add patch "fix ethtool_get_drvinfo NULL pointer dereference"

Conflicts:
	kernel.spec

.gitignore

@@ -0,0 +1,6 @@
+linux-*.tar.bz2
+patch-*.bz2
+clog
+*.rpm
+kernel-2.6.*/
+/patch-2.6.32.26.bz2

Makefile

@@ -0,0 +1,269 @@
+# Makefile for source rpm: kernel
+SPECFILE := kernel.spec
+
+# use noarch for make prep instead of the current CPU
+# noarch creates and checks all config files not just the current one,
+# in addition "i386" isn't a valid kernel target
+PREPARCH  = noarch
+
+# we only check the .sign signatures
+UPSTREAM_CHECKS = sign
+
+.PHONY: help
+help:
+%:
+	@echo "Try fedpkg $@ or something like that"
+	@exit 1
+
+include Makefile.config
+
+ifndef KVERSION
+KVERSION := $(shell awk '$$1 == "%define" && $$2 == "base_sublevel" { \
+				print "2.6." $$3 \
+			 }' $(SPECFILE))
+endif
+
+prep:
+	fedpkg -v prep --arch=$(PREPARCH)
+
+extremedebug:
+	@perl -pi -e 's/# CONFIG_DEBUG_PAGEALLOC is not set/CONFIG_DEBUG_PAGEALLOC=y/' config-nodebug
+
+debug:
+	@perl -pi -e 's/# CONFIG_SLUB_DEBUG_ON is not set/CONFIG_SLUB_DEBUG_ON=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_LOCK_STAT is not set/CONFIG_LOCK_STAT=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_STACK_USAGE is not set/CONFIG_DEBUG_STACK_USAGE=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_SLAB is not set/CONFIG_DEBUG_SLAB=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_MUTEXES is not set/CONFIG_DEBUG_MUTEXES=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_RT_MUTEXES is not set/CONFIG_DEBUG_RT_MUTEXES=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_RWSEMS is not set/CONFIG_DEBUG_RWSEMS=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_LOCK_ALLOC is not set/CONFIG_DEBUG_LOCK_ALLOC=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_PROVE_LOCKING is not set/CONFIG_PROVE_LOCKING=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_SPINLOCK is not set/CONFIG_DEBUG_SPINLOCK=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_VM is not set/CONFIG_DEBUG_VM=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_SLEEP_IN_IRQ is not set/CONFIG_DEBUG_SLEEP_IN_IRQ=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_FAULT_INJECTION is not set/CONFIG_FAULT_INJECTION=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_FAILSLAB is not set/CONFIG_FAILSLAB=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_FAIL_PAGE_ALLOC is not set/CONFIG_FAIL_PAGE_ALLOC=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_FAIL_IO_TIMEOUT is not set/CONFIG_FAIL_IO_TIMEOUT=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_FAIL_MAKE_REQUEST is not set/CONFIG_FAIL_MAKE_REQUEST=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_FAULT_INJECTION_DEBUG_FS is not set/CONFIG_FAULT_INJECTION_DEBUG_FS=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_FAULT_INJECTION_STACKTRACE_FILTER is not set/CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_SG is not set/CONFIG_DEBUG_SG=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_WRITECOUNT is not set/CONFIG_DEBUG_WRITECOUNT=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS is not set/CONFIG_DEBUG_OBJECTS=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS_FREE is not set/CONFIG_DEBUG_OBJECTS_FREE=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS_TIMERS is not set/CONFIG_DEBUG_OBJECTS_TIMERS=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_X86_PTDUMP is not set/CONFIG_X86_PTDUMP=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_CAN_DEBUG_DEVICES is not set/CONFIG_CAN_DEBUG_DEVICES=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_MODULE_FORCE_UNLOAD is not set/CONFIG_MODULE_FORCE_UNLOAD=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_SYSCTL_SYSCALL_CHECK is not set/CONFIG_SYSCTL_SYSCALL_CHECK=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_NOTIFIERS is not set/CONFIG_DEBUG_NOTIFIERS=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DMA_API_DEBUG is not set/CONFIG_DMA_API_DEBUG=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_PM_TEST_SUSPEND is not set/CONFIG_PM_TEST_SUSPEND=y/' config-generic
+	@perl -pi -e 's/# CONFIG_BOOT_TRACER is not set/CONFIG_BOOT_TRACER=y/' config-generic
+	@perl -pi -e 's/# CONFIG_B43_DEBUG is not set/CONFIG_B43_DEBUG=y/' config-generic
+	@perl -pi -e 's/# CONFIG_B43LEGACY_DEBUG is not set/CONFIG_B43LEGACY_DEBUG=y/' config-generic
+	@perl -pi -e 's/# CONFIG_MMIOTRACE is not set/CONFIG_MMIOTRACE=y/' config-nodebug
+	@perl -pi -e 's/CONFIG_STRIP_ASM_SYMS=y/# CONFIG_STRIP_ASM_SYMS is not set/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_CREDENTIALS is not set/CONFIG_DEBUG_CREDENTIALS=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set/CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_ACPI_DEBUG is not set/CONFIG_ACPI_DEBUG=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_EXT4_DEBUG is not set/CONFIG_EXT4_DEBUG=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_DEBUG_PERF_USE_VMALLOC is not set/CONFIG_DEBUG_PERF_USE_VMALLOC=y/' config-nodebug
+	@perl -pi -e 's/# CONFIG_JBD2_DEBUG is not set/CONFIG_JBD2_DEBUG=y/' config-nodebug
+
+	@# just in case we're going from extremedebug -> debug
+	@perl -pi -e 's/CONFIG_DEBUG_PAGEALLOC=y/# CONFIG_DEBUG_PAGEALLOC is not set/' config-nodebug
+
+	@perl -pi -e 's/CONFIG_NR_CPUS=256/CONFIG_NR_CPUS=512/' config-x86_64-generic
+
+	@perl -pi -e 's/^%define debugbuildsenabled 1/%define debugbuildsenabled 0/' kernel.spec
+	@perl -pi -e 's/^%define rawhide_skip_docs 0/%define rawhide_skip_docs 1/' kernel.spec
+
+release:
+	@perl -pi -e 's/CONFIG_SLUB_DEBUG_ON=y/# CONFIG_SLUB_DEBUG_ON is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_LOCK_STAT=y/# CONFIG_LOCK_STAT is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_STACK_USAGE=y/# CONFIG_DEBUG_STACK_USAGE is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_SLAB=y/# CONFIG_DEBUG_SLAB is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_MUTEXES=y/# CONFIG_DEBUG_MUTEXES is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_RT_MUTEXES=y/# CONFIG_DEBUG_RT_MUTEXES is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_RWSEMS=y/# CONFIG_DEBUG_RWSEMS is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_LOCK_ALLOC=y/# CONFIG_DEBUG_LOCK_ALLOC is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_PROVE_LOCKING=y/# CONFIG_PROVE_LOCKING is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_SPINLOCK=y/# CONFIG_DEBUG_SPINLOCK is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_VM=y/# CONFIG_DEBUG_VM is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_SLEEP_IN_IRQ=y/# CONFIG_DEBUG_SLEEP_IN_IRQ is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_FAULT_INJECTION=y/# CONFIG_FAULT_INJECTION is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_FAILSLAB=y/# CONFIG_FAILSLAB is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_FAIL_PAGE_ALLOC=y/# CONFIG_FAIL_PAGE_ALLOC is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_FAIL_IO_TIMEOUT=y/# CONFIG_FAIL_IO_TIMEOUT is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_FAIL_MAKE_REQUEST=y/# CONFIG_FAIL_MAKE_REQUEST is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_FAULT_INJECTION_DEBUG_FS=y/# CONFIG_FAULT_INJECTION_DEBUG_FS is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y/# CONFIG_FAULT_INJECTION_STACKTRACE_FILTER is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_SG=y/# CONFIG_DEBUG_SG is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_WRITECOUNT=y/# CONFIG_DEBUG_WRITECOUNT is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS=y/# CONFIG_DEBUG_OBJECTS is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS_FREE=y/# CONFIG_DEBUG_OBJECTS_FREE is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS_TIMERS=y/# CONFIG_DEBUG_OBJECTS_TIMERS is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_X86_PTDUMP=y/# CONFIG_X86_PTDUMP is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_CAN_DEBUG_DEVICES=y/# CONFIG_CAN_DEBUG_DEVICES is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_MODULE_FORCE_UNLOAD=y/# CONFIG_MODULE_FORCE_UNLOAD is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_SYSCTL_SYSCALL_CHECK=y/# CONFIG_SYSCTL_SYSCALL_CHECK is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_NOTIFIERS=y/# CONFIG_DEBUG_NOTIFIERS is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DMA_API_DEBUG=y/# CONFIG_DMA_API_DEBUG is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_PM_TEST_SUSPEND=y/#\ CONFIG_PM_TEST_SUSPEND\ is\ not\ set/' config-generic
+	@perl -pi -e 's/CONFIG_BOOT_TRACER=y/#\ CONFIG_BOOT_TRACER\ is\ not\ set/' config-generic
+	@perl -pi -e 's/CONFIG_B43_DEBUG=y/# CONFIG_B43_DEBUG is not set/' config-generic
+	@perl -pi -e 's/CONFIG_B43LEGACY_DEBUG=y/# CONFIG_B43LEGACY_DEBUG is not set/' config-generic
+	@perl -pi -e 's/CONFIG_MMIOTRACE=y/# CONFIG_MMIOTRACE is not set/' config-nodebug
+	@perl -pi -e 's/# CONFIG_STRIP_ASM_SYMS is not set/CONFIG_STRIP_ASM_SYMS=y/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_CREDENTIALS=y/# CONFIG_DEBUG_CREDENTIALS is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y/# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_ACPI_DEBUG=y/# CONFIG_ACPI_DEBUG is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_EXT4_DEBUG=y/# CONFIG_EXT4_DEBUG is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_DEBUG_PERF_USE_VMALLOC=y/# CONFIG_DEBUG_PERF_USE_VMALLOC is not set/' config-nodebug
+	@perl -pi -e 's/CONFIG_JBD2_DEBUG=y/# CONFIG_JBD2_DEBUG is not set/' config-nodebug
+
+	@perl -pi -e 's/CONFIG_DEBUG_PAGEALLOC=y/# CONFIG_DEBUG_PAGEALLOC is not set/' config-debug
+	@perl -pi -e 's/CONFIG_DEBUG_PAGEALLOC=y/# CONFIG_DEBUG_PAGEALLOC is not set/' config-nodebug
+
+	@perl -pi -e 's/CONFIG_NR_CPUS=512/CONFIG_NR_CPUS=256/' config-x86_64-generic
+
+	@perl -pi -e 's/^%define debugbuildsenabled 0/%define debugbuildsenabled 1/' kernel.spec
+	@perl -pi -e 's/^%define rawhide_skip_docs 1/%define rawhide_skip_docs 0/' kernel.spec
+
+rhel:
+	@perl -pi -e 's/# CONFIG_PPC_64K_PAGES is not set/CONFIG_PPC_64K_PAGES=y/' config-powerpc64
+	@perl -pi -e 's/CONFIG_NR_CPUS=256/CONFIG_NR_CPUS=512/' config-x86_64-generic
+
+reconfig:
+	@rm -f kernel-*-config
+	@VERSION=$(KVERSION) make -f Makefile.config configs
+	@scripts/reconfig.sh
+
+unused-kernel-patches:
+	@for f in *.patch; do if [ -e $$f ]; then (egrep -q "^Patch[[:digit:]]+:[[:space:]]+$$f" $(SPECFILE) || echo "Unused:    $$f") && egrep -q "^ApplyPatch[[:space:]]+$$f|^ApplyOptionalPatch[[:space:]]+$$f" $(SPECFILE) || echo "Unapplied: $$f"; fi; done
+
+# since i386 isn't a target...
+compile compile-short: DIST_DEFINES += --target $(shell uname -m)
+
+# 'make local' also needs to build the noarch firmware package
+local: noarch
+
+#
+# Hacks for building vanilla (unpatched) kernel rpms.
+# Use "make vanilla-TARGET" like "make TARGET" (make vanilla-scratch-build).
+#
+vanilla-%: $(SPECFILE:.spec=-vanilla.spec)
+	@$(MAKE) $* SPECFILE=$<
+
+$(SPECFILE:.spec=-vanilla.spec): $(SPECFILE)
+	@rm -f $@
+	(echo %define nopatches 1; cat $<) > $@
+
+#scratch-build: NAME = $(shell rpm $(RPM_DEFINES) $(DIST_DEFINES) -q --qf "%{NAME}\n" --specfile $(SPECFILE)| head -1)
+#scratch-build: test-srpm
+#	$(BUILD_CLIENT) build $(BUILD_FLAGS) --scratch $(TARGET) \
+#			$(SRCRPMDIR)/$(NAME)-$(VERSION)-$(RELEASE).src.rpm
+
+# Dismal kludge for building via brew from cvs after "make vanilla-tag".
+ifdef BEEHIVE_SRPM_BUILD
+export CHECKOUT_TAG ?= $(shell sed s/^.// CVS/Tag)
+tag-pattern = $(TAG_NAME)-$(TAG_VERSION)-0_%_$(TAG_RELEASE)
+ifeq (,$(filter-out $(tag-pattern),$(CHECKOUT_TAG)))
+variant := $(patsubst $(tag-pattern),%,$(CHECKOUT_TAG))
+srpm: SPECFILE := $(wildcard $(SPECFILE:.spec=-$(variant).spec) \
+			     $(SPECFILE:.spec=.t.$(variant).spec))
+srpm beehive-sprm: RELEASE := 0.$(variant).$(RELEASE)
+endif
+endif
+
+#
+# Hacks for building kernel rpms from upstream code plus local GIT branches.
+# Use "make git/BRANCH/TARGET" like "make TARGET".
+# Use "make git/BRANCH-fedora/TARGET" to include Fedora patches on top.
+#
+ifndef GIT_SPEC
+git/%:
+	@$(MAKE) GIT_SPEC=$(subst /,-,$(*D)) git-$(*F)
+else
+git-%: $(SPECFILE:.spec=.t.$(GIT_SPEC).spec)
+	@$(MAKE) GIT_SPEC= $* SPECFILE=$<
+endif
+
+#
+# Your git-branches.mk file can define GIT_DIR, e.g.:
+#	GIT_DIR = ${HOME}/kernel/.git
+# Make sure GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL are also set
+# or your rpm changelogs will look like crap.
+#
+# For each branch it can define a variable branch-BRANCH or tag-BRANCH
+# giving the parent of BRANCH to diff against in a separate patch.  If
+# the parent is unknown, it will use $(branch-upstream) defaulting to
+# "refs/remotes/upstream/master".
+#
+# Defining tag-BRANCH means the tag corresponds to an upstream patch in
+# the sources file, so that is used instead of generating a patch with
+# git.  If there is no tag-upstream defined, it will figure out a vNNN
+# tag or vNNN-gitN pseudo-tag from the last patch in the sources file.
+# For example:
+#	tag-some-hacks = v2.6.21-rc5
+#	branch-more-hacks = some-hacks
+# Leads to patches:
+#	git diff v2.6.21-rc5..more-hacks > linux-2.6.21-rc5-some-hacks.patch
+#	git diff some-hacks..more-hacks > linux-2.6.21-rc5-more-hacks.patch
+# Whereas having no git-branches.mk at all but doing
+# "make GIT_DIR=... git/mybranch/test-srpm" does:
+#	id=`cat patch-2.6.21-rc5-git4.id` # auto-fetched via upstream file
+#	git diff $id..upstream > linux-2.6.21-rc5-git4-upstream.patch
+#	git diff upstream..mybranch > linux-2.6.21-rc5-git4-mybranch.patch
+# If the upstream patch (or any branch patch) is empty it's left out.
+#
+git-branches.mk:;
+-include git-branches.mk
+
+branch-upstream ?= refs/remotes/upstream/master
+
+ifdef GIT_DIR
+export GIT_DIR
+export GIT_AUTHOR_NAME
+export GIT_AUTHOR_EMAIL
+gen-patches ?= gen-patches
+
+ifndef havespec
+$(SPECFILE:.spec=.t.%-fedora.spec): $(SPECFILE) $(gen-patches) FORCE
+	./$(gen-patches) --fedora < $< > $@ $(gen-patches-args)
+$(SPECFILE:.spec=.t.%.spec): $(SPECFILE) $(gen-patches) FORCE
+	./$(gen-patches) < $< > $@ $(gen-patches-args)
+.PRECIOUS: $(SPECFILE:.spec=.t.%.spec) $(SPECFILE:.spec=.t.%-fedora.spec)
+endif
+
+spec-%: $(SPECFILE:.spec=.t.%.spec) ;
+$(SPECFILE):;
+FORCE:;
+
+branch-of-* = $(firstword $(head-$*) $*)
+gen-patches-args = --name $* v$(KVERSION) $(call heads,$(branch-of-*))
+define heads
+$(if $(tag-$1),$(filter-out v$(KVERSION),$(tag-$1)),\
+     $(call heads,$(firstword $(branch-$1) $(branch-upstream)))) $1
+endef
+
+files-%-fedora:
+	@echo $(SPECFILE:.spec=.t.$*-fedora.spec)
+	@$(call list-patches,$(branch-of-*))
+files-%:
+	@echo $(SPECFILE:.spec=.t.$*.spec)
+	@$(call list-patches,$(branch-of-*))
+define list-patches
+$(if $(tag-$1),version=$(patsubst v%,%,$(tag-$1)),\
+     $(call list-patches,$(firstword $(branch-$1) $(branch-upstream)))); \
+echo linux-$${version}-$(patsubst refs/remotes/%/master,%,$1).patch
+endef
+
+ifndef tag-$(branch-upstream)
+tag-$(branch-upstream) := $(shell \
+	sed -n 's/^.*  *//;s/\.bz2$$//;s/patch-/v/;/^v/h;$${g;p}' sources)
+endif
+endif

Makefile.config

@@ -0,0 +1,105 @@
+# Make rules for configuration files.
+#
+# $Id$
+
+CFG		= kernel-$(VERSION)
+
+CONFIGFILES	= \
+	$(CFG)-i686.config $(CFG)-i686-debug.config \
+	$(CFG)-i686-PAE.config $(CFG)-i686-PAEdebug.config \
+	$(CFG)-x86_64.config $(CFG)-x86_64-debug.config \
+	$(CFG)-s390x.config $(CFG)-arm.config \
+	$(CFG)-ppc.config $(CFG)-ppc-smp.config \
+	$(CFG)-sparc64.config  \
+	$(CFG)-ppc64.config $(CFG)-ppc64-debug.config \
+	$(CFG)-ia64.config
+
+PLATFORMS	= x86 x86_64 powerpc powerpc32 powerpc64 s390x ia64 sparc64
+TEMPFILES	= $(addprefix temp-, $(addsuffix -generic, $(PLATFORMS)))
+
+configs: $(CONFIGFILES)
+	@rm -f kernel-*-config
+	@rm -f $(TEMPFILES)
+	@rm -f temp-generic temp-*-generic temp-*-generic-tmp
+
+# Augment the clean target to clean up our own cruft
+clean ::
+	@rm -fv $(CONFIGFILES) $(TEMPFILES) temp-generic kernel-$(VERSION)*config
+
+temp-generic: config-generic
+	cat config-generic config-nodebug > temp-generic
+
+temp-debug-generic: config-generic
+	cat config-generic config-debug > temp-debug-generic
+
+temp-x86-generic: config-x86-generic temp-generic
+	perl merge.pl $^  > $@
+
+temp-x86-debug-generic: config-x86-generic temp-debug-generic
+	perl merge.pl $^  > $@
+
+temp-x86_64-generic: config-x86_64-generic temp-generic
+	perl merge.pl $^  > $@
+
+temp-x86_64-debug-generic: config-x86_64-generic temp-debug-generic
+	perl merge.pl $^  > $@
+
+temp-sparc64-generic: config-sparc64-generic temp-generic
+	perl merge.pl $^  > $@
+
+temp-powerpc-generic: config-powerpc-generic temp-generic
+	perl merge.pl $^  > $@
+
+temp-powerpc-debug-generic: config-powerpc-generic temp-debug-generic
+	perl merge.pl $^  > $@
+
+temp-powerpc32-generic: config-powerpc32-generic temp-powerpc-generic
+	perl merge.pl $^  > $@
+
+temp-s390-generic: config-s390x temp-generic
+	perl merge.pl $^ > $@
+
+temp-ia64-generic: config-ia64-generic temp-generic
+	perl merge.pl $^ > $@
+
+kernel-$(VERSION)-i686-PAE.config: config-i686-PAE temp-x86-generic
+	perl merge.pl $^ i386 > $@
+
+kernel-$(VERSION)-i686-PAEdebug.config: config-i686-PAE temp-x86-debug-generic
+	perl merge.pl $^ i386 > $@
+
+kernel-$(VERSION)-i686.config: /dev/null temp-x86-generic
+	perl merge.pl $^ i386 > $@
+
+kernel-$(VERSION)-i686-debug.config: /dev/null temp-x86-debug-generic
+	perl merge.pl $^ i386 > $@
+
+kernel-$(VERSION)-x86_64.config: /dev/null temp-x86_64-generic
+	perl merge.pl $^ x86_64 > $@
+
+kernel-$(VERSION)-x86_64-debug.config: /dev/null temp-x86_64-debug-generic
+	perl merge.pl $^ x86_64 > $@
+
+kernel-$(VERSION)-sparc64.config: /dev/null temp-sparc64-generic
+	perl merge.pl $^ sparc64 > $@
+
+kernel-$(VERSION)-ppc64.config: config-powerpc64 temp-powerpc-generic
+	perl merge.pl $^ powerpc > $@
+
+kernel-$(VERSION)-ppc64-debug.config: config-powerpc64 temp-powerpc-debug-generic
+	perl merge.pl $^ powerpc > $@
+
+kernel-$(VERSION)-s390x.config: config-s390x temp-s390-generic
+	perl merge.pl $^ s390 > $@
+
+kernel-$(VERSION)-arm.config: config-arm temp-generic
+	perl merge.pl $^ arm > $@
+
+kernel-$(VERSION)-ppc.config: /dev/null temp-powerpc32-generic
+	perl merge.pl $^ powerpc > $@
+
+kernel-$(VERSION)-ppc-smp.config: config-powerpc32-smp temp-powerpc32-generic
+	perl merge.pl $^ powerpc > $@
+
+kernel-$(VERSION)-ia64.config: /dev/null temp-ia64-generic
+	perl merge.pl $^ ia64 > $@

README.txt

@@ -0,0 +1,67 @@
+
+		Kernel package tips & tricks.
+		~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The kernel is one of the more complicated packages in the distro, and
+for the newcomer, some of the voodoo in the spec file can be somewhat scary.
+This file attempts to document some of the magic.
+
+
+Speeding up make prep
+---------------------
+The kernel is nearly 500MB of source code, and as such, 'make prep'
+takes a while. The spec file employs some trickery so that repeated
+invocations of make prep don't take as long.  Ordinarily the %prep
+phase of a package will delete the tree it is about to untar/patch.
+The kernel %prep keeps around an unpatched version of the tree,
+and makes a symlink tree clone of that clean tree and than applies
+the patches listed in the spec to the symlink tree.
+This makes a huge difference if you're doing multiple make preps a day.
+As an added bonus, doing a diff between the clean tree and the symlink
+tree is slightly faster than it would be doing two proper copies of the tree.
+
+
+build logs.
+-----------
+There's a convenience helper script in scripts/grab-logs.sh
+that will grab the build logs from koji for the kernel version reported
+by make verrel
+
+
+config heirarchy.
+-----------------
+Instead of having to maintain a config file for every arch variant we build on,
+the kernel spec uses a nested system of configs.  At the top level, is
+config-generic. Add options here that should be present in every possible
+config on all architectures.
+Beneath this are per-arch overrides. For example config-x86-generic add
+additional x86 specific options, and also _override_ any options that were
+set in config-generic.
+There exist two additional overrides, config-debug, and config-nodebug,
+which override -generic, and the per-arch overrides. It is documented
+further below.
+
+debug options.
+--------------
+This is a little complicated, as the purpose & meaning of this changes
+depending on where we are in the release cycle.
+If we are building for a current stable release, 'make release' has
+typically been run already, which sets up the following..
+- Two builds occur, a 'kernel' and a 'kernel-debug' flavor.
+- kernel-debug will get various heavyweight debugging options like
+  lockdep etc turned on.
+
+If we are building for rawhide, 'make debug' has been run, which changes
+the status quo to:
+- We only build one kernel 'kernel'
+- The debug options from 'config-debug' are always turned on.
+This is done to increase coverage testing, as not many people actually
+run kernel-debug.
+
+To add new debug options, add an option to _both_ config-debug and config-nodebug,
+and also new stanzas to the Makefile 'debug' and 'release' targets.
+
+Sometimes debug options get added to config-generic, or per-arch overrides
+instead of config-[no]debug. In this instance, the options should have no
+discernable performance impact, otherwise they belong in the debug files.
+

acpi-ec-add-delay-before-write.patch

@@ -0,0 +1,52 @@
+https://bugzilla.kernel.org/show_bug.cgi?id=14733#c41
+
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 27e0b92..09fbb69 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -226,6 +226,7 @@ static int ec_poll(struct acpi_ec *ec)
+ 				if (ec_transaction_done(ec))
+ 					return 0;
+ 			} else {
++				msleep(1);
+ 				if (wait_event_timeout(ec->wait,
+ 						ec_transaction_done(ec),
+ 						msecs_to_jiffies(1)))
+@@ -233,8 +234,8 @@ static int ec_poll(struct acpi_ec *ec)
+ 			}
+ 			advance_transaction(ec, acpi_ec_read_status(ec));
+ 		} while (time_before(jiffies, delay));
+-		if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
+-			break;
++//		if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
++//			break;
+ 		pr_debug(PREFIX "controller reset, restart transaction\n");
+ 		spin_lock_irqsave(&ec->curr_lock, flags);
+ 		start_transaction(ec);
+@@ -271,15 +272,25 @@ static int ec_check_ibf0(struct acpi_ec *ec)
+ 	return (status & ACPI_EC_FLAG_IBF) == 0;
+ }
+ 
++/* try to clean input buffer with burst_disable transaction */
++static int acpi_ec_clean_buffer(struct acpi_ec *ec)
++{
++	struct transaction t = {.command = ACPI_EC_BURST_DISABLE,
++				.wdata = NULL, .rdata = NULL,
++				.wlen = 0, .rlen = 0};
++	return acpi_ec_transaction_unlocked(ec, &t);
++}
++
+ static int ec_wait_ibf0(struct acpi_ec *ec)
+ {
++	
+ 	unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
+ 	/* interrupt wait manually if GPE mode is not active */
+ 	while (time_before(jiffies, delay))
+ 		if (wait_event_timeout(ec->wait, ec_check_ibf0(ec),
+ 					msecs_to_jiffies(1)))
+ 			return 0;
+-	return -ETIME;
++	return acpi_ec_clean_buffer(ec);
+ }
+ 
+ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)

