 	    psrch_inf->entries_in_buffer, psrch_inf->index_of_last_entry)); */
+ 
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -640,6 +640,70 @@ static int is_dir_changed(struct file *f
+ 
+ }
+ 
++static int cifs_save_resume_key(const char *current_entry,
++	struct cifsFileInfo *cifsFile)
++{
++	int rc = 0;
++	unsigned int len = 0;
++	__u16 level;
++	char *filename;
++
++	if ((cifsFile == NULL) || (current_entry == NULL))
++		return -EINVAL;
++
++	level = cifsFile->srch_inf.info_level;
++
++	if (level == SMB_FIND_FILE_UNIX) {
++		FILE_UNIX_INFO *pFindData = (FILE_UNIX_INFO *)current_entry;
++
++		filename = &pFindData->FileName[0];
++		if (cifsFile->srch_inf.unicode) {
++			len = cifs_unicode_bytelen(filename);
++		} else {
++			/* BB should we make this strnlen of PATH_MAX? */
++			len = strnlen(filename, PATH_MAX);
++		}
++		cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
++	} else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
++		FILE_DIRECTORY_INFO *pFindData =
++			(FILE_DIRECTORY_INFO *)current_entry;
++		filename = &pFindData->FileName[0];
++		len = le32_to_cpu(pFindData->FileNameLength);
++		cifsFile->srch_inf.resume_key = pFindData->FileIndex;
++	} else if (level == SMB_FIND_FILE_FULL_DIRECTORY_INFO) {
++		FILE_FULL_DIRECTORY_INFO *pFindData =
++			(FILE_FULL_DIRECTORY_INFO *)current_entry;
++		filename = &pFindData->FileName[0];
++		len = le32_to_cpu(pFindData->FileNameLength);
++		cifsFile->srch_inf.resume_key = pFindData->FileIndex;
++	} else if (level == SMB_FIND_FILE_ID_FULL_DIR_INFO) {
++		SEARCH_ID_FULL_DIR_INFO *pFindData =
++			(SEARCH_ID_FULL_DIR_INFO *)current_entry;
++		filename = &pFindData->FileName[0];
++		len = le32_to_cpu(pFindData->FileNameLength);
++		cifsFile->srch_inf.resume_key = pFindData->FileIndex;
++	} else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
++		FILE_BOTH_DIRECTORY_INFO *pFindData =
++			(FILE_BOTH_DIRECTORY_INFO *)current_entry;
++		filename = &pFindData->FileName[0];
++		len = le32_to_cpu(pFindData->FileNameLength);
++		cifsFile->srch_inf.resume_key = pFindData->FileIndex;
++	} else if (level == SMB_FIND_FILE_INFO_STANDARD) {
++		FIND_FILE_STANDARD_INFO *pFindData =
++			(FIND_FILE_STANDARD_INFO *)current_entry;
++		filename = &pFindData->FileName[0];
++		/* one byte length, no name conversion */
++		len = (unsigned int)pFindData->FileNameLength;
++		cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
++	} else {
++		cFYI(1, ("Unknown findfirst level %d", level));
++		return -EINVAL;
++	}
++	cifsFile->srch_inf.resume_name_len = len;
++	cifsFile->srch_inf.presume_name = filename;
++	return rc;
++}
++
+ /* find the corresponding entry in the search */
+ /* Note that the SMB server returns search entries for . and .. which
+    complicates logic here if we choose to parse for them and we do not
+@@ -703,6 +767,7 @@ static int find_cifs_entry(const int xid
+ 	while ((index_to_find >= cifsFile->srch_inf.index_of_last_entry) &&
+ 	      (rc == 0) && !cifsFile->srch_inf.endOfSearch) {
+ 		cFYI(1, ("calling findnext2"));
++		cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
+ 		rc = CIFSFindNext(xid, pTcon, cifsFile->netfid,
+ 				  &cifsFile->srch_inf);
+ 		if (rc)
+@@ -919,69 +984,6 @@ static int cifs_filldir(char *pfindEntry
+ 	return rc;
+ }
+ 
+-static int cifs_save_resume_key(const char *current_entry,
+-	struct cifsFileInfo *cifsFile)
+-{
+-	int rc = 0;
+-	unsigned int len = 0;
+-	__u16 level;
+-	char *filename;
+-
+-	if ((cifsFile == NULL) || (current_entry == NULL))
+-		return -EINVAL;
+-
+-	level = cifsFile->srch_inf.info_level;
+-
+-	if (level == SMB_FIND_FILE_UNIX) {
+-		FILE_UNIX_INFO *pFindData = (FILE_UNIX_INFO *)current_entry;
+-
+-		filename = &pFindData->FileName[0];
+-		if (cifsFile->srch_inf.unicode) {
+-			len = cifs_unicode_bytelen(filename);
+-		} else {
+-			/* BB should we make this strnlen of PATH_MAX? */
+-			len = strnlen(filename, PATH_MAX);
+-		}
+-		cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
+-	} else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
+-		FILE_DIRECTORY_INFO *pFindData =
+-			(FILE_DIRECTORY_INFO *)current_entry;
+-		filename = &pFindData->FileName[0];
+-		len = le32_to_cpu(pFindData->FileNameLength);
