r2987 - in trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian: . patches patches/series
Simon Horman
horms@costa.debian.org
Thu, 14 Apr 2005 02:57:08 +0000
Author: horms
Date: 2005-04-14 02:57:07 +0000 (Thu, 14 Apr 2005)
New Revision: 2987
Added:
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/0007-1.2086.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/0025-1.2104.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/arch-ia64-syscall-audit.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-i2c-chips-eprom.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-media-video-i2c-msg.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-media-video-saa7110-oops.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-amd811e-irq.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-sis900-oops.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-via-rhine-irq.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-via-rhine-wol-oops.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fs-cramfs-stat.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fs-jdb-race.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lib-rwsem-spinlock.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/net-netrom-double-lock.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/net-xfrm-find_acq_byseq.dpatch
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sound-core-timer-oops.dpatch
Modified:
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16
Log:
Patches from 2.6.11.X
* net-ipv4-bic-binary-search.patch:
Fix BIC congestion avoidance algorithm error
* net-ipv4-ipsec-icmp-deadlock.patch:
Fix IPSEC ICMP deadlock
* drivers-media-video-saa7110-oops.patch:
Fix saa7110 driver to handle I2C_FUNC_I2C support correctly,
prefiously it would oops.
* fs-cramfs-stat.dpatch:
Fix bogus blocks field for devices in cramfs.
* drivers-media-video-i2c-msg.dpatch:
Fix i2c message flags in video drivers
* drivers-net-sis900-oops.dpatch:
Fix oops in sis900 driver caused by it being preemted
before it has finished setting sis_priv->mii
* drivers-net-via-rhine-wol-oops.dpatch:
Fix oops in VIA Rhine driver caused by assuming all cards have WOL support.
* net-netrom-double-lock.dpatch:
Fix dealock in netrom caused by double locking.
* drivers-net-amd811e-irq.dpatch:
Fix bug in AMD8111e driver where it neglects to release an
irq on some error conditions.
* net-xfrm-find_acq_byseq.dpatch:
Fix __xfrm_find_acq_byseq() so it only returns objects
in the XFRM_STATE_ACQ state.
* drivers-net-via-rhine-irq.dpatch:
VIA Rhine driver was releasing an irq in some error situations
* sound-core-timer-oops.dpatch:
Fix ALSA timer notification.
o Ooops in read()
o wake-up polls and signals with new events
* fs-jdb-race.dpatch:
Fix race in JDB
* arch-ia64-syscall-audit.dpatch:
Fix ia64 syscall auditing
* drivers-i2c-chips-eprom.dpatch:
Fix oops in eprom driver that occrs when data is read from sysfs
* lib-rwsem-spinlock.dpatch:
Fix dealock that occurs dio_complete() does up_read() from IRQ context
by using interupd disabling spin locks.
Modified: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog 2005-04-14 02:57:07 UTC (rev 2987)
@@ -43,10 +43,81 @@
* kernel-futex-deadlock.dpatch:
Fix possible deadlog in fitex mmap_sem. See CAN-2005-0937
- (closes: #303140)
+ (closes: #303140) (Simon Horman)
- -- Simon Horman <horms@debian.org> Tue, 5 Apr 2005 16:29:56 +0900
+ * net-ipv4-bic-binary-search.patch:
+ Fix BIC congestion avoidance algorithm error
+ (Simon Horman)
+ * net-ipv4-ipsec-icmp-deadlock.patch:
+ Fix IPSEC ICMP deadlock
+ (Simon Horman)
+
+ * drivers-media-video-saa7110-oops.patch:
+ Fix saa7110 driver to handle I2C_FUNC_I2C support correctly,
+ prefiously it would oops.
+ (Simon Horman)
+
+ * fs-cramfs-stat.dpatch:
+ Fix bogus blocks field for devices in cramfs.
+ (Simon Horman)
+
+ * drivers-media-video-i2c-msg.dpatch:
+ Fix i2c message flags in video drivers
+ (Simon Horman)
+
+ * drivers-net-sis900-oops.dpatch:
+ Fix oops in sis900 driver caused by it being preemted
+ before it has finished setting sis_priv->mii
+ (Simon Horman)
+
+ * drivers-net-via-rhine-wol-oops.dpatch:
+ Fix oops in VIA Rhine driver caused by assuming all cards have WOL support.
+ (Simon Horman)
+
+ * net-netrom-double-lock.dpatch:
+ Fix dealock in netrom caused by double locking.
+ (Simon Horman)
+
+ * drivers-net-amd811e-irq.dpatch:
+ Fix bug in AMD8111e driver where it neglects to release an
+ irq on some error conditions.
+ (Simon Horman)
+
+ * net-xfrm-find_acq_byseq.dpatch:
+ Fix __xfrm_find_acq_byseq() so it only returns objects
+ in the XFRM_STATE_ACQ state.
+ (Simon Horman)
+
+ * drivers-net-via-rhine-irq.dpatch:
+ VIA Rhine driver was releasing an irq in some error situations
+ (Simon Horman)
+
+ * sound-core-timer-oops.dpatch:
+ Fix ALSA timer notification.
+ o Ooops in read()
+ o wake-up polls and signals with new events
+ (Simon Horman)
+
+ * fs-jdb-race.dpatch:
+ Fix race in JDB
+ (Simon Horman)
+
+ * arch-ia64-syscall-audit.dpatch:
+ Fix ia64 syscall auditing
+ (Simon Horman)
+
+ * drivers-i2c-chips-eprom.dpatch:
+ Fix oops in eprom driver that occrs when data is read from sysfs
+ (Simon Horman)
+
+ * lib-rwsem-spinlock.dpatch:
+ Fix dealock that occurs dio_complete() does up_read() from IRQ context
+ by using interupd disabling spin locks.
+ (Simon Horman)
+
+ -- Simon Horman <horms@debian.org> Wed, 13 Apr 2005 17:23:38 +0900
+
kernel-source-2.6.8 (2.6.8-15) unstable; urgency=high
* [Security] Fix race in radeon driver which can result
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/0007-1.2086.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/0007-1.2086.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/0007-1.2086.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,108 @@
+# origin: khali (BitKeeper)
+# cset: 1.2086 (2.6) key=4233d0b0SP5VmIKcsKJIyhyjL8yZ1Q
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@4233d0b0SP5VmIKcsKJIyhyjL8yZ1Q
+# inclusion: upstream
+# descrition: [PATCH] fix amd64 2.6.11 oops on modprobe (saa7110)
+# revision date: Fri, 08 Apr 2005 14:50:07 +0900
+#
+# S rset: ChangeSet|1.2085..1.2086
+# I rset: drivers/media/video/saa7110.c|1.17..1.18
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/12 21:33:36-08:00 khali@linux-fr.org
+# [PATCH] fix amd64 2.6.11 oops on modprobe (saa7110)
+#
+# This is a rewrite of the saa7110_write_block function, which was plain
+# broken in the case where the underlying adapter supports I2C_FUNC_I2C.
+# It also includes related fixes which ensure that different parts of the
+# driver agree on the number of registers the chip has.