add-appleir-usb-driver.patch

@@ -0,0 +1,635 @@
+ Documentation/input/appleir.txt |   46 ++++
+ drivers/hid/hid-apple.c         |    4 -
+ drivers/hid/hid-core.c          |    5 +-
+ drivers/hid/hid-ids.h           |    1 +
+ drivers/input/misc/Kconfig      |   13 +
+ drivers/input/misc/Makefile     |    1 +
+ drivers/input/misc/appleir.c    |  477 +++++++++++++++++++++++++++++++++++++++
+ 7 files changed, 541 insertions(+), 6 deletions(-)
+ create mode 100644 Documentation/input/appleir.txt
+ create mode 100644 drivers/input/misc/appleir.c
+
+diff --git a/Documentation/input/appleir.txt b/Documentation/input/appleir.txt
+new file mode 100644
+index 0000000..0aaf5fe
+--- /dev/null
++++ b/Documentation/input/appleir.txt
+@@ -0,0 +1,46 @@
++Apple IR receiver Driver (appleir)
++----------------------------------
++	Copyright (C) 2009 Bastien Nocera <hadess@hadess.net>
++
++The appleir driver is a kernel input driver to handle Apple's IR
++receivers (and associated remotes) in the kernel.
++
++The driver is an input driver which only handles "official" remotes
++as built and sold by Apple.
++
++Authors
++-------
++
++James McKenzie (original driver)
++Alex Karpenko (05ac:8242 support)
++Greg Kroah-Hartman (cleanups and original submission)
++Bastien Nocera (further cleanups and suspend support)
++
++Supported hardware
++------------------
++
++- All Apple laptops and desktops from 2005 onwards, except:
++  - the unibody Macbook (2009)
++  - Mac Pro (all versions)
++- Apple TV (all revisions)
++
++The remote will only support the 6 buttons of the original remotes
++as sold by Apple. See the next section if you want to use other remotes
++or want to use lirc with the device instead of the kernel driver.
++
++Using lirc (native) instead of the kernel driver
++------------------------------------------------
++
++First, you will need to disable the kernel driver for the receiver.
++
++This can be achieved by passing quirks to the usbhid driver.
++The quirk line would be:
++usbhid.quirks=0x05ac:0x8242:0x08
++
++With 0x05ac being the vendor ID (Apple, you shouldn't need to change this)
++With 0x8242 being the product ID (check the output of lsusb for your hardware)
++And 0x08 being "HID_CONNECT_HIDDEV"
++
++This should force the creation of a hiddev device for the receiver, and
++make it usable under lirc.
++
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 4b96e7a..d1fdcd0 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -353,10 +353,6 @@ static void apple_remove(struct hid_device *hdev)
+ }
+ 
+ static const struct hid_device_id apple_devices[] = {
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ATV_IRCONTROL),
+-		.driver_data = APPLE_HIDDEV | APPLE_IGNORE_HIDINPUT },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4),
+-		.driver_data = APPLE_HIDDEV | APPLE_IGNORE_HIDINPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE),
+ 		.driver_data = APPLE_MIGHTYMOUSE | APPLE_INVERT_HWHEEL },
+ 
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 7d05c4b..3efb0fa 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1252,8 +1252,6 @@ EXPORT_SYMBOL_GPL(hid_disconnect);
+ static const struct hid_device_id hid_blacklist[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ATV_IRCONTROL) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ISO) },
+@@ -1539,6 +1537,9 @@ static const struct hid_device_id hid_ignore_list[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_AIPTEK, USB_DEVICE_ID_AIPTEK_24) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_AIRCABLE, USB_DEVICE_ID_AIRCABLE1) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ALCOR, USB_DEVICE_ID_ALCOR_USBRS232) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ATV_IRCONTROL) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_LCM)},
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_LCM2)},
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index adbef5d..c399110 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -90,6 +90,7 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS	0x0238
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY	0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY	0x030b
++#define USB_DEVICE_ID_APPLE_IRCONTROL	0x8240
+ #define USB_DEVICE_ID_APPLE_ATV_IRCONTROL	0x8241
+ #define USB_DEVICE_ID_APPLE_IRCONTROL4	0x8242
+ 
+diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
+index a9bb254..51b6684 100644
+--- a/drivers/input/misc/Kconfig
++++ b/drivers/input/misc/Kconfig
+@@ -148,6 +148,19 @@ config INPUT_KEYSPAN_REMOTE
+ 	  To compile this driver as a module, choose M here: the module will
+ 	  be called keyspan_remote.
+ 
++config INPUT_APPLEIR
++	tristate "Apple infrared receiver (built in)"
++	depends on USB_ARCH_HAS_HCD
++	select USB
++	help
++	  Say Y here if you want to use a Apple infrared remote control. All
++	  the Apple computers from 2005 onwards include such a port, except
++	  the unibody Macbook (2009), and Mac Pros. This receiver is also
++	  used in the Apple TV set-top box.
++
++	  To compile this driver as a module, choose M here: the module will
++	  be called appleir.
++
+ config INPUT_POWERMATE
+ 	tristate "Griffin PowerMate and Contour Jog support"
+ 	depends on USB_ARCH_HAS_HCD
+diff --git a/drivers/input/misc/Makefile b/drivers/input/misc/Makefile
+index a8b8485..041e6f5 100644
+--- a/drivers/input/misc/Makefile
++++ b/drivers/input/misc/Makefile
+@@ -5,6 +5,7 @@
+ # Each configuration option enables a list of files.
+ 
+ obj-$(CONFIG_INPUT_APANEL)		+= apanel.o
++obj-$(CONFIG_INPUT_APPLEIR)		+= appleir.o
+ obj-$(CONFIG_INPUT_ATI_REMOTE)		+= ati_remote.o
+ obj-$(CONFIG_INPUT_ATI_REMOTE2)		+= ati_remote2.o
+ obj-$(CONFIG_INPUT_ATLAS_BTNS)		+= atlas_btns.o
+diff --git a/drivers/input/misc/appleir.c b/drivers/input/misc/appleir.c
+new file mode 100644
+index 0000000..6e332ab
+--- /dev/null
++++ b/drivers/input/misc/appleir.c
+@@ -0,0 +1,477 @@
++/*
++ * appleir: USB driver for the apple ir device
++ *
++ * Original driver written by James McKenzie
++ * Ported to recent 2.6 kernel versions by Greg Kroah-Hartman <gregkh@suse.de>
++ *
++ * Copyright (C) 2006 James McKenzie
++ * Copyright (C) 2008 Greg Kroah-Hartman <greg@kroah.com>
++ * Copyright (C) 2008 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the Free
++ * Software Foundation, version 2.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/slab.h>
++#include <linux/input.h>
++#include <linux/usb/input.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/usb.h>
++#include <linux/usb/input.h>
++#include <asm/unaligned.h>
++#include <asm/byteorder.h>
++
++#define DRIVER_VERSION "v1.2"
++#define DRIVER_AUTHOR "James McKenzie"
++#define DRIVER_DESC "Apple infrared receiver driver"
++#define DRIVER_LICENSE "GPL"
++
++MODULE_AUTHOR(DRIVER_AUTHOR);
++MODULE_DESCRIPTION(DRIVER_DESC);
++MODULE_LICENSE(DRIVER_LICENSE);
++
++#define USB_VENDOR_ID_APPLE			0x05ac
++#define USB_DEVICE_ID_APPLE_IRCONTROL		0x8240
++#define USB_DEVICE_ID_APPLE_ATV_IRCONTROL	0x8241
++#define USB_DEVICE_ID_APPLE_IRCONTROL4		0x8242
++
++#define URB_SIZE	32
++
++#define MAX_KEYS	8
++#define MAX_KEYS_MASK	(MAX_KEYS - 1)
++
++#define dbginfo(dev, format, arg...) do { if (debug) dev_info(dev , format , ## arg); } while (0)
++
++static int debug;
++module_param(debug, int, 0644);
++MODULE_PARM_DESC(debug, "Enable extra debug messages and information");
++
++struct appleir {
++	struct input_dev *input_dev;
++	u8 *data;
++	dma_addr_t dma_buf;
++	struct usb_device *usbdev;
++	unsigned int flags;
++	struct urb *urb;
++	int timer_initted;
++	struct timer_list key_up_timer;
++	int current_key;
++	char phys[32];
++};
++
++static DEFINE_MUTEX(appleir_mutex);
++
++enum {
++	APPLEIR_OPENED = 0x1,
++	APPLEIR_SUSPENDED = 0x2,
++};
++
++static struct usb_device_id appleir_ids[] = {
++	{ USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
++	{ USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ATV_IRCONTROL) },
++	{ USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
++	{}
++};
++MODULE_DEVICE_TABLE(usb, appleir_ids);
++
++/* I have two devices both of which report the following */
++/* 25 87 ee 83 0a  	+  */
++/* 25 87 ee 83 0c  	-  */
++/* 25 87 ee 83 09	<< */
++/* 25 87 ee 83 06	>> */
++/* 25 87 ee 83 05	>" */
++/* 25 87 ee 83 03	menu */
++/* 26 00 00 00 00	for key repeat*/
++
++/* Thomas Glanzmann reports the following responses */
++/* 25 87 ee ca 0b	+  */
++/* 25 87 ee ca 0d	-  */
++/* 25 87 ee ca 08	<< */
++/* 25 87 ee ca 07	>> */
++/* 25 87 ee ca 04	>" */
++/* 25 87 ee ca 02 	menu */
++/* 26 00 00 00 00       for key repeat*/
++/* He also observes the following event sometimes */
++/* sent after a key is release, which I interpret */
++/* as a flat battery message */
++/* 25 87 e0 ca 06	flat battery */
++
++/* Alexandre Karpenko reports the following responses for Device ID 0x8242 */
++/* 25 87 ee 47 0b	+  */
++/* 25 87 ee 47 0d	-  */
++/* 25 87 ee 47 08	<< */
++/* 25 87 ee 47 07	>> */
++/* 25 87 ee 47 04	>" */
++/* 25 87 ee 47 02 	menu */
++/* 26 87 ee 47 ** 	for key repeat (** is the code of the key being held) */
++
++static int keymap[MAX_KEYS] = {
++	KEY_RESERVED,
++	KEY_MENU,
++	KEY_PLAYPAUSE,
++	KEY_FORWARD,
++	KEY_BACK,
++	KEY_VOLUMEUP,
++	KEY_VOLUMEDOWN,
++	KEY_RESERVED,
++};
++
++static void dump_packet(struct appleir *appleir, char *msg, u8 *data, int len)
++{
++	int i;
++
++	printk(KERN_ERR "appleir: %s (%d bytes)", msg, len);
++
++	for (i = 0; i < len; ++i)
++		printk(" %02x", data[i]);
++	printk("\n");
++}
++
++static void key_up(struct appleir *appleir, int key)
++{
++	dbginfo (&appleir->input_dev->dev, "key %d up\n", key);
++	input_report_key(appleir->input_dev, key, 0);
++	input_sync(appleir->input_dev);
++}
++
++static void key_down(struct appleir *appleir, int key)
++{
++	dbginfo (&appleir->input_dev->dev, "key %d down\n", key);
++	input_report_key(appleir->input_dev, key, 1);
++	input_sync(appleir->input_dev);
++}
++
++static void battery_flat(struct appleir *appleir)
++{
++	dev_err(&appleir->input_dev->dev, "possible flat battery?\n");
++}
++
++static void key_up_tick(unsigned long data)
++{
++	struct appleir *appleir = (struct appleir *)data;
++
++	if (appleir->current_key) {
++		key_up(appleir, appleir->current_key);
++		appleir->current_key = 0;
++	}
++}
++
++static void new_data(struct appleir *appleir, u8 *data, int len)
++{
++	static const u8 keydown[] = { 0x25, 0x87, 0xee };
++	static const u8 keyrepeat[] = { 0x26, };
++	static const u8 flatbattery[] = { 0x25, 0x87, 0xe0 };
++
++	if (debug)
++		dump_packet(appleir, "received", data, len);
++
++	if (len != 5)
++		return;
++
++	if (!memcmp(data, keydown, sizeof(keydown))) {
++		/*If we already have a key down, take it up before marking */
++		/*this one down */
++		if (appleir->current_key)
++			key_up(appleir, appleir->current_key);
++		appleir->current_key = keymap[(data[4] >> 1) & MAX_KEYS_MASK];
++
++		key_down(appleir, appleir->current_key);
++		/*remote doesn't do key up, either pull them up, in the test */
++		/*above, or here set a timer which pulls them up after 1/8 s */
++		mod_timer(&appleir->key_up_timer, jiffies + HZ / 8);
++
++		return;
++	}
++
++	if (!memcmp(data, keyrepeat, sizeof(keyrepeat))) {
++		key_down(appleir, appleir->current_key);
++		/*remote doesn't do key up, either pull them up, in the test */
++		/*above, or here set a timer which pulls them up after 1/8 s */
++		mod_timer(&appleir->key_up_timer, jiffies + HZ / 8);
++		return;
++	}
++
++	if (!memcmp(data, flatbattery, sizeof(flatbattery))) {
++		battery_flat(appleir);
++		/* Fall through */
++	}
++
++	dump_packet(appleir, "unknown packet", data, len);
++}
++
++static void appleir_urb(struct urb *urb)
++{
++	struct appleir *appleir = urb->context;
++	int status = urb->status;
++	int retval;
++
++	switch (status) {
++	case 0:
++		new_data(appleir, urb->transfer_buffer, urb->actual_length);
++		break;
++	case -ECONNRESET:
++	case -ENOENT:
++	case -ESHUTDOWN:
++		/* this urb is terminated, clean up */
++		dbginfo(&appleir->input_dev->dev, "%s - urb shutting down with status: %d", __func__,
++			urb->status);
++		return;
++	default:
++		dbginfo(&appleir->input_dev->dev, "%s - nonzero urb status received: %d", __func__,
++			urb->status);
++	}
++
++	retval = usb_submit_urb(urb, GFP_ATOMIC);
++	if (retval)
++		err("%s - usb_submit_urb failed with result %d", __func__,
++		    retval);
++}
++
++static int appleir_open(struct input_dev *dev)
++{
++	struct appleir *appleir = input_get_drvdata(dev);
++	struct usb_interface *intf = usb_ifnum_to_if(appleir->usbdev, 0);
++	int r;
++
++	r = usb_autopm_get_interface(intf);
++	if (r) {
++		dev_err(&intf->dev,
++			"%s(): usb_autopm_get_interface() = %d\n", __func__, r);
++		return r;
++	}
++
++	mutex_lock(&appleir_mutex);
++
++	if (usb_submit_urb(appleir->urb, GFP_KERNEL)) {
++		r = -EIO;
++		goto fail;
++	}
++
++	appleir->flags |= APPLEIR_OPENED;
++
++	mutex_unlock(&appleir_mutex);
++
++	usb_autopm_put_interface(intf);
++
++	return 0;
++fail:
++	mutex_unlock(&appleir_mutex);
++	usb_autopm_put_interface(intf);
++	return r;
++}
++
++static void appleir_close(struct input_dev *dev)
++{
++	struct appleir *appleir = input_get_drvdata(dev);
++
++	mutex_lock(&appleir_mutex);
++
++	if (!(appleir->flags & APPLEIR_SUSPENDED)) {
++		usb_kill_urb(appleir->urb);
++		del_timer_sync(&appleir->key_up_timer);
++	}
++
++	appleir->flags &= ~APPLEIR_OPENED;
++
++	mutex_unlock(&appleir_mutex);
++}
++
++static int appleir_probe(struct usb_interface *intf,
++			 const struct usb_device_id *id)
++{
++	struct usb_device *dev = interface_to_usbdev(intf);
++	struct usb_endpoint_descriptor *endpoint;
++	struct appleir *appleir = NULL;
++	struct input_dev *input_dev;
++	int retval = -ENOMEM;
++	int i;
++
++	appleir = kzalloc(sizeof(struct appleir), GFP_KERNEL);
++	if (!appleir)
++		goto fail;
++
++	appleir->data = usb_buffer_alloc(dev, URB_SIZE, GFP_KERNEL,
++					 &appleir->dma_buf);
++	if (!appleir->data)
++		goto fail;
++
++	appleir->urb = usb_alloc_urb(0, GFP_KERNEL);
++	if (!appleir->urb)
++		goto fail;
++
++	appleir->usbdev = dev;
++
++	input_dev = input_allocate_device();
++	if (!input_dev)
++		goto fail;
++
++	appleir->input_dev = input_dev;
++
++	usb_make_path(dev, appleir->phys, sizeof(appleir->phys));
++	strlcpy(appleir->phys, "/input0", sizeof(appleir->phys));
++
++	input_dev->name = "Apple infrared remote control driver";
++	input_dev->phys = appleir->phys;
++	usb_to_input_id(dev, &input_dev->id);
++	input_dev->dev.parent = &intf->dev;
++	input_set_drvdata(input_dev, appleir);
++
++	input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
++	input_dev->ledbit[0] = 0;
++
++	for (i = 0; i < MAX_KEYS; i++)
++		set_bit(keymap[i], input_dev->keybit);
++
++	clear_bit(0, input_dev->keybit);
++
++	input_dev->open = appleir_open;
++	input_dev->close = appleir_close;
++
++	endpoint = &intf->cur_altsetting->endpoint[0].desc;
++
++	usb_fill_int_urb(appleir->urb, dev,
++			 usb_rcvintpipe(dev, endpoint->bEndpointAddress),
++			 appleir->data, 8,
++			 appleir_urb, appleir, endpoint->bInterval);
++
++	appleir->urb->transfer_dma = appleir->dma_buf;
++	appleir->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
++
++	usb_set_intfdata(intf, appleir);
++
++	init_timer(&appleir->key_up_timer);
++
++	appleir->key_up_timer.function = key_up_tick;
++	appleir->key_up_timer.data = (unsigned long)appleir;
++
++	appleir->timer_initted++;
++
++	retval = input_register_device(appleir->input_dev);
++	if (retval)
++		goto fail;
++
++	return 0;
++
++fail:
++	printk(KERN_WARNING "Failed to load appleir\n");
++	if (appleir) {
++		if (appleir->data)
++			usb_buffer_free(dev, URB_SIZE, appleir->data,
++					appleir->dma_buf);
++
++		if (appleir->timer_initted)
++			del_timer_sync(&appleir->key_up_timer);
++
++		if (appleir->input_dev)
++			input_free_device(appleir->input_dev);
++
++		kfree(appleir);
++	}
++
++	return retval;
++}
++
++static void appleir_disconnect(struct usb_interface *intf)
++{
++	struct appleir *appleir = usb_get_intfdata(intf);
++
++	usb_set_intfdata(intf, NULL);
++	if (appleir) {
++		input_unregister_device(appleir->input_dev);
++		if (appleir->timer_initted)
++			del_timer_sync(&appleir->key_up_timer);
++		usb_kill_urb(appleir->urb);
++		usb_free_urb(appleir->urb);
++		usb_buffer_free(interface_to_usbdev(intf), URB_SIZE,
++				appleir->data, appleir->dma_buf);
++		kfree(appleir);
++	}
++}
++
++static int appleir_suspend(struct usb_interface *interface,
++			   pm_message_t message)
++{
++	struct appleir *appleir;
++
++	appleir = usb_get_intfdata(interface);
++
++	mutex_lock(&appleir_mutex);
++
++	if (appleir->flags & APPLEIR_OPENED) {
++		usb_kill_urb(appleir->urb);
++		del_timer_sync(&appleir->key_up_timer);
++	}
++
++	appleir->flags |= APPLEIR_SUSPENDED;
++
++	mutex_unlock(&appleir_mutex);
++
++	return 0;
++}
++
++static int appleir_resume(struct usb_interface *interface)
++{
++	struct appleir *appleir;
++
++	appleir = usb_get_intfdata(interface);
++
++	mutex_lock(&appleir_mutex);
++
++	if (appleir->flags & APPLEIR_OPENED) {
++		struct usb_endpoint_descriptor *endpoint;
++
++		endpoint = &interface->cur_altsetting->endpoint[0].desc;
++		usb_fill_int_urb(appleir->urb, appleir->usbdev,
++				 usb_rcvintpipe(appleir->usbdev, endpoint->bEndpointAddress),
++				 appleir->data, 8,
++				 appleir_urb, appleir, endpoint->bInterval);
++		appleir->urb->transfer_dma = appleir->dma_buf;
++		appleir->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
++
++		init_timer(&appleir->key_up_timer);
++
++		appleir->key_up_timer.function = key_up_tick;
++		appleir->key_up_timer.data = (unsigned long)appleir;
++	}
++
++	appleir->flags &= ~APPLEIR_SUSPENDED;
++
++	mutex_unlock(&appleir_mutex);
++
++	return 0;
++}
++
++static struct usb_driver appleir_driver = {
++	.name                 = "appleir",
++	.probe                = appleir_probe,
++	.disconnect           = appleir_disconnect,
++	.suspend              = appleir_suspend,
++	.resume               = appleir_resume,
++	.reset_resume         = appleir_resume,
++	.id_table             = appleir_ids,
++	.supports_autosuspend = 1,
++};
++
++static int __init appleir_init(void)
++{
++	int retval;
++
++	retval = usb_register(&appleir_driver);
++	if (retval)
++		goto out;
++	printk(KERN_INFO DRIVER_VERSION ":" DRIVER_DESC);
++out:
++	return retval;
++}
++
++static void __exit appleir_exit(void)
++{
++	usb_deregister(&appleir_driver);
++}
++
++module_init(appleir_init);
++module_exit(appleir_exit);
+-- 
+1.6.5.2
+

add-support-for-ricoh-e822-sdhci.patch

@@ -0,0 +1,141 @@
+diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
+index e035664..3d7f790 100644
+--- a/drivers/mmc/host/sdhci-pci.c
++++ b/drivers/mmc/host/sdhci-pci.c
+@@ -86,7 +86,30 @@ static int ricoh_probe(struct sdhci_pci_chip *chip)
+ 	if (chip->pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG ||
+ 	    chip->pdev->subsystem_vendor == PCI_VENDOR_ID_SONY)
+ 		chip->quirks |= SDHCI_QUIRK_NO_CARD_NO_RESET;
++	return 0;
++}
++
++static int ricoh_mmc_probe_slot(struct sdhci_pci_slot *slot)
++{
++	slot->host->caps =
++		((0x21 << SDHCI_TIMEOUT_CLK_SHIFT)
++			& SDHCI_TIMEOUT_CLK_MASK) |
++
++		((0x21 << SDHCI_CLOCK_BASE_SHIFT)
++			& SDHCI_CLOCK_BASE_MASK) |
+ 
++		SDHCI_TIMEOUT_CLK_UNIT |
++		SDHCI_CAN_VDD_330 |
++		SDHCI_CAN_DO_SDMA;
++	return 0;
++}
++
++static int ricoh_mmc_resume(struct sdhci_pci_chip *chip)
++{
++	/* Apply a delay to allow controller to settle */
++	/* Otherwise it becomes confused if card state changed
++		during suspend */
++	msleep(500);
+ 	return 0;
+ }
+ 
+@@ -95,6 +118,15 @@ static const struct sdhci_pci_fixes sdhci_ricoh = {
+ 	.quirks		= SDHCI_QUIRK_32BIT_DMA_ADDR,
+ };
+ 
++static const struct sdhci_pci_fixes sdhci_ricoh_mmc = {
++	.probe_slot	= ricoh_mmc_probe_slot,
++	.resume		= ricoh_mmc_resume,
++	.quirks		= SDHCI_QUIRK_32BIT_DMA_ADDR |
++			  SDHCI_QUIRK_CLOCK_BEFORE_RESET |
++			  SDHCI_QUIRK_NO_CARD_NO_RESET |
++			  SDHCI_QUIRK_MISSING_CAPS
++};
++
+ static const struct sdhci_pci_fixes sdhci_ene_712 = {
+ 	.quirks		= SDHCI_QUIRK_SINGLE_POWER_WRITE |
+ 			  SDHCI_QUIRK_BROKEN_DMA,
+@@ -307,6 +339,22 @@ static const struct pci_device_id pci_ids[] __devinitdata = {
+ 	},
+ 
+ 	{
++		.vendor         = PCI_VENDOR_ID_RICOH,
++		.device         = 0x843,
++		.subvendor      = PCI_ANY_ID,
++		.subdevice      = PCI_ANY_ID,
++		.driver_data    = (kernel_ulong_t)&sdhci_ricoh_mmc,
++	},
++
++	{
++		.vendor         = PCI_VENDOR_ID_RICOH,
++		.device         = 0xe822,
++		.subvendor      = PCI_ANY_ID,
++		.subdevice      = PCI_ANY_ID,
++		.driver_data    = (kernel_ulong_t)&sdhci_ricoh_mmc,
++	},
++
++	{
+ 		.vendor		= PCI_VENDOR_ID_ENE,
+ 		.device		= PCI_DEVICE_ID_ENE_CB712_SD,
+ 		.subvendor	= PCI_ANY_ID,
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index c279fbc..7d4bff0 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1147,6 +1147,11 @@ static void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ 
+ 	ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
+ 
++	if (ios->bus_width == MMC_BUS_WIDTH_8)
++		ctrl |= SDHCI_CTRL_8BITBUS;
++	else
++		ctrl &= ~SDHCI_CTRL_8BITBUS;
++
+ 	if (ios->bus_width == MMC_BUS_WIDTH_4)
+ 		ctrl |= SDHCI_CTRL_4BITBUS;
+ 	else
+@@ -1678,7 +1683,8 @@ int sdhci_add_host(struct sdhci_host *host)
+ 			host->version);
+ 	}
+ 
+-	caps = sdhci_readl(host, SDHCI_CAPABILITIES);
++	caps = (host->quirks & SDHCI_QUIRK_MISSING_CAPS) ? host->caps :
++		sdhci_readl(host, SDHCI_CAPABILITIES);
+ 
+ 	if (host->quirks & SDHCI_QUIRK_FORCE_DMA)
+ 		host->flags |= SDHCI_USE_SDMA;
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index ce5f1d7..b5e2761 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -70,6 +70,7 @@
+ #define   SDHCI_CTRL_ADMA1	0x08
+ #define   SDHCI_CTRL_ADMA32	0x10
+ #define   SDHCI_CTRL_ADMA64	0x18
++#define  SDHCI_CTRL_8BITBUS	0x20
+ 
+ #define SDHCI_POWER_CONTROL	0x29
+ #define  SDHCI_POWER_ON		0x01
+@@ -125,7 +126,7 @@
+ #define  SDHCI_INT_DATA_MASK	(SDHCI_INT_DATA_END | SDHCI_INT_DMA_END | \
+ 		SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
+ 		SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
+-		SDHCI_INT_DATA_END_BIT | SDHCI_ADMA_ERROR)
++		SDHCI_INT_DATA_END_BIT | SDHCI_INT_ADMA_ERROR)
+ #define SDHCI_INT_ALL_MASK	((unsigned int)-1)
+ 
+ #define SDHCI_ACMD12_ERR	0x3C
+@@ -235,6 +236,10 @@ struct sdhci_host {
+ /* Controller uses SDCLK instead of TMCLK for data timeouts */
+ #define SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK		(1<<24)
+ 
++/* RHEL6 miss some quirks */
++
++/* Controller is missing device caps. Use caps provided by host */
++#define SDHCI_QUIRK_MISSING_CAPS			(1<<28)
+ 	int			irq;		/* Device IRQ */
+ 	void __iomem *		ioaddr;		/* Mapped address */
+ 
+@@ -286,6 +291,8 @@ struct sdhci_host {
+ 
+ 	struct timer_list	timer;		/* Timer for timeouts */
+ 
++	unsigned int		caps;		/* Alternative capabilities */
++
+ 	unsigned long		private[0] ____cacheline_aligned;
+ };
+ 

btrfs-prohibit-a-operation-of-changing-acls-mask-when-noacl-mount-option-is-used.patch