+-		cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+-	} else if (level == SMB_FIND_FILE_FULL_DIRECTORY_INFO) {
+-		FILE_FULL_DIRECTORY_INFO *pFindData =
+-			(FILE_FULL_DIRECTORY_INFO *)current_entry;
+-		filename = &pFindData->FileName[0];
+-		len = le32_to_cpu(pFindData->FileNameLength);
+-		cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+-	} else if (level == SMB_FIND_FILE_ID_FULL_DIR_INFO) {
+-		SEARCH_ID_FULL_DIR_INFO *pFindData =
+-			(SEARCH_ID_FULL_DIR_INFO *)current_entry;
+-		filename = &pFindData->FileName[0];
+-		len = le32_to_cpu(pFindData->FileNameLength);
+-		cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+-	} else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
+-		FILE_BOTH_DIRECTORY_INFO *pFindData =
+-			(FILE_BOTH_DIRECTORY_INFO *)current_entry;
+-		filename = &pFindData->FileName[0];
+-		len = le32_to_cpu(pFindData->FileNameLength);
+-		cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+-	} else if (level == SMB_FIND_FILE_INFO_STANDARD) {
+-		FIND_FILE_STANDARD_INFO *pFindData =
+-			(FIND_FILE_STANDARD_INFO *)current_entry;
+-		filename = &pFindData->FileName[0];
+-		/* one byte length, no name conversion */
+-		len = (unsigned int)pFindData->FileNameLength;
+-		cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
+-	} else {
+-		cFYI(1, ("Unknown findfirst level %d", level));
+-		return -EINVAL;
+-	}
+-	cifsFile->srch_inf.resume_name_len = len;
+-	cifsFile->srch_inf.presume_name = filename;
+-	return rc;
+-}
+ 
+ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
+ {
+From jejb@kernel.org  Wed Oct 15 14:36:09 2008
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Date: Sat, 11 Oct 2008 16:55:13 GMT
+Subject: rfkill: update LEDs for all state changes
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810111655.m9BGtDQf013236@hera.kernel.org>
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 417bd25ac4c6f76c8aafe8a584f3620f4a936b72 upstream
+
+The LED state was not being updated by rfkill_force_state(), which
+will cause regressions in wireless drivers that had old-style rfkill
+support and are updated to use rfkill_force_state().
+
+The LED state was not being updated when a change was detected through
+the rfkill->get_state() hook, either.
+
+Move the LED trigger update calls into notify_rfkill_state_change(),
+where it should have been in the first place.  This takes care of both
+issues above.
+
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/rfkill/rfkill.c |    5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/rfkill/rfkill.c
++++ b/net/rfkill/rfkill.c
+@@ -117,6 +117,7 @@ static void rfkill_led_trigger_activate(
+ 
+ static void notify_rfkill_state_change(struct rfkill *rfkill)
+ {
++	rfkill_led_trigger(rfkill, rfkill->state);
+ 	blocking_notifier_call_chain(&rfkill_notifier_list,
+ 			RFKILL_STATE_CHANGED,
+ 			rfkill);
+@@ -204,10 +205,8 @@ static int rfkill_toggle_radio(struct rf
+ 			rfkill->state = state;
+ 	}
+ 
+-	if (force || rfkill->state != oldstate) {
+-		rfkill_led_trigger(rfkill, rfkill->state);
++	if (force || rfkill->state != oldstate)
+ 		notify_rfkill_state_change(rfkill);
+-	}
+ 
+ 	return retval;
+ }
+From jejb@kernel.org  Wed Oct 15 14:39:45 2008
+From: Dan Williams <dcbw@redhat.com>
+Date: Sat, 11 Oct 2008 16:55:19 GMT
+Subject: libertas: clear current command on card removal
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810111655.m9BGtJ8b013700@hera.kernel.org>
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit 71b35f3abeb8f7f7e0afd7573424540cc5aae2d5 upstream
+
+If certain commands were in-flight when the card was pulled or the
+driver rmmod-ed, cleanup would block on the work queue stopping, but the
+work queue was in turn blocked on the current command being canceled,
+which didn't happen.  Fix that.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/main.c |   20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/libertas/main.c
++++ b/drivers/net/wireless/libertas/main.c
+@@ -1196,7 +1196,13 @@ void lbs_remove_card(struct lbs_private 
+ 	cancel_delayed_work_sync(&priv->scan_work);
+ 	cancel_delayed_work_sync(&priv->assoc_work);
+ 	cancel_work_sync(&priv->mcast_work);
++
++	/* worker thread destruction blocks on the in-flight command which
++	 * should have been cleared already in lbs_stop_card().