+#
+# Signed-off-by: Jean Delvare <khali@linux-fr.org>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# drivers/media/video/saa7110.c
+# 2005/03/11 01:06:09-08:00 khali@linux-fr.org +16 -17
+# fix amd64 2.6.11 oops on modprobe (saa7110)
+#
+#
+===== drivers/media/video/saa7110.c 1.17 vs 1.18 =====
+--- 1.17/drivers/media/video/saa7110.c 2005-01-08 14:44:25 +09:00
++++ 1.18/drivers/media/video/saa7110.c 2005-03-11 18:06:09 +09:00
+@@ -60,8 +60,10 @@ MODULE_PARM_DESC(debug, "Debug level (0-
+
+ #define I2C_SAA7110 0x9C /* or 0x9E */
+
++#define SAA7110_NR_REG 0x35
++
+ struct saa7110 {
+- unsigned char reg[54];
++ u8 reg[SAA7110_NR_REG];
+
+ int norm;
+ int input;
+@@ -95,31 +97,28 @@ saa7110_write_block (struct i2c_client *
+ unsigned int len)
+ {
+ int ret = -1;
+- u8 reg = *data++;
++ u8 reg = *data; /* first register to write to */
+
+- len--;
++ /* Sanity check */
++ if (reg + (len - 1) > SAA7110_NR_REG)
++ return ret;
+
+ /* the saa7110 has an autoincrement function, use it if
+ * the adapter understands raw I2C */
+ if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+ struct saa7110 *decoder = i2c_get_clientdata(client);
+ struct i2c_msg msg;
+- u8 block_data[54];
+
+- msg.len = 0;
+- msg.buf = (char *) block_data;
++ msg.len = len;
++ msg.buf = (char *) data;
+ msg.addr = client->addr;
+- msg.flags = client->flags;
+- while (len >= 1) {
+- msg.len = 0;
+- block_data[msg.len++] = reg;
+- while (len-- >= 1 && msg.len < 54)
+- block_data[msg.len++] =
+- decoder->reg[reg++] = *data++;
+- ret = i2c_transfer(client->adapter, &msg, 1);
+- }
++ msg.flags = 0;
++ ret = i2c_transfer(client->adapter, &msg, 1);
++
++ /* Cache the written data */
++ memcpy(decoder->reg + reg, data + 1, len - 1);
+ } else {
+- while (len-- >= 1) {
++ for (++data, --len; len; len--) {
+ if ((ret = saa7110_write(client, reg++,
+ *data++)) < 0)
+ break;
+@@ -192,7 +191,7 @@ saa7110_selmux (struct i2c_client *clien
+ return 0;
+ }
+
+-static const unsigned char initseq[] = {
++static const unsigned char initseq[1 + SAA7110_NR_REG] = {
+ 0, 0x4C, 0x3C, 0x0D, 0xEF, 0xBD, 0xF2, 0x03, 0x00,
+ /* 0x08 */ 0xF8, 0xF8, 0x60, 0x60, 0x00, 0x86, 0x18, 0x90,
+ /* 0x10 */ 0x00, 0x59, 0x40, 0x46, 0x42, 0x1A, 0xFF, 0xDA,
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/0025-1.2104.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/0025-1.2104.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/0025-1.2104.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,66 @@
+# origin: kaber (BitKeeper)
+# cset: 1.2104 (2.6) key=423bba8brL9iqryqalMjl7qMjwdfsw
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@423bba8brL9iqryqalMjl7qMjwdfsw
+# inclusion: upstream
+# descrition: [PATCH] Fix crash while reading /proc/net/route
+# revision date: Fri, 08 Apr 2005 14:55:03 +0900
+#
+# S rset: ChangeSet|1.2103..1.2104
+# I rset: net/ipv4/fib_hash.c|1.36..1.37
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/18 21:37:15-08:00 kaber@trash.net
+# [PATCH] Fix crash while reading /proc/net/route
+#
+# [IPV4]: Fix crash while reading /proc/net/route caused by stale pointers
+#
+# Signed-off-by: Patrick McHardy <kaber@trash.net>
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# net/ipv4/fib_hash.c
+# 2005/03/16 15:58:42-08:00 kaber@trash.net +11 -1
+# Fix crash while reading /proc/net/route
+#
+#
+===== net/ipv4/fib_hash.c 1.36 vs 1.37 =====
+--- 1.36/net/ipv4/fib_hash.c 2005-02-28 04:07:04 +09:00
++++ 1.37/net/ipv4/fib_hash.c 2005-03-17 08:58:42 +09:00
+@@ -919,13 +919,23 @@ out:
+ return fa;
+ }
+
++static struct fib_alias *fib_get_idx(struct seq_file *seq, loff_t pos)
++{
++ struct fib_alias *fa = fib_get_first(seq);
++
++ if (fa)
++ while (pos && (fa = fib_get_next(seq)))
++ --pos;
++ return pos ? NULL : fa;
++}
++
+ static void *fib_seq_start(struct seq_file *seq, loff_t *pos)
+ {
+ void *v = NULL;
+
+ read_lock(&fib_hash_lock);
+ if (ip_fib_main_table)
+- v = *pos ? fib_get_next(seq) : SEQ_START_TOKEN;
++ v = *pos ? fib_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+ return v;
+ }
+
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/arch-ia64-syscall-audit.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/arch-ia64-syscall-audit.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/arch-ia64-syscall-audit.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,83 @@
+# origin: amy.griffis (BitKeeper)
+# cset: 1.2120 (2.6) key=425579bbVV5KiaB2sCN4_39dg_gFDA
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@425579bbVV5KiaB2sCN4_39dg_gFDA
+# inclusion: upstream
+# descrition: [PATCH] fix ia64 syscall auditing
+# revision date: Fri, 08 Apr 2005 14:59:41 +0900
+#
+# S rset: ChangeSet|1.2119..1.2120
+# I rset: arch/ia64/kernel/signal.c|1.49..1.50
+# I rset: arch/ia64/kernel/fsys.S|1.34..1.35
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/04/07 11:19:39-07:00 amy.griffis@hp.com
+# [PATCH] fix ia64 syscall auditing
+#
+# Attached is a patch against David's audit.17 kernel that adds checks
+# for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and
+# signal handling code paths. The patch enables auditing of system
+# calls set up via fsys_bubble_down, as well as ensuring that
+# audit_syscall_exit() is called on return from sigreturn.
+#
+# Neglecting to check for TIF_SYSCALL_AUDIT at these points results in
+# incorrect information in audit_context, causing frequent system panics
+# when system call auditing is enabled on an ia64 system.
+#
+# I have tested this patch and have seen no problems with it.
+#
+# [Original patch from Amy Griffis ported to current kernel by David Woodhouse]
+#
+# From: Amy Griffis <amy.griffis@hp.com>
+# From: David Woodhouse <dwmw2@infradead.org>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# arch/ia64/kernel/signal.c
+# 2005/03/31 15:18:29-08:00 amy.griffis@hp.com +2 -1
+# fix ia64 syscall auditing
+#
+# arch/ia64/kernel/fsys.S
+# 2005/03/31 15:20:32-08:00 amy.griffis@hp.com +3 -1
+# fix ia64 syscall auditing
+#
+#
+===== arch/ia64/kernel/signal.c 1.49 vs 1.50 =====
+--- 1.49/arch/ia64/kernel/signal.c 2005-01-26 05:23:45 +09:00
++++ 1.50/arch/ia64/kernel/signal.c 2005-04-01 08:18:29 +09:00
+@@ -224,7 +224,8 @@ ia64_rt_sigreturn (struct sigscratch *sc
+ * could be corrupted.
+ */
+ retval = (long) &ia64_leave_kernel;
+- if (test_thread_flag(TIF_SYSCALL_TRACE))
++ if (test_thread_flag(TIF_SYSCALL_TRACE)
++ || test_thread_flag(TIF_SYSCALL_AUDIT))
+ /*
+ * strace expects to be notified after sigreturn returns even though the
+ * context to which we return may not be in the middle of a syscall.
+===== arch/ia64/kernel/fsys.S 1.34 vs 1.35 =====
+--- 1.34/arch/ia64/kernel/fsys.S 2005-01-23 07:19:11 +09:00
++++ 1.35/arch/ia64/kernel/fsys.S 2005-04-01 08:20:32 +09:00
+@@ -611,8 +611,10 @@ GLOBAL_ENTRY(fsys_bubble_down)
+ movl r2=ia64_ret_from_syscall
+ ;;
+ mov rp=r2 // set the real return addr
+- tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
++ and r3=_TIF_SYSCALL_TRACEAUDIT,r3
+ ;;
++ cmp.eq p8,p0=r3,r0
++
+ (p10) br.cond.spnt.many ia64_ret_from_syscall // p10==true means out registers are more than 8
+ (p8) br.call.sptk.many b6=b6 // ignore this return addr
+ br.cond.sptk ia64_trace_syscall
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-i2c-chips-eprom.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-i2c-chips-eprom.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-i2c-chips-eprom.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,64 @@
+# origin: khali (BitKeeper)
+# cset: 1.2121 (2.6) key=42557a31YlCws5QVQJcn9OjmNAbPtg
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@42557a31YlCws5QVQJcn9OjmNAbPtg
+# inclusion: upstream
+# descrition: [PATCH] I2C: Fix oops in eeprom driver
+# revision date: Fri, 08 Apr 2005 14:59:57 +0900
+#
+# S rset: ChangeSet|1.2120..1.2121
+# I rset: drivers/i2c/chips/eeprom.c|1.16..1.17
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/04/07 11:21:37-07:00 khali@linux-fr.org
+# [PATCH] I2C: Fix oops in eeprom driver
+#
+# This fixes an oops in the eeprom driver. It was first reported here:
+# http://bugzilla.kernel.org/show_bug.cgi?id=4347
+#
+# It was additionally discussed here (while tracking a completely
+# different bug):
+# http://archives.andrew.net.au/lm-sensors/msg30021.html
+#
+# The patch is already in 2.6.12-rc1:
+# http://linux.bkbits.net:8080/linux-2.5/cset@1.2227
+#
+# The oops happens when one reads data from the sysfs interface file such
+# that (off < 16) and (count < 16 - off). For example "sensors" from
+# lm_sensors 2.9.0 does this, and causes the oops.