@@ -0,0 +1,42 @@
+From: Shi Weihua <shiwh@cn.fujitsu.com>
+Date: Tue, 18 May 2010 00:51:54 +0000 (+0000)
+Subject: Btrfs: prohibit a operation of changing acl's mask when noacl mount option used
+X-Git-Tag: v2.6.35-rc3~3^2~3
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=731e3d1b
+
+Btrfs: prohibit a operation of changing acl's mask when noacl mount option used
+
+when used Posix File System Test Suite(pjd-fstest) to test btrfs,
+some cases about setfacl failed when noacl mount option used.
+I simplified used commands in pjd-fstest, and the following steps
+can reproduce it.
+------------------------
+# cd btrfs-part/
+# mkdir aaa
+# setfacl -m m::rw aaa    <- successed, but not expected by pjd-fstest.
+------------------------
+I checked ext3, a warning message occured, like as:
+  setfacl: aaa/: Operation not supported
+Certainly, it's expected by pjd-fstest.
+
+So, i compared acl.c of btrfs and ext3. Based on that, a patch created.
+Fortunately, it works.
+
+Signed-off-by: Shi Weihua <shiwh@cn.fujitsu.com>
+Signed-off-by: Chris Mason <chris.mason@oracle.com>
+---
+
+diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
+index 6b4d0cc..a372985 100644
+--- a/fs/btrfs/acl.c
++++ b/fs/btrfs/acl.c
+@@ -163,6 +163,9 @@ static int btrfs_xattr_acl_set(struct dentry *dentry, const char *name,
+ 	if (!is_owner_or_cap(inode))
+ 		return -EPERM;
+ 
++	if (!IS_POSIXACL(inode))
++		return -EOPNOTSUPP;
++
+ 	if (value) {
+ 		acl = posix_acl_from_xattr(value, size);
+ 		if (acl == NULL) {

config-arm

@@ -0,0 +1,102 @@
+CONFIG_ARM=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+# CONFIG_SMP is not set
+
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+
+CONFIG_ARCH_VERSATILE=y
+CONFIG_ARCH_VERSATILE_PB=y
+CONFIG_MACH_VERSATILE_AB=y
+
+CONFIG_HIGHMEM=y
+# CONFIG_HIGHPTE is not set
+
+# CONFIG_CPU_ICACHE_DISABLE is not set
+# CONFIG_CPU_DCACHE_DISABLE is not set
+# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
+# CONFIG_CPU_CACHE_ROUND_ROBIN is not set
+
+CONFIG_ZBOOT_ROM_TEXT=0
+CONFIG_ZBOOT_ROM_BSS=0
+
+# CONFIG_XIP_KERNEL is not set
+
+CONFIG_ATAGS_PROC=y
+
+# CONFIG_FPE_NWFPE is not set
+CONFIG_FPE_FASTFPE=y
+CONFIG_VFP=y
+
+CONFIG_PM=y
+# CONFIG_PM_DEBUG is not set
+# CONFIG_PM_TRACE is not set
+CONFIG_SUSPEND=y
+# CONFIG_PM_TEST_SUSPEND is not set
+CONFIG_APM_EMULATION=y
+
+CONFIG_ARM_THUMB=y
+
+CONFIG_AEABI=y
+CONFIG_OABI_COMPAT=y
+
+# CONFIG_UACCESS_WITH_MEMCPY is not set
+
+CONFIG_CMDLINE="console=ttyAM0,115200 root=/dev/sda1 rootdelay=20"
+
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+
+# CONFIG_CPU_IDLE is not set
+
+CONFIG_LEDS=y
+CONFIG_LEDS_CPU=y
+
+CONFIG_MTD_AFS_PARTS=y
+CONFIG_MTD_ARM_INTEGRATOR=y
+CONFIG_MTD_IMPA7=y
+
+CONFIG_AX88796=m
+CONFIG_AX88796_93CX6=y
+CONFIG_SMC91X=m
+CONFIG_DM9000=m
+CONFIG_DM9000_DEBUGLEVEL=4
+# CONFIG_DM9000_FORCE_SIMPLE_PHY_POLL is not set
+CONFIG_SMC911X=m
+CONFIG_SMSC911X=m
+
+CONFIG_SERIO_AMBAKMI=m
+
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+
+CONFIG_I2C_VERSATILE=y
+
+CONFIG_THERMAL=y
+
+# CONFIG_MFD_T7L66XB is not set
+# CONFIG_MFD_TC6387XB is not set
+
+CONFIG_FB_ARMCLCD=m
+
+CONFIG_SND_ARM=y
+CONFIG_SND_ARMAACI=m
+
+CONFIG_USB_MUSB_HDRC=m
+# CONFIG_MUSB_PIO_ONLY is not set
+CONFIG_USB_TUSB6010=y
+# CONFIG_USB_MUSB_DEBUG is not set
+
+CONFIG_MMC_ARMMMCI=m
+
+CONFIG_RTC_DRV_PL030=m
+CONFIG_RTC_DRV_PL031=m
+
+# CONFIG_SGI_IOC4 is not set
+
+# CONFIG_DEBUG_USER is not set
+# CONFIG_DEBUG_ERRORS is not set
+# CONFIG_DEBUG_LL is not set
+
+CONFIG_ARM_UNWIND=y
+
+CONFIG_RCU_FANOUT=32

config-debug

@@ -0,0 +1,64 @@
+CONFIG_SND_VERBOSE_PRINTK=y
+CONFIG_SND_DEBUG=y
+CONFIG_SND_PCM_XRUN_DEBUG=y
+
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_DEBUG_VM=y
+CONFIG_DEBUG_SPINLOCK=y
+
+CONFIG_FAULT_INJECTION=y
+CONFIG_FAILSLAB=y
+CONFIG_FAIL_PAGE_ALLOC=y
+CONFIG_FAIL_MAKE_REQUEST=y
+CONFIG_FAULT_INJECTION_DEBUG_FS=y
+CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
+CONFIG_FAIL_IO_TIMEOUT=y
+
+CONFIG_SLUB_DEBUG_ON=y
+
+CONFIG_LOCK_STAT=y
+
+CONFIG_DEBUG_STACK_USAGE=y
+
+CONFIG_ACPI_DEBUG=y
+# CONFIG_ACPI_DEBUG_FUNC_TRACE is not set
+
+CONFIG_DEBUG_SG=y
+
+# CONFIG_DEBUG_PAGEALLOC is not set
+
+CONFIG_DEBUG_WRITECOUNT=y
+CONFIG_DEBUG_OBJECTS=y
+# CONFIG_DEBUG_OBJECTS_SELFTEST is not set
+CONFIG_DEBUG_OBJECTS_FREE=y
+CONFIG_DEBUG_OBJECTS_TIMERS=y
+CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
+
+CONFIG_X86_PTDUMP=y
+
+CONFIG_CAN_DEBUG_DEVICES=y
+
+CONFIG_MODULE_FORCE_UNLOAD=y
+
+CONFIG_SYSCTL_SYSCALL_CHECK=y
+
+CONFIG_DEBUG_NOTIFIERS=y
+
+CONFIG_DMA_API_DEBUG=y
+
+CONFIG_MMIOTRACE=y
+
+CONFIG_DEBUG_CREDENTIALS=y
+
+CONFIG_EXT4_DEBUG=y
+
+CONFIG_DEBUG_PERF_USE_VMALLOC=y
+
+# off in both production debug and nodebug builds,
+#  on in rawhide nodebug builds
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+
+CONFIG_JBD2_DEBUG=y

config-i686-PAE

@@ -0,0 +1,37 @@
+# CONFIG_HIGHMEM4G is not set
+CONFIG_HIGHMEM64G=y
+
+CONFIG_XEN_DEV_EVTCHN=m
+CONFIG_XEN_SYS_HYPERVISOR=y
+
+CONFIG_LANGWELL_IPC=y
+# CONFIG_IMG_DOES_NOT_SUPPORT_MENLOW is not set
+CONFIG_PVR_RELEASE="release"
+CONFIG_PVR_SERVICES4=y
+CONFIG_PVR_XOPEN_SOURCE=600
+CONFIG_PVR2D_VALIDATE_INPUT_PARAMS=y
+CONFIG_PVR_DISPLAY_CONTROLLER="mrstlfb"
+CONFIG_PVR_SGX_CORE_REV=121
+CONFIG_PVR_SUPPORT_SVRINIT=y
+CONFIG_PVR_SUPPORT_SGX=y
+CONFIG_PVR_SUPPORT_PERCONTEXT_PB=y
+CONFIG_PVR_SUPPORT_LINUX_X86_WRITECOMBINE=y
+CONFIG_PVR_TRANSFER_QUEUE=y
+CONFIG_PVR_SUPPORT_DRI_DRM=y
+CONFIG_PVR_SYS_USING_INTERRUPTS=y
+CONFIG_PVR_SUPPORT_HW_RECOVERY=y
+CONFIG_PVR_SUPPORT_POWER_MANAGEMENT=y
+CONFIG_PVR_SECURE_HANDLES=y
+CONFIG_PVR_USE_PTHREADS=y
+CONFIG_PVR_SUPPORT_SGX_EVENT_OBJECT=y
+CONFIG_PVR_SUPPORT_SGX_HWPERF=y
+CONFIG_PVR_SUPPORT_SGX_LOW_LATENCY_SCHEDULING=y
+CONFIG_PVR_SUPPORT_LINUX_X86_PAT=y
+CONFIG_PVR_PROC_USE_SEQ_FILE=y
+CONFIG_PVR_SUPPORT_SGX535=y
+# CONFIG_PVR_SUPPORT_CACHEFLUSH_ON_ALLOC is not set
+# CONFIG_PVR_SUPPORT_MEMINFO_IDS is not set
+CONFIG_PVR_SUPPORT_CACHE_LINE_FLUSH=y
+CONFIG_PVR_SUPPORT_CPU_CACHED_BUFFERS=y
+CONFIG_PVR_DEBUG_MESA_OGL_TRACE=y
+

config-ia64-generic

@@ -0,0 +1,206 @@
+#
+# Automatically generated make config: don't edit
+#
+
+#
+# Processor type and features
+#
+CONFIG_IA64=y
+CONFIG_64BIT=y
+# CONFIG_XEN is not set
+CONFIG_MMU=y
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_EFI=y
+# CONFIG_ITANIUM is not set
+CONFIG_MCKINLEY=y
+CONFIG_IA64_GENERIC=y
+# CONFIG_IA64_DIG is not set
+# CONFIG_IA64_HP_ZX1 is not set
+# CONFIG_IA64_SGI_SN2 is not set
+CONFIG_IA64_ESI=y
+CONFIG_IA64_HP_AML_NFW=y
+CONFIG_MSPEC=y
+# CONFIG_IA64_HP_SIM is not set
+# CONFIG_IA64_PAGE_SIZE_4KB is not set
+# CONFIG_IA64_PAGE_SIZE_8KB is not set
+CONFIG_IA64_PAGE_SIZE_16KB=y
+# CONFIG_IA64_PAGE_SIZE_64KB is not set
+CONFIG_IA64_L1_CACHE_SHIFT=7
+CONFIG_NUMA=y
+# CONFIG_VIRTUAL_MEM_MAP is not set
+CONFIG_SPARSEMEM_MANUAL=y
+CONFIG_SPARSEMEM=y
+CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTREMOVE=y
+CONFIG_IA64_MCA_RECOVERY=m
+CONFIG_IA64_CYCLONE=y
+CONFIG_MMTIMER=y
+CONFIG_IOSAPIC=y
+CONFIG_FORCE_MAX_ZONEORDER=18
+CONFIG_NR_CPUS=1024
+# CONFIG_IA32_SUPPORT is not set
+# CONFIG_COMPAT is not set
+CONFIG_PERFMON=y
+CONFIG_IA64_PALINFO=y
+CONFIG_EFI_VARS=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=16
+CONFIG_EFI_PCDP=y
+#
+# Block devices
+#
+# CONFIG_BLK_DEV_FD is not set
+
+#
+# IDE chipset support/bugfixes
+#
+CONFIG_BLK_DEV_SGIIOC4=y
+
+#
+# Character devices
+#
+CONFIG_TCG_INFINEON=m
+
+#
+# Watchdog Cards
+#
+# CONFIG_HW_RANDOM is not set
+# CONFIG_GEN_RTC is not set
+CONFIG_EFI_RTC=y
+CONFIG_RTC_DRV_EFI=y
+
+
+#
+# AGP
+#
+CONFIG_AGP_I460=y
+CONFIG_AGP_HP_ZX1=y
+CONFIG_AGP_SGI_TIOCA=y
+
+#
+# HP Simulator drivers
+#
+# CONFIG_HP_SIMETH is not set
+# CONFIG_HP_SIMSERIAL is not set
+# CONFIG_HP_SIMSCSI is not set
+
+#
+# Kernel hacking
+#
+# CONFIG_IA64_PRINT_HAZARDS is not set
+# CONFIG_DISABLE_VHPT is not set
+# CONFIG_IA64_DEBUG_CMPXCHG is not set
+# CONFIG_IA64_DEBUG_IRQ is not set
+
+#
+# Memory Technology Devices (MTD)
+#
+# CONFIG_MTD is not set
+
+#
+# SGI
+#
+CONFIG_SGI_SNSC=y
+CONFIG_SGI_TIOCX=y
+CONFIG_SGI_MBCS=m
+CONFIG_SGI_IOC3=m
+CONFIG_SGI_IOC4=y
+CONFIG_SGI_XP=m
+CONFIG_SGI_GRU=m
+# CONFIG_SGI_GRU_DEBUG is not set
+CONFIG_SERIAL_SGI_L1_CONSOLE=y
+CONFIG_SERIAL_SGI_IOC3=m
+CONFIG_SERIAL_SGI_IOC4=m
+
+
+#
+# SCSI low-level drivers
+#
+# CONFIG_SCSI_BUSLOGIC is not set
+
+#
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+# CONFIG_ACPI_ASUS is not set
+CONFIG_ACPI_PROCFS_POWER=y
+CONFIG_ACPI_SYSFS_POWER=y
+# CONFIG_ACPI_BATTERY is not set
+CONFIG_ACPI_BLACKLIST_YEAR=0
+CONFIG_ACPI_BUTTON=y
+# CONFIG_ACPI_DOCK is not set
+CONFIG_ACPI_FAN=y
+CONFIG_ACPI_HOTPLUG_MEMORY=y
+CONFIG_ACPI_NUMA=y
+CONFIG_ACPI_POWER=y
+CONFIG_ACPI_PROCESSOR=y
+CONFIG_ACPI_PROCFS=y
+CONFIG_ACPI_SLEEP=y
+CONFIG_ACPI_THERMAL=y
+# CONFIG_ACPI_TOSHIBA is not set
+CONFIG_ACPI_VIDEO=m
+# CONFIG_ACPI_PROC_EVENT is not set
+
+CONFIG_PM=y
+CONFIG_HOTPLUG_PCI=y
+# CONFIG_HPET is not set
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+CONFIG_HOTPLUG_PCI_SHPC=m
+CONFIG_HOTPLUG_PCI_SGI=m
+CONFIG_PNPACPI=y
+
+CONFIG_SCHED_SMT=y
+
+CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
+
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEBUG=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=m
+CONFIG_CPU_FREQ_GOV_ONDEMAND=m
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPU_FREQ_STAT=m
+CONFIG_CPU_FREQ_STAT_DETAILS=y
+
+CONFIG_IA64_ACPI_CPUFREQ=m
+
+# CONFIG_PERMIT_BSP_REMOVE is not set
+# CONFIG_FORCE_CPEI_RETARGET is not set
+
+CONFIG_NODES_SHIFT=10
+
+
+CONFIG_HW_RANDOM_INTEL=m
+
+CONFIG_CRASH_DUMP=y
+CONFIG_PROC_VMCORE=y
+
+# drivers/media/video/usbvision/usbvision-i2c.c:64:39: error: macro "outb" passed 4 arguments, but takes just 2
+# CONFIG_VIDEO_USBVISION is not set
+
+# CONFIG_IA64_MC_ERR_INJECT is not set
+
+CONFIG_DMIID=y
+
+CONFIG_SENSORS_I5K_AMB=m
+
+CONFIG_SPARSEMEM_VMEMMAP=y
+
+CONFIG_FRAME_WARN=2048
+
+CONFIG_VIRT_CPU_ACCOUNTING=y
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=m
+CONFIG_KVM_INTEL=m
+
+CONFIG_HP_ILO=m
+
+CONFIG_PARAVIRT_GUEST=y
+CONFIG_PARAVIRT=y
+
+CONFIG_DMAR_DEFAULT_ON=y
+
+CONFIG_RCU_FANOUT=64
+
+CONFIG_ACPI_POWER_METER=m
+CONFIG_I2C_SCMI=m

config-nodebug

@@ -0,0 +1,64 @@
+CONFIG_SND_VERBOSE_PRINTK=y
+CONFIG_SND_DEBUG=y
+CONFIG_SND_PCM_XRUN_DEBUG=y
+
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_FAILSLAB is not set
+# CONFIG_FAIL_PAGE_ALLOC is not set
+# CONFIG_FAIL_MAKE_REQUEST is not set
+# CONFIG_FAULT_INJECTION_DEBUG_FS is not set
+# CONFIG_FAULT_INJECTION_STACKTRACE_FILTER is not set
+# CONFIG_FAIL_IO_TIMEOUT is not set
+
+# CONFIG_SLUB_DEBUG_ON is not set
+
+# CONFIG_LOCK_STAT is not set
+
+# CONFIG_DEBUG_STACK_USAGE is not set
+
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_DEBUG_FUNC_TRACE is not set
+
+# CONFIG_DEBUG_SG is not set
+
+# CONFIG_DEBUG_PAGEALLOC is not set
+
+# CONFIG_DEBUG_WRITECOUNT is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_OBJECTS_SELFTEST is not set
+# CONFIG_DEBUG_OBJECTS_FREE is not set
+# CONFIG_DEBUG_OBJECTS_TIMERS is not set
+CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
+
+# CONFIG_X86_PTDUMP is not set
+
+# CONFIG_CAN_DEBUG_DEVICES is not set
+
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+
+# CONFIG_SYSCTL_SYSCALL_CHECK is not set
+
+# CONFIG_DEBUG_NOTIFIERS is not set
+
+# CONFIG_DMA_API_DEBUG is not set
+
+# CONFIG_MMIOTRACE is not set
+
+# CONFIG_DEBUG_CREDENTIALS is not set
+
+# off in both production debug and nodebug builds,
+#  on in rawhide nodebug builds
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+
+# CONFIG_EXT4_DEBUG is not set
+
+# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
+
+# CONFIG_JBD2_DEBUG is not set

config-powerpc-generic

@@ -0,0 +1,326 @@
+# Most PowerPC kernels we build are SMP
+CONFIG_SMP=y
+CONFIG_IRQ_ALL_CPUS=y
+CONFIG_PPC=y
+CONFIG_WATCHDOG_RTAS=m
+CONFIG_DEBUGGER=y
+CONFIG_GENERIC_NVRAM=y
+CONFIG_ALTIVEC=y
+
+CONFIG_TAU=y
+# CONFIG_TAU_INT is not set
+CONFIG_TAU_AVERAGE=y
+
+CONFIG_SECCOMP=y
+
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEBUG=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=m
+CONFIG_CPU_FREQ_GOV_ONDEMAND=m
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPU_FREQ_TABLE=y
+CONFIG_CPU_FREQ_STAT=m
+CONFIG_CPU_FREQ_STAT_DETAILS=y
+
+CONFIG_PM=y
+
+CONFIG_PM_STD_PARTITION=""
+
+CONFIG_SUSPEND=y
+CONFIG_HIBERNATION=y
+# CONFIG_RTC is not set
+# CONFIG_GEN_RTC is not set
+# CONFIG_GEN_RTC_X is not set
+CONFIG_RTC_DRV_GENERIC=y
+CONFIG_PROC_DEVICETREE=y
+# CONFIG_CMDLINE_BOOL is not set
+
+CONFIG_ADB=y
+CONFIG_ADB_PMU=y
+CONFIG_WINDFARM=y
+CONFIG_WINDFARM_PM112=y
+CONFIG_I2C_POWERMAC=y
+CONFIG_APPLE_AIRPORT=m
+CONFIG_SERIAL_PMACZILOG=m
+# CONFIG_SERIAL_PMACZILOG_TTYS is not set
+CONFIG_AGP_UNINORTH=y
+CONFIG_FB_OF=y
+# CONFIG_FB_CONTROL is not set
+CONFIG_FB_IBM_GXT4500=y
+CONFIG_FB_RADEON=y
+CONFIG_FB_MATROX=y
+CONFIG_FB_NVIDIA=m
+# CONFIG_FB_VGA16 is not set
+CONFIG_FB_ATY128_BACKLIGHT=y
+CONFIG_FB_ATY_BACKLIGHT=y
+CONFIG_FB_RADEON_BACKLIGHT=y
+CONFIG_FB_RIVA_BACKLIGHT=y
+CONFIG_FB_NVIDIA_BACKLIGHT=y
+
+CONFIG_SND_POWERMAC=m
+CONFIG_SND_POWERMAC_AUTO_DRC=y
+CONFIG_SND_AOA=m
+CONFIG_SND_AOA_SOUNDBUS=m
+CONFIG_SND_AOA_FABRIC_LAYOUT=m
+CONFIG_SND_AOA_ONYX=m
+CONFIG_SND_AOA_TAS=m
+CONFIG_SND_AOA_TOONIE=m
+CONFIG_SND_AOA_SOUNDBUS_I2S=m
+
+CONFIG_XMON=y
+# CONFIG_XMON_DEFAULT is not set
+CONFIG_XMON_DISASSEMBLY=y
+
+CONFIG_BOOTX_TEXT=y
+CONFIG_MAC_EMUMOUSEBTN=y
+CONFIG_CAPI_EICON=y
+
+CONFIG_NVRAM=y
+
+# CONFIG_PCMCIA_M8XX is not set
+# CONFIG_SCSI_AHA1542 is not set
+# CONFIG_SCSI_IN2000 is not set
+# CONFIG_SCSI_IPS is not set
+# CONFIG_NI52 is not set
+# CONFIG_NI65 is not set
+# CONFIG_LANCE is not set
+# CONFIG_3C515 is not set
+# CONFIG_ELPLUS is not set
+
+CONFIG_MEMORY_HOTPLUG=y
+
+# Stuff which wants bus_to_virt() or virt_to_bus()
+# CONFIG_BLK_CPQ_DA is not set
+# CONFIG_VIDEO_STRADIS is not set
+# CONFIG_VIDEO_ZORAN is not set
+# CONFIG_ATM_HORIZON is not set
+# CONFIG_ATM_FIRESTREAM is not set
+# CONFIG_ATM_AMBASSADOR is not set
+# CONFIG_SCSI_DC390T is not set
+# CONFIG_SCSI_BUSLOGIC is not set
+
+
+# CONFIG_PPC_EARLY_DEBUG is not set
+
+# CONFIG_PMAC_BACKLIGHT_LEGACY is not set
+CONFIG_LEDS_TRIGGER_TIMER=m
+CONFIG_LEDS_TRIGGER_HEARTBEAT=m
+CONFIG_LEDS_TRIGGER_GPIO=m
+
+# FIXME: Should depend on IA64/x86
+# CONFIG_SGI_IOC4 is not set
+
+CONFIG_PPC_EFIKA=y
+CONFIG_PPC_MEDIA5200=y
+
+# CONFIG_PPC_LITE5200 is not set
+CONFIG_PPC_BESTCOMM=y
+CONFIG_PMAC_RACKMETER=m
+CONFIG_USB_OHCI_HCD_PPC_SOC=y
+CONFIG_USB_OHCI_HCD_PCI=y
+CONFIG_USB_OHCI_HCD_PPC_OF=y
+CONFIG_USB_OHCI_HCD_PPC_OF_BE=y
+CONFIG_USB_OHCI_HCD_PPC_OF_LE=y
+
+CONFIG_SERIAL_UARTLITE=m
+CONFIG_SERIAL_UARTLITE_CONSOLE=y
+
+CONFIG_SENSORS_AMS=m
+CONFIG_SENSORS_AMS_PMU=y
+CONFIG_SENSORS_AMS_I2C=y
+
+CONFIG_IDE=y
+CONFIG_BLK_DEV_IDE=y
+
+#
+# Please see Documentation/ide.txt for help/info on IDE drives
+#
+# CONFIG_BLK_DEV_IDE_SATA is not set
+# CONFIG_BLK_DEV_IDECS is not set
+CONFIG_BLK_DEV_IDECD=m
+# CONFIG_BLK_DEV_IDETAPE is not set
+CONFIG_IDE_TASK_IOCTL=y
+#
+# IDE chipset support/bugfixes
+#
+# CONFIG_IDE_GENERIC is not set
+# CONFIG_BLK_DEV_IDEPNP is not set
+# CONFIG_BLK_DEV_IDEPCI is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+# CONFIG_BLK_DEV_CMD64X is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_JMICRON is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SL82C105 is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
+CONFIG_BLK_DEV_IDE_PMAC=y
+CONFIG_BLK_DEV_IDE_PMAC_ATA100FIRST=y
+CONFIG_BLK_DEV_IDEDMA=y
+# CONFIG_BLK_DEV_HD is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+CONFIG_MTD_PHYSMAP_OF=m
+CONFIG_IDE_PROC_FS=y
+CONFIG_MACINTOSH_DRIVERS=y
+
+CONFIG_PPC_PASEMI_MDIO=m
+CONFIG_SPU_FS_64K_LS=y
+CONFIG_PPC_PASEMI_CPUFREQ=y
+CONFIG_PMAC_APM_EMU=m
+CONFIG_HW_RANDOM_PASEMI=m
+
+CONFIG_EDAC=y
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_MM_EDAC=m
+CONFIG_EDAC_PASEMI=m
+CONFIG_EDAC_AMD8131=m
+CONFIG_EDAC_AMD8111=m
+
+CONFIG_AXON_RAM=m
+CONFIG_OPROFILE_CELL=y
+
+CONFIG_SUSPEND_FREEZER=y
+# CONFIG_IDEPCI_PCIBUS_ORDER is not set
+CONFIG_PATA_PLATFORM=m
+CONFIG_PATA_OF_PLATFORM=m
+CONFIG_USB_EHCI_HCD_PPC_OF=y
+
+# CONFIG_MPC5121_ADS is not set
+# CONFIG_MPC5121_GENERIC is not set
+CONFIG_MTD_OF_PARTS=m
+# CONFIG_MTD_NAND_FSL_ELBC is not set
+CONFIG_THERMAL=y
+
+# CONFIG_MEMORY_HOTREMOVE is not set
+
+CONFIG_DMADEVICES=y
+# CONFIG_FSL_DMA is not set
+
+CONFIG_SND_PPC=y
+
+CONFIG_PPC_82xx=y
+CONFIG_PPC_83xx=y
+CONFIG_PPC_86xx=y
+CONFIG_EXTRA_TARGETS=""
+# CONFIG_CODE_PATCHING_SELFTEST is not set
+# CONFIG_FTR_FIXUP_SELFTEST is not set
+
+# CONFIG_MATH_EMULATION is not set
+# CONFIG_RAPIDIO is not set
+# CONFIG_FS_ENET is not set
+# CONFIG_UCC_GETH is not set
+# CONFIG_KEYBOARD_GPIO is not set
+# CONFIG_KEYBOARD_MATRIX is not set
+# CONFIG_MOUSE_GPIO is not set
+# CONFIG_SERIAL_CPM is not set
+# CONFIG_SERIAL_QE is not set
+# CONFIG_I2C_CPM is not set
+# CONFIG_I2C_GPIO is not set
+# CONFIG_W1_MASTER_GPIO is not set
+# CONFIG_LEDS_GPIO is not set
+# CONFIG_GPIO_SYSFS is not set
+# CONFIG_GPIO_MAX732X is not set
+
+
+CONFIG_SERIO_XILINX_XPS_PS2=m
+
+# CONFIG_PPC_SMLPAR is not set
+
+CONFIG_MGCOGE=y
+CONFIG_GEF_SBC610=y
+CONFIG_GEF_PPC9A=y
+CONFIG_GEF_SBC310=y
+
+CONFIG_QUICC_ENGINE=y
+CONFIG_QE_GPIO=y
+CONFIG_MPC8xxx_GPIO=y
+
+CONFIG_IDE_GD=y
+CONFIG_IDE_GD_ATA=y
+CONFIG_IDE_GD_ATAPI=y
+
+CONFIG_MCU_MPC8349EMITX=m
+
+CONFIG_GPIO_XILINX=y
+
+CONFIG_UCB1400_CORE=m
+
+CONFIG_PMIC_DA903X=y
+CONFIG_BACKLIGHT_DA903X=m
+CONFIG_LEDS_DA903X=m
+
+CONFIG_MSI_BITMAP_SELFTEST=y
+
+CONFIG_RELOCATABLE=y
+
+# CONFIG_HVC_UDBG is not set
+CONFIG_PRINT_STACK_DEPTH=64
+
+CONFIG_BATTERY_DA9030=m
+# CONFIG_TWL4030_CORE is not set
+
+CONFIG_BLK_DEV_IT8172=m
+CONFIG_TOUCHSCREEN_DA9034=m
+
+CONFIG_SIMPLE_GPIO=y
+
+CONFIG_FSL_PQ_MDIO=m
+
+CONFIG_PS3_VRAM=m
+CONFIG_MDIO_GPIO=m
+CONFIG_SERIAL_OF_PLATFORM_NWPSERIAL=m
+# CONFIG_DEBUG_GPIO is not set
+CONFIG_GPIO_PCA953X=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_USB_GPIO_VBUS=m
+
+CONFIG_USB_FHCI_HCD=m
+# CONFIG_FHCI_DEBUG is not set
+
+# CONFIG_DRM_RADEON_KMS is not set
+
+# CONFIG_AMIGAONE is not set
+
+CONFIG_PPC_OF_BOOT_TRAMPOLINE=y
+
+CONFIG_DTL=y
+
+CONFIG_MMC_SDHCI_OF=m
+
+# CONFIG_CONSISTENT_SIZE_BOOL is not set
+
+CONFIG_CAN_SJA1000_OF_PLATFORM=m
+
+CONFIG_PPC_EMULATED_STATS=y
+
+CONFIG_SWIOTLB=y
+
+# CONFIG_RDS is not set
+
+CONFIG_PPC_DISABLE_WERROR=y
+
+CONFIG_XILINX_EMACLITE=m
+
+CONFIG_GPIO_WM831X=m
+# CONFIG_GPIO_LANGWELL is not set
+# CONFIG_GPIO_UCB1400 is not set
+CONFIG_EDAC_MPC85XX=m
+