++	 */
++	lbs_deb_main("destroying worker thread\n");
+ 	destroy_workqueue(priv->work_thread);
++	lbs_deb_main("done destroying worker thread\n");
+ 
+ 	if (priv->psmode == LBS802_11POWERMODEMAX_PSP) {
+ 		priv->psmode = LBS802_11POWERMODECAM;
+@@ -1314,14 +1320,26 @@ void lbs_stop_card(struct lbs_private *p
+ 		device_remove_file(&dev->dev, &dev_attr_lbs_rtap);
+ 	}
+ 
+-	/* Flush pending command nodes */
++	/* Delete the timeout of the currently processing command */
+ 	del_timer_sync(&priv->command_timer);
++
++	/* Flush pending command nodes */
+ 	spin_lock_irqsave(&priv->driver_lock, flags);
++	lbs_deb_main("clearing pending commands\n");
+ 	list_for_each_entry(cmdnode, &priv->cmdpendingq, list) {
+ 		cmdnode->result = -ENOENT;
+ 		cmdnode->cmdwaitqwoken = 1;
+ 		wake_up_interruptible(&cmdnode->cmdwait_q);
+ 	}
++
++	/* Flush the command the card is currently processing */
++	if (priv->cur_cmd) {
++		lbs_deb_main("clearing current command\n");
++		priv->cur_cmd->result = -ENOENT;
++		priv->cur_cmd->cmdwaitqwoken = 1;
++		wake_up_interruptible(&priv->cur_cmd->cmdwait_q);
++	}
++	lbs_deb_main("done clearing commands\n");
+ 	spin_unlock_irqrestore(&priv->driver_lock, flags);
+ 
+ 	unregister_netdev(dev);
+From jejb@kernel.org  Wed Oct 15 14:41:06 2008
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 11 Oct 2008 16:55:21 GMT
+Subject: b43legacy: Fix failure in rate-adjustment mechanism
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810111655.m9BGtL1M013741@hera.kernel.org>
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit c6a2afdacccd56cc0be8e9a7977f0ed1509069f6 upstream
+Date: Sat, 6 Sep 2008 16:51:22 -0500
+Subject: b43legacy: Fix failure in rate-adjustment mechanism
+
+A coding error present since b43legacy was incorporated into the
+kernel has prevented the driver from using the rate-setting mechanism
+of mac80211. The driver has been forced to remain at a 1 Mb/s rate.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43legacy/xmit.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/b43legacy/xmit.c
++++ b/drivers/net/wireless/b43legacy/xmit.c
+@@ -626,7 +626,7 @@ void b43legacy_handle_hwtxstatus(struct 
+ 	tmp = hw->count;
+ 	status.frame_count = (tmp >> 4);
+ 	status.rts_count = (tmp & 0x0F);
+-	tmp = hw->flags;
++	tmp = hw->flags << 1;
+ 	status.supp_reason = ((tmp & 0x1C) >> 2);
+ 	status.pm_indicated = !!(tmp & 0x80);
+ 	status.intermediate = !!(tmp & 0x40);
+From jejb@kernel.org  Wed Oct 15 14:42:49 2008
+From: Alan Cox <alan@redhat.com>
+Date: Sun, 12 Oct 2008 19:40:08 GMT
+Subject: x86, early_ioremap: fix fencepost error
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810121940.m9CJe8k3024539@hera.kernel.org>
+
+From: Alan Cox <alan@redhat.com>
+
+commit c613ec1a7ff3714da11c7c48a13bab03beb5c376 upstream
+
+The x86 implementation of early_ioremap has an off by one error. If we get
+an object which ends on the first byte of a page we undermap by one page and
+this causes a crash on boot with the ASUS P5QL whose DMI table happens to fit
+this alignment.
+
+The size computation is currently
+
+	last_addr = phys_addr + size - 1;
+	npages = (PAGE_ALIGN(last_addr) - phys_addr)
+
+(Consider a request for 1 byte at alignment 0...)
+
+Closes #11693
+
+Debugging work by Ian Campbell/Felix Geyer
+
+Signed-off-by: Alan Cox <alan@rehat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/ioremap.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -595,7 +595,7 @@ void __init *early_ioremap(unsigned long
+ 	 */
+ 	offset = phys_addr & ~PAGE_MASK;
+ 	phys_addr &= PAGE_MASK;
+-	size = PAGE_ALIGN(last_addr) - phys_addr;
++	size = PAGE_ALIGN(last_addr + 1) - phys_addr;
+ 
+ 	/*
+ 	 * Mappings have to fit in the FIX_BTMAP area.
+From jejb@kernel.org  Wed Oct 15 14:44:01 2008
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Sun, 12 Oct 2008 19:40:11 GMT
+Subject: x86: SB450: skip IRQ0 override if it is not routed to INT2 of IOAPIC
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810121940.m9CJeBqq024591@hera.kernel.org>
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 33fb0e4eb53f16af312f9698f974e2e64af39c12 upstream
+
+On some HP nx6... laptops (e.g. nx6325) BIOS reports an IRQ0 override
+but the SB450 chipset is configured such that timer interrupts goe to
+INT0 of IOAPIC.
+
+Check IRQ0 routing and if it is routed to INT0 of IOAPIC skip the
+timer override.