+#
+# Signed-off-by: Jean Delvare <khali@linux-fr.org>
+# Signed-off-by: Andrew Morton <akpm@osdl.org>
+# Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# drivers/i2c/chips/eeprom.c
+# 2005/03/17 10:54:07-08:00 khali@linux-fr.org +2 -1
+# I2C: Fix oops in eeprom driver
+#
+#
+===== drivers/i2c/chips/eeprom.c 1.16 vs 1.17 =====
+--- 1.16/drivers/i2c/chips/eeprom.c 2005-01-15 07:17:45 +09:00
++++ 1.17/drivers/i2c/chips/eeprom.c 2005-03-18 03:54:07 +09:00
+@@ -130,7 +130,8 @@ static ssize_t eeprom_read(struct kobjec
+
+ /* Hide Vaio security settings to regular users (16 first bytes) */
+ if (data->nature == VAIO && off < 16 && !capable(CAP_SYS_ADMIN)) {
+- int in_row1 = 16 - off;
++ size_t in_row1 = 16 - off;
++ in_row1 = min(in_row1, count);
+ memset(buf, 0, in_row1);
+ if (count - in_row1 > 0)
+ memcpy(buf + in_row1, &data->data[16], count - in_row1);
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-media-video-i2c-msg.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-media-video-i2c-msg.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-media-video-i2c-msg.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,127 @@
+# origin: khali (BitKeeper)
+# cset: 1.2090 (2.6) key=4233d25ebtWCbA--t5x40vhqpFSp0Q
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@4233d25ebtWCbA--t5x40vhqpFSp0Q
+# inclusion: upstream
+# descrition: [PATCH] Fix i2c messsage flags in video drivers
+# revision date: Fri, 08 Apr 2005 14:51:10 +0900
+#
+# S rset: ChangeSet|1.2089..1.2090
+# I rset: drivers/media/video/bt819.c|1.16..1.17
+# I rset: drivers/media/video/saa7114.c|1.6..1.7
+# I rset: drivers/media/video/adv7175.c|1.21..1.22
+# I rset: drivers/media/video/adv7170.c|1.6..1.7
+# I rset: drivers/media/video/saa7185.c|1.19..1.20
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/12 21:40:46-08:00 khali@linux-fr.org
+# [PATCH] Fix i2c messsage flags in video drivers
+#
+# While working on the saa7110 driver I found a problem with the way
+# various video drivers (found on Zoran-based boards) prepare i2c messages
+# to be used by i2c_transfer. The drivers improperly copy the i2c client
+# flags as the message flags, while both sets are mostly unrelated. The
+# net effect in this case is to trigger an I2C block read instead of the
+# expected I2C block write. The fix is simply not to pass any flag,
+# because none are needed.
+#
+# I think this patch qualifies hands down as a "critical bug fix" to be
+# included in whatever bug-fix-only trees exist these days. As far as I
+# can see, all Zoran-based boards are broken in 2.6.11 without this patch.
+#
+# Signed-off-by: Jean Delvare <khali@linux-fr.org>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# drivers/media/video/saa7185.c
+# 2005/03/08 04:18:12-08:00 khali@linux-fr.org +1 -1
+# Fix i2c messsage flags in video drivers
+#
+# drivers/media/video/saa7114.c
+# 2005/03/08 04:18:20-08:00 khali@linux-fr.org +1 -1
+# Fix i2c messsage flags in video drivers
+#
+# drivers/media/video/bt819.c
+# 2005/03/08 04:18:51-08:00 khali@linux-fr.org +1 -1
+# Fix i2c messsage flags in video drivers
+#
+# drivers/media/video/adv7175.c
+# 2005/03/08 04:18:57-08:00 khali@linux-fr.org +1 -1
+# Fix i2c messsage flags in video drivers
+#
+# drivers/media/video/adv7170.c
+# 2005/03/08 04:19:04-08:00 khali@linux-fr.org +1 -1
+# Fix i2c messsage flags in video drivers
+#
+#
+===== drivers/media/video/bt819.c 1.16 vs 1.17 =====
+--- 1.16/drivers/media/video/bt819.c 2005-01-08 14:44:25 +09:00
++++ 1.17/drivers/media/video/bt819.c 2005-03-08 21:18:51 +09:00
+@@ -146,7 +146,7 @@ bt819_write_block (struct i2c_client *cl
+ u8 block_data[32];
+
+ msg.addr = client->addr;
+- msg.flags = client->flags;
++ msg.flags = 0;
+ while (len >= 2) {
+ msg.buf = (char *) block_data;
+ msg.len = 0;
+===== drivers/media/video/saa7114.c 1.6 vs 1.7 =====
+--- 1.6/drivers/media/video/saa7114.c 2005-01-08 14:44:25 +09:00
++++ 1.7/drivers/media/video/saa7114.c 2005-03-08 21:18:20 +09:00
+@@ -163,7 +163,7 @@ saa7114_write_block (struct i2c_client *
+ u8 block_data[32];
+
+ msg.addr = client->addr;
+- msg.flags = client->flags;
++ msg.flags = 0;
+ while (len >= 2) {
+ msg.buf = (char *) block_data;
+ msg.len = 0;
+===== drivers/media/video/adv7175.c 1.21 vs 1.22 =====
+--- 1.21/drivers/media/video/adv7175.c 2005-01-08 14:44:25 +09:00
++++ 1.22/drivers/media/video/adv7175.c 2005-03-08 21:18:57 +09:00
+@@ -126,7 +126,7 @@ adv7175_write_block (struct i2c_client *
+ u8 block_data[32];
+
+ msg.addr = client->addr;
+- msg.flags = client->flags;
++ msg.flags = 0;
+ while (len >= 2) {
+ msg.buf = (char *) block_data;
+ msg.len = 0;
+===== drivers/media/video/adv7170.c 1.6 vs 1.7 =====
+--- 1.6/drivers/media/video/adv7170.c 2005-01-08 14:44:25 +09:00
++++ 1.7/drivers/media/video/adv7170.c 2005-03-08 21:19:04 +09:00
+@@ -130,7 +130,7 @@ adv7170_write_block (struct i2c_client *
+ u8 block_data[32];
+
+ msg.addr = client->addr;
+- msg.flags = client->flags;
++ msg.flags = 0;
+ while (len >= 2) {
+ msg.buf = (char *) block_data;
+ msg.len = 0;
+===== drivers/media/video/saa7185.c 1.19 vs 1.20 =====
+--- 1.19/drivers/media/video/saa7185.c 2005-01-08 14:44:25 +09:00
++++ 1.20/drivers/media/video/saa7185.c 2005-03-08 21:18:12 +09:00
+@@ -118,7 +118,7 @@ saa7185_write_block (struct i2c_client *
+ u8 block_data[32];
+
+ msg.addr = client->addr;
+- msg.flags = client->flags;
++ msg.flags = 0;
+ while (len >= 2) {
+ msg.buf = (char *) block_data;
+ msg.len = 0;
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-media-video-saa7110-oops.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-media-video-saa7110-oops.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-media-video-saa7110-oops.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,108 @@
+# origin: khali (BitKeeper)
+# cset: 1.2086 (2.6) key=4233d0b0SP5VmIKcsKJIyhyjL8yZ1Q
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@4233d0b0SP5VmIKcsKJIyhyjL8yZ1Q
+# inclusion: upstream
+# descrition: [PATCH] fix amd64 2.6.11 oops on modprobe (saa7110)
+# revision date: Fri, 08 Apr 2005 14:50:07 +0900
+#
+# S rset: ChangeSet|1.2085..1.2086
+# I rset: drivers/media/video/saa7110.c|1.17..1.18
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/12 21:33:36-08:00 khali@linux-fr.org
+# [PATCH] fix amd64 2.6.11 oops on modprobe (saa7110)
+#
+# This is a rewrite of the saa7110_write_block function, which was plain
+# broken in the case where the underlying adapter supports I2C_FUNC_I2C.
+# It also includes related fixes which ensure that different parts of the
+# driver agree on the number of registers the chip has.