config-powerpc32-generic

@@ -0,0 +1,184 @@
+# CONFIG_SMP is not set
+CONFIG_PPC32=y
+# CONFIG_PPC64 is not set
+# CONFIG_RTAS_PROC is not set
+# CONFIG_PCMCIA_M8XX is not set
+# CONFIG_HOTPLUG_PCI is not set
+CONFIG_CPU_FREQ_PMAC=y
+CONFIG_PPC_CHRP=y
+CONFIG_PPC_PMAC=y
+CONFIG_PPC_MPC52xx=y
+CONFIG_PPC_PREP=y
+
+# CONFIG_PPC_MPC5200_SIMPLE is not set
+CONFIG_SATA_FSL=m
+# CONFIG_SATA_NV is not set
+
+# busted in .28git1
+# ERROR: "cacheable_memzero" [drivers/net/gianfar_driver.ko] undefined!
+# CONFIG_GIANFAR is not set
+CONFIG_USB_EHCI_FSL=y
+
+CONFIG_PMAC_APM_EMU=y
+CONFIG_PMAC_BACKLIGHT=y
+
+CONFIG_HIGHMEM=y
+# CONFIG_HIGHMEM_START_BOOL is not set
+# CONFIG_LOWMEM_SIZE_BOOL is not set
+# CONFIG_TASK_SIZE_BOOL is not set
+# CONFIG_KERNEL_START_BOOL is not set
+# CONFIG_PPC601_SYNC_FIX is not set
+CONFIG_ADVANCED_OPTIONS=y
+CONFIG_SCSI_MESH=m
+CONFIG_SCSI_MESH_SYNC_RATE=5
+CONFIG_SCSI_MESH_RESET_DELAY_MS=4000
+
+CONFIG_SCSI_MAC53C94=m
+CONFIG_ADB_CUDA=y
+CONFIG_ADB_MACIO=y
+CONFIG_INPUT_ADBHID=y
+CONFIG_ADB_PMU_LED=y
+CONFIG_ADB_PMU_LED_IDE=y
+
+CONFIG_PMAC_MEDIABAY=y
+CONFIG_BMAC=m
+CONFIG_MACE=m
+# CONFIG_MACE_AAUI_PORT is not set
+CONFIG_MV643XX_ETH=m
+CONFIG_I2C_HYDRA=m
+CONFIG_I2C_MPC=m
+CONFIG_THERM_WINDTUNNEL=m
+CONFIG_THERM_ADT746X=m
+# CONFIG_ANSLCD is not set
+
+CONFIG_FB_PLATINUM=y
+CONFIG_FB_VALKYRIE=y
+CONFIG_FB_CT65550=y
+# CONFIG_BDI_SWITCH is not set
+
+CONFIG_MAC_FLOPPY=m
+# CONFIG_BLK_DEV_FD is not set
+
+CONFIG_FB_ATY128=y
+CONFIG_FB_ATY=y
+CONFIG_FB_MATROX=y
+# CONFIG_KEXEC is not set
+
+# CONFIG_HVC_RTAS is not set
+
+# CONFIG_UDBG_RTAS_CONSOLE is not set
+CONFIG_BRIQ_PANEL=m
+
+# CONFIG_ATA_PIIX is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ATIIXP is not set
+CONFIG_PATA_MPC52xx=m
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_SERVERWORKS is not set
+
+CONFIG_SERIAL_MPC52xx=y
+CONFIG_SERIAL_MPC52xx_CONSOLE=y
+CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=115200
+# CONFIG_MPC5200_WDT is not set
+CONFIG_8xxx_WDT=m
+CONFIG_GEF_WDT=m
+
+CONFIG_PPC_MPC5200_BUGFIX=y
+CONFIG_FEC_MPC52xx=m
+#CHECK: This may later become a tristate.
+CONFIG_FEC_MPC52xx_MDIO=y
+CONFIG_PPC_MPC5200_GPIO=y
+CONFIG_MDIO_GPIO=m
+
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+
+# CONFIG_EMBEDDED6xx is not set
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+
+# CONFIG_BLK_DEV_PLATFORM is not set
+# CONFIG_BLK_DEV_4DRIVES is not set
+# CONFIG_BLK_DEV_ALI14XX is not set
+# CONFIG_BLK_DEV_DTC2278 is not set
+# CONFIG_BLK_DEV_HT6560B is not set
+# CONFIG_BLK_DEV_QD65XX is not set
+# CONFIG_BLK_DEV_UMC8672 is not set
+
+# CONFIG_VIRQ_DEBUG is not set
+
+CONFIG_PPC_BESTCOMM_ATA=m
+CONFIG_PPC_BESTCOMM_FEC=m
+CONFIG_PPC_BESTCOMM_GEN_BD=m
+
+CONFIG_FORCE_MAX_ZONEORDER=11
+# CONFIG_PAGE_OFFSET_BOOL is not set
+# CONFIG_FB_FSL_DIU is not set
+CONFIG_IRQSTACKS=y
+CONFIG_VIRTUALIZATION=y
+
+# CONFIG_DEBUG_GPIO is not set
+# CONFIG_GPIO_PCA953X is not set
+# CONFIG_GPIO_PCF857X is not set
+# CONFIG_HTC_EGPIO is not set
+
+# CONFIG_TIFM_CORE is not set
+
+# CONFIG_BLK_CPQ_CISS_DA is not set
+# CONFIG_CISS_SCSI_TAPE is not set
+
+# CONFIG_I2C_NFORCE2 is not set
+
+# CONFIG_SND_INTEL8X0 is not set
+# CONFIG_SND_INTEL8X0M is not set
+
+# CONFIG_MEMSTICK is not set
+
+# CONFIG_IPMI_HANDLER is not set
+# CONFIG_TCG_TPM is not set
+
+# PPC gets sad with debug alloc (bz 448598)
+# CONFIG_DEBUG_PAGEALLOC is not set
+
+CONFIG_SND_ISA=y
+CONFIG_CRYPTO_DEV_TALITOS=m
+
+CONFIG_FSL_EMB_PERFMON=y
+CONFIG_MPC8272_ADS=y
+CONFIG_PQ2FADS=y
+CONFIG_EP8248E=y
+CONFIG_MPC831x_RDB=y
+CONFIG_MPC832x_MDS=y
+CONFIG_MPC832x_RDB=y
+CONFIG_MPC834x_MDS=y
+CONFIG_MPC834x_ITX=y
+CONFIG_MPC836x_MDS=y
+CONFIG_MPC836x_RDK=y
+CONFIG_MPC837x_MDS=y
+CONFIG_MPC837x_RDB=y
+CONFIG_SBC834x=y
+CONFIG_ASP834x=y
+CONFIG_KMETER1=y
+CONFIG_MPC8641_HPCN=y
+CONFIG_SBC8641D=y
+CONFIG_MPC8610_HPCD=y
+
+# CONFIG_USB_MUSB_HDRC is not set
+
+# busted in 2.6.27
+# drivers/mtd/maps/sbc8240.c: In function 'init_sbc8240_mtd':
+# drivers/mtd/maps/sbc8240.c:172: warning: passing argument 1 of 'simple_map_init' from incompatible pointer type
+# drivers/mtd/maps/sbc8240.c:177: error: 'struct mtd_info' has no member named 'module'
+
+CONFIG_MTD_NAND_FSL_UPM=m
+
+CONFIG_USB_GPIO_VBUS=m
+
+CONFIG_RCU_FANOUT=32
+
+CONFIG_PERF_COUNTERS=y
+CONFIG_PERF_EVENTS=y
+CONFIG_EVENT_PROFILE=y
+

config-powerpc32-smp

@@ -0,0 +1,4 @@
+CONFIG_SMP=y
+# CONFIG_HOTPLUG_CPU is not set
+CONFIG_NR_CPUS=4
+# CONFIG_BATTERY_PMU is not set

config-powerpc64

@@ -0,0 +1,176 @@
+CONFIG_WINDFARM_PM81=y
+CONFIG_WINDFARM_PM91=y
+CONFIG_WINDFARM_PM121=y
+CONFIG_PPC_PMAC64=y
+CONFIG_PPC_MAPLE=y
+CONFIG_PPC_CELL=y
+CONFIG_PPC_IBM_CELL_BLADE=y
+CONFIG_PPC_ISERIES=y
+CONFIG_PPC_PSERIES=y
+CONFIG_PPC_PMAC=y
+CONFIG_PPC_PASEMI=y
+# CONFIG_PPC_PASEMI_IOMMU_DMA_FORCE is not set
+CONFIG_PPC_PS3=y
+CONFIG_PPC_CELLEB=y
+CONFIG_PPC_CELL_QPACE=y
+CONFIG_PS3_HTAB_SIZE=20
+# CONFIG_PS3_DYNAMIC_DMA is not set
+CONFIG_PS3_ADVANCED=y
+CONFIG_PS3_HTAB_SIZE=20
+# CONFIG_PS3_DYNAMIC_DMA is not set
+CONFIG_PS3_VUART=y
+CONFIG_PS3_PS3AV=y
+CONFIG_PS3_STORAGE=m
+CONFIG_PS3_DISK=m
+CONFIG_PS3_ROM=m
+CONFIG_PS3_FLASH=m
+CONFIG_PS3_LPM=y
+CONFIG_SND_PS3=m
+CONFIG_SND_PS3_DEFAULT_START_DELAY=1000
+CONFIG_GELIC_NET=m
+CONFIG_GELIC_WIRELESS=y
+CONFIG_GELIC_WIRELESS_OLD_PSK_INTERFACE=y
+CONFIG_CBE_THERM=m
+CONFIG_CBE_CPUFREQ=m
+CONFIG_CBE_CPUFREQ_PMI=m
+CONFIG_CBE_CPUFREQ_PMI_ENABLE=y
+CONFIG_PMAC_RACKMETER=m
+CONFIG_IBMEBUS=y
+CONFIG_SPU_FS=m
+CONFIG_RTAS_FLASH=y
+CONFIG_PPC_SPLPAR=y
+CONFIG_SCANLOG=y
+CONFIG_LPARCFG=y
+CONFIG_SERIAL_ICOM=m
+CONFIG_HVCS=m
+CONFIG_HVC_CONSOLE=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_THERM_PM72=y
+CONFIG_IBMVETH=m
+CONFIG_SCSI_IBMVSCSI=m
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+CONFIG_HOTPLUG_PCI_SHPC=m
+CONFIG_HOTPLUG_PCI_RPA=m
+CONFIG_HOTPLUG_PCI_RPA_DLPAR=y
+CONFIG_ADB_PMU_LED=y
+CONFIG_ADB_PMU_LED_IDE=y
+CONFIG_PMAC_SMU=y
+CONFIG_CPU_FREQ_PMAC64=y
+CONFIG_SCSI_IPR=m
+CONFIG_SCSI_IPR_TRACE=y
+CONFIG_SCSI_IPR_DUMP=y
+CONFIG_SPIDER_NET=m
+CONFIG_HVC_RTAS=y
+CONFIG_HVC_ISERIES=y
+CONFIG_CBE_RAS=y
+
+# iSeries device drivers
+#
+CONFIG_ISERIES_VETH=m
+CONFIG_VIODASD=m
+CONFIG_VIOCD=m
+CONFIG_VIOTAPE=m
+
+CONFIG_PASEMI_MAC=m
+CONFIG_SERIAL_OF_PLATFORM=m
+
+CONFIG_PPC_PASEMI_IOMMU=y
+CONFIG_SERIAL_TXX9=y
+CONFIG_SERIAL_TXX9_NR_UARTS=6
+CONFIG_SERIAL_TXX9_CONSOLE=y
+
+CONFIG_HVC_BEAT=y
+
+CONFIG_FB_PS3=y
+CONFIG_FB_PS3_DEFAULT_SIZE_M=18
+
+CONFIG_PPC_PMI=m
+CONFIG_PS3_SYS_MANAGER=y
+# CONFIG_BLK_DEV_CELLEB is not set
+
+CONFIG_PATA_SCC=m
+
+CONFIG_APM_EMULATION=m
+
+CONFIG_PPC64=y
+CONFIG_VIRT_CPU_ACCOUNTING=y
+CONFIG_NR_CPUS=128
+# CONFIG_FB_PLATINUM is not set
+# CONFIG_FB_VALKYRIE is not set
+# CONFIG_FB_CT65550 is not set
+# CONFIG_FB_VGA16 is not set
+# CONFIG_FB_ATY128 is not set
+# CONFIG_FB_ATY is not set
+
+# CONFIG_POWER4_ONLY is not set
+
+CONFIG_RTAS_PROC=y
+CONFIG_IOMMU_VMERGE=y
+CONFIG_NUMA=y
+# CONFIG_PPC_64K_PAGES is not set
+CONFIG_SCHED_SMT=y
+
+# CONFIG_MV643XX_ETH is not set
+CONFIG_IRQSTACKS=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+# CONFIG_INPUT_PCSPKR is not set
+
+CONFIG_EHEA=m
+CONFIG_INFINIBAND_EHCA=m
+
+CONFIG_HCALL_STATS=y
+
+CONFIG_XMON_DISASSEMBLY=y
+
+CONFIG_SCSI_IBMVSCSIS=m
+
+CONFIG_SECCOMP=y
+
+CONFIG_TUNE_CELL=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+# CONFIG_BLK_DEV_PLATFORM is not set
+CONFIG_IBM_NEW_EMAC=m
+CONFIG_IBM_NEW_EMAC_RXB=128
+CONFIG_IBM_NEW_EMAC_TXB=64
+CONFIG_IBM_NEW_EMAC_POLL_WEIGHT=32
+CONFIG_IBM_NEW_EMAC_RX_COPY_THRESHOLD=256
+CONFIG_IBM_NEW_EMAC_RX_SKB_HEADROOM=0
+# CONFIG_IBM_NEW_EMAC_DEBUG is not set
+
+# CONFIG_VIRQ_DEBUG is not set
+CONFIG_ELECTRA_CF=m
+
+CONFIG_SPARSEMEM_VMEMMAP=y
+
+CONFIG_MTD_NAND_PASEMI=m
+CONFIG_EDAC_CELL=m
+CONFIG_EDAC_CPC925=m
+CONFIG_FRAME_WARN=2048
+
+CONFIG_PHYP_DUMP=y
+CONFIG_FORCE_MAX_ZONEORDER=13
+CONFIG_VIRTUALIZATION=y
+
+CONFIG_VSX=y
+
+CONFIG_SCSI_IBMVFC=m
+# CONFIG_SCSI_IBMVFC_TRACE is not set
+CONFIG_IBM_BSR=m
+
+CONFIG_SERIO_XILINX_XPS_PS2=m
+
+CONFIG_PPC_IBM_CELL_RESETBUTTON=y
+CONFIG_PPC_IBM_CELL_POWERBUTTON=m
+CONFIG_CBE_CPUFREQ_SPU_GOVERNOR=m
+
+CONFIG_RTC_DRV_PS3=y
+
+CONFIG_CRASH_DUMP=y
+CONFIG_RELOCATABLE=y
+
+CONFIG_RCU_FANOUT=64
+
+CONFIG_PERF_COUNTERS=y
+CONFIG_PERF_EVENTS=y
+CONFIG_EVENT_PROFILE=y

config-rhel-generic

@@ -0,0 +1,204 @@
+# CONFIG_ISA is not set
+# CONFIG_ISAPNP is not set
+# CONFIG_I2C_PCA_ISA is not set
+
+# CONFIG_SCSI_BUSLOGIC is not set
+# CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_ADVANSYS is not set
+# CONFIG_SCSI_AHA1542 is not set
+# CONFIG_SCSI_FUTURE_DOMAIN is not set
+# CONFIG_SCSI_IN2000 is not set
+# CONFIG_SCSI_QLOGIC_FAS is not set
+# CONFIG_SCSI_DC390T is not set
+
+# CONFIG_ATALK is not set
+# CONFIG_DEV_APPLETALK is not set
+# CONFIG_LTPC is not set
+# CONFIG_COPS is not set
+# CONFIG_IPX is not set
+# CONFIG_IPDDP is not set
+# CONFIG_DECNET is not set
+# CONFIG_PLIP is not set
+
+# CONFIG_PCMCIA_AHA152X is not set
+# CONFIG_PCMCIA_NINJA_SCSI is not set
+# CONFIG_PCMCIA_QLOGIC is not set
+# CONFIG_PCMCIA_SYM53C500 is not set
+
+# CONFIG_EL2 is not set
+# CONFIG_ELPLUS is not set
+# CONFIG_WD80x3 is not set
+# CONFIG_I82092 is not set
+# CONFIG_YELLOWFIN is not set
+# CONFIG_SUNDANCE is not set
+# CONFIG_ULTRA is not set
+# CONFIG_SKFP is not set
+# CONFIG_DE600 is not set
+# CONFIG_DE620 is not set
+# CONFIG_CS89x0 is not set
+# CONFIG_AC3200 is not set
+# CONFIG_NI52 is not set
+# CONFIG_NI65 is not set
+# CONFIG_LANCE is not set
+# CONFIG_EL16 is not set
+# CONFIG_EL3 is not set
+# CONFIG_3C515 is not set
+# CONFIG_HAMACHI is not set
+# CONFIG_HP100 is not set
+# CONFIG_EQUALIZER is not set
+# CONFIG_NET_SB1000 is not set
+# CONFIG_DEPCA is not set
+# CONFIG_ATP is not set
+
+# CONFIG_TR is not set
+
+# CONFIG_GAMEPORT is not set
+
+# CONFIG_SND_AD1816A is not set
+# CONFIG_SND_AD1848 is not set
+# CONFIG_SND_CS4231 is not set
+# CONFIG_SND_CS4236 is not set
+# CONFIG_SND_ES968 is not set
+# CONFIG_SND_ES1688 is not set
+# CONFIG_SND_ES18XX is not set
+# CONFIG_SND_GUSCLASSIC is not set
+# CONFIG_SND_GUSEXTREME is not set
+# CONFIG_SND_GUSMAX is not set
+# CONFIG_SND_INTERWAVE is not set
+# CONFIG_SND_INTERWAVE_STB is not set
+# CONFIG_SND_OPTI92X_AD1848 is not set
+# CONFIG_SND_OPTI92X_CS4231 is not set
+# CONFIG_SND_OPTI93X is not set
+# CONFIG_SND_MIRO is not set
+# CONFIG_SND_SB8 is not set
+# CONFIG_SND_SB16 is not set
+# CONFIG_SND_SBAWE is not set
+# CONFIG_SND_SB16_CSP is not set
+# CONFIG_SND_WAVEFRONT is not set
+# CONFIG_SND_ALS100 is not set
+# CONFIG_SND_AZT2320 is not set
+# CONFIG_SND_CMI8330 is not set
+# CONFIG_SND_DT019X is not set
+# CONFIG_SND_OPL3SA2 is not set
+# CONFIG_SND_SGALAXY is not set
+# CONFIG_SND_SSCAPE is not set
+
+# CONFIG_WAN_ROUTER is not set
+
+# CONFIG_BINFMT_AOUT is not set
+
+# CONFIG_DRM_TDFX is not set
+# CONFIG_DRM_SIS is not set
+
+# CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+
+# CONFIG_PARIDE is not set
+
+# CONFIG_I2O is not set
+
+# CONFIG_MWAVE is not set
+
+# CONFIG_ROCKETPORT is not set
+# CONFIG_R3964 is not set
+
+# CONFIG_JOYSTICK_ANALOG is not set
+# CONFIG_JOYSTICK_A3D is not set
+# CONFIG_JOYSTICK_ADI is not set
+# CONFIG_JOYSTICK_COBRA is not set
+# CONFIG_JOYSTICK_GF2K is not set
+# CONFIG_JOYSTICK_GRIP is not set
+# CONFIG_JOYSTICK_GRIP_MP is not set
+# CONFIG_JOYSTICK_GUILLEMOT is not set
+# CONFIG_JOYSTICK_INTERACT is not set
+# CONFIG_JOYSTICK_SIDEWINDER is not set
+# CONFIG_JOYSTICK_TMDC is not set
+# CONFIG_JOYSTICK_IFORCE is not set
+# CONFIG_JOYSTICK_WARRIOR is not set
+# CONFIG_JOYSTICK_MAGELLAN is not set
+# CONFIG_JOYSTICK_SPACEORB is not set
+# CONFIG_JOYSTICK_SPACEBALL is not set
+# CONFIG_JOYSTICK_STINGER is not set
+# CONFIG_JOYSTICK_DB9 is not set
+# CONFIG_JOYSTICK_GAMECON is not set
+# CONFIG_JOYSTICK_TURBOGRAFX is not set
+
+# CONFIG_RADIO_CADET is not set
+# CONFIG_RADIO_RTRACK is not set
+# CONFIG_RADIO_RTRACK2 is not set
+# CONFIG_RADIO_AZTECH is not set
+# CONFIG_RADIO_GEMTEK is not set
+# CONFIG_RADIO_GEMTEK_PCI is not set
+# CONFIG_RADIO_MAXIRADIO is not set
+# CONFIG_RADIO_MAESTRO is not set
+# CONFIG_RADIO_SF16FMI is not set
+# CONFIG_RADIO_SF16FMR2 is not set
+# CONFIG_RADIO_TERRATEC is not set
+# CONFIG_RADIO_TRUST is not set
+# CONFIG_RADIO_TYPHOON is not set
+# CONFIG_RADIO_ZOLTRIX is not set
+
+
+# CONFIG_VIDEO_PMS is not set
+# CONFIG_VIDEO_BWQCAM is not set
+# CONFIG_VIDEO_CQCAM is not set
+# CONFIG_VIDEO_W9966 is not set
+# CONFIG_VIDEO_CPIA is not set
+# CONFIG_VIDEO_CPIA_PP is not set
+# CONFIG_VIDEO_CPIA_USB is not set
+# CONFIG_VIDEO_SAA5249 is not set
+# CONFIG_VIDEO_STRADIS is not set
+# CONFIG_VIDEO_ZORAN is not set
+# CONFIG_VIDEO_ZORAN_BUZ is not set
+# CONFIG_VIDEO_ZORAN_DC10 is not set
+# CONFIG_VIDEO_ZORAN_DC30 is not set
+# CONFIG_VIDEO_ZORAN_LML33 is not set
+# CONFIG_VIDEO_ZORAN_LML33R10 is not set
+# CONFIG_VIDEO_MEYE is not set
+# CONFIG_VIDEO_SAA7134 is not set
+# CONFIG_VIDEO_MXB is not set
+# CONFIG_VIDEO_HEXIUM_ORION is not set
+# CONFIG_VIDEO_HEXIUM_GEMINI is not set
+# CONFIG_VIDEO_CX88 is not set
+# CONFIG_VIDEO_SAA5246A is not set
+
+# CONFIG_INFTL is not set
+# CONFIG_MTD_DOC2000 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+# CONFIG_MTD_PMC551 is not set
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+# CONFIG_MTD_PCI is not set
+
+# CONFIG_FB_MATROX is not set
+# CONFIG_FB_3DFX is not set
+# CONFIG_FB_HGA is not set
+# CONFIG_FB_ATY is not set
+# CONFIG_FB_TRIDENT is not set
+# CONFIG_FB_VOODOO1 is not set
+# CONFIG_FB_ATY128 is not set
+# CONFIG_FB_RADEON is not set
+# CONFIG_FB_NEOMAGIC is not set
+# CONFIG_FB_ASILIANT is not set
+# CONFIG_FB_HGA_ACCEL is not set
+# CONFIG_FB_3DFX_ACCEL is not set
+
+# CONFIG_JFS_FS is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_REISERFS_FS is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_9P_FS is not set
+# CONFIG_OCFS2_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+