+
+[ This more generic PCI ID based quirk should alleviate the need for
+  dmi_ignore_irq0_timer_override DMI quirks. ]
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Acked-by: "Maciej W. Rozycki" <macro@linux-mips.org>
+Tested-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/early-quirks.c |   48 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -95,6 +95,52 @@ static void __init nvidia_bugs(int num, 
+ 
+ }
+ 
++static u32 ati_ixp4x0_rev(int num, int slot, int func)
++{
++	u32 d;
++	u8  b;
++
++	b = read_pci_config_byte(num, slot, func, 0xac);
++	b &= ~(1<<5);
++	write_pci_config_byte(num, slot, func, 0xac, b);
++
++	d = read_pci_config(num, slot, func, 0x70);
++	d |= 1<<8;
++	write_pci_config(num, slot, func, 0x70, d);
++
++	d = read_pci_config(num, slot, func, 0x8);
++	d &= 0xff;
++	return d;
++}
++
++static void __init ati_bugs(int num, int slot, int func)
++{
++#if defined(CONFIG_ACPI) && defined (CONFIG_X86_IO_APIC)
++	u32 d;
++	u8  b;
++
++	if (acpi_use_timer_override)
++		return;
++
++	d = ati_ixp4x0_rev(num, slot, func);
++	if (d  < 0x82)
++		acpi_skip_timer_override = 1;
++	else {
++		/* check for IRQ0 interrupt swap */
++		outb(0x72, 0xcd6); b = inb(0xcd7);
++		if (!(b & 0x2))
++			acpi_skip_timer_override = 1;
++	}
++
++	if (acpi_skip_timer_override) {
++		printk(KERN_INFO "SB4X0 revision 0x%x\n", d);
++		printk(KERN_INFO "Ignoring ACPI timer override.\n");
++		printk(KERN_INFO "If you got timer trouble "
++		       "try acpi_use_timer_override\n");
++	}
++#endif
++}
++
+ #define QFLAG_APPLY_ONCE 	0x1
+ #define QFLAG_APPLIED		0x2
+ #define QFLAG_DONE		(QFLAG_APPLY_ONCE|QFLAG_APPLIED)
+@@ -114,6 +160,8 @@ static struct chipset early_qrk[] __init
+ 	  PCI_CLASS_BRIDGE_PCI, PCI_ANY_ID, QFLAG_APPLY_ONCE, via_bugs },
+ 	{ PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB,
+ 	  PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, fix_hypertransport_config },
++	{ PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_SMBUS,
++	  PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs },
+ 	{}
+ };
+ 
+From jejb@kernel.org  Wed Oct 15 14:45:08 2008
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 13 Oct 2008 17:15:23 GMT
+Subject: x86: improve UP kernel when CPU-hotplug and SMP is enabled
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810131715.m9DHFNoT025122@hera.kernel.org>
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 649c6653fa94ec8f3ea32b19c97b790ec4e8e4ac upstream
+
+num_possible_cpus() can be > 1 when disabled CPUs have been accounted.
+
+Disabled CPUs are not in the cpu_present_map, so we can use
+num_present_cpus() as a safe indicator to switch to UP alternatives.
+
+Reported-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/alternative.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/alternative.c
++++ b/arch/x86/kernel/alternative.c
+@@ -444,7 +444,7 @@ void __init alternative_instructions(voi
+ 					    _text, _etext);
+ 
+ 		/* Only switch to UP mode if we don't immediately boot others */
+-		if (num_possible_cpus() == 1 || setup_max_cpus <= 1)
++		if (num_present_cpus() == 1 || setup_max_cpus <= 1)
+ 			alternatives_smp_switch(0);
+ 	}
+ #endif
+From 9d731d77c9794bb0a264f58d35949a1ab6dcc41c Mon Sep 17 00:00:00 2001
+From: Rafael J. Wysocki <rjw@sisk.pl>
+Date: Sun, 12 Oct 2008 20:59:48 -0700
+Subject: sky2: Fix WOL regression
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 9d731d77c9794bb0a264f58d35949a1ab6dcc41c upstream
+
+Since dev->power.should_wakeup bit is used by the PCI core to
+decide whether the device should wake up the system from sleep
+states, set/unset this bit whenever WOL is enabled/disabled using
+sky2_set_wol().