+#
+# Signed-off-by: Jean Delvare <khali@linux-fr.org>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# drivers/media/video/saa7110.c
+# 2005/03/11 01:06:09-08:00 khali@linux-fr.org +16 -17
+# fix amd64 2.6.11 oops on modprobe (saa7110)
+#
+#
+===== drivers/media/video/saa7110.c 1.17 vs 1.18 =====
+--- 1.17/drivers/media/video/saa7110.c 2005-01-08 14:44:25 +09:00
++++ 1.18/drivers/media/video/saa7110.c 2005-03-11 18:06:09 +09:00
+@@ -60,8 +60,10 @@ MODULE_PARM_DESC(debug, "Debug level (0-
+
+ #define I2C_SAA7110 0x9C /* or 0x9E */
+
++#define SAA7110_NR_REG 0x35
++
+ struct saa7110 {
+- unsigned char reg[54];
++ u8 reg[SAA7110_NR_REG];
+
+ int norm;
+ int input;
+@@ -95,31 +97,28 @@ saa7110_write_block (struct i2c_client *
+ unsigned int len)
+ {
+ int ret = -1;
+- u8 reg = *data++;
++ u8 reg = *data; /* first register to write to */
+
+- len--;
++ /* Sanity check */
++ if (reg + (len - 1) > SAA7110_NR_REG)
++ return ret;
+
+ /* the saa7110 has an autoincrement function, use it if
+ * the adapter understands raw I2C */
+ if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+ struct saa7110 *decoder = i2c_get_clientdata(client);
+ struct i2c_msg msg;
+- u8 block_data[54];
+
+- msg.len = 0;
+- msg.buf = (char *) block_data;
++ msg.len = len;
++ msg.buf = (char *) data;
+ msg.addr = client->addr;
+- msg.flags = client->flags;
+- while (len >= 1) {
+- msg.len = 0;
+- block_data[msg.len++] = reg;
+- while (len-- >= 1 && msg.len < 54)
+- block_data[msg.len++] =
+- decoder->reg[reg++] = *data++;
+- ret = i2c_transfer(client->adapter, &msg, 1);
+- }
++ msg.flags = 0;
++ ret = i2c_transfer(client->adapter, &msg, 1);
++
++ /* Cache the written data */
++ memcpy(decoder->reg + reg, data + 1, len - 1);
+ } else {
+- while (len-- >= 1) {
++ for (++data, --len; len; len--) {
+ if ((ret = saa7110_write(client, reg++,
+ *data++)) < 0)
+ break;
+@@ -192,7 +191,7 @@ saa7110_selmux (struct i2c_client *clien
+ return 0;
+ }
+
+-static const unsigned char initseq[] = {
++static const unsigned char initseq[1 + SAA7110_NR_REG] = {
+ 0, 0x4C, 0x3C, 0x0D, 0xEF, 0xBD, 0xF2, 0x03, 0x00,
+ /* 0x08 */ 0xF8, 0xF8, 0x60, 0x60, 0x00, 0x86, 0x18, 0x90,
+ /* 0x10 */ 0x00, 0x59, 0x40, 0x46, 0x42, 0x1A, 0xFF, 0xDA,
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-amd811e-irq.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-amd811e-irq.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-amd811e-irq.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,60 @@
+# origin: dilinger (BitKeeper)
+# cset: 1.2103 (2.6) key=423bb97clhqMvFL08P6JJ_Jc27TAAA
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@423bb97clhqMvFL08P6JJ_Jc27TAAA
+# inclusion: upstream
+# descrition: [PATCH] Possible AMD8111e free irq issue
+# revision date: Fri, 08 Apr 2005 14:54:47 +0900
+#
+# S rset: ChangeSet|1.2102..1.2103
+# I rset: drivers/net/amd8111e.c|1.30..1.31
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/18 21:32:44-08:00 dilinger@debian.org
+# [PATCH] Possible AMD8111e free irq issue
+#
+# It seems to me that if in the amd8111e_open() fuction dev->irq isn't
+# zero and the irq request succeeds it might not get released anymore.
+#
+# Specifically, on failure of the amd8111e_restart() call the function
+# returns -ENOMEM without releasing the irq. The amd8111e_restart()
+# function can fail because of various pci_alloc_consistent() and
+# dev_alloc_skb() calls in amd8111e_init_ring() which is being
+# called by amd8111e_restart.
+#
+# 1374 if(dev->irq ==0 || request_irq(dev->irq, amd8111e_interrupt, SA_SHIRQ,
+# 1375 dev->name, dev))
+# 1376 return -EAGAIN;
+#
+# Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# drivers/net/amd8111e.c
+# 2005/03/09 20:29:47-08:00 dilinger@debian.org +2 -0
+# Possible AMD8111e free irq issue
+#
+#
+===== drivers/net/amd8111e.c 1.30 vs 1.31 =====
+--- 1.30/drivers/net/amd8111e.c 2005-01-11 01:52:26 +09:00
++++ 1.31/drivers/net/amd8111e.c 2005-03-10 13:29:47 +09:00
+@@ -1381,6 +1381,8 @@ static int amd8111e_open(struct net_devi
+
+ if(amd8111e_restart(dev)){
+ spin_unlock_irq(&lp->lock);
++ if (dev->irq)
++ free_irq(dev->irq, dev);
+ return -ENOMEM;
+ }
+ /* Start ipg timer */
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-sis900-oops.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-sis900-oops.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-sis900-oops.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,174 @@
+# origin: chrisw (BitKeeper)
+# cset: 1.2095 (2.6) key=4233d3c5YkBpjko54dEwE4WPIndnLg
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@4233d3c5YkBpjko54dEwE4WPIndnLg
+# inclusion: upstream
+# descrition: [PATCH] sis900 kernel oops fix
+# revision date: Fri, 08 Apr 2005 14:52:30 +0900
+#
+# S rset: ChangeSet|1.2094..1.2095
+# R rset: drivers/net/sis900.c|1.62..1.63
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/12 21:46:45-08:00 chrisw@osdl.org
+# [PATCH] sis900 kernel oops fix
+#
+# Backport of fix described below.
+#
+# From: Herbert Xu <herbert@gondor.apana.org.au>
+#
+# Fix bug #4223.
+#
+# OK, this happened because we got preempted before sis900_mii_probe
+# finished setting the sis_priv->mii. Theoretically this can happen
+# with SMP as well but I suppose the number of SMP machines with sis900
+# is fairly small.
+#
+# Anyway, the fix is to make sure that sis900_mii_probe is done before
+# the device can be opened. This patch does it by moving the setup
+# before register_netdevice.
+#
+# Since the netdev name is not available before register_netdev, I've
+# changed the relevant printk's to use pci_name instead. Note that
+# one of those printk's may be called after register_netdev as well.