config-s390x

@@ -0,0 +1,227 @@
+CONFIG_64BIT=y
+# CONFIG_MARCH_G5 is not set
+# CONFIG_MARCH_Z900 is not set
+CONFIG_MARCH_Z9_109=y
+# CONFIG_MARCH_Z990 is not set
+
+CONFIG_NR_CPUS=64
+CONFIG_COMPAT=y
+
+# See bug 496596
+CONFIG_HZ_100=y
+# See bug 496605
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+
+CONFIG_MMU=y
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+
+CONFIG_LOG_BUF_SHIFT=16
+CONFIG_NO_IDLE_HZ=y
+
+CONFIG_SMP=y
+
+#
+# I/O subsystem configuration
+#
+CONFIG_QDIO=m
+
+#
+# Misc
+#
+CONFIG_IPL=y
+# CONFIG_IPL_TAPE is not set
+CONFIG_IPL_VM=y
+# CONFIG_PROCESS_DEBUG is not set
+CONFIG_PFAULT=y
+CONFIG_SHARED_KERNEL=y
+CONFIG_CMM=m
+CONFIG_CMM_PROC=y
+CONFIG_NETIUCV=m
+CONFIG_SMSGIUCV=m
+
+#
+# SCSI low-level drivers
+#
+CONFIG_ZFCP=m
+CONFIG_ZFCPDUMP=y
+CONFIG_CCW=y
+
+#
+# S/390 block device drivers
+#
+CONFIG_DCSSBLK=m
+CONFIG_BLK_DEV_XPRAM=m
+CONFIG_DASD=m
+CONFIG_DASD_PROFILE=y
+CONFIG_DASD_ECKD=m
+CONFIG_DASD_FBA=m
+CONFIG_DASD_DIAG=m
+CONFIG_DASD_EER=y
+
+#
+# S/390 character device drivers
+#
+CONFIG_TN3270=y
+CONFIG_TN3270_CONSOLE=y
+CONFIG_TN3215=y
+CONFIG_TN3215_CONSOLE=y
+CONFIG_CCW_CONSOLE=y
+CONFIG_SCLP_TTY=y
+CONFIG_SCLP_CONSOLE=y
+CONFIG_SCLP_VT220_TTY=y
+CONFIG_SCLP_VT220_CONSOLE=y
+CONFIG_SCLP_CPI=m
+CONFIG_SCLP_ASYNC=m
+CONFIG_S390_TAPE=m
+CONFIG_S390_TAPE_3590=m
+
+CONFIG_APPLDATA_BASE=y
+CONFIG_APPLDATA_MEM=m
+CONFIG_APPLDATA_OS=m
+CONFIG_APPLDATA_NET_SUM=m
+CONFIG_TN3270_TTY=y
+CONFIG_TN3270_FS=m
+
+
+#
+# S/390 tape interface support
+#
+CONFIG_S390_TAPE_BLOCK=y
+
+#
+# S/390 tape hardware support
+#
+CONFIG_S390_TAPE_34XX=m
+
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+
+#
+# Token Ring devices
+#
+CONFIG_TR=y
+CONFIG_NETCONSOLE=m
+
+#
+# Wan interfaces
+#
+# CONFIG_WAN is not set
+
+#
+# S/390 network device drivers
+#
+CONFIG_LCS=m
+CONFIG_CTC=m
+CONFIG_IUCV=m
+CONFIG_QETH=m
+CONFIG_QETH_IPV6=y
+CONFIG_CCWGROUP=m
+
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_WIRELESS_EXT is not set
+# CONFIG_WLAN_80211 is not set
+# CONFIG_MAC80211 is not set
+# CONFIG_B44 is not set
+
+#
+# Partition Types
+#
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_OSF_PARTITION is not set
+CONFIG_IBM_PARTITION=y
+# CONFIG_MAC_PARTITION is not set
+CONFIG_MSDOS_PARTITION=y
+# CONFIG_SGI_PARTITION is not set
+# CONFIG_SUN_PARTITION is not set
+
+
+#
+# S390 crypto hw
+#
+CONFIG_CRYPTO_SHA1_S390=m
+CONFIG_CRYPTO_SHA256_S390=m
+CONFIG_CRYPTO_DES_S390=m
+CONFIG_CRYPTO_AES_S390=m
+
+#
+# Kernel hacking
+#
+
+#
+# S390 specific stack options; needs gcc 3.5 so off for now
+#
+CONFIG_PACK_STACK=y
+CONFIG_CHECK_STACK=y
+# CONFIG_WARN_STACK is not set
+# CONFIG_SMALL_STACK is not set
+
+CONFIG_ZVM_WATCHDOG=m
+CONFIG_VMLOGRDR=m
+CONFIG_MONREADER=m
+
+CONFIG_VIRT_CPU_ACCOUNTING=y
+
+# CONFIG_CLAW is not set
+
+CONFIG_VMCP=m
+
+# CONFIG_ATMEL is not set
+
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+# CONFIG_MII is not set
+
+
+CONFIG_STACK_GUARD=256
+CONFIG_CMM_IUCV=y
+
+# CONFIG_DETECT_SOFTLOCKUP is not set
+
+CONFIG_S390_HYPFS_FS=y
+
+CONFIG_MONWRITER=m
+CONFIG_ZCRYPT=m
+CONFIG_ZCRYPT_MONOLITHIC=y
+
+CONFIG_S390_SWITCH_AMODE=y
+CONFIG_S390_EXEC_PROTECT=y
+CONFIG_AFIUCV=m
+CONFIG_S390_PRNG=m
+
+CONFIG_S390_VMUR=m
+
+# CONFIG_THERMAL is not set
+
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_CTCM=m
+CONFIG_QETH_L2=m
+CONFIG_QETH_L3=m
+CONFIG_CRYPTO_SHA512_S390=m
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=m
+CONFIG_S390_GUEST=y
+
+
+CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTREMOVE=y
+CONFIG_CHSC_SCH=m
+
+# drivers/isdn/hardware/mISDN/hfcmulti.c:5255:2: error: #error "not running on big endian machines now"
+# CONFIG_MISDN_HFCMULTI is not set
+
+CONFIG_HVC_IUCV=y
+
+CONFIG_RCU_FANOUT=64
+
+CONFIG_SECCOMP=y
+
+CONFIG_PM=y
+CONFIG_HIBERNATION=y
+CONFIG_PM_STD_PARTITION="/dev/jokes"
+
+CONFIG_PERF_COUNTERS=y
+CONFIG_PERF_EVENTS=y
+CONFIG_EVENT_PROFILE=y
+

config-sparc64-generic

@@ -0,0 +1,196 @@
+CONFIG_SMP=y
+CONFIG_SPARC=y
+CONFIG_SPARC64=y
+CONFIG_SECCOMP=y
+CONFIG_HZ_100=y
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=100
+
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_TABLE=m
+CONFIG_CPU_FREQ_DEBUG=y
+# CONFIG_CPU_FREQ_STAT is not set
+# CONFIG_CPU_FREQ_STAT_DETAILS is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=m
+CONFIG_CPU_FREQ_GOV_ONDEMAND=m
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_US3_FREQ=m
+CONFIG_US2E_FREQ=m
+
+CONFIG_SUN_LDOMS=y
+CONFIG_SCHED_SMT=y
+CONFIG_SCHED_MC=y
+CONFIG_64BIT=y
+# CONFIG_BBC_I2C is not set
+CONFIG_HUGETLB_PAGE_SIZE_4MB=y
+# CONFIG_HUGETLB_PAGE_SIZE_512K is not set
+# CONFIG_HUGETLB_PAGE_SIZE_64K is not set
+CONFIG_NR_CPUS=256
+CONFIG_US3_FREQ=m
+CONFIG_US2E_FREQ=m
+CONFIG_SUN_OPENPROMFS=m
+CONFIG_COMPAT=y
+CONFIG_UID16=y
+CONFIG_BINFMT_ELF32=y
+CONFIG_ENVCTRL=m
+CONFIG_DISPLAY7SEG=m
+CONFIG_WATCHDOG_CP1XXX=m
+CONFIG_WATCHDOG_RIO=m
+# CONFIG_CMDLINE_BOOL is not set
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+# CONFIG_PARPORT is not set
+# CONFIG_BLK_DEV_FD is not set
+# CONFIG_LIRC_PARALLEL is not set
+# CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_SIMTEC is not set
+# CONFIG_I2C_VOODOO3 is not set
+CONFIG_I2C_ALI1535=m
+# CONFIG_VGASTATE is not set
+# CONFIG_FB_DDC is not set
+# CONFIG_FB_BW2 is not set
+CONFIG_FB_CG3=y
+CONFIG_FB_CG6=y
+# CONFIG_FB_RIVA is not set
+# CONFIG_FB_MATROX is not set
+# CONFIG_FB_RADEON is not set
+CONFIG_FB_ATY=y
+# CONFIG_FB_S3 is not set
+# CONFIG_FB_SAVAGE is not set
+# CONFIG_FB_SIS is not set
+# CONFIG_FB_NEOMAGIC is not set
+# CONFIG_FB_3DFX is not set
+# CONFIG_FB_VOODOO1 is not set
+# CONFIG_FB_TRIDENT is not set
+CONFIG_FB_SBUS=y
+CONFIG_FB_FFB=y
+# CONFIG_FB_TCX is not set
+# CONFIG_FB_CG14 is not set
+CONFIG_FB_PM2=y
+CONFIG_FB_P9100=y
+# CONFIG_FB_LEO is not set
+CONFIG_FB_XVR500=y
+CONFIG_FB_XVR2500=y
+# CONFIG_VGASTATE is not set
+# CONFIG_FB_DDC is not set
+# CONFIG_FB_CIRRUS is not set
+# CONFIG_FB_ATY128 is not set
+# CONFIG_FB_KYRO is not set
+# CONFIG_AGP is not set
+# CONFIG_DRM_NOUVEAU is not set
+# CONFIG_MDA_CONSOLE is not set
+CONFIG_FONTS=y
+# CONFIG_FONT_8x8 is not set
+# CONFIG_FONT_8x16 is not set
+# CONFIG_FONT_7x14 is not set
+# CONFIG_FONT_10x18 is not set
+# CONFIG_FONT_6x11 is not set
+# CONFIG_FONT_SUN12x22 is not set
+# CONFIG_FONT_PEARL_8x8 is not set
+# CONFIG_FONT_ACORN_8x8 is not set
+CONFIG_FONT_SUN8x16=y
+CONFIG_FONT_SUN12x22=y
+# CONFIG_LOGO_LINUX_CLUT224 is not set
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_SUNZILOG=y
+CONFIG_SERIAL_SUNZILOG_CONSOLE=y
+CONFIG_SERIAL_SUNSU=y
+CONFIG_SERIAL_SUNSU_CONSOLE=y
+CONFIG_SERIAL_SUNSAB=y
+CONFIG_SERIAL_SUNSAB_CONSOLE=y
+CONFIG_SERIAL_SUNHV=y
+CONFIG_SUN_OPENPROMIO=y
+CONFIG_OBP_FLASH=m
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_BLK_DEV_FD=y
+CONFIG_SUNVDC=m
+CONFIG_SUNVNET=m
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
+# CONFIG_SCSI_ADVANSYS is not set
+# CONFIG_SCSI_BUSLOGIC is not set
+# CONFIG_SCSI_EATA is not set
+# CONFIG_SCSI_GDTH is not set
+# CONFIG_SCSI_AIC7XXX is not set
+# CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_FUTURE_DOMAIN is not set
+CONFIG_SCSI_QLOGICPTI=m
+CONFIG_SCSI_SUNESP=m
+CONFIG_SUNLANCE=m
+CONFIG_SUNBMAC=m
+CONFIG_SUNQE=m
+# CONFIG_DM9102 is not set
+# CONFIG_HAMACHI is not set
+# CONFIG_R8169 is not set
+CONFIG_ATM_FORE200E_USE_TASKLET=y
+CONFIG_ATM_FORE200E_DEBUG=0
+CONFIG_ATM_FORE200E_TX_RETRY=16
+# CONFIG_DRM_TDFX is not set
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_KEYBOARD_SUNKBD=y
+# CONFIG_INPUT_PCSPKR is not set
+CONFIG_INPUT_SPARCSPKR=m
+# CONFIG_SOUND_PRIME is not set
+# CONFIG_SND_SUN_AMD7930 is not set
+CONFIG_SND_SUN_CS4231=m
+# CONFIG_SND_SUN_DBRI is not set
+CONFIG_PARPORT_SUNBPP=m
+CONFIG_LOGO_SUN_CLUT224=y
+CONFIG_MTD_SUN_UFLASH=m
+CONFIG_MYRI_SBUS=m
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_VIDEO_ZORAN is not set
+# CONFIG_VIDEO_STRADIS is not set
+# CONFIG_IEEE1394_SBP2 is not set
+# CONFIG_USB_NET2280 is not set
+# CONFIG_DEBUG_BUGVERBOSE is not set
+# CONFIG_DEBUG_DCFLUSH is not set
+# CONFIG_DEBUG_BOOTMEM is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_LOCK_STAT is not set
+# CONFIG_LOCKDEP is not set
+# CONFIG_STACK_DEBUG is not set
+
+CONFIG_SPARSEMEM_VMEMMAP=y
+
+# CONFIG_THERMAL is not set
+
+CONFIG_FRAME_WARN=2048
+
+CONFIG_NUMA=y
+
+CONFIG_SND_SPARC=y
+
+CONFIG_HW_RANDOM_N2RNG=m
+
+# drivers/isdn/hardware/mISDN/hfcmulti.c:5255:2: error: #error "not running on big endian machines now"
+# CONFIG_MISDN_HFCMULTI is not set
+
+CONFIG_US3_MC=y
+CONFIG_SENSORS_ULTRA45=m
+CONFIG_LEDS_SUNFIRE=m
+CONFIG_TADPOLE_TS102_UCTRL=m
+
+CONFIG_RCU_FANOUT=64
+
+CONFIG_LIRC_ENE0100=m
+# CONFIG_BATTERY_DS2782 is not set
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SN9C20X_EVDEV=y
+CONFIG_LSM_MMAP_MIN_ADDR=65536
+
+CONFIG_PERF_COUNTERS=y
+CONFIG_PERF_EVENTS=y
+CONFIG_EVENT_PROFILE=y

config-x86-generic

@@ -0,0 +1,476 @@
+CONFIG_UID16=y
+# CONFIG_64BIT is not set
+# CONFIG_KERNEL_LZMA is not set
+
+#
+# Processor type and features
+#
+#
+# Enable summit and co via the generic arch
+#
+CONFIG_X86_EXTENDED_PLATFORM=y
+CONFIG_X86_32_NON_STANDARD=y
+
+# CONFIG_X86_ELAN is not set
+# CONFIG_X86_NUMAQ is not set
+# CONFIG_X86_SUMMIT is not set
+CONFIG_X86_BIGSMP=y
+# CONFIG_X86_VISWS is not set
+# CONFIG_X86_RDC321X is not set
+# CONFIG_X86_ES7000 is not set
+# CONFIG_M386 is not set
+# CONFIG_M486 is not set
+# CONFIG_M586 is not set
+# CONFIG_M586TSC is not set
+# CONFIG_M586MMX is not set
+CONFIG_M686=y
+# CONFIG_MPENTIUMII is not set
+# CONFIG_MPENTIUMIII is not set
+# CONFIG_MPENTIUMM is not set
+# CONFIG_MPENTIUM4 is not set
+# CONFIG_MK6 is not set
+# CONFIG_MK7 is not set
+# CONFIG_MK8 is not set
+# CONFIG_MCRUSOE is not set
+# CONFIG_MWINCHIPC6 is not set
+# CONFIG_MWINCHIP3D is not set
+# CONFIG_MCYRIXIII is not set
+# CONFIG_MVIAC3_2 is not set
+CONFIG_SMP=y
+CONFIG_NR_CPUS=32
+CONFIG_X86_GENERIC=y
+CONFIG_X86_CMPXCHG=y
+CONFIG_X86_L1_CACHE_SHIFT=7
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_X86_PPRO_FENCE=y
+CONFIG_X86_WP_WORKS_OK=y
+CONFIG_X86_INVLPG=y
+CONFIG_X86_BSWAP=y
+CONFIG_X86_POPAD_OK=y
+CONFIG_X86_INTEL_USERCOPY=y
+CONFIG_X86_USE_PPRO_CHECKSUM=y
+CONFIG_HPET=y
+CONFIG_HPET_TIMER=y
+# CONFIG_HPET_MMAP is not set
+CONFIG_X86_LOCAL_APIC=y
+CONFIG_X86_IO_APIC=y
+CONFIG_X86_TSC=y
+CONFIG_X86_MCE=y
+CONFIG_TOSHIBA=m
+CONFIG_I8K=m
+CONFIG_SONYPI=m
+CONFIG_SONYPI_COMPAT=y
+CONFIG_MICROCODE=m
+CONFIG_X86_MSR=y
+CONFIG_X86_CPUID=y
+# CONFIG_X86_CPU_DEBUG is not set
+CONFIG_EDD=m
+# CONFIG_EDD_OFF is not set
+# CONFIG_NUMA is not set
+
+# CONFIG_NOHIGHMEM is not set
+CONFIG_HIGHMEM4G=y
+# CONFIG_HIGHMEM64G is not set
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=n
+
+# CONFIG_MATH_EMULATION is not set
+CONFIG_MTRR=y
+CONFIG_X86_PAT=y
+CONFIG_X86_PM_TIMER=y
+
+CONFIG_EFI=y
+CONFIG_EFI_VARS=y
+CONFIG_EFI_PCDP=y
+CONFIG_FB_EFI=y
+# CONFIG_FB_N411 is not set
+
+CONFIG_DMAR=y
+CONFIG_DMAR_BROKEN_GFX_WA=y
+CONFIG_DMAR_FLOPPY_WA=y
+CONFIG_DMAR_DEFAULT_ON=y
+
+CONFIG_FB_GEODE=y
+CONFIG_FB_GEODE_LX=y
+CONFIG_FB_GEODE_GX=y
+# CONFIG_FB_GEODE_GX1 is not set
+
+# CONFIG_PCI_GOBIOS is not set
+# CONFIG_PCI_GODIRECT is not set
+# CONFIG_PCI_GOMMCONFIG is not set
+CONFIG_PCI_GOANY=y
+
+#
+# x86 specific drivers
+#
+CONFIG_PCMCIA_FDOMAIN=m
+CONFIG_SCSI_FUTURE_DOMAIN=m
+CONFIG_SCSI_ADVANSYS=m
+
+CONFIG_CC_STACKPROTECTOR=y
+
+CONFIG_SECCOMP=y
+
+CONFIG_CAPI_EICON=y
+
+CONFIG_I2O=m
+CONFIG_I2O_BLOCK=m
+CONFIG_I2O_SCSI=m
+CONFIG_I2O_PROC=m
+CONFIG_I2O_CONFIG=y
+CONFIG_I2O_EXT_ADAPTEC=y
+CONFIG_I2O_EXT_ADAPTEC_DMA64=y
+CONFIG_I2O_CONFIG_OLD_IOCTL=y
+CONFIG_I2O_BUS=m
+
+#
+# APM (Advanced Power Management) BIOS Support
+#
+CONFIG_APM=y
+# CONFIG_APM_IGNORE_USER_SUSPEND is not set
+# CONFIG_APM_DO_ENABLE is not set
+CONFIG_APM_CPU_IDLE=y
+# CONFIG_APM_DISPLAY_BLANK is not set
+# CONFIG_APM_ALLOW_INTS is not set
+
+#
+# Kernel debugging
+#
+CONFIG_X86_MPPARSE=y
+
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+# CONFIG_ACPI_ASUS is not set
+CONFIG_ACPI_PROCFS_POWER=y
+CONFIG_ACPI_SYSFS_POWER=y
+CONFIG_ACPI_BATTERY=y
+CONFIG_ACPI_BLACKLIST_YEAR=1999
+CONFIG_ACPI_BUTTON=y
+CONFIG_ACPI_CONTAINER=m
+CONFIG_ACPI_DOCK=y
+CONFIG_ACPI_FAN=y
+CONFIG_ACPI_NUMA=y
+CONFIG_ACPI_PROCESSOR=y
+CONFIG_ACPI_POWER=y
+CONFIG_ACPI_PROCFS=y
+CONFIG_ACPI_SBS=m
+CONFIG_ACPI_SLEEP=y
+CONFIG_ACPI_THERMAL=y
+CONFIG_TOPSTAR_LAPTOP=m
+CONFIG_ACPI_TOSHIBA=m
+CONFIG_ACPI_VIDEO=m
+# Disable in F9.
+CONFIG_ACPI_PROC_EVENT=y
+CONFIG_PNPACPI=y
+CONFIG_ACPI_POWER_METER=m
+CONFIG_ACPI_PROCESSOR_AGGREGATOR=m
+
+#
+# CPUFreq processor drivers
+#
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEBUG=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=m
+CONFIG_CPU_FREQ_GOV_ONDEMAND=m
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPU_FREQ_TABLE=y
+CONFIG_CPU_FREQ_STAT=m
+CONFIG_CPU_FREQ_STAT_DETAILS=y
+
+CONFIG_X86_ACPI_CPUFREQ=m
+# CONFIG_X86_POWERNOW_K6 is not set
+CONFIG_X86_POWERNOW_K7=y
+CONFIG_X86_POWERNOW_K8=m
+# CONFIG_X86_GX_SUSPMOD is not set
+# CONFIG_X86_SPEEDSTEP_CENTRINO is not set
+CONFIG_X86_SPEEDSTEP_ICH=y
+CONFIG_X86_SPEEDSTEP_SMI=y
+CONFIG_X86_SPEEDSTEP_LIB=y
+# CONFIG_X86_SPEEDSTEP_RELAXED_CAP_CHECK is not set
+CONFIG_X86_P4_CLOCKMOD=m
+CONFIG_X86_LONGRUN=y
+# CONFIG_X86_LONGHAUL is not set
+# CONFIG_X86_CPUFREQ_NFORCE2 is not set
+# e_powersaver is dangerous
+# CONFIG_X86_E_POWERSAVER is not set
+
+CONFIG_X86_HT=y
+CONFIG_X86_TRAMPOLINE=y
+
+#
+# various x86 specific drivers
+#
+CONFIG_NVRAM=y
+CONFIG_IBM_ASM=m
+CONFIG_CRYPTO_AES_586=m
+CONFIG_CRYPTO_TWOFISH_586=m
+CONFIG_CRYPTO_DEV_PADLOCK=m
+CONFIG_CRYPTO_DEV_PADLOCK_AES=m
+CONFIG_CRYPTO_DEV_PADLOCK_SHA=m
+
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_SCHED_SMT=y
+CONFIG_SUSPEND=y
+CONFIG_HIBERNATION=y
+CONFIG_PM_STD_PARTITION=""
+
+CONFIG_DEBUG_RODATA=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+# CONFIG_4KSTACKS is not set
+CONFIG_DEBUG_NMI_TIMEOUT=5
+
+CONFIG_PCI_DIRECT=y
+CONFIG_PCI_MMCONFIG=y
+CONFIG_PCI_BIOS=y
+
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_COMPAQ=m
+# CONFIG_HOTPLUG_PCI_COMPAQ_NVRAM is not set
+CONFIG_HOTPLUG_PCI_IBM=m
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+# SHPC has half-arsed PCI probing, which makes it load on too many systems
+# CONFIG_HOTPLUG_PCI_SHPC is not set
+CONFIG_PM=y
+
+CONFIG_IPW2100=m
+CONFIG_IPW2100_MONITOR=y
+CONFIG_IPW2200=m
+CONFIG_IPW2200_MONITOR=y
+CONFIG_IPW2200_RADIOTAP=y
+CONFIG_IPW2200_PROMISCUOUS=y
+CONFIG_IPW2200_QOS=y
+
+CONFIG_BLK_DEV_AMD74XX=y
+
+CONFIG_I2C_ALI1535=m
+CONFIG_I2C_ALI15X3=m
+CONFIG_I2C_ALI1563=m
+CONFIG_I2C_AMD756=m
+CONFIG_I2C_AMD756_S4882=m
+CONFIG_I2C_AMD8111=m
+CONFIG_I2C_I801=m
+CONFIG_I2C_ISCH=m
+CONFIG_I2C_NFORCE2=m
+CONFIG_I2C_NFORCE2_S4985=m
+CONFIG_I2C_PIIX4=m
+CONFIG_I2C_SIS5595=m
+CONFIG_I2C_SIS630=m
+CONFIG_I2C_SIS96X=m
+
+CONFIG_I2C_VIA=m
+CONFIG_I2C_VIAPRO=m
+CONFIG_I2C_VOODOO3=m
+
+CONFIG_SCx200_ACB=m
+
+# CONFIG_X86_REBOOTFIXUPS is not set
+
+CONFIG_DELL_RBU=m
+CONFIG_DCDBAS=m
+
+CONFIG_PC8736x_GPIO=m
+# CONFIG_NSC_GPIO is not set
+CONFIG_CS5535_GPIO=m
+
+CONFIG_EDAC=y
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_MM_EDAC=m
+CONFIG_EDAC_AMD76X=m
+CONFIG_EDAC_E7XXX=m
+CONFIG_EDAC_E752X=m
+CONFIG_EDAC_I82860=m
+CONFIG_EDAC_I82875P=m
+CONFIG_EDAC_I82975X=m
+CONFIG_EDAC_I3000=m
+CONFIG_EDAC_I5000=m
+CONFIG_EDAC_I5100=m
+CONFIG_EDAC_I5400=m
+CONFIG_EDAC_R82600=m
+CONFIG_EDAC_AMD8131=m
+CONFIG_EDAC_AMD8111=m
+
+CONFIG_SCHED_MC=y
+
+CONFIG_SND_ISA=y
+CONFIG_SND_ES18XX=m
+
+CONFIG_TCG_INFINEON=m
+
+CONFIG_HW_RANDOM_INTEL=m
+CONFIG_HW_RANDOM_AMD=m
+CONFIG_HW_RANDOM_GEODE=m
+CONFIG_HW_RANDOM_VIA=m
+
+
+# CONFIG_COMPAT_VDSO is not set
+
+# CONFIG_SGI_IOC4 is not set
+
+CONFIG_X86_PLATFORM_DEVICES=y
+CONFIG_ASUS_LAPTOP=m
+CONFIG_COMPAL_LAPTOP=m
+CONFIG_EEEPC_LAPTOP=m
+CONFIG_FUJITSU_LAPTOP=m
+# CONFIG_FUJITSU_LAPTOP_DEBUG is not set
+CONFIG_MSI_LAPTOP=m
+CONFIG_SONY_LAPTOP=m
+CONFIG_DELL_LAPTOP=m
+CONFIG_ACPI_WMI=m
+CONFIG_ACER_WMI=m
+CONFIG_TC1100_WMI=m
+CONFIG_HP_WMI=m
+CONFIG_DELL_WMI=m
+
+# CONFIG_SMSC37B787_WDT is not set
+CONFIG_W83697HF_WDT=m
+CONFIG_IB700_WDT=m
+
+CONFIG_RELOCATABLE=y
+CONFIG_PHYSICAL_ALIGN=0x400000
+CONFIG_PHYSICAL_START=0x400000
+CONFIG_CRASH_DUMP=y
+# CONFIG_KEXEC_JUMP is not set
+CONFIG_PROC_VMCORE=y
+CONFIG_CRASH=m
+
+CONFIG_CRYPTO_DEV_GEODE=m
+
+CONFIG_VIDEO_CAFE_CCIC=m
+
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=m
+CONFIG_KVM_INTEL=m
+CONFIG_KVM_AMD=m
+CONFIG_LGUEST=m
+
+CONFIG_PARAVIRT_GUEST=y
+CONFIG_PARAVIRT=y
+# CONFIG_PARAVIRT_DEBUG is not set
+
+# PARAVIRT_SPINLOCKS has a 5% perf hit
+# CONFIG_PARAVIRT_SPINLOCKS is not set
+CONFIG_KVM_CLOCK=y
+CONFIG_KVM_GUEST=y
+CONFIG_LGUEST_GUEST=y
+CONFIG_VMI=y
+
+CONFIG_XEN=y
+CONFIG_XEN_MAX_DOMAIN_MEMORY=8
+CONFIG_XEN_BALLOON=y
+CONFIG_XEN_SCRUB_PAGES=y
+CONFIG_XEN_SAVE_RESTORE=y
+CONFIG_HVC_XEN=y
+CONFIG_XEN_FBDEV_FRONTEND=m
+CONFIG_XEN_KBDDEV_FRONTEND=m
+CONFIG_XEN_BLKDEV_FRONTEND=m
+CONFIG_XEN_NETDEV_FRONTEND=m
+CONFIG_XENFS=m
+CONFIG_XEN_COMPAT_XENFS=y
+
+CONFIG_MTD_ESB2ROM=m
+CONFIG_MTD_CK804XROM=m
+CONFIG_MTD_NAND_CAFE=m
+
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_CPU_IDLE=y
+# CONFIG_CPU_IDLE_GOV_LADDER is not set
+CONFIG_CPU_IDLE_GOV_MENU=y
+
+CONFIG_THINKPAD_ACPI=m
+# CONFIG_THINKPAD_ACPI_DEBUG is not set
+# CONFIG_THINKPAD_ACPI_DEBUGFACILITIES is not set
+CONFIG_THINKPAD_ACPI_HOTKEY_POLL=y
+CONFIG_THINKPAD_ACPI_VIDEO=y
+# CONFIG_THINKPAD_ACPI_UNSAFE_LEDS is not set
+
+CONFIG_MACINTOSH_DRIVERS=y
+
+CONFIG_DMIID=y
+CONFIG_ISCSI_IBFT_FIND=y
+CONFIG_ISCSI_IBFT=m
+
+CONFIG_DMADEVICES=y
+CONFIG_INTEL_IOATDMA=m
+
+CONFIG_SENSORS_I5K_AMB=m
+
+# CONFIG_CPA_DEBUG is not set
+# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
+
+CONFIG_HP_WATCHDOG=m
+
+CONFIG_OLPC=y
+CONFIG_BATTERY_OLPC=y
+CONFIG_MOUSE_PS2_OLPC=y
+
+CONFIG_STRICT_DEVMEM=y
+
+# CONFIG_MEMTEST is not set
+# CONFIG_MAXSMP is not set
+CONFIG_MTRR_SANITIZER=y
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
+CONFIG_SYSPROF_TRACER=y
+
+# CONFIG_X86_VERBOSE_BOOTUP is not set
+# CONFIG_MMIOTRACE_TEST is not set
+
+# CONFIG_DEBUG_PER_CPU_MAPS is not set
+
+CONFIG_HP_ILO=m
+
+CONFIG_BACKLIGHT_MBP_NVIDIA=m
+
+CONFIG_OPROFILE_IBS=y
+CONFIG_MICROCODE_INTEL=y
+CONFIG_MICROCODE_AMD=y
+
+# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set
+CONFIG_X86_RESERVE_LOW_64K=y
+
+# CONFIG_CMDLINE_BOOL is not set
+
+CONFIG_PANASONIC_LAPTOP=m
+
+CONFIG_XEN_DEBUG_FS=y
+CONFIG_X86_PTRACE_BTS=y
+
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
+
+CONFIG_POWER_TRACER=y
+CONFIG_HW_BRANCH_TRACER=y
+
+# CONFIG_SPARSE_IRQ is not set
+
+CONFIG_RCU_FANOUT=32
+
+# CONFIG_IOMMU_STRESS is not set
+
+CONFIG_PERF_COUNTERS=y
+CONFIG_PERF_EVENTS=y
+CONFIG_EVENT_PROFILE=y
+
+CONFIG_X86_MCE_INTEL=y
+CONFIG_X86_MCE_AMD=y
+# CONFIG_X86_ANCIENT_MCE is not set
+# CONFIG_X86_MCE_INJECT is not set
+
+# CONFIG_X86_MRST is not set
+CONFIG_SFI=y
+
+CONFIG_INPUT_WINBOND_CIR=m
+CONFIG_I2C_SCMI=m
+CONFIG_SBC_FITPC2_WATCHDOG=m
+CONFIG_EDAC_I3200=m
+CONFIG_EDAC_DECODE_MCE=m
+
+CONFIG_GPIO_LANGWELL=y
+
+# CONFIG_INTEL_TXT is not set
+
+CONFIG_ACERHDF=m