+
+Remove an open-coded reference to the standard PCI PM registers that
+is not used any more.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Cc: Tino Keitel <tino.keitel@gmx.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c |   19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -3034,7 +3034,8 @@ static int sky2_set_wol(struct net_devic
+ 	struct sky2_port *sky2 = netdev_priv(dev);
+ 	struct sky2_hw *hw = sky2->hw;
+ 
+-	if (wol->wolopts & ~sky2_wol_supported(sky2->hw))
++	if ((wol->wolopts & ~sky2_wol_supported(sky2->hw))
++	    || !device_can_wakeup(&hw->pdev->dev))
+ 		return -EOPNOTSUPP;
+ 
+ 	sky2->wol = wol->wolopts;
+@@ -3045,6 +3046,8 @@ static int sky2_set_wol(struct net_devic
+ 		sky2_write32(hw, B0_CTST, sky2->wol
+ 			     ? Y2_HW_WOL_ON : Y2_HW_WOL_OFF);
+ 
++	device_set_wakeup_enable(&hw->pdev->dev, sky2->wol);
++
+ 	if (!netif_running(dev))
+ 		sky2_wol_init(sky2);
+ 	return 0;
+@@ -4166,18 +4169,6 @@ static int __devinit sky2_test_msi(struc
+ 	return err;
+ }
+ 
+-static int __devinit pci_wake_enabled(struct pci_dev *dev)
+-{
+-	int pm  = pci_find_capability(dev, PCI_CAP_ID_PM);
+-	u16 value;
+-
+-	if (!pm)
+-		return 0;
+-	if (pci_read_config_word(dev, pm + PCI_PM_CTRL, &value))
+-		return 0;
+-	return value & PCI_PM_CTRL_PME_ENABLE;
+-}
+-
+ /* This driver supports yukon2 chipset only */
+ static const char *sky2_name(u8 chipid, char *buf, int sz)
+ {
+@@ -4238,7 +4229,7 @@ static int __devinit sky2_probe(struct p
+ 		}
+ 	}
+ 
+-	wol_default = pci_wake_enabled(pdev) ? WAKE_MAGIC : 0;
++	wol_default = device_may_wakeup(&pdev->dev) ? WAKE_MAGIC : 0;
+ 
+ 	err = -ENOMEM;
+ 	hw = kzalloc(sizeof(*hw), GFP_KERNEL);
+From f382a0a8e9403c6d7f8b2cfa21e41fefb5d0c9bd Mon Sep 17 00:00:00 2001
+From: Matthew Wilcox <matthew@wil.cx>
+Date: Tue, 12 Aug 2008 07:13:14 -0600
+Subject: netdrvr: atl1e: Don't take the mdio_lock in atl1e_probe
+
+From: Matthew Wilcox <matthew@wil.cx>
+
+commit f382a0a8e9403c6d7f8b2cfa21e41fefb5d0c9bd upstream
+
+Lockdep warns about the mdio_lock taken with interrupts enabled then later
+taken from interrupt context.  Initially, I considered changing these
+to spin_lock_irq/spin_unlock_irq, but then I looked at atl1e_phy_init()
+and saw that it calls msleep().  Sleeping while holding a spinlock is
+not allowed either.
+
+In the probe path, we haven't registered the interrupt handler, so
+it can't poke at this card yet.  It's before we call register_netdev(),
+so I don't think any other threads can reach this card either.  If I'm
+right, we don't need a spinlock at all.
+
+Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
+Cc: Jay Cliburn <jacliburn@bellsouth.net>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/atl1e/atl1e_main.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/atl1e/atl1e_main.c
++++ b/drivers/net/atl1e/atl1e_main.c
+@@ -2390,9 +2390,7 @@ static int __devinit atl1e_probe(struct 
+ 	}
+ 
+ 	/* Init GPHY as early as possible due to power saving issue  */
+-	spin_lock(&adapter->mdio_lock);
+ 	atl1e_phy_init(&adapter->hw);
+-	spin_unlock(&adapter->mdio_lock);
+ 	/* reset the controller to
+ 	 * put the device in a known good starting state */
+ 	err = atl1e_reset_hw(&adapter->hw);
+From jejb@kernel.org  Thu Oct 16 14:54:47 2008
+From: Oleg Nesterov <oleg@tv-sign.ru>
+Date: Thu, 16 Oct 2008 19:05:07 GMT
+Subject: fbcon_set_all_vcs: fix kernel crash when switching the rotated consoles
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810161905.m9GJ57Ki013495@hera.kernel.org>
+
+From: Oleg Nesterov <oleg@tv-sign.ru>
+
+commit 232fb69a53a5ec3f22a8104d447abe4806848a8f upstream
+
+echo 3 >> /sys/class/graphics/fbcon/rotate_all, then switch to another
+console. Result:
+
+	BUG: unable to handle kernel paging request at ffffc20005d00000
+	IP: [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
+	PGD 7e228067 PUD 7e229067 PMD 7bc1f067 PTE 0
+	Oops: 0002 [1] SMP
+	CPU 1
+	Modules linked in: [...a lot...]