+#
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# drivers/net/sis900.c
+# 2005/03/10 12:23:49-08:00 chrisw@osdl.org +14 -16
+# sis900 kernel oops fix
+#
+#
+--- a/drivers/net/sis900.c 2004-08-14 14:36:56.000000000 +0900
++++ b/drivers/net/sis900.c 2005-04-08 16:40:10.000000000 +0900
+@@ -234,7 +234,7 @@
+ signature = (u16) read_eeprom(ioaddr, EEPROMSignature);
+ if (signature == 0xffff || signature == 0x0000) {
+ printk (KERN_INFO "%s: Error EERPOM read %x\n",
+- net_dev->name, signature);
++ pci_name(pci_dev), signature);
+ return 0;
+ }
+
+@@ -265,7 +265,8 @@
+ if (!isa_bridge) {
+ isa_bridge = pci_find_device(PCI_VENDOR_ID_SI, 0x0018, isa_bridge);
+ if (!isa_bridge) {
+- printk("%s: Can not find ISA bridge\n", net_dev->name);
++ printk(KERN_WARNING "%s: Can not find ISA bridge\n",
++ pci_name(pci_dev));
+ return 0;
+ }
+ }
+@@ -450,10 +451,6 @@
+ net_dev->tx_timeout = sis900_tx_timeout;
+ net_dev->watchdog_timeo = TX_TIMEOUT;
+ net_dev->ethtool_ops = &sis900_ethtool_ops;
+-
+- ret = register_netdev(net_dev);
+- if (ret)
+- goto err_unmap_rx;
+
+ /* Get Mac address according to the chip revision */
+ pci_read_config_byte(pci_dev, PCI_CLASS_REVISION, &revision);
+@@ -470,7 +467,7 @@
+
+ if (ret == 0) {
+ ret = -ENODEV;
+- goto err_out_unregister;
++ goto err_unmap_rx;
+ }
+
+ /* 630ET : set the mii access mode as software-mode */
+@@ -480,7 +477,7 @@
+ /* probe for mii transceiver */
+ if (sis900_mii_probe(net_dev) == 0) {
+ ret = -ENODEV;
+- goto err_out_unregister;
++ goto err_unmap_rx;
+ }
+
+ /* save our host bridge revision */
+@@ -488,6 +485,10 @@
+ if (dev)
+ pci_read_config_byte(dev, PCI_CLASS_REVISION, &sis_priv->host_bridge_rev);
+
++ ret = register_netdev(net_dev);
++ if (ret)
++ goto err_unmap_rx;
++
+ /* print some information about our NIC */
+ printk(KERN_INFO "%s: %s at %#lx, IRQ %d, ", net_dev->name,
+ card_name, ioaddr, net_dev->irq);
+@@ -497,8 +498,6 @@
+
+ return 0;
+
+- err_out_unregister:
+- unregister_netdev(net_dev);
+ err_unmap_rx:
+ pci_free_consistent(pci_dev, RX_TOTAL_SIZE, sis_priv->rx_ring,
+ sis_priv->rx_ring_dma);
+@@ -525,6 +524,7 @@
+ static int __init sis900_mii_probe (struct net_device * net_dev)
+ {
+ struct sis900_private * sis_priv = net_dev->priv;
++ const char *dev_name = pci_name(sis_priv->pci_dev);
+ u16 poll_bit = MII_STAT_LINK, status = 0;
+ unsigned long timeout = jiffies + 5 * HZ;
+ int phy_addr;
+@@ -574,20 +574,19 @@
+ mii_phy->phy_types =
+ (mii_status & (MII_STAT_CAN_TX_FDX | MII_STAT_CAN_TX)) ? LAN : HOME;
+ printk(KERN_INFO "%s: %s transceiver found at address %d.\n",
+- net_dev->name, mii_chip_table[i].name, phy_addr);
++ dev_name, mii_chip_table[i].name, phy_addr);
+ break;
+ }
+
+ if( !mii_chip_table[i].phy_id1 ) {
+ printk(KERN_INFO "%s: Unknown PHY transceiver found at address %d.\n",
+- net_dev->name, phy_addr);
++ dev_name, phy_addr);
+ mii_phy->phy_types = UNKNOWN;
+ }
+ }
+
+ if (sis_priv->mii == NULL) {
+- printk(KERN_INFO "%s: No MII transceivers found!\n",
+- net_dev->name);
++ printk(KERN_INFO "%s: No MII transceivers found!\n", dev_name);
+ return 0;
+ }
+
+@@ -611,7 +610,8 @@
+
+ poll_bit ^= (mdio_read(net_dev, sis_priv->cur_phy, MII_STATUS) & poll_bit);
+ if (time_after_eq(jiffies, timeout)) {
+- printk(KERN_WARNING "%s: reset phy and link down now\n", net_dev->name);
++ printk(KERN_WARNING "%s: reset phy and link down now\n",
++ dev_name);
+ return -ETIME;
+ }
+ }
+@@ -678,7 +678,7 @@
+ if( sis_priv->mii != default_phy ){
+ sis_priv->mii = default_phy;
+ sis_priv->cur_phy = default_phy->phy_addr;
+- printk(KERN_INFO "%s: Using transceiver found at address %d as default\n", net_dev->name,sis_priv->cur_phy);
++ printk(KERN_INFO "%s: Using transceiver found at address %d as default\n", pci_name(sis_priv->pci_dev), sis_priv->cur_phy);
+ }
+
+ status = mdio_read(net_dev, sis_priv->cur_phy, MII_CONTROL);
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-via-rhine-irq.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-via-rhine-irq.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-via-rhine-irq.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,56 @@
+# origin: dilinger (BitKeeper)
+# cset: 1.2108 (2.6) key=423bbc05NDXpG43AD5mxHCl1xpVtDQ
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@423bbc05NDXpG43AD5mxHCl1xpVtDQ
+# inclusion: upstream
+# descrition: [PATCH] Possible VIA-Rhine free irq issue
+# revision date: Fri, 08 Apr 2005 14:56:09 +0900
+#
+# S rset: ChangeSet|1.2107..1.2108
+# R rset: drivers/net/via-rhine.c|1.90..1.91
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/18 21:43:33-08:00 dilinger@debian.org
+# [PATCH] Possible VIA-Rhine free irq issue
+#
+# It seems to me that in the VIA Rhine device driver the requested irq might
+# not be freed in case the alloc_ring() function fails. alloc_ring()
+# can fail with a ENOMEM return value because of possible
+# pci_alloc_consistent() failures.
+#
+# Updated to CodingStyle.
+#
+# Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# drivers/net/via-rhine.c
+# 2005/03/11 15:18:25-08:00 dilinger@debian.org +3 -1
+# Possible VIA-Rhine free irq issue
+#
+#
+--- a/drivers/net/via-rhine.c 2005-04-08 17:13:44.000000000 +0900
++++ b/drivers/net/via-rhine.c 2005-04-08 17:14:14.000000000 +0900
+@@ -1180,8 +1180,10 @@ static int rhine_open(struct net_device
+ dev->name, rp->pdev->irq);
+
+ i = alloc_ring(dev);
+- if (i)
++ if (i) {
++ free_irq(rp->pdev->irq, dev);
+ return i;
++ }
+ alloc_rbufs(dev);
+ alloc_tbufs(dev);
+ wait_for_reset(dev, rp->quirks, dev->name);
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-via-rhine-wol-oops.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-via-rhine-wol-oops.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/drivers-net-via-rhine-wol-oops.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,113 @@
+# origin: olof (BitKeeper)
+# cset: 1.2096 (2.6) key=4233d40fv14RepFez__xMz0T3WDd0g
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@4233d40fv14RepFez__xMz0T3WDd0g
+# inclusion: upstream
+# descrition: [PATCH] [VIA RHINE] older chips oops on shutdown
+# revision date: Fri, 08 Apr 2005 14:52:46 +0900
+#
+# S rset: ChangeSet|1.2095..1.2096
+# I rset: drivers/net/via-rhine.c|1.89..1.90
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/12 21:47:59-08:00 olof@austin.ibm.com
+# [PATCH] [VIA RHINE] older chips oops on shutdown
+#
+# Kernel 2.6.11, hardware is a MSI KT333-based board with an XP1800.
+#
+# I'm oopsing on shutdown on a machine that has a Via Rhine adapter in it:
+#
+# Unable to handle kernel paging request at virtual address e0803003
+# printing eip:
+# c01f262c
+# *pde = 014dc067
+# *pte = 00000000
+# Oops: 0000 [#1]
+# Modules linked in: cpufreq_userspace cpufreq_powersave cpufreq_ondemand
+# CPU: 0
+# EIP: 0060:[<c01f262c>] Not tainted VLI
+# EFLAGS: 00010292 (2.6.11)
+# EIP is at ioread8+0x2c/0x40
+# eax: e0803003 ebx: e0803003 ecx: c026b430 edx: e0803003
+# esi: dff90260 edi: e0802f80 ebp: dd117e74 esp: dd117e74
+# ds: 007b es: 007b ss: 0068
+# Process reboot (pid: 5769, threadinfo=dd117000 task=dfafa080)
+# Stack: dd117e8c c026b490 dff90040 c151ccd4 c044a1a8 b7fdc078 dd117ea4
+# c0253ad9
+# c151ccd4 00000042 fee1dead 00000001 dd117fbc c012461c c04d72a8 00000001
+# 00000000 00010800 00000000 dd117ed8 c013b40b dffe7380 00030800 00000000
+# Call Trace:
+# [<c0103d5f>] show_stack+0x7f/0xa0
+# [<c0103efa>] show_registers+0x15a/0x1c0
+# [<c01040ce>] die+0xce/0x150
+# [<c0113406>] do_page_fault+0x356/0x692
+# [<c01039ff>] error_code+0x2b/0x30
+# [<c026b490>] rhine_shutdown+0x60/0x140
+# [<c0253ad9>] device_shutdown+0x89/0x8b
+# [<c012461c>] sys_reboot+0xac/0x200
+# [<c0102f71>] sysenter_past_esp+0x52/0x75
+# Code: 3d ff ff 03 00 89 c2 89 e5 77 20 66 31 c0 3d 00 00 01 00 75 0c
+# 81 e2 ff ff 00 00 ec 0f b6 c0 c9 c3 0f 0b 37 00 7b 65 3b c0 eb ea <0f>
+# b6 00 eb ec eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 55
+#
+# Seems like it is the ioread8 in:
+#
+# /* Hit power state D3 (sleep) */
+# iowrite8(ioread8(ioaddr + StickyHW) | 0x03, ioaddr + StickyHW);
+#
+# that fails. StickyHW is 0x83. lspci says:
+#
+# 0000:00:07.0 Ethernet controller: VIA Technologies, Inc. VT86C100A
+# [Rhine] (rev 06)
+# Flags: bus master, medium devsel, latency 32, IRQ 18
+# I/O ports at ec00 [size=128]
+# Memory at dfffff80 (32-bit, non-prefetchable) [size=128]
+#
+# In other words, it's trying to read outside of the I/O range (0x80),
+# which matches the fauling address.