config-x86_64-generic

@@ -0,0 +1,387 @@
+CONFIG_64BIT=y
+CONFIG_UID16=y
+# CONFIG_KERNEL_LZMA is not set
+
+# CONFIG_MK8 is not set
+# CONFIG_MPSC is not set
+CONFIG_GENERIC_CPU=y
+CONFIG_X86_EXTENDED_PLATFORM=y
+# CONFIG_X86_VSMP is not set
+# CONFIG_X86_UV is not set
+CONFIG_X86_MSR=y
+CONFIG_X86_CPUID=y
+# CONFIG_X86_CPU_DEBUG is not set
+CONFIG_MTRR=y
+CONFIG_NUMA=y
+CONFIG_K8_NUMA=y
+CONFIG_X86_64_ACPI_NUMA=y
+# CONFIG_NUMA_EMU is not set
+CONFIG_NR_CPUS=256
+CONFIG_X86_POWERNOW_K8=m
+CONFIG_X86_P4_CLOCKMOD=m
+CONFIG_IA32_EMULATION=y
+# CONFIG_IA32_AOUT is not set
+# CONFIG_IOMMU_DEBUG is not set
+CONFIG_DEBUG_RODATA=y
+CONFIG_MICROCODE=m
+CONFIG_SWIOTLB=y
+CONFIG_CALGARY_IOMMU=y
+CONFIG_CALGARY_IOMMU_ENABLED_BY_DEFAULT=y
+CONFIG_X86_PM_TIMER=y
+CONFIG_EDD=m
+# CONFIG_EDD_OFF is not set
+CONFIG_PCI_BIOS=y
+CONFIG_PCI_MMCONFIG=y
+CONFIG_DMAR=y
+CONFIG_DMAR_BROKEN_GFX_WA=y
+CONFIG_DMAR_FLOPPY_WA=y
+CONFIG_DMAR_DEFAULT_ON=y
+
+CONFIG_KEXEC_JUMP=y
+
+CONFIG_EFI=y
+CONFIG_EFI_VARS=y
+CONFIG_EFI_PCDP=y
+CONFIG_FB_EFI=y
+
+CONFIG_I2O=m
+CONFIG_I2O_BLOCK=m
+CONFIG_I2O_SCSI=m
+CONFIG_I2O_PROC=m
+CONFIG_I2O_CONFIG=y
+CONFIG_I2O_EXT_ADAPTEC=y
+CONFIG_I2O_EXT_ADAPTEC_DMA64=y
+CONFIG_I2O_CONFIG_OLD_IOCTL=y
+CONFIG_I2O_BUS=m
+
+CONFIG_SECCOMP=y
+
+CONFIG_CAPI_EICON=y
+
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_SCHED_SMT=y
+CONFIG_SUSPEND=y
+CONFIG_HIBERNATION=y
+CONFIG_PM_STD_PARTITION=""
+
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=m
+CONFIG_CPU_FREQ_GOV_ONDEMAND=m
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPU_FREQ_TABLE=y
+CONFIG_CPU_FREQ_DEBUG=y
+# CONFIG_X86_SPEEDSTEP_CENTRINO is not set
+CONFIG_X86_ACPI_CPUFREQ=m
+CONFIG_CPU_FREQ_STAT=m
+CONFIG_CPU_FREQ_STAT_DETAILS=y
+
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+# CONFIG_ACPI_ASUS is not set
+CONFIG_ACPI_PROCFS_POWER=y
+CONFIG_ACPI_SYSFS_POWER=y
+CONFIG_ACPI_BATTERY=y
+CONFIG_ACPI_BLACKLIST_YEAR=0
+CONFIG_ACPI_BUTTON=y
+CONFIG_ACPI_CONTAINER=m
+CONFIG_ACPI_DOCK=y
+CONFIG_ACPI_FAN=y
+CONFIG_ACPI_HOTPLUG_MEMORY=m
+CONFIG_ACPI_NUMA=y
+CONFIG_ACPI_PROCESSOR=y
+CONFIG_ACPI_PROCFS=y
+CONFIG_ACPI_SBS=m
+CONFIG_ACPI_SLEEP=y
+CONFIG_ACPI_THERMAL=y
+CONFIG_ACPI_TOSHIBA=m
+CONFIG_ACPI_POWER=y
+CONFIG_ACPI_VIDEO=m
+# Disable in F9.
+CONFIG_ACPI_PROC_EVENT=y
+CONFIG_ACPI_POWER_METER=m
+CONFIG_ACPI_PROCESSOR_AGGREGATOR=m
+
+CONFIG_X86_PLATFORM_DEVICES=y
+CONFIG_ASUS_LAPTOP=m
+CONFIG_COMPAL_LAPTOP=m
+CONFIG_FUJITSU_LAPTOP=m
+# CONFIG_FUJITSU_LAPTOP_DEBUG is not set
+CONFIG_MSI_LAPTOP=m
+CONFIG_SONY_LAPTOP=m
+CONFIG_SONYPI_COMPAT=y
+CONFIG_EEEPC_LAPTOP=m
+CONFIG_DELL_LAPTOP=m
+CONFIG_ACPI_WMI=m
+CONFIG_ACER_WMI=m
+CONFIG_HP_WMI=m
+CONFIG_DELL_WMI=m
+
+CONFIG_THINKPAD_ACPI=m
+# CONFIG_THINKPAD_ACPI_DEBUG is not set
+# CONFIG_THINKPAD_ACPI_DEBUGFACILITIES is not set
+CONFIG_THINKPAD_ACPI_HOTKEY_POLL=y
+CONFIG_THINKPAD_ACPI_VIDEO=y
+# CONFIG_THINKPAD_ACPI_UNSAFE_LEDS is not set
+
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_COMPAQ=m
+# CONFIG_HOTPLUG_PCI_COMPAQ_NVRAM is not set
+CONFIG_HOTPLUG_PCI_IBM=m
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+# SHPC has half-arsed PCI probing, which makes it load on too many systems
+CONFIG_HOTPLUG_PCI_SHPC=m
+
+CONFIG_HPET=y
+# CONFIG_HPET_MMAP is not set
+CONFIG_PM=y
+
+CONFIG_IPW2100=m
+CONFIG_IPW2100_MONITOR=y
+CONFIG_IPW2200=m
+CONFIG_IPW2200_MONITOR=y
+CONFIG_IPW2200_RADIOTAP=y
+CONFIG_IPW2200_PROMISCUOUS=y
+CONFIG_IPW2200_QOS=y
+
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+
+CONFIG_BLK_DEV_AMD74XX=y
+CONFIG_CRYPTO_DEV_PADLOCK=m
+CONFIG_CRYPTO_DEV_PADLOCK_AES=m
+CONFIG_CRYPTO_DEV_PADLOCK_SHA=m
+# CONFIG_CRYPTO_AES is not set
+CONFIG_CRYPTO_AES_X86_64=m
+# CONFIG_CRYPTO_TWOFISH is not set
+CONFIG_CRYPTO_TWOFISH_X86_64=m
+# CONFIG_CRYPTO_SALSA20 is not set
+CONFIG_CRYPTO_SALSA20_X86_64=m
+CONFIG_CRYPTO_AES_NI_INTEL=m
+
+CONFIG_X86_MCE=y
+CONFIG_X86_MCE_INTEL=y
+CONFIG_X86_MCE_AMD=y
+
+# CONFIG_I2C_ALI1535 is not set
+# CONFIG_I2C_ALI1563 is not set
+# CONFIG_I2C_ALI15X3 is not set
+CONFIG_I2C_AMD756=m
+CONFIG_I2C_AMD756_S4882=m
+CONFIG_I2C_AMD8111=m
+CONFIG_I2C_I801=m
+CONFIG_I2C_ISCH=m
+CONFIG_I2C_NFORCE2_S4985=m
+CONFIG_I2C_PIIX4=m
+# CONFIG_I2C_SIS5595 is not set
+# CONFIG_I2C_SIS630 is not set
+
+CONFIG_I2C_SIS96X=m
+CONFIG_I2C_VIA=m
+CONFIG_I2C_VIAPRO=m
+
+CONFIG_DELL_RBU=m
+CONFIG_DCDBAS=m
+
+CONFIG_NVRAM=y
+
+CONFIG_EDAC=y
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_MM_EDAC=m
+CONFIG_EDAC_AMD76X=m
+CONFIG_EDAC_E7XXX=m
+CONFIG_EDAC_E752X=m
+CONFIG_EDAC_I5000=m
+CONFIG_EDAC_I5100=m
+CONFIG_EDAC_I5400=m
+CONFIG_EDAC_I82875P=m
+CONFIG_EDAC_I82860=m
+CONFIG_EDAC_I82975X=m
+CONFIG_EDAC_R82600=m
+CONFIG_EDAC_AMD8131=m
+CONFIG_EDAC_AMD8111=m
+CONFIG_EDAC_AMD64=m
+# CONFIG_EDAC_AMD64_ERROR_INJECTION is not set
+CONFIG_EDAC_DECODE_MCE=m
+
+CONFIG_SCHED_MC=y
+
+CONFIG_TCG_INFINEON=m
+
+CONFIG_HW_RANDOM_INTEL=m
+CONFIG_HW_RANDOM_AMD=m
+CONFIG_HW_RANDOM_VIA=m
+
+# CONFIG_HW_RANDOM_GEODE is not set
+
+
+CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_DEBUG_NMI_TIMEOUT=5
+
+# CONFIG_PC8736x_GPIO is not set
+
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+CONFIG_SPARSEMEM_MANUAL=y
+CONFIG_SPARSEMEM=y
+CONFIG_HAVE_MEMORY_PRESENT=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTREMOVE=y
+
+# CONFIG_BLK_DEV_CMD640 is not set
+# CONFIG_BLK_DEV_RZ1000 is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_CS5535 is not set
+
+CONFIG_CC_STACKPROTECTOR=y
+
+CONFIG_SGI_IOC4=m
+CONFIG_SGI_XP=m
+CONFIG_SGI_GRU=m
+# CONFIG_SGI_GRU_DEBUG is not set
+
+# CONFIG_SMSC37B787_WDT is not set
+CONFIG_W83697HF_WDT=m
+
+# CONFIG_VIDEO_CAFE_CCIC is not set
+
+CONFIG_MTD_ESB2ROM=m
+CONFIG_MTD_CK804XROM=m
+
+CONFIG_RELOCATABLE=y
+CONFIG_MACINTOSH_DRIVERS=y
+
+CONFIG_CRASH_DUMP=y
+CONFIG_PHYSICAL_START=0x1000000
+CONFIG_PROC_VMCORE=y
+CONFIG_CRASH=m
+
+CONFIG_DMIID=y
+CONFIG_ISCSI_IBFT_FIND=y
+CONFIG_ISCSI_IBFT=m
+
+
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_CPU_IDLE=y
+# CONFIG_CPU_IDLE_GOV_LADDER is not set
+CONFIG_CPU_IDLE_GOV_MENU=y
+
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=m
+CONFIG_KVM_INTEL=m
+CONFIG_KVM_AMD=m
+
+CONFIG_PARAVIRT_GUEST=y
+CONFIG_PARAVIRT=y
+# CONFIG_PARAVIRT_DEBUG is not set
+# PARAVIRT_SPINLOCKS has a 5% perf hit
+# CONFIG_PARAVIRT_SPINLOCKS is not set
+CONFIG_KVM_CLOCK=y
+CONFIG_KVM_GUEST=y
+
+CONFIG_XEN=y
+CONFIG_XEN_MAX_DOMAIN_MEMORY=32
+CONFIG_XEN_BALLOON=y
+CONFIG_XEN_SCRUB_PAGES=y
+CONFIG_XEN_SAVE_RESTORE=y
+CONFIG_HVC_XEN=y
+CONFIG_XEN_FBDEV_FRONTEND=m
+CONFIG_XEN_KBDDEV_FRONTEND=m
+CONFIG_XEN_BLKDEV_FRONTEND=m
+CONFIG_XEN_NETDEV_FRONTEND=m
+CONFIG_XENFS=m
+CONFIG_XEN_COMPAT_XENFS=y
+CONFIG_XEN_DEV_EVTCHN=m
+CONFIG_XEN_SYS_HYPERVISOR=y
+
+CONFIG_DMADEVICES=y
+CONFIG_INTEL_IOATDMA=m
+
+CONFIG_SENSORS_I5K_AMB=m
+
+# CONFIG_COMPAT_VDSO is not set
+CONFIG_PROVIDE_OHCI1394_DMA_INIT=y
+# CONFIG_DEBUG_PER_CPU_MAPS is not set
+# CONFIG_CPA_DEBUG is not set
+
+CONFIG_HP_WATCHDOG=m
+
+CONFIG_FRAME_WARN=2048
+
+CONFIG_NODES_SHIFT=9
+CONFIG_X86_PAT=y
+# FIXME: These should be 32bit only
+# CONFIG_FB_N411 is not set
+CONFIG_STRICT_DEVMEM=y
+
+CONFIG_DIRECT_GBPAGES=y
+
+# CONFIG_MEMTEST is not set
+CONFIG_AMD_IOMMU=y
+CONFIG_AMD_IOMMU_STATS=y
+# CONFIG_MAXSMP is not set
+CONFIG_MTRR_SANITIZER=y
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
+CONFIG_SYSPROF_TRACER=y
+# CONFIG_X86_VERBOSE_BOOTUP is not set
+# CONFIG_MMIOTRACE_TEST is not set
+
+CONFIG_X86_MPPARSE=y
+
+CONFIG_BACKLIGHT_MBP_NVIDIA=m
+
+CONFIG_OPROFILE_IBS=y
+CONFIG_MICROCODE_INTEL=y
+CONFIG_MICROCODE_AMD=y
+
+# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set
+CONFIG_X86_RESERVE_LOW_64K=y
+
+# CONFIG_CMDLINE_BOOL is not set
+
+CONFIG_PANASONIC_LAPTOP=m
+
+CONFIG_XEN_DEBUG_FS=y
+CONFIG_X86_PTRACE_BTS=y
+
+CONFIG_I7300_IDLE=m
+CONFIG_INTR_REMAP=y
+
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
+
+CONFIG_POWER_TRACER=y
+CONFIG_HW_BRANCH_TRACER=y
+
+CONFIG_X86_X2APIC=y
+CONFIG_SPARSE_IRQ=y
+
+CONFIG_RCU_FANOUT=64
+
+# CONFIG_IOMMU_STRESS is not set
+
+CONFIG_PERF_COUNTERS=y
+CONFIG_PERF_EVENTS=y
+CONFIG_EVENT_PROFILE=y
+
+# CONFIG_X86_MCE_INJECT is not set
+
+CONFIG_SFI=y
+CONFIG_INPUT_WINBOND_CIR=m
+CONFIG_I2C_SCMI=m
+CONFIG_SBC_FITPC2_WATCHDOG=m
+CONFIG_EDAC_I3200=m
+CONFIG_TOPSTAR_LAPTOP=m
+# CONFIG_INTEL_TXT is not set
+CONFIG_GPIO_LANGWELL=y
+
+CONFIG_FUNCTION_GRAPH_TRACER=y
+
+CONFIG_ACERHDF=m

crypto-add-async-hash-testing.patch

@@ -0,0 +1,111 @@
+From e45009229be6a7fae49bdfa3459905668c0b0fb1 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 19 May 2010 14:12:03 +1000
+Subject: crypto: testmgr - Add testing for async hashing and update/final
+
+Extend testmgr such that it tests async hash algorithms,
+and that for both sync and async hashes it tests both
+->digest() and ->update()/->final() sequences.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/testmgr.c |   66 +++++++++++++++++++++++++++++++++++++++--------------
+ 1 files changed, 48 insertions(+), 18 deletions(-)
+
+diff --git a/crypto/testmgr.c b/crypto/testmgr.c
+index c494d76..5c8aaa0 100644
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -153,8 +153,21 @@ static void testmgr_free_buf(char *buf[XBUFSIZE])
+ 		free_page((unsigned long)buf[i]);
+ }
+ 
++static int do_one_async_hash_op(struct ahash_request *req,
++				struct tcrypt_result *tr,
++				int ret)
++{
++	if (ret == -EINPROGRESS || ret == -EBUSY) {
++		ret = wait_for_completion_interruptible(&tr->completion);
++		if (!ret)
++			ret = tr->err;
++		INIT_COMPLETION(tr->completion);
++	}
++	return ret;
++}
++
+ static int test_hash(struct crypto_ahash *tfm, struct hash_testvec *template,
+-		     unsigned int tcount)
++		     unsigned int tcount, bool use_digest)
+ {
+ 	const char *algo = crypto_tfm_alg_driver_name(crypto_ahash_tfm(tfm));
+ 	unsigned int i, j, k, temp;
+@@ -206,23 +219,36 @@ static int test_hash(struct crypto_ahash *tfm, struct hash_testvec *template,
+ 		}
+ 
+ 		ahash_request_set_crypt(req, sg, result, template[i].psize);
+-		ret = crypto_ahash_digest(req);
+-		switch (ret) {
+-		case 0:
+-			break;
+-		case -EINPROGRESS:
+-		case -EBUSY:
+-			ret = wait_for_completion_interruptible(
+-				&tresult.completion);
+-			if (!ret && !(ret = tresult.err)) {
+-				INIT_COMPLETION(tresult.completion);
+-				break;
++		if (use_digest) {
++			ret = do_one_async_hash_op(req, &tresult,
++						   crypto_ahash_digest(req));
++			if (ret) {
++				pr_err("alg: hash: digest failed on test %d "
++				       "for %s: ret=%d\n", j, algo, -ret);
++				goto out;
++			}
++		} else {
++			ret = do_one_async_hash_op(req, &tresult,
++						   crypto_ahash_init(req));
++			if (ret) {
++				pr_err("alt: hash: init failed on test %d "
++				       "for %s: ret=%d\n", j, algo, -ret);
++				goto out;
++			}
++			ret = do_one_async_hash_op(req, &tresult,
++						   crypto_ahash_update(req));
++			if (ret) {
++				pr_err("alt: hash: update failed on test %d "
++				       "for %s: ret=%d\n", j, algo, -ret);
++				goto out;
++			}
++			ret = do_one_async_hash_op(req, &tresult,
++						   crypto_ahash_final(req));
++			if (ret) {
++				pr_err("alt: hash: final failed on test %d "
++				       "for %s: ret=%d\n", j, algo, -ret);
++				goto out;
+ 			}
+-			/* fall through */
+-		default:
+-			printk(KERN_ERR "alg: hash: digest failed on test %d "
+-			       "for %s: ret=%d\n", j, algo, -ret);
+-			goto out;
+ 		}
+ 
+ 		if (memcmp(result, template[i].digest,
+@@ -1402,7 +1428,11 @@ static int alg_test_hash(const struct alg_test_desc *desc, const char *driver,
+ 		return PTR_ERR(tfm);
+ 	}
+ 
+-	err = test_hash(tfm, desc->suite.hash.vecs, desc->suite.hash.count);
++	err = test_hash(tfm, desc->suite.hash.vecs,
++			desc->suite.hash.count, true);
++	if (!err)
++		err = test_hash(tfm, desc->suite.hash.vecs,
++				desc->suite.hash.count, false);
+ 
+ 	crypto_free_ahash(tfm);
+ 	return err;
+-- 
+1.7.0.1
+