+	Pid: 10, comm: events/1 Not tainted 2.6.26.5-45.fc9.x86_64 #1
+	RIP: 0010:[bitfill_aligned+149/265]  [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
+	RSP: 0018:ffff81007d811bc8  EFLAGS: 00010216
+	RAX: ffffc20005d00000 RBX: 0000000000000000 RCX: 0000000000000400
+	RDX: 0000000000000000 RSI: ffffc20005d00000 RDI: ffffffffffffffff
+	RBP: ffff81007d811be0 R08: 0000000000000400 R09: 0000000000000040
+	R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000010000
+	R13: ffffffff811632f0 R14: 0000000000000006 R15: ffff81007cb85400
+	FS:  0000000000000000(0000) GS:ffff81007e004780(0000) knlGS:0000000000000000
+	CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
+	CR2: ffffc20005d00000 CR3: 0000000000201000 CR4: 00000000000006e0
+	DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+	DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+	Process events/1 (pid: 10, threadinfo ffff81007d810000, task ffff81007d808000)
+	Stack:  ffff81007c9d75a0 0000000000000000 0000000000000000 ffff81007d811c80
+	 ffffffff81163a61 ffff810000000000 ffffffff8115f9c8 0000001000000000
+	 0000000100aaaaaa 000000007cd0d4a0 fffffd8a00000800 0001000000000000
+	Call Trace:
+	 [cfb_fillrect+523/798] cfb_fillrect+0x20b/0x31e
+	 [soft_cursor+416/436] ? soft_cursor+0x1a0/0x1b4
+	 [ccw_clear_margins+205/263] ccw_clear_margins+0xcd/0x107
+	 [fbcon_clear_margins+59/61] fbcon_clear_margins+0x3b/0x3d
+	 [fbcon_switch+1291/1466] fbcon_switch+0x50b/0x5ba
+	 [redraw_screen+261/481] redraw_screen+0x105/0x1e1
+	 [ccw_cursor+0/1869] ? ccw_cursor+0x0/0x74d
+	 [complete_change_console+48/190] complete_change_console+0x30/0xbe
+	 [change_console+115/120] change_console+0x73/0x78
+	 [console_callback+0/292] ? console_callback+0x0/0x124
+	 [console_callback+97/292] console_callback+0x61/0x124
+	 [schedule_delayed_work+25/30] ? schedule_delayed_work+0x19/0x1e
+	 [run_workqueue+139/282] run_workqueue+0x8b/0x11a
+	 [worker_thread+221/238] worker_thread+0xdd/0xee
+	 [autoremove_wake_function+0/56] ? autoremove_wake_function+0x0/0x38
+	 [worker_thread+0/238] ? worker_thread+0x0/0xee
+	 [kthread+73/118] kthread+0x49/0x76
+	 [child_rip+10/18] child_rip+0xa/0x12
+	 [kthread+0/118] ? kthread+0x0/0x76
+	 [child_rip+0/18] ? child_rip+0x0/0x12
+
+Because fbcon_set_all_vcs()->FBCON_SWAP() uses display->rotate == 0 instead
+of fbcon_ops->rotate, and vc_resize() has no effect because it is called with
+new_cols/rows == ->vc_cols/rows.
+
+Tested on 2.6.26.5-45.fc9.x86_64, but
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git seems to
+have the same problem.
+
+Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
+Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/console/fbcon.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -2996,8 +2996,8 @@ static void fbcon_set_all_vcs(struct fb_
+ 		p = &fb_display[vc->vc_num];
+ 		set_blitting_type(vc, info);
+ 		var_to_display(p, &info->var, info);
+-		cols = FBCON_SWAP(p->rotate, info->var.xres, info->var.yres);
+-		rows = FBCON_SWAP(p->rotate, info->var.yres, info->var.xres);
++		cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
++		rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ 		cols /= vc->vc_font.width;
+ 		rows /= vc->vc_font.height;
+ 		vc_resize(vc, cols, rows);
+From jejb@kernel.org  Thu Oct 16 15:31:27 2008
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Thu, 16 Oct 2008 22:05:10 GMT
+Subject: modules: fix module "notes" kobject leak
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810162205.m9GM5A4T005941@hera.kernel.org>
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit e94320939f44e0cbaccc3f259a5778abced4949c upstream
+
+Fix "notes" kobject leak
+
+It happens every rmmod if KALLSYMS=y and SYSFS=y.
+
+	# modprobe foo
+
+kobject: 'foo' (ffffffffa00743d0): kobject_add_internal: parent: 'module', set: 'module'
+kobject: 'holders' (ffff88017e7c5770): kobject_add_internal: parent: 'foo', set: '<NULL>'
+kobject: 'foo' (ffffffffa00743d0): kobject_uevent_env
+kobject: 'foo' (ffffffffa00743d0): fill_kobj_path: path = '/module/foo'
+kobject: 'notes' (ffff88017fa9b668): kobject_add_internal: parent: 'foo', set: '<NULL>'
+	  ^^^^^
+
+	# rmmod foo
+
+kobject: 'holders' (ffff88017e7c5770): kobject_cleanup
+kobject: 'holders' (ffff88017e7c5770): auto cleanup kobject_del
+kobject: 'holders' (ffff88017e7c5770): calling ktype release
+kobject: (ffff88017e7c5770): dynamic_kobj_release
+kobject: 'holders': free name
+kobject: 'foo' (ffffffffa00743d0): kobject_cleanup
+kobject: 'foo' (ffffffffa00743d0): does not have a release() function, it is broken and must be fixed.
+kobject: 'foo' (ffffffffa00743d0): auto cleanup 'remove' event
+kobject: 'foo' (ffffffffa00743d0): kobject_uevent_env
+kobject: 'foo' (ffffffffa00743d0): fill_kobj_path: path = '/module/foo'
+kobject: 'foo' (ffffffffa00743d0): auto cleanup kobject_del
+kobject: 'foo': free name
+
+	[whooops]
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/module.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1173,7 +1173,7 @@ static void free_notes_attrs(struct modu
+ 		while (i-- > 0)
+ 			sysfs_remove_bin_file(notes_attrs->dir,
+ 					      &notes_attrs->attrs[i]);
+-		kobject_del(notes_attrs->dir);
++		kobject_put(notes_attrs->dir);
+ 	}
+ 	kfree(notes_attrs);
+ }
+From jejb@kernel.org  Thu Oct 16 15:33:09 2008
+From: Cornelia Huck <cornelia.huck@de.ibm.com>
+Date: Thu, 16 Oct 2008 22:05:05 GMT
+Subject: Driver core: Fix cleanup in device_create_vargs().