+#
+# I'm guessing my chip revision doesn't support WOL, it's a crappy noname
+# card.
+#
+# It does seem as if rhine_power_init checks quirks for rqWOL before
+# touching any registers. Should rhine_shutdown do the same? Proposed
+# patch below, which resolves the problem on my system.
+#
+#
+# Check to make sure WOL is supported before setting it up in
+# rhine_shutdown.
+#
+#
+# Signed-off-by: Olof Johansson <olof@austin.ibm.com>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# drivers/net/via-rhine.c
+# 2005/03/05 04:25:34-08:00 olof@austin.ibm.com +3 -0
+# [VIA RHINE] older chips oops on shutdown
+#
+#
+===== drivers/net/via-rhine.c 1.89 vs 1.90 =====
+--- 1.89/drivers/net/via-rhine.c 2005-01-11 01:52:27 +09:00
++++ 1.90/drivers/net/via-rhine.c 2005-03-05 21:25:34 +09:00
+@@ -1899,6 +1899,9 @@ static void rhine_shutdown (struct devic
+ struct rhine_private *rp = netdev_priv(dev);
+ void __iomem *ioaddr = rp->base;
+
++ if (!(rp->quirks & rqWOL))
++ return; /* Nothing to do for non-WOL adapters */
++
+ rhine_power_init(dev);
+
+ /* Make sure we use pattern 0, 1 and not 4, 5 */
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fs-cramfs-stat.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fs-cramfs-stat.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fs-cramfs-stat.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,52 @@
+# origin: akpm (BitKeeper)
+# cset: 1.2087 (2.6) key=4233d1160KRwGtYr32RaehQWJRFT_g
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@4233d1160KRwGtYr32RaehQWJRFT_g
+# inclusion: upstream
+# descrition: [PATCH] cramfs: small stat(2) fix
+# revision date: Fri, 08 Apr 2005 14:50:21 +0900
+#
+# S rset: ChangeSet|1.2086..1.2087
+# I rset: fs/cramfs/inode.c|1.38..1.39
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/12 21:35:18-08:00 akpm@osdl.org
+# [PATCH] cramfs: small stat(2) fix
+#
+# From: Eric Lammerts <eric@lammerts.org>
+#
+# When I stat(2) a device node on a cramfs, the st_blocks field is bogus
+# (it's derived from the size field which in this case holds the major/minor
+# numbers). This makes du(1) output completely wrong.
+#
+# Signed-off-by: Eric Lammerts <eric@lammerts.org>
+# Signed-off-by: Andrew Morton <akpm@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# fs/cramfs/inode.c
+# 2005/03/04 13:15:57-08:00 akpm@osdl.org +1 -0
+# cramfs: small stat(2) fix
+#
+#
+===== fs/cramfs/inode.c 1.38 vs 1.39 =====
+--- 1.38/fs/cramfs/inode.c 2004-04-17 00:39:37 +09:00
++++ 1.39/fs/cramfs/inode.c 2005-03-05 06:15:57 +09:00
+@@ -70,6 +70,7 @@ static struct inode *get_cramfs_inode(st
+ inode->i_data.a_ops = &cramfs_aops;
+ } else {
+ inode->i_size = 0;
++ inode->i_blocks = 0;
+ init_special_inode(inode, inode->i_mode,
+ old_decode_dev(cramfs_inode->size));
+ }
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fs-jdb-race.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fs-jdb-race.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fs-jdb-race.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,82 @@
+# origin: jack (BitKeeper)
+# cset: 1.2119 (2.6) key=42557944npki8tNf8noV_Xl4nlFwHA
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@42557944npki8tNf8noV_Xl4nlFwHA
+# inclusion: upstream
+# descrition: [PATCH] Prevent race condition in jbd
+# revision date: Fri, 08 Apr 2005 14:59:25 +0900
+#
+# S rset: ChangeSet|1.2118..1.2119
+# I rset: fs/jbd/transaction.c|1.91..1.92
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/04/07 11:17:40-07:00 jack@suse.cz
+# [PATCH] Prevent race condition in jbd
+#
+# From: Stephen Tweedie <sct@redhat.com>
+# Subject: Prevent race condition in jbd
+#
+# This patch from Stephen Tweedie which fixes a race in jbd code (it
+# demonstrated itself as more or less random NULL dereferences in the
+# journal code).
+#
+# Acked-by: Jan Kara <jack@suse.cz>
+# Acked-by: Chris Mason <mason@suse.com>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# fs/jbd/transaction.c
+# 2005/04/06 17:00:00-07:00 jack@suse.cz +3 -3
+# Prevent race condition in jbd
+#
+#
+===== fs/jbd/transaction.c 1.91 vs 1.92 =====
+--- 1.91/fs/jbd/transaction.c 2005-01-05 11:48:12 +09:00
++++ 1.92/fs/jbd/transaction.c 2005-04-07 09:00:00 +09:00
+@@ -1775,10 +1775,10 @@ static int journal_unmap_buffer(journal_
+ JBUFFER_TRACE(jh, "checkpointed: add to BJ_Forget");
+ ret = __dispose_buffer(jh,
+ journal->j_running_transaction);
++ journal_put_journal_head(jh);
+ spin_unlock(&journal->j_list_lock);
+ jbd_unlock_bh_state(bh);
+ spin_unlock(&journal->j_state_lock);
+- journal_put_journal_head(jh);
+ return ret;
+ } else {
+ /* There is no currently-running transaction. So the
+@@ -1789,10 +1789,10 @@ static int journal_unmap_buffer(journal_
+ JBUFFER_TRACE(jh, "give to committing trans");
+ ret = __dispose_buffer(jh,
+ journal->j_committing_transaction);
++ journal_put_journal_head(jh);
+ spin_unlock(&journal->j_list_lock);
+ jbd_unlock_bh_state(bh);
+ spin_unlock(&journal->j_state_lock);
+- journal_put_journal_head(jh);
+ return ret;
+ } else {
+ /* The orphan record's transaction has
+@@ -1813,10 +1813,10 @@ static int journal_unmap_buffer(journal_
+ journal->j_running_transaction);
+ jh->b_next_transaction = NULL;
+ }
++ journal_put_journal_head(jh);
+ spin_unlock(&journal->j_list_lock);
+ jbd_unlock_bh_state(bh);
+ spin_unlock(&journal->j_state_lock);
+- journal_put_journal_head(jh);
+ return 0;
+ } else {
+ /* Good, the buffer belongs to the running transaction.
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lib-rwsem-spinlock.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lib-rwsem-spinlock.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lib-rwsem-spinlock.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,275 @@
+# origin: akpm (BitKeeper)
+# cset: 1.2123 (2.6) key=42557d826x7o3ENdeb1ipondVn37xA
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@42557d826x7o3ENdeb1ipondVn37xA
+# inclusion: upstream
+# descrition: [PATCH] rwsem fix
+# revision date: Fri, 08 Apr 2005 15:00:30 +0900
+#
+# S rset: ChangeSet|1.2122..1.2123
+# I rset: lib/rwsem.c|1.16..1.17
+# I rset: lib/rwsem-spinlock.c|1.7..1.8
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/04/07 11:35:46-07:00 akpm@osdl.org
+# [PATCH] rwsem fix
+#
+# We should merge this backport - it's needed to prevent deadlocks when
+# dio_complete() does up_read() from IRQ context. And perhaps other places.