die-floppy-die.patch

@@ -0,0 +1,18 @@
+Kill the floppy.ko pnp modalias. We were surviving just fine without
+autoloading floppy drivers, tyvm.
+
+Please feel free to register all complaints in the wastepaper bin.
+
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 91b7530..2ea84a6 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4631,7 +4631,7 @@ static const struct pnp_device_id floppy_pnpids[] = {
+ 	{ "PNP0700", 0 },
+ 	{ }
+ };
+-MODULE_DEVICE_TABLE(pnp, floppy_pnpids);
++/* MODULE_DEVICE_TABLE(pnp, floppy_pnpids); */
+ 
+ #else
+ 

drm-i915-resume-force-mode.patch

@@ -0,0 +1,50 @@
+http://lists.freedesktop.org/archives/intel-gfx/2009-February/001313.html
+
+--- a/drivers/gpu/drm/i915/i915_suspend.c.orig	2009-02-18 22:59:19.000000000 -0500
++++ b/drivers/gpu/drm/i915/i915_suspend.c	2009-02-18 22:59:58.000000000 -0500
+@@ -28,6 +28,7 @@
+ #include "drm.h"
+ #include "i915_drm.h"
+ #include "i915_drv.h"
++#include <drm/drm_crtc_helper.h>
+ 
+ static bool i915_pipe_enabled(struct drm_device *dev, enum pipe pipe)
+ {
+@@ -519,6 +520,8 @@
+ 
+ 	i915_restore_vga(dev);
+ 
++	drm_helper_resume_force_mode(dev);
++
+ 	return 0;
+ }
+ 
+From f5192bce8be69e5b33d7579bc282fef4d673e2c1 Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Sun, 15 Mar 2009 13:55:55 +0100
+Subject: [PATCH] Fix i915 nomodeset NULL deref. during PM resume
+
+drm_helper_resume_force_mode() would crash while attempting to
+iterate through crtc_list, which is uninitialized when is modesetting
+disabled.
+---
+ drivers/gpu/drm/i915/i915_suspend.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
+index ef5fb6e..b138032 100644
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -520,7 +520,8 @@ int i915_restore_state(struct drm_device *dev)
+ 
+ 	i915_restore_vga(dev);
+ 
+-	drm_helper_resume_force_mode(dev);
++	if (drm_core_check_feature(dev, DRIVER_MODESET))
++		drm_helper_resume_force_mode(dev);
+ 
+ 	return 0;
+ }
+-- 
+1.6.2
+

drm-i915-sanity-check-pread-pwrite.patch

@@ -0,0 +1,90 @@
+From ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Sun, 26 Sep 2010 20:50:05 +0100
+Subject: drm/i915: Sanity check pread/pwrite
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4 upstream.
+
+Move the access control up from the fast paths, which are no longer
+universally taken first, up into the caller. This then duplicates some
+sanity checking along the slow paths, but is much simpler.
+Tracked as CVE-2010-2962.
+
+Reported-by: Kees Cook <kees@ubuntu.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Backported-by: Chuck Ebbert <cebbert@redhat.com> 2.6.32
+
+---
+ drivers/gpu/drm/i915/i915_gem.c |   28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -465,8 +465,15 @@ i915_gem_pread_ioctl(struct drm_device *
+ 	 */
+ 	if (args->offset > obj->size || args->size > obj->size ||
+ 	    args->offset + args->size > obj->size) {
+-		drm_gem_object_unreference(obj);
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto err;
++	}
++
++	if (!access_ok(VERIFY_WRITE,
++		       (char __user *)(uintptr_t)args->data_ptr,
++		       args->size)) {
++		ret = -EFAULT;
++		goto err;
+ 	}
+ 
+ 	if (i915_gem_object_needs_bit17_swizzle(obj)) {
+@@ -478,8 +485,8 @@ i915_gem_pread_ioctl(struct drm_device *
+ 							file_priv);
+ 	}
+ 
++err:
+ 	drm_gem_object_unreference(obj);
+-
+ 	return ret;
+ }
+ 
+@@ -568,8 +575,6 @@ i915_gem_gtt_pwrite_fast(struct drm_devi
+ 
+ 	user_data = (char __user *) (uintptr_t) args->data_ptr;
+ 	remain = args->size;
+-	if (!access_ok(VERIFY_READ, user_data, remain))
+-		return -EFAULT;
+ 
+ 
+ 	mutex_lock(&dev->struct_mutex);
+@@ -928,8 +933,15 @@ i915_gem_pwrite_ioctl(struct drm_device
+ 	 */
+ 	if (args->offset > obj->size || args->size > obj->size ||
+ 	    args->offset + args->size > obj->size) {
+-		drm_gem_object_unreference(obj);
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto err;
++	}
++
++	if (!access_ok(VERIFY_READ,
++		       (char __user *)(uintptr_t)args->data_ptr,
++		       args->size)) {
++		ret = -EFAULT;
++		goto err;
+ 	}
+ 
+ 	/* We can only do the GTT pwrite on untiled buffers, as otherwise
+@@ -963,8 +975,8 @@ i915_gem_pwrite_ioctl(struct drm_device
+ 		DRM_INFO("pwrite failed %d\n", ret);
+ #endif
+ 
++err:
+ 	drm_gem_object_unreference(obj);
+-
+ 	return ret;
+ }
+ 

drm-intel-945gm-stability-fixes.patch

@@ -0,0 +1,117 @@
+upstream commit 944001201ca0196bcdb088129e5866a9f379d08c
+(plus some defines)
+[2.6.32 backport]
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 0d05c6f..b87f65d 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -4967,6 +4967,16 @@ i915_gem_load(struct drm_device *dev)
+ 	list_add(&dev_priv->mm.shrink_list, &shrink_list);
+ 	spin_unlock(&shrink_list_lock);
+ 
++	/* On GEN3 we really need to make sure the ARB C3 LP bit is set */
++	if (IS_GEN3(dev)) {
++		u32 tmp = I915_READ(MI_ARB_STATE);
++		if (!(tmp & MI_ARB_C3_LP_WRITE_ENABLE)) {
++			/* arb state is a masked write, so set bit + bit in mask */
++			tmp = MI_ARB_C3_LP_WRITE_ENABLE | (MI_ARB_C3_LP_WRITE_ENABLE << MI_ARB_MASK_SHIFT);
++			I915_WRITE(MI_ARB_STATE, tmp);
++		}
++	}
++
+ 	/* Old X drivers will take 0-2 for front, back, depth buffers */
+ 	dev_priv->fence_reg_start = 3;
+ 
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 4cbc521..4543975 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -357,6 +357,70 @@
+ #define LM_BURST_LENGTH     0x00000700
+ #define LM_FIFO_WATERMARK   0x0000001F
+ #define MI_ARB_STATE	0x020e4 /* 915+ only */
++#define   MI_ARB_MASK_SHIFT	  16	/* shift for enable bits */
++
++/* Make render/texture TLB fetches lower priorty than associated data
++ *   fetches. This is not turned on by default
++ */
++#define   MI_ARB_RENDER_TLB_LOW_PRIORITY	(1 << 15)
++
++/* Isoch request wait on GTT enable (Display A/B/C streams).
++ * Make isoch requests stall on the TLB update. May cause
++ * display underruns (test mode only)
++ */
++#define   MI_ARB_ISOCH_WAIT_GTT			(1 << 14)
++
++/* Block grant count for isoch requests when block count is
++ * set to a finite value.
++ */
++#define   MI_ARB_BLOCK_GRANT_MASK		(3 << 12)
++#define   MI_ARB_BLOCK_GRANT_8			(0 << 12)	/* for 3 display planes */
++#define   MI_ARB_BLOCK_GRANT_4			(1 << 12)	/* for 2 display planes */
++#define   MI_ARB_BLOCK_GRANT_2			(2 << 12)	/* for 1 display plane */
++#define   MI_ARB_BLOCK_GRANT_0			(3 << 12)	/* don't use */
++
++/* Enable render writes to complete in C2/C3/C4 power states.
++ * If this isn't enabled, render writes are prevented in low
++ * power states. That seems bad to me.
++ */
++#define   MI_ARB_C3_LP_WRITE_ENABLE		(1 << 11)
++
++/* This acknowledges an async flip immediately instead
++ * of waiting for 2TLB fetches.
++ */
++#define   MI_ARB_ASYNC_FLIP_ACK_IMMEDIATE	(1 << 10)
++
++/* Enables non-sequential data reads through arbiter
++ */
++#define   MI_ARB_DUAL_DATA_PHASE_DISABLE       	(1 << 9)
++
++/* Disable FSB snooping of cacheable write cycles from binner/render
++ * command stream
++ */
++#define   MI_ARB_CACHE_SNOOP_DISABLE		(1 << 8)
++
++/* Arbiter time slice for non-isoch streams */
++#define   MI_ARB_TIME_SLICE_MASK		(7 << 5)
++#define   MI_ARB_TIME_SLICE_1			(0 << 5)
++#define   MI_ARB_TIME_SLICE_2			(1 << 5)
++#define   MI_ARB_TIME_SLICE_4			(2 << 5)
++#define   MI_ARB_TIME_SLICE_6			(3 << 5)
++#define   MI_ARB_TIME_SLICE_8			(4 << 5)
++#define   MI_ARB_TIME_SLICE_10			(5 << 5)
++#define   MI_ARB_TIME_SLICE_14			(6 << 5)
++#define   MI_ARB_TIME_SLICE_16			(7 << 5)
++
++/* Low priority grace period page size */
++#define   MI_ARB_LOW_PRIORITY_GRACE_4KB		(0 << 4)	/* default */
++#define   MI_ARB_LOW_PRIORITY_GRACE_8KB		(1 << 4)
++
++/* Disable display A/B trickle feed */
++#define   MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE	(1 << 2)
++
++/* Set display plane priority */
++#define   MI_ARB_DISPLAY_PRIORITY_A_B		(0 << 0)	/* display A > display B */
++#define   MI_ARB_DISPLAY_PRIORITY_B_A		(1 << 0)	/* display B > display A */
++
+ #define CACHE_MODE_0	0x02120 /* 915+ only */
+ #define   CM0_MASK_SHIFT          16
+ #define   CM0_IZ_OPT_DISABLE      (1<<6)
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1045,6 +1045,13 @@ extern int i915_wait_ring(struct drm_dev
+ #define IS_I9XX(dev)		(INTEL_INFO(dev)->is_i9xx)
+ #define IS_MOBILE(dev)		(INTEL_INFO(dev)->is_mobile)
+ 
++#define IS_GEN3(dev)	(IS_I915G(dev) ||			\
++			 IS_I915GM(dev) ||			\
++			 IS_I945G(dev) ||			\
++			 IS_I945GM(dev) ||			\
++			 IS_G33(dev) || \
++			 IS_PINEVIEW(dev))
++
+ #define I915_NEED_GFX_HWS(dev)	(INTEL_INFO(dev)->need_gfx_hws)
+ 
+ /* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
+-- 

drm-intel-acpi-populate-didl.patch

@@ -0,0 +1,70 @@
+diff -up linux-2.6.33.noarch/drivers/gpu/drm/i915/i915_opregion.c.orig linux-2.6.33.noarch/drivers/gpu/drm/i915/i915_opregion.c
+--- linux-2.6.33.noarch/drivers/gpu/drm/i915/i915_opregion.c.orig	2010-02-24 13:52:17.000000000 -0500
++++ linux-2.6.33.noarch/drivers/gpu/drm/i915/i915_opregion.c	2010-04-01 10:35:35.249121262 -0400
+@@ -382,8 +382,54 @@ static void intel_didl_outputs(struct dr
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	struct intel_opregion *opregion = &dev_priv->opregion;
+ 	struct drm_connector *connector;
++	acpi_handle handle;
++	struct acpi_device *acpi_dev, *acpi_cdev, *acpi_video_bus = NULL;
++	unsigned long long device_id;
++	acpi_status status;
+ 	int i = 0;
+ 
++	handle = DEVICE_ACPI_HANDLE(&dev->pdev->dev);
++	if (!handle || ACPI_FAILURE(acpi_bus_get_device(handle, &acpi_dev)))
++		return;
++
++	if (acpi_is_video_device(acpi_dev))
++		acpi_video_bus = acpi_dev;
++	else {
++		list_for_each_entry(acpi_cdev, &acpi_dev->children, node) {
++			if (acpi_is_video_device(acpi_cdev)) {
++				acpi_video_bus = acpi_cdev;
++				break;
++			}
++		}
++	}
++
++	if (!acpi_video_bus)
++		goto blind_set;
++
++	list_for_each_entry(acpi_cdev, &acpi_video_bus->children, node) {
++		if (i >= 8) {
++			dev_printk (KERN_ERR, &dev->pdev->dev,
++				    "More than 8 outputs detected\n");
++			return;
++		}
++		status = acpi_evaluate_integer(acpi_cdev->handle, "_ADR",
++					       NULL, &device_id);
++		if (ACPI_SUCCESS(status)) {
++			if (!device_id)
++				goto blind_set;
++			opregion->acpi->didl[i] = (u32)(device_id & 0x0f0f);
++			i++;
++		}
++	}
++
++end:
++	/* If fewer than 8 outputs, the list must be null terminated */
++	if (i < 8)
++		opregion->acpi->didl[i] = 0;
++	return;
++
++blind_set:
++	i = 0;
+ 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ 		int output_type = ACPI_OTHER_OUTPUT;
+ 		if (i >= 8) {
+@@ -416,10 +462,7 @@ static void intel_didl_outputs(struct dr
+ 		opregion->acpi->didl[i] |= (1<<31) | output_type | i;
+ 		i++;
+ 	}
+-
+-	/* If fewer than 8 outputs, the list must be null terminated */
+-	if (i < 8)
+-		opregion->acpi->didl[i] = 0;
++	goto end;
+ }
+ 
+ int intel_opregion_init(struct drm_device *dev, int resume)

drm-intel-big-hammer.patch

@@ -0,0 +1,16 @@
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 37427e4..08af9db 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2553,6 +2553,11 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
+ 
+ 	mutex_lock(&dev->struct_mutex);
+ 
++	/* We don't get the flushing right for these chipsets, use the
++	 * big hamer for now to avoid random crashiness. */
++	if (IS_I855(dev) || IS_I865G(dev))
++		wbinvd();
++
+ 	i915_verify_inactive(dev, __FILE__, __LINE__);
+ 
+ 	if (dev_priv->mm.wedged) {

drm-intel-make-lvds-work.patch

@@ -0,0 +1,19 @@
+diff -up linux-2.6.33.noarch/drivers/gpu/drm/i915/intel_display.c.old linux-2.6.33.noarch/drivers/gpu/drm/i915/intel_display.c
+--- linux-2.6.33.noarch/drivers/gpu/drm/i915/intel_display.c.old	2010-03-31 15:51:11.798876290 -0400
++++ linux-2.6.33.noarch/drivers/gpu/drm/i915/intel_display.c	2010-03-31 16:01:18.342747791 -0400
+@@ -3742,7 +3742,6 @@ struct drm_crtc *intel_get_load_detect_p
+ void intel_release_load_detect_pipe(struct intel_output *intel_output, int dpms_mode)
+ {
+ 	struct drm_encoder *encoder = &intel_output->enc;
+-	struct drm_device *dev = encoder->dev;
+ 	struct drm_crtc *crtc = encoder->crtc;
+ 	struct drm_encoder_helper_funcs *encoder_funcs = encoder->helper_private;
+ 	struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+@@ -3752,7 +3751,6 @@ void intel_release_load_detect_pipe(stru
+ 		intel_output->base.encoder = NULL;
+ 		intel_output->load_detect_temp = false;
+ 		crtc->enabled = drm_helper_crtc_in_use(crtc);
+-		drm_helper_disable_unused_functions(dev);
+ 	}
+ 
+ 	/* Switch crtc and output back off if necessary */

drm-intel-next.patch

@@ -0,0 +1 @@
+empty

drm-intel-no-tv-hotplug.patch

@@ -0,0 +1,11 @@
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_reg.h.jx linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_reg.h
+--- linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_reg.h.jx	2009-09-16 13:36:20.000000000 -0400
++++ linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_reg.h	2009-09-16 13:40:32.000000000 -0400
+@@ -836,7 +836,6 @@
+ 			 HDMID_HOTPLUG_INT_EN |	  \
+ 			 SDVOB_HOTPLUG_INT_EN |	  \
+ 			 SDVOC_HOTPLUG_INT_EN |	  \
+-			 TV_HOTPLUG_INT_EN |	  \
+ 			 CRT_HOTPLUG_INT_EN)
+ 
+ 

drm-nouveau-d620.patch

@@ -0,0 +1,121 @@
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
+index 6b6c303..a81c738 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
+@@ -3198,7 +3198,6 @@ static int run_lvds_table(struct drm_device *dev, struct dcb_entry *dcbent, int
+ 	struct nvbios *bios = &dev_priv->vbios;
+ 	unsigned int outputset = (dcbent->or == 4) ? 1 : 0;
+ 	uint16_t scriptptr = 0, clktable;
+-	uint8_t clktableptr = 0;
+ 
+ 	/*
+ 	 * For now we assume version 3.0 table - g80 support will need some
+@@ -3217,26 +3216,29 @@ static int run_lvds_table(struct drm_device *dev, struct dcb_entry *dcbent, int
+ 		scriptptr = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 11 + outputset * 2]);
+ 		break;
+ 	case LVDS_RESET:
++		clktable = bios->fp.lvdsmanufacturerpointer + 15;
++		if (dcbent->or == 4)
++			clktable += 8;
++
+ 		if (dcbent->lvdsconf.use_straps_for_mode) {
+ 			if (bios->fp.dual_link)
+-				clktableptr += 2;
+-			if (bios->fp.BITbit1)
+-				clktableptr++;
++				clktable += 4;
++			if (bios->fp.if_is_24bit)
++				clktable += 2;
+ 		} else {
+ 			/* using EDID */
+-			uint8_t fallback = bios->data[bios->fp.lvdsmanufacturerpointer + 4];
+-			int fallbackcmpval = (dcbent->or == 4) ? 4 : 1;
++			int cmpval_24bit = (dcbent->or == 4) ? 4 : 1;
+ 
+ 			if (bios->fp.dual_link) {
+-				clktableptr += 2;
+-				fallbackcmpval *= 2;
++				clktable += 4;
++				cmpval_24bit <<= 1;
+ 			}
+-			if (fallbackcmpval & fallback)
+-				clktableptr++;
++
++			if (bios->fp.strapless_is_24bit & cmpval_24bit)
++				clktable += 2;
+ 		}
+ 
+-		/* adding outputset * 8 may not be correct */
+-		clktable = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 15 + clktableptr * 2 + outputset * 8]);
++		clktable = ROM16(bios->data[clktable]);
+ 		if (!clktable) {
+ 			NV_ERROR(dev, "Pixel clock comparison table not found\n");
+ 			return -ENOENT;
+@@ -3638,37 +3640,40 @@ int nouveau_bios_parse_lvds_table(struct drm_device *dev, int pxclk, bool *dl, b
+ 		*if_is_24bit = bios->data[lvdsofs] & 16;
+ 		break;
+ 	case 0x30:
+-		/*
+-		 * My money would be on there being a 24 bit interface bit in
+-		 * this table, but I have no example of a laptop bios with a
+-		 * 24 bit panel to confirm that. Hence we shout loudly if any
+-		 * bit other than bit 0 is set (I've not even seen bit 1)
+-		 */
+-		if (bios->data[lvdsofs] > 1)
+-			NV_ERROR(dev,
+-				 "You have a very unusual laptop display; please report it\n");
++	case 0x40:
+ 		/*
+ 		 * No sign of the "power off for reset" or "reset for panel
+ 		 * on" bits, but it's safer to assume we should
+ 		 */
+ 		bios->fp.power_off_for_reset = true;
+ 		bios->fp.reset_after_pclk_change = true;
++
+ 		/*
+ 		 * It's ok lvdsofs is wrong for nv4x edid case; dual_link is
+-		 * over-written, and BITbit1 isn't used
++		 * over-written, and if_is_24bit isn't used
+ 		 */
+ 		bios->fp.dual_link = bios->data[lvdsofs] & 1;
+-		bios->fp.BITbit1 = bios->data[lvdsofs] & 2;
+-		bios->fp.duallink_transition_clk = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 5]) * 10;
+-		break;
+-	case 0x40:
+-		bios->fp.dual_link = bios->data[lvdsofs] & 1;
+ 		bios->fp.if_is_24bit = bios->data[lvdsofs] & 2;
+ 		bios->fp.strapless_is_24bit = bios->data[bios->fp.lvdsmanufacturerpointer + 4];
+ 		bios->fp.duallink_transition_clk = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 5]) * 10;
+ 		break;
+ 	}
+ 
++	/* Dell Latitude D620 reports a too-high value for the dual-link
++	 * transition freq, causing us to program the panel incorrectly.
++	 *
++	 * It doesn't appear the VBIOS actually uses its transition freq
++	 * (90000kHz), instead it uses the "Number of LVDS channels" field
++	 * out of the panel ID structure (http://www.spwg.org/).
++	 *
++	 * For the moment, a quirk will do :)
++	 */
++	if ((dev->pdev->device == 0x01d7) &&
++	    (dev->pdev->subsystem_vendor == 0x1028) &&
++	    (dev->pdev->subsystem_device == 0x01c2)) {
++		bios->fp.duallink_transition_clk = 80000;
++	}
++
+ 	/* set dual_link flag for EDID case */
+ 	if (pxclk && (chip_version < 0x25 || chip_version > 0x28))
+ 		bios->fp.dual_link = (pxclk >= bios->fp.duallink_transition_clk);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.h b/drivers/gpu/drm/nouveau/nouveau_bios.h
+index 4f88e69..fd6274a 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bios.h
++++ b/drivers/gpu/drm/nouveau/nouveau_bios.h
+@@ -267,7 +267,6 @@ struct nvbios {
+ 		bool reset_after_pclk_change;
+ 		bool dual_link;
+ 		bool link_c_increment;
+-		bool BITbit1;
+ 		bool if_is_24bit;
+ 		int duallink_transition_clk;
+ 		uint8_t strapless_is_24bit;

drm-nouveau-kconfig.patch

@@ -0,0 +1,11 @@
+--- a/drivers/staging/Kconfig	2010-01-12 13:37:11.000000000 +1000
++++ b/drivers/staging/Kconfig	2010-01-12 13:37:24.000000000 +1000
+@@ -103,6 +103,8 @@
+ 
+ source "drivers/staging/line6/Kconfig"
+ 
++source "drivers/gpu/drm/nouveau/Kconfig"
++
+ source "drivers/staging/octeon/Kconfig"
+ 
+ source "drivers/staging/serqt_usb2/Kconfig"

drm-nouveau-mutex.patch

@@ -0,0 +1,56 @@
+From 967c89306de560a6da9539d24a0d63cb036d58ed Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 16 Feb 2010 11:14:14 +1000
+Subject: [PATCH] drm/nouveau: use mutex for vbios lock
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+---
+ drivers/gpu/drm/nouveau/nouveau_bios.c |    7 +++----
+ drivers/gpu/drm/nouveau/nouveau_bios.h |    2 +-
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
+index 2cd0fad..0e9cd1d 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
+@@ -5861,13 +5861,12 @@ nouveau_bios_run_init_table(struct drm_device *dev, uint16_t table,
+ 	struct drm_nouveau_private *dev_priv = dev->dev_private;
+ 	struct nvbios *bios = &dev_priv->VBIOS;
+ 	struct init_exec iexec = { true, false };
+-	unsigned long flags;
+ 
+-	spin_lock_irqsave(&bios->lock, flags);
++	mutex_lock(&bios->lock);
+ 	bios->display.output = dcbent;
+ 	parse_init_table(bios, table, &iexec);
+ 	bios->display.output = NULL;
+-	spin_unlock_irqrestore(&bios->lock, flags);
++	mutex_unlock(&bios->lock);
+ }
+ 
+ static bool NVInitVBIOS(struct drm_device *dev)
+@@ -5876,7 +5875,7 @@ static bool NVInitVBIOS(struct drm_device *dev)
+ 	struct nvbios *bios = &dev_priv->VBIOS;
+ 
+ 	memset(bios, 0, sizeof(struct nvbios));
+-	spin_lock_init(&bios->lock);
++	mutex_init(&bios->lock);
+ 	bios->dev = dev;
+ 
+ 	if (!NVShadowVBIOS(dev, bios->data))
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.h b/drivers/gpu/drm/nouveau/nouveau_bios.h
+index 68446fd..fd94bd6 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bios.h
++++ b/drivers/gpu/drm/nouveau/nouveau_bios.h
+@@ -205,7 +205,7 @@ struct nvbios {
+ 	struct drm_device *dev;
+ 	struct nouveau_bios_info pub;
+ 
+-	spinlock_t lock;
++	struct mutex lock;
+ 
+ 	uint8_t data[NV_PROM_SIZE];
+ 	unsigned int length;
+-- 
+1.6.6.1
+

drm-nouveau-nva3-noaccel.patch

@@ -0,0 +1,105 @@
+From 030e105efc9a29c7d34fb59fb0e0a40e54178299 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Wed, 30 Jun 2010 13:34:05 +1000
+Subject: [PATCH] drm/nouveau: disable acceleration on NVA3/NVA5/NVA8 by default
+
+There's an GPU lockup problem for which the cause is currently unknown
+on these chipsets.
+
+Until it's resolved, it's better to leave the user with a working system
+without acceleration than to have random lockups.
+
+With this patch, acceleration will be off by default if a known problem
+chipset is detected, but can be re-enabled with nouveau.noaccel=0 on
+the kernel commandline.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+
+[ cebbert@redhat.com : Backport to F12 and fix some module parameter descriptions. ]
+---
+
+--- a/drivers/gpu/drm/nouveau/nouveau_drv.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drv.c
+@@ -75,11 +75,11 @@ int nouveau_ignorelid = 0;
+ int nouveau_ignorelid = 0;
+ module_param_named(ignorelid, nouveau_ignorelid, int, 0400);
+ 
+-MODULE_PARM_DESC(noagp, "Disable all acceleration");
++MODULE_PARM_DESC(noaccel, "Disable all acceleration");
+-int nouveau_noaccel = 0;
++int nouveau_noaccel = -1;
+ module_param_named(noaccel, nouveau_noaccel, int, 0400);
+ 
+-MODULE_PARM_DESC(noagp, "Disable fbcon acceleration");
++MODULE_PARM_DESC(nofbaccel, "Disable fbcon acceleration");
+ int nouveau_nofbaccel = 0;
+ module_param_named(nofbaccel, nouveau_nofbaccel, int, 0400);
+ 
+--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
++++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
+@@ -493,6 +493,7 @@ enum nouveau_card_type {
+ 
+ struct drm_nouveau_private {
+ 	struct drm_device *dev;
++	bool noaccel;
+ 	enum {
+ 		NOUVEAU_CARD_INIT_DOWN,
+ 		NOUVEAU_CARD_INIT_DONE,
+--- a/drivers/gpu/drm/nouveau/nouveau_state.c
++++ b/drivers/gpu/drm/nouveau/nouveau_state.c
+@@ -435,7 +435,7 @@ nouveau_card_init(struct drm_device *dev)
+ 	if (ret)
+ 		goto out_timer;
+ 
+-	if (nouveau_noaccel)
++	if (dev_priv->noaccel)
+ 		engine->graph.accel_blocked = true;
+ 	else {
+ 		/* PGRAPH */
+@@ -491,10 +491,10 @@ out_display:
+ out_irq:
+ 	drm_irq_uninstall(dev);
+ out_fifo:
+-	if (!nouveau_noaccel)
++	if (!dev_priv->noaccel)
+ 		engine->fifo.takedown(dev);
+ out_graph:
+-	if (!nouveau_noaccel)
++	if (!dev_priv->noaccel)
+ 		engine->graph.takedown(dev);
+ out_fb:
+ 	engine->fb.takedown(dev);
+@@ -532,7 +532,7 @@ static void nouveau_card_takedown(struct drm_device *dev)
+ 			dev_priv->channel = NULL;
+ 		}
+ 
+-		if (!nouveau_noaccel) {
++		if (!dev_priv->noaccel) {
+ 			engine->fifo.takedown(dev);
+ 			engine->graph.takedown(dev);
+ 		}
+@@ -691,6 +691,21 @@ int nouveau_load(struct drm_device *dev, unsigned long flags)
+ 	NV_INFO(dev, "Detected an NV%2x generation card (0x%08x)\n",
+ 		dev_priv->card_type, reg0);
+ 
++	if (nouveau_noaccel == -1) {
++		switch (dev_priv->chipset) {
++		case 0xa3:
++		case 0xa5:
++		case 0xa8:
++			dev_priv->noaccel = true;
++			break;
++		default:
++			dev_priv->noaccel = false;
++			break;
++		}
++	} else {
++		dev_priv->noaccel = (nouveau_noaccel != 0);
++	}
++
+ 	/* map larger RAMIN aperture on NV40 cards */
+ 	dev_priv->ramin  = NULL;
+ 	if (dev_priv->card_type >= NV_40) {
+-- 
+1.7.2
+

drm-nouveau-safetile-getparam.patch

@@ -0,0 +1,26 @@
+From 2aa78d8442bd947637ed81da00fd9c22232d2ed0 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Wed, 9 Sep 2009 16:16:44 +1000
+Subject: [PATCH 5/6] f12: add getparam to know scanout tile_flags is safe
+
+---
+ drivers/gpu/drm/nouveau/nouveau_state.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
+index 36f8268..27c4d48 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_state.c
++++ b/drivers/gpu/drm/nouveau/nouveau_state.c
+@@ -861,6 +861,9 @@ int nouveau_ioctl_getparam(struct drm_device *dev, void *data,
+ 
+ 		getparam->value = dev_priv->vm_vram_base;
+ 		break;
++	case 0xdeadcafe00000003: /* NOUVEAU_GETPARAM_SCANOUT_TILEFLAGS */
++		getparam->value = 1;
++		break;
+ 	case NOUVEAU_GETPARAM_GRAPH_UNITS:
+ 		/* NV40 and NV50 versions are quite different, but register
+ 		 * address is the same. User is supposed to know the card
+-- 
+1.6.5.2
+

drm-nouveau-tvout-disable.patch

@@ -0,0 +1,57 @@
+From 1c48b3294c0efe6b28ef84139eb838725bb34ccc Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 8 Sep 2009 13:57:50 +1000
+Subject: [PATCH 4/6] drm/nouveau: disable tv-out by default for the moment
+
+---
+ drivers/gpu/drm/nouveau/nouveau_drv.c  |    4 ++++
+ drivers/gpu/drm/nouveau/nouveau_drv.h  |    1 +
+ drivers/gpu/drm/nouveau/nv04_display.c |    5 +++++
+ 3 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.c b/drivers/gpu/drm/nouveau/nouveau_drv.c
+index 06eb993..d117ab5 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drv.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drv.c
+@@ -71,6 +71,10 @@ MODULE_PARM_DESC(uscript_tmds, "TMDS output script table ID (>=GeForce 8)");
+ int nouveau_nofbaccel = 0;
+ module_param_named(nofbaccel, nouveau_nofbaccel, int, 0400);
+ 
++MODULE_PARM_DESC(tv, "Enable TV-out support (<GeForce 8)");
++int nouveau_tv = 0;
++module_param_named(tv, nouveau_tv, int, 0400);
++
+ MODULE_PARM_DESC(tv_norm, "Default TV norm.\n"
+ 		 "\t\tSupported: PAL, PAL-M, PAL-N, PAL-Nc, NTSC-M, NTSC-J,\n"
+ 		 "\t\t\thd480i, hd480p, hd576i, hd576p, hd720p, hd1080i.\n"
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
+index bf9acc6..0941725 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
++++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
+@@ -648,6 +648,7 @@ extern int nouveau_uscript_tmds;
+ extern int nouveau_vram_pushbuf;
+ extern int nouveau_vram_notify;
+ extern int nouveau_fbpercrtc;
++extern int nouveau_tv;
+ extern char *nouveau_tv_norm;
+ extern int nouveau_reg_debug;
+ extern char *nouveau_vbios;
+diff --git a/drivers/gpu/drm/nouveau/nv04_display.c b/drivers/gpu/drm/nouveau/nv04_display.c
+index ef77215..dfae228 100644
+--- a/drivers/gpu/drm/nouveau/nv04_display.c
++++ b/drivers/gpu/drm/nouveau/nv04_display.c
+@@ -142,6 +142,11 @@ nv04_display_create(struct drm_device *dev)
+ 			ret = nv04_dfp_create(dev, dcbent);
+ 			break;
+ 		case OUTPUT_TV:
++			if (!nouveau_tv) {
++				NV_INFO(dev, "Enable TV-Out with tv module option\n");
++				continue;
++			}
++
+ 			if (dcbent->location == DCB_LOC_ON_CHIP)
+ 				ret = nv17_tv_create(dev, dcbent);
+ 			else
+-- 
+1.6.5.2
+

drm-nouveau-update.patch

@@ -0,0 +1,306 @@
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
+index 5445cef..1c15ef3 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
++++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
+@@ -583,6 +583,7 @@ struct drm_nouveau_private {
+ 	uint64_t vm_end;
+ 	struct nouveau_gpuobj *vm_vram_pt[NV50_VM_VRAM_NR];
+ 	int vm_vram_pt_nr;
++	uint64_t vram_sys_base;
+ 
+ 	/* the mtrr covering the FB */
+ 	int fb_mtrr;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
+index 8f3a12f..2dc09db 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
+@@ -285,53 +285,50 @@ nv50_mem_vm_bind_linear(struct drm_device *dev, uint64_t virt, uint32_t size,
+ 			uint32_t flags, uint64_t phys)
+ {
+ 	struct drm_nouveau_private *dev_priv = dev->dev_private;
+-	struct nouveau_gpuobj **pgt;
+-	unsigned psz, pfl, pages;
+-
+-	if (virt >= dev_priv->vm_gart_base &&
+-	    (virt + size) < (dev_priv->vm_gart_base + dev_priv->vm_gart_size)) {
+-		psz = 12;
+-		pgt = &dev_priv->gart_info.sg_ctxdma;
+-		pfl = 0x21;
+-		virt -= dev_priv->vm_gart_base;
+-	} else
+-	if (virt >= dev_priv->vm_vram_base &&
+-	    (virt + size) < (dev_priv->vm_vram_base + dev_priv->vm_vram_size)) {
+-		psz = 16;
+-		pgt = dev_priv->vm_vram_pt;
+-		pfl = 0x01;
+-		virt -= dev_priv->vm_vram_base;
+-	} else {
+-		NV_ERROR(dev, "Invalid address: 0x%16llx-0x%16llx\n",
+-			 virt, virt + size - 1);
+-		return -EINVAL;
+-	}
++	struct nouveau_gpuobj *pgt;
++	unsigned block;
++	int i;
+ 
+-	pages = size >> psz;
++	virt = ((virt - dev_priv->vm_vram_base) >> 16) << 1;
++	size = (size >> 16) << 1;
++
++	phys |= ((uint64_t)flags << 32);
++	phys |= 1;
++	if (dev_priv->vram_sys_base) {
++		phys += dev_priv->vram_sys_base;
++		phys |= 0x30;
++	}
+ 
+ 	dev_priv->engine.instmem.prepare_access(dev, true);
+-	if (flags & 0x80000000) {
+-		while (pages--) {
+-			struct nouveau_gpuobj *pt = pgt[virt >> 29];
+-			unsigned pte = ((virt & 0x1fffffffULL) >> psz) << 1;
++	while (size) {
++		unsigned offset_h = upper_32_bits(phys);
++		unsigned offset_l = lower_32_bits(phys);
++		unsigned pte, end;
++
++		for (i = 7; i >= 0; i--) {
++			block = 1 << (i + 1);
++			if (size >= block && !(virt & (block - 1)))
++				break;
++		}
++		offset_l |= (i << 7);
+ 
+-			nv_wo32(dev, pt, pte++, 0x00000000);
+-			nv_wo32(dev, pt, pte++, 0x00000000);
++		phys += block << 15;
++		size -= block;
+ 
+-			virt += (1 << psz);
+-		}
+-	} else {
+-		while (pages--) {
+-			struct nouveau_gpuobj *pt = pgt[virt >> 29];
+-			unsigned pte = ((virt & 0x1fffffffULL) >> psz) << 1;
+-			unsigned offset_h = upper_32_bits(phys) & 0xff;
+-			unsigned offset_l = lower_32_bits(phys);
++		while (block) {
++			pgt = dev_priv->vm_vram_pt[virt >> 14];
++			pte = virt & 0x3ffe;
+ 
+-			nv_wo32(dev, pt, pte++, offset_l | pfl);
+-			nv_wo32(dev, pt, pte++, offset_h | flags);
++			end = pte + block;
++			if (end > 16384)
++				end = 16384;
++			block -= (end - pte);
++			virt  += (end - pte);
+ 
+-			phys += (1 << psz);
+-			virt += (1 << psz);
++			while (pte < end) {
++				nv_wo32(dev, pgt, pte++, offset_l);
++				nv_wo32(dev, pgt, pte++, offset_h);
++			}
+ 		}
+ 	}
+ 	dev_priv->engine.instmem.finish_access(dev);
+@@ -356,7 +353,41 @@ nv50_mem_vm_bind_linear(struct drm_device *dev, uint64_t virt, uint32_t size,
+ void
+ nv50_mem_vm_unbind(struct drm_device *dev, uint64_t virt, uint32_t size)
+ {
+-	nv50_mem_vm_bind_linear(dev, virt, size, 0x80000000, 0);
++	struct drm_nouveau_private *dev_priv = dev->dev_private;
++	struct nouveau_gpuobj *pgt;
++	unsigned pages, pte, end;
++
++	virt -= dev_priv->vm_vram_base;
++	pages = (size >> 16) << 1;
++
++	dev_priv->engine.instmem.prepare_access(dev, true);
++	while (pages) {
++		pgt = dev_priv->vm_vram_pt[virt >> 29];
++		pte = (virt & 0x1ffe0000ULL) >> 15;
++
++		end = pte + pages;
++		if (end > 16384)
++			end = 16384;
++		pages -= (end - pte);
++		virt  += (end - pte) << 15;
++
++		while (pte < end)
++			nv_wo32(dev, pgt, pte++, 0);
++	}
++	dev_priv->engine.instmem.finish_access(dev);
++
++	nv_wr32(dev, 0x100c80, 0x00050001);
++	if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
++		NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
++		NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
++		return;
++	}
++
++	nv_wr32(dev, 0x100c80, 0x00000001);
++	if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
++		NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
++		NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
++	}
+ }
+ 
+ /*
+diff --git a/drivers/gpu/drm/nouveau/nv04_dac.c b/drivers/gpu/drm/nouveau/nv04_dac.c
+index d0e038d..1d73b15 100644
+--- a/drivers/gpu/drm/nouveau/nv04_dac.c
++++ b/drivers/gpu/drm/nouveau/nv04_dac.c
+@@ -119,7 +119,7 @@ static enum drm_connector_status nv04_dac_detect(struct drm_encoder *encoder,
+ 						 struct drm_connector *connector)
+ {
+ 	struct drm_device *dev = encoder->dev;
+-	uint8_t saved_seq1, saved_pi, saved_rpc1;
++	uint8_t saved_seq1, saved_pi, saved_rpc1, saved_cr_mode;
+ 	uint8_t saved_palette0[3], saved_palette_mask;
+ 	uint32_t saved_rtest_ctrl, saved_rgen_ctrl;
+ 	int i;
+@@ -135,6 +135,9 @@ static enum drm_connector_status nv04_dac_detect(struct drm_encoder *encoder,
+ 		/* only implemented for head A for now */
+ 		NVSetOwner(dev, 0);
+ 
++	saved_cr_mode = NVReadVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX);
++	NVWriteVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX, saved_cr_mode | 0x80);
++
+ 	saved_seq1 = NVReadVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX);
+ 	NVWriteVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX, saved_seq1 & ~0x20);
+ 
+@@ -203,6 +206,7 @@ out:
+ 	NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_PIXEL_INDEX, saved_pi);
+ 	NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_RPC1_INDEX, saved_rpc1);
+ 	NVWriteVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX, saved_seq1);
++	NVWriteVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX, saved_cr_mode);
+ 
+ 	if (blue == 0x18) {
+ 		NV_INFO(dev, "Load detected on head A\n");
+diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
+index 94400f7..f0dc4e3 100644
+--- a/drivers/gpu/drm/nouveau/nv50_instmem.c
++++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
+@@ -76,6 +76,11 @@ nv50_instmem_init(struct drm_device *dev)
+ 	for (i = 0x1700; i <= 0x1710; i += 4)
+ 		priv->save1700[(i-0x1700)/4] = nv_rd32(dev, i);
+ 
++	if (dev_priv->chipset == 0xaa || dev_priv->chipset == 0xac)
++		dev_priv->vram_sys_base = nv_rd32(dev, 0x100e10) << 12;
++	else
++		dev_priv->vram_sys_base = 0;
++
+ 	/* Reserve the last MiB of VRAM, we should probably try to avoid
+ 	 * setting up the below tables over the top of the VBIOS image at
+ 	 * some point.
+@@ -172,16 +177,28 @@ nv50_instmem_init(struct drm_device *dev)
+ 	 * We map the entire fake channel into the start of the PRAMIN BAR
+ 	 */
+ 	ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, pt_size, 0x1000,
+-							0, &priv->pramin_pt);
++				     0, &priv->pramin_pt);
+ 	if (ret)
+ 		return ret;
+ 
+-	for (i = 0, v = c_offset; i < pt_size; i += 8, v += 0x1000) {
+-		if (v < (c_offset + c_size))
+-			BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, v | 1);
+-		else
+-			BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, 0x00000009);
++	v = c_offset | 1;
++	if (dev_priv->vram_sys_base) {
++		v += dev_priv->vram_sys_base;
++		v |= 0x30;
++	}
++
++	i = 0;
++	while (v < dev_priv->vram_sys_base + c_offset + c_size) {
++		BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, v);
++		BAR0_WI32(priv->pramin_pt->gpuobj, i + 4, 0x00000000);
++		v += 0x1000;
++		i += 8;
++	}
++
++	while (i < pt_size) {
++		BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, 0x00000000);
+ 		BAR0_WI32(priv->pramin_pt->gpuobj, i + 4, 0x00000000);
++		i += 8;
+ 	}
+ 
+ 	BAR0_WI32(chan->vm_pd, 0x00, priv->pramin_pt->instance | 0x63);
+@@ -416,7 +433,9 @@ nv50_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+ {
+ 	struct drm_nouveau_private *dev_priv = dev->dev_private;
+ 	struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
+-	uint32_t pte, pte_end, vram;
++	struct nouveau_gpuobj *pramin_pt = priv->pramin_pt->gpuobj;
++	uint32_t pte, pte_end;
++	uint64_t vram;
+ 
+ 	if (!gpuobj->im_backing || !gpuobj->im_pramin || gpuobj->im_bound)
+ 		return -EINVAL;
+@@ -424,20 +443,24 @@ nv50_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+ 	NV_DEBUG(dev, "st=0x%0llx sz=0x%0llx\n",
+ 		 gpuobj->im_pramin->start, gpuobj->im_pramin->size);
+ 
+-	pte     = (gpuobj->im_pramin->start >> 12) << 3;
+-	pte_end = ((gpuobj->im_pramin->size >> 12) << 3) + pte;
++	pte     = (gpuobj->im_pramin->start >> 12) << 1;
++	pte_end = ((gpuobj->im_pramin->size >> 12) << 1) + pte;
+ 	vram    = gpuobj->im_backing_start;
+ 
+ 	NV_DEBUG(dev, "pramin=0x%llx, pte=%d, pte_end=%d\n",
+ 		 gpuobj->im_pramin->start, pte, pte_end);
+ 	NV_DEBUG(dev, "first vram page: 0x%08x\n", gpuobj->im_backing_start);
+ 
++	vram |= 1;
++	if (dev_priv->vram_sys_base) {
++		vram += dev_priv->vram_sys_base;
++		vram |= 0x30;
++	}
++
+ 	dev_priv->engine.instmem.prepare_access(dev, true);
+ 	while (pte < pte_end) {
+-		nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 0)/4, vram | 1);
+-		nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 4)/4, 0x00000000);
+-
+-		pte += 8;
++		nv_wo32(dev, pramin_pt, pte++, lower_32_bits(vram));
++		nv_wo32(dev, pramin_pt, pte++, upper_32_bits(vram));
+ 		vram += NV50_INSTMEM_PAGE_SIZE;
+ 	}
+ 	dev_priv->engine.instmem.finish_access(dev);
+@@ -470,14 +493,13 @@ nv50_instmem_unbind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+ 	if (gpuobj->im_bound == 0)
+ 		return -EINVAL;
+ 
+-	pte     = (gpuobj->im_pramin->start >> 12) << 3;
+-	pte_end = ((gpuobj->im_pramin->size >> 12) << 3) + pte;
++	pte     = (gpuobj->im_pramin->start >> 12) << 1;
++	pte_end = ((gpuobj->im_pramin->size >> 12) << 1) + pte;
+ 
+ 	dev_priv->engine.instmem.prepare_access(dev, true);
+ 	while (pte < pte_end) {
+-		nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 0)/4, 0x00000009);
+-		nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 4)/4, 0x00000000);
+-		pte += 8;
++		nv_wo32(dev, priv->pramin_pt->gpuobj, pte++, 0x00000000);
++		nv_wo32(dev, priv->pramin_pt->gpuobj, pte++, 0x00000000);
+ 	}
+ 	dev_priv->engine.instmem.finish_access(dev);
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
+index bcf843f..71247da 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
+@@ -3726,7 +3726,7 @@ nouveau_bios_dp_table(struct drm_device *dev, struct dcb_entry *dcbent,
+ 	}
+ 	table = &bios->data[bios->display.dp_table_ptr];
+ 
+-	if (table[0] != 0x21) {
++	if (table[0] != 0x20 && table[0] != 0x21) {
+ 		NV_ERROR(dev, "DisplayPort table version 0x%02x unknown\n",
+ 			 table[0]);
+ 		return NULL;

drm-radeon-pm.patch

@@ -0,0 +1,586 @@
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/atombios_crtc.c.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/atombios_crtc.c
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/atombios_crtc.c.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/atombios_crtc.c	2009-03-03 20:53:05.000000000 +0000
+@@ -441,14 +441,23 @@ static bool atombios_crtc_mode_fixup(str
+ 
+ static void atombios_crtc_prepare(struct drm_crtc *crtc)
+ {
++	struct drm_device *dev = crtc->dev;
++	struct drm_radeon_private *dev_priv = dev->dev_private;
++
++	mutex_lock(&dev_priv->mode_info.power.pll_mutex);
++
+ 	atombios_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+ 	atombios_lock_crtc(crtc, 1);
+ }
+ 
+ static void atombios_crtc_commit(struct drm_crtc *crtc)
+ {
++	struct drm_device *dev = crtc->dev;
++	struct drm_radeon_private *dev_priv = dev->dev_private;
++
+ 	atombios_crtc_dpms(crtc, DRM_MODE_DPMS_ON);
+ 	atombios_lock_crtc(crtc, 0);
++	mutex_unlock(&dev_priv->mode_info.power.pll_mutex);
+ }
+ 
+ static const struct drm_crtc_helper_funcs atombios_helper_funcs = {
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_atombios.c.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_atombios.c
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_atombios.c.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_atombios.c	2009-03-03 20:53:05.000000000 +0000
+@@ -620,6 +620,34 @@ void radeon_atom_static_pwrmgt_setup(str
+ 	atom_execute_table(dev_priv->mode_info.atom_context, index, (uint32_t *)&args);
+ }
+ 
++void radeon_atom_get_mc_arb_info(struct drm_device *dev)
++{
++	struct drm_radeon_private *dev_priv = dev->dev_private;
++	struct radeon_mode_info *mode_info = &dev_priv->mode_info;
++	struct atom_context *ctx = mode_info->atom_context;
++	int index = GetIndexIntoMasterTable(DATA, MC_InitParameter);
++	uint8_t frev, crev;
++	uint16_t size, data_offset;
++
++	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
++	dev_priv->mode_info.power.mc_arb_init_values =
++		kmalloc(size*sizeof(int), GFP_KERNEL);
++	memcpy(dev_priv->mode_info.power.mc_arb_init_values,
++	       ctx->bios + data_offset, size * sizeof(int));
++}
++
++void radeon_atom_get_engine_clock(struct drm_device *dev, int *engine_clock)
++{
++	struct drm_radeon_private *dev_priv = dev->dev_private;
++	struct radeon_mode_info *mode_info = &dev_priv->mode_info;
++	struct atom_context *ctx = mode_info->atom_context;
++	GET_ENGINE_CLOCK_PS_ALLOCATION args;
++	int index = GetIndexIntoMasterTable(COMMAND, GetEngineClock);
++
++	atom_execute_table(ctx, index, (uint32_t *)&args);
++	*engine_clock = args.ulReturnEngineClock;
++}
++
+ void radeon_atom_set_engine_clock(struct drm_device *dev, int eng_clock)
+ {
+ 	struct drm_radeon_private *dev_priv = dev->dev_private;
+@@ -633,6 +661,18 @@ void radeon_atom_set_engine_clock(struct
+ 	atom_execute_table(dev_priv->mode_info.atom_context, index, (uint32_t *)&args);
+ }
+ 
++void radeon_atom_get_memory_clock(struct drm_device *dev, int *mem_clock)
++{
++	struct drm_radeon_private *dev_priv = dev->dev_private;
++	struct radeon_mode_info *mode_info = &dev_priv->mode_info;
++	struct atom_context *ctx = mode_info->atom_context;
++	GET_MEMORY_CLOCK_PS_ALLOCATION args;
++	int index = GetIndexIntoMasterTable(COMMAND, GetMemoryClock);
++	
++	atom_execute_table(ctx, index, (uint32_t *)&args);
++	*mem_clock = args.ulReturnMemoryClock;
++}
++
+ void radeon_atom_set_memory_clock(struct drm_device *dev, int mem_clock)
+ {
+ 	struct drm_radeon_private *dev_priv = dev->dev_private;
+@@ -646,6 +686,16 @@ void radeon_atom_set_memory_clock(struct
+ 	atom_execute_table(dev_priv->mode_info.atom_context, index, (uint32_t *)&args);
+ }
+ 
++void radeon_atom_initialize_memory_controller(struct drm_device *dev)
++{
++	struct drm_radeon_private *dev_priv = dev->dev_private;
++	struct atom_context *ctx = dev_priv->mode_info.atom_context;
++	int index = GetIndexIntoMasterTable(COMMAND, MemoryDeviceInit);
++	MEMORY_PLLINIT_PS_ALLOCATION args;
++
++	atom_execute_table(ctx, index, (uint32_t *)&args);
++}
++
+ void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev)
+ {
+ 	struct drm_radeon_private *dev_priv = dev->dev_private;
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_cp.c.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_cp.c
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_cp.c.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_cp.c	2009-03-03 20:53:05.000000000 +0000
+@@ -3223,6 +3223,8 @@ int radeon_driver_load(struct drm_device
+ 		if (ret)
+ 			goto modeset_fail;
+ 
++		mutex_init(&dev_priv->mode_info.power.pll_mutex);
++
+ 		radeon_modeset_init(dev);
+ 
+ 		