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810162205.m9GM55pF005776@hera.kernel.org>
+
+From: Cornelia Huck <cornelia.huck@de.ibm.com>
+
+commit 286661b3777897220ecfcd774bccc68a34667f39 upstream
+
+If device_register() in device_create_vargs() fails, the device
+must be cleaned up with put_device() (which is also fine on NULL)
+instead of kfree().
+
+Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/core.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1243,7 +1243,7 @@ struct device *device_create_vargs(struc
+ 	return dev;
+ 
+ error:
+-	kfree(dev);
++	put_device(dev);
+ 	return ERR_PTR(retval);
+ }
+ EXPORT_SYMBOL_GPL(device_create_vargs);
+From jejb@kernel.org  Thu Oct 16 15:33:36 2008
+From: Cornelia Huck <cornelia.huck@de.ibm.com>
+Date: Thu, 16 Oct 2008 22:05:07 GMT
+Subject: Driver core: Clarify device cleanup.
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810162205.m9GM579P005836@hera.kernel.org>
+
+From: Cornelia Huck <cornelia.huck@de.ibm.com>
+
+commit 5739411acbaa63a6c22c91e340fdcdbcc7d82a51 upstream
+
+Make the comments on how to use device_initialize(), device_add()
+and device_register() a bit clearer - in particular, explicitly
+note that put_device() must be used once we tried to add the device
+to the hierarchy.
+
+Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/core.c |   23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -523,11 +523,16 @@ static void klist_children_put(struct kl
+  * device_initialize - init device structure.
+  * @dev: device.
+  *
+- * This prepares the device for use by other layers,
+- * including adding it to the device hierarchy.
++ * This prepares the device for use by other layers by initializing
++ * its fields.
+  * It is the first half of device_register(), if called by
+- * that, though it can also be called separately, so one
+- * may use @dev's fields (e.g. the refcount).
++ * that function, though it can also be called separately, so one
++ * may use @dev's fields. In particular, get_device()/put_device()
++ * may be used for reference counting of @dev after calling this
++ * function.
++ *
++ * NOTE: Use put_device() to give up your reference instead of freeing
++ * @dev directly once you have called this function.
+  */
+ void device_initialize(struct device *dev)
+ {
+@@ -836,9 +841,13 @@ static void device_remove_sys_dev_entry(
+  * This is part 2 of device_register(), though may be called
+  * separately _iff_ device_initialize() has been called separately.
+  *
+- * This adds it to the kobject hierarchy via kobject_add(), adds it
++ * This adds @dev to the kobject hierarchy via kobject_add(), adds it
+  * to the global and sibling lists for the device, then
+  * adds it to the other relevant subsystems of the driver model.
++ *
++ * NOTE: _Never_ directly free @dev after calling this function, even
++ * if it returned an error! Always use put_device() to give up your
++ * reference instead.
+  */
+ int device_add(struct device *dev)
+ {
+@@ -965,6 +974,10 @@ done:
+  * I.e. you should only call the two helpers separately if
+  * have a clearly defined need to use and refcount the device
+  * before it is added to the hierarchy.
++ *
++ * NOTE: _Never_ directly free @dev after calling this function, even
++ * if it returned an error! Always use put_device() to give up the
++ * reference initialized in this function instead.
+  */
+ int device_register(struct device *dev)
+ {
+From jejb@kernel.org  Thu Oct 16 15:37:22 2008
+From: Johannes Berg <johannes@sipsolutions.net>
+Date: Thu, 16 Oct 2008 19:05:12 GMT
+Subject: ath9k/mac80211: disallow fragmentation in ath9k, report to userspace
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810161905.m9GJ5Cvk013905@hera.kernel.org>
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 4233df6b748193d45f79fb7448991a473061a65d upstream
+
+As I've reported, ath9k currently fails utterly when fragmentation
+is enabled. This makes ath9k "support" hardware fragmentation by
+not supporting fragmentation at all to avoid the double-free issue.
+The patch also changes mac80211 to report errors from the driver
+operation to userspace.