+#
+# From: David Howells <dhowells@redhat.com>
+#
+# [PATCH] rwsem: Make rwsems use interrupt disabling spinlocks
+#
+# The attached patch makes read/write semaphores use interrupt disabling
+# spinlocks in the slow path, thus rendering the up functions and trylock
+# functions available for use in interrupt context. This matches the
+# regular semaphore behaviour.
+#
+# I've assumed that the normal down functions must be called with interrupts
+# enabled (since they might schedule), and used the irq-disabling spinlock
+# variants that don't save the flags.
+#
+# Signed-Off-By: David Howells <dhowells@redhat.com>
+# Tested-by: Badari Pulavarty <pbadari@us.ibm.com>
+# Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# lib/rwsem.c
+# 2005/04/01 23:22:40-08:00 akpm@osdl.org +10 -6
+# rwsem fix
+#
+# lib/rwsem-spinlock.c
+# 2005/04/01 23:22:40-08:00 akpm@osdl.org +26 -16
+# rwsem fix
+#
+#
+===== lib/rwsem.c 1.16 vs 1.17 =====
+--- 1.16/lib/rwsem.c 2004-09-08 15:32:52 +09:00
++++ 1.17/lib/rwsem.c 2005-04-02 16:22:40 +09:00
+@@ -150,7 +150,7 @@ rwsem_down_failed_common(struct rw_semap
+ set_task_state(tsk, TASK_UNINTERRUPTIBLE);
+
+ /* set up my own style of waitqueue */
+- spin_lock(&sem->wait_lock);
++ spin_lock_irq(&sem->wait_lock);
+ waiter->task = tsk;
+ get_task_struct(tsk);
+
+@@ -163,7 +163,7 @@ rwsem_down_failed_common(struct rw_semap
+ if (!(count & RWSEM_ACTIVE_MASK))
+ sem = __rwsem_do_wake(sem, 0);
+
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irq(&sem->wait_lock);
+
+ /* wait to be given the lock */
+ for (;;) {
+@@ -219,15 +219,17 @@ rwsem_down_write_failed(struct rw_semaph
+ */
+ struct rw_semaphore fastcall *rwsem_wake(struct rw_semaphore *sem)
+ {
++ unsigned long flags;
++
+ rwsemtrace(sem, "Entering rwsem_wake");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irqsave(&sem->wait_lock, flags);
+
+ /* do nothing if list empty */
+ if (!list_empty(&sem->wait_list))
+ sem = __rwsem_do_wake(sem, 0);
+
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+ rwsemtrace(sem, "Leaving rwsem_wake");
+
+@@ -241,15 +243,17 @@ struct rw_semaphore fastcall *rwsem_wake
+ */
+ struct rw_semaphore fastcall *rwsem_downgrade_wake(struct rw_semaphore *sem)
+ {
++ unsigned long flags;
++
+ rwsemtrace(sem, "Entering rwsem_downgrade_wake");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irqsave(&sem->wait_lock, flags);
+
+ /* do nothing if list empty */
+ if (!list_empty(&sem->wait_list))
+ sem = __rwsem_do_wake(sem, 1);
+
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+ rwsemtrace(sem, "Leaving rwsem_downgrade_wake");
+ return sem;
+===== lib/rwsem-spinlock.c 1.7 vs 1.8 =====
+--- 1.7/lib/rwsem-spinlock.c 2004-06-21 10:23:45 +09:00
++++ 1.8/lib/rwsem-spinlock.c 2005-04-02 16:22:40 +09:00
+@@ -140,12 +140,12 @@ void fastcall __sched __down_read(struct
+
+ rwsemtrace(sem, "Entering __down_read");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irq(&sem->wait_lock);
+
+ if (sem->activity >= 0 && list_empty(&sem->wait_list)) {
+ /* granted */
+ sem->activity++;
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irq(&sem->wait_lock);
+ goto out;
+ }
+
+@@ -160,7 +160,7 @@ void fastcall __sched __down_read(struct
+ list_add_tail(&waiter.list, &sem->wait_list);
+
+ /* we don't need to touch the semaphore struct anymore */
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irq(&sem->wait_lock);
+
+ /* wait to be given the lock */
+ for (;;) {
+@@ -181,10 +181,12 @@ void fastcall __sched __down_read(struct
+ */
+ int fastcall __down_read_trylock(struct rw_semaphore *sem)
+ {
++ unsigned long flags;
+ int ret = 0;
++
+ rwsemtrace(sem, "Entering __down_read_trylock");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irqsave(&sem->wait_lock, flags);
+
+ if (sem->activity >= 0 && list_empty(&sem->wait_list)) {
+ /* granted */
+@@ -192,7 +194,7 @@ int fastcall __down_read_trylock(struct
+ ret = 1;
+ }
+
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+ rwsemtrace(sem, "Leaving __down_read_trylock");
+ return ret;
+@@ -209,12 +211,12 @@ void fastcall __sched __down_write(struc
+
+ rwsemtrace(sem, "Entering __down_write");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irq(&sem->wait_lock);
+
+ if (sem->activity == 0 && list_empty(&sem->wait_list)) {
+ /* granted */
+ sem->activity = -1;
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irq(&sem->wait_lock);
+ goto out;
+ }
+
+@@ -229,7 +231,7 @@ void fastcall __sched __down_write(struc
+ list_add_tail(&waiter.list, &sem->wait_list);
+
+ /* we don't need to touch the semaphore struct anymore */
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irq(&sem->wait_lock);
+
+ /* wait to be given the lock */
+ for (;;) {
+@@ -250,10 +252,12 @@ void fastcall __sched __down_write(struc
+ */
+ int fastcall __down_write_trylock(struct rw_semaphore *sem)
+ {
++ unsigned long flags;
+ int ret = 0;
++
+ rwsemtrace(sem, "Entering __down_write_trylock");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irqsave(&sem->wait_lock, flags);
+
+ if (sem->activity == 0 && list_empty(&sem->wait_list)) {
+ /* granted */
+@@ -261,7 +265,7 @@ int fastcall __down_write_trylock(struct
+ ret = 1;
+ }
+
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+ rwsemtrace(sem, "Leaving __down_write_trylock");
+ return ret;
+@@ -272,14 +276,16 @@ int fastcall __down_write_trylock(struct
+ */
+ void fastcall __up_read(struct rw_semaphore *sem)
+ {
++ unsigned long flags;
++
+ rwsemtrace(sem, "Entering __up_read");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irqsave(&sem->wait_lock, flags);
+
+ if (--sem->activity == 0 && !list_empty(&sem->wait_list))
+ sem = __rwsem_wake_one_writer(sem);
+
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+ rwsemtrace(sem, "Leaving __up_read");
+ }
+@@ -289,15 +295,17 @@ void fastcall __up_read(struct rw_semaph
+ */
+ void fastcall __up_write(struct rw_semaphore *sem)
+ {
++ unsigned long flags;
++
+ rwsemtrace(sem, "Entering __up_write");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irqsave(&sem->wait_lock, flags);
+
+ sem->activity = 0;
+ if (!list_empty(&sem->wait_list))
+ sem = __rwsem_do_wake(sem, 1);
+
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+ rwsemtrace(sem, "Leaving __up_write");
+ }
+@@ -308,15 +316,17 @@ void fastcall __up_write(struct rw_semap
+ */
+ void fastcall __downgrade_write(struct rw_semaphore *sem)
+ {
++ unsigned long flags;
++
+ rwsemtrace(sem, "Entering __downgrade_write");
+
+- spin_lock(&sem->wait_lock);
++ spin_lock_irqsave(&sem->wait_lock, flags);
+
+ sem->activity = 1;
+ if (!list_empty(&sem->wait_list))
+ sem = __rwsem_do_wake(sem, 0);
+
+- spin_unlock(&sem->wait_lock);
++ spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+ rwsemtrace(sem, "Leaving __downgrade_write");
+ }
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/net-netrom-double-lock.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/net-netrom-double-lock.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/net-netrom-double-lock.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,93 @@
+# origin: ralf (BitKeeper)
+# cset: 1.2101 (2.6) key=423bb8e0G7HTjpdyVnmXdWE563EMRg
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@423bb8e0G7HTjpdyVnmXdWE563EMRg
+# inclusion: upstream
+# descrition: [PATCH] NetROM locking
+# revision date: Fri, 08 Apr 2005 14:54:11 +0900
+#
+# S rset: ChangeSet|1.2100..1.2101
+# I rset: net/netrom/nr_in.c|1.8..1.9
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/18 21:30:08-08:00 ralf@linux-mips.org
+# [PATCH] NetROM locking
+#
+# Fix deadlock in NetROM due to double locking. I was sent the patch by
+# Alan and have doublechecked it. This bug hits Net/ROM users really hard.
+# It's accepted by DaveM - but just too late to make it into 2.6.11.
+#
+# Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# net/netrom/nr_in.c
+# 2005/02/05 14:16:26-08:00 ralf@linux-mips.org +0 -9
+# NetROM locking
+#
+#
+===== net/netrom/nr_in.c 1.8 vs 1.9 =====
+--- 1.8/net/netrom/nr_in.c 2003-08-15 13:10:02 +09:00
++++ 1.9/net/netrom/nr_in.c 2005-02-06 07:16:26 +09:00
+@@ -74,7 +74,6 @@ static int nr_queue_rx_frame(struct sock
+ static int nr_state1_machine(struct sock *sk, struct sk_buff *skb,
+ int frametype)
+ {
+- bh_lock_sock(sk);
+ switch (frametype) {
+ case NR_CONNACK: {
+ nr_cb *nr = nr_sk(sk);
+@@ -103,8 +102,6 @@ static int nr_state1_machine(struct sock
+ default:
+ break;
+ }
+- bh_unlock_sock(sk);
+-
+ return 0;
+ }
+
+@@ -116,7 +113,6 @@ static int nr_state1_machine(struct sock
+ static int nr_state2_machine(struct sock *sk, struct sk_buff *skb,
+ int frametype)
+ {
+- bh_lock_sock(sk);
+ switch (frametype) {
+ case NR_CONNACK | NR_CHOKE_FLAG:
+ nr_disconnect(sk, ECONNRESET);
+@@ -132,8 +128,6 @@ static int nr_state2_machine(struct sock
+ default:
+ break;
+ }
+- bh_unlock_sock(sk);
+-
+ return 0;
+ }
+
+@@ -154,7 +148,6 @@ static int nr_state3_machine(struct sock
+ nr = skb->data[18];
+ ns = skb->data[17];
+
+- bh_lock_sock(sk);
+ switch (frametype) {
+ case NR_CONNREQ:
+ nr_write_internal(sk, NR_CONNACK);
+@@ -265,8 +258,6 @@ static int nr_state3_machine(struct sock
+ default:
+ break;
+ }
+- bh_unlock_sock(sk);
+-
+ return queued;
+ }
+
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/net-xfrm-find_acq_byseq.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/net-xfrm-find_acq_byseq.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/net-xfrm-find_acq_byseq.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,56 @@
+# origin: davem (BitKeeper)
+# cset: 1.2105 (2.6) key=423bbaf7lJWZCakduVey5gIRHo9ZEg
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@423bbaf7lJWZCakduVey5gIRHo9ZEg
+# inclusion: upstream
+# descrition: [PATCH] [IPSEC]: Fix __xfrm_find_acq_byseq()
+# revision date: Fri, 08 Apr 2005 14:55:19 +0900
+#
+# S rset: ChangeSet|1.2104..1.2105
+# I rset: net/xfrm/xfrm_state.c|1.54..1.55
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/03/18 21:39:03-08:00 davem@davemloft.net
+# [PATCH] [IPSEC]: Fix __xfrm_find_acq_byseq()
+#
+# This function, as it's name implies, is supposed to only
+# return IPSEC objects which are in the XFRM_STATE_ACQ
+# ("acquire") state. But it returns any object with the
+# matching sequence number.
+#
+# This is wrong and confuses IPSEC daemons to no end.
+#
+# [XFRM]: xfrm_find_acq_byseq should only return XFRM_STATE_ACQ states.
+#
+# Signed-off-by: Patrick McHardy <kaber@trash.net>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# net/xfrm/xfrm_state.c
+# 2005/03/16 14:27:04-08:00 davem@davemloft.net +1 -1
+# [IPSEC]: Fix __xfrm_find_acq_byseq()
+#
+#
+===== net/xfrm/xfrm_state.c 1.54 vs 1.55 =====
+--- 1.54/net/xfrm/xfrm_state.c 2005-02-09 09:17:47 +09:00
++++ 1.55/net/xfrm/xfrm_state.c 2005-03-17 07:27:04 +09:00
+@@ -609,7 +609,7 @@ static struct xfrm_state *__xfrm_find_ac
+
+ for (i = 0; i < XFRM_DST_HSIZE; i++) {
+ list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
+- if (x->km.seq == seq) {
++ if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
+ xfrm_state_hold(x);
+ return x;
+ }
Modified: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16 2005-04-14 02:57:07 UTC (rev 2987)
@@ -10,3 +10,19 @@
+ fs-binfmt_elf-dos.dpatch
+ arch-ppc64-hugepage-aio-panic.dpatch
+ kernel-futex-deadlock.dpatch
++ net-ipv4-bic-binary-search.dpatch
++ net-ipv4-ipsec-icmp-deadlock.dpatch
++ drivers-media-video-saa7110-oops.dpatch
++ fs-cramfs-stat.dpatch
++ drivers-media-video-i2c-msg.dpatch
++ drivers-net-sis900-oops.dpatch
++ drivers-net-via-rhine-wol-oops.dpatch
++ net-netrom-double-lock.dpatch
++ drivers-net-amd811e-irq.dpatch
++ net-xfrm-find_acq_byseq.dpatch
++ drivers-net-via-rhine-irq.dpatch
++ sound-core-timer-oops.dpatch
++ fs-jdb-race.dpatch
++ arch-ia64-syscall-audit.dpatch
++ drivers-i2c-chips-eprom.dpatch
++ lib-rwsem-spinlock.dpatch
Added: trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sound-core-timer-oops.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sound-core-timer-oops.dpatch 2005-04-14 02:54:30 UTC (rev 2986)
+++ trunk/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sound-core-timer-oops.dpatch 2005-04-14 02:57:07 UTC (rev 2987)
@@ -0,0 +1,63 @@
+# origin: tiwai (BitKeeper)
+# cset: 1.2118 (2.6) key=425578aegXDOzQOhUtDDVOl9auJQ8g
+# URL: http://linux.bkbits.net:8080/linux-2.6/cset@425578aegXDOzQOhUtDDVOl9auJQ8g
+# inclusion: upstream
+# descrition: [PATCH] Fix Oops with ALSA timer event notification
+# revision date: Fri, 08 Apr 2005 14:59:08 +0900
+#
+# S rset: ChangeSet|1.2117..1.2118
+# I rset: sound/core/timer.c|1.37..1.38
+#
+# Key:
+# S: Skipped ChangeSet file only
+# O: Original Followed by Updated
+# U: Updated Included with updated range of versions
+# I: Included Included verbatim
+# E: Excluded Excluded on request from user
+# D: Deleted Manually deleted by subsequent user edit
+# R: Revised Manually revised by subsequent user edit
+#
+#
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/04/07 11:15:10-07:00 tiwai@suse.de
+# [PATCH] Fix Oops with ALSA timer event notification
+#
+# the patch below fixes the bug of ALSA timer notification, which is
+# used in the recent ALSA dmix plugin.
+#
+# - fixed Oops in read()
+# - fixed wake-up polls and signals with new events
+#
+# Signed-off-by: Takashi Iwai <tiwai@suse.de>
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+#
+# sound/core/timer.c
+# 2005/03/14 14:07:32-08:00 tiwai@suse.de +4 -1
+# Fix Oops with ALSA timer event notification
+#
+#
+===== sound/core/timer.c 1.37 vs 1.38 =====
+--- 1.37/sound/core/timer.c 2004-11-29 15:09:44 +09:00
++++ 1.38/sound/core/timer.c 2005-03-15 07:07:32 +09:00
+@@ -1117,7 +1117,8 @@ static void snd_timer_user_append_to_tqu
+ if (tu->qused >= tu->queue_size) {
+ tu->overrun++;
+ } else {
+- memcpy(&tu->queue[tu->qtail++], tread, sizeof(*tread));
++ memcpy(&tu->tqueue[tu->qtail++], tread, sizeof(*tread));
++ tu->qtail %= tu->queue_size;
+ tu->qused++;
+ }
+ }
+@@ -1140,6 +1141,8 @@ static void snd_timer_user_ccallback(snd
+ spin_lock(&tu->qlock);
+ snd_timer_user_append_to_tqueue(tu, &r1);
+ spin_unlock(&tu->qlock);
++ kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ wake_up(&tu->qchange_sleep);
+ }
+
+ static void snd_timer_user_tinterrupt(snd_timer_instance_t *timeri,