+
+That hack in ath9k should be removed once the rate control algorithm
+it has is fixed, and we can at that time consider removing the hw
+fragmentation support entirely since it's not used by any driver.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/main.c |    8 +++++++-
+ net/mac80211/wext.c               |    2 +-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath9k/main.c
++++ b/drivers/net/wireless/ath9k/main.c
+@@ -1007,6 +1007,11 @@ static int ath9k_ampdu_action(struct iee
+ 	return ret;
+ }
+ 
++static int ath9k_no_fragmentation(struct ieee80211_hw *hw, u32 value)
++{
++	return -EOPNOTSUPP;
++}
++
+ static struct ieee80211_ops ath9k_ops = {
+ 	.tx 		    = ath9k_tx,
+ 	.start 		    = ath9k_start,
+@@ -1031,7 +1036,8 @@ static struct ieee80211_ops ath9k_ops = 
+ 	.get_tsf 	    = ath9k_get_tsf,
+ 	.reset_tsf 	    = ath9k_reset_tsf,
+ 	.tx_last_beacon     = NULL,
+-	.ampdu_action       = ath9k_ampdu_action
++	.ampdu_action       = ath9k_ampdu_action,
++	.set_frag_threshold = ath9k_no_fragmentation,
+ };
+ 
+ void ath_get_beaconconfig(struct ath_softc *sc,
+--- a/net/mac80211/wext.c
++++ b/net/mac80211/wext.c
+@@ -804,7 +804,7 @@ static int ieee80211_ioctl_siwfrag(struc
+ 	 * configure it here */
+ 
+ 	if (local->ops->set_frag_threshold)
+-		local->ops->set_frag_threshold(
++		return local->ops->set_frag_threshold(
+ 			local_to_hw(local),
+ 			local->fragmentation_threshold);
+ 
+From jejb@kernel.org  Thu Oct 16 15:37:50 2008
+From: James Bottomley <jejb@kernel.org>
+Date: Thu, 16 Oct 2008 19:05:16 GMT
+Subject: md: Fix rdev_size_store with size == 0
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200810161905.m9GJ5GiT014058@hera.kernel.org>
+
+From: Chris Webb <chris@arachsys.com>
+
+commit 7d3c6f8717ee6c2bf6cba5fa0bda3b28fbda6015 upstream
+
+Fix rdev_size_store with size == 0.
+size == 0 means to use the largest size allowed by the
+underlying device and is used when modifying an active array.
+
+This fixes a regression introduced by
+ commit d7027458d68b2f1752a28016dcf2ffd0a7e8f567
+
+Signed-off-by: Chris Webb <chris@arachsys.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2109,8 +2109,6 @@ rdev_size_store(mdk_rdev_t *rdev, const 
+ 
+ 	if (strict_strtoull(buf, 10, &size) < 0)
+ 		return -EINVAL;
+-	if (size < my_mddev->size)
+-		return -EINVAL;
+ 	if (my_mddev->pers && rdev->raid_disk >= 0) {
+ 		if (my_mddev->persistent) {
+ 			size = super_types[my_mddev->major_version].
+@@ -2121,9 +2119,9 @@ rdev_size_store(mdk_rdev_t *rdev, const 
+ 			size = (rdev->bdev->bd_inode->i_size >> 10);
+ 			size -= rdev->data_offset/2;
+ 		}
+-		if (size < my_mddev->size)
+-			return -EINVAL; /* component must fit device */
+ 	}
++	if (size < my_mddev->size)
++		return -EINVAL; /* component must fit device */
+ 
+ 	rdev->size = size;
+ 	if (size > oldsize && my_mddev->external) {
+From 6c5e51dae2c37127e00be392f40842e08077e96a Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Sun, 12 Oct 2008 14:30:44 +0200
+Subject: xfs: fix remount rw with unrecognized options
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 6c5e51dae2c37127e00be392f40842e08077e96a upstream
+
+When we skip unrecognized options in xfs_fs_remount we should just break
+out of the switch and not return because otherwise we may skip clearing
+the xfs-internal read-only flag.  This will only show up on some
+operations like touch because most read-only checks are done by the VFS
+which thinks this filesystem is r/w.  Eventually we should replace the
+XFS read-only flag with a helper that always checks the VFS flag to make
+sure they can never get out of sync.
+
+Bug reported and fix verified by Marcel Beister on #xfs.
+Bug fix verified by updated xfstests/189.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Eric Sandeen <sandeen@sandeen.net>
+Signed-off-by: Timothy Shimmin <tes@sgi.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/xfs/linux-2.6/xfs_super.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/xfs/linux-2.6/xfs_super.c
++++ b/fs/xfs/linux-2.6/xfs_super.c
+@@ -1323,7 +1323,7 @@ xfs_fs_remount(
+ 	"XFS: mount option \"%s\" not supported for remount\n", p);
+ 			return -EINVAL;
+ #else
+-			return 0;
++			break;
+ #endif
+ 		}
+ 	}
+From a477e4e6d48d3ac7c7a75bad40585cb391e5c237 Mon Sep 17 00:00:00 2001
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+Date: Fri, 3 Oct 2008 15:45:26 -0700
+Subject: ath9k: fix oops on trying to hold the wrong spinlock
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit a477e4e6d48d3ac7c7a75bad40585cb391e5c237 upstream
+
+We were trying to hold the wrong spinlock due to a typo
+on IEEE80211_BAR_CTL_TID_S's definition. We use this to
+compute the tid number and then hold this this tid number's
+spinlock.
+
+Tested-by: Steven Noonan <steven@uplinklabs.net>
+Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/core.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath9k/core.h
++++ b/drivers/net/wireless/ath9k/core.h
+@@ -316,7 +316,7 @@ void ath_descdma_cleanup(struct ath_soft
+ #define ATH_RX_TIMEOUT           40      /* 40 milliseconds */
+ #define WME_NUM_TID              16
+ #define IEEE80211_BAR_CTL_TID_M  0xF000  /* tid mask */
+-#define IEEE80211_BAR_CTL_TID_S  2       /* tid shift */
++#define IEEE80211_BAR_CTL_TID_S  12      /* tid shift */
+ 
+ enum ATH_RX_TYPE {
+ 	ATH_RX_NON_CONSUMED = 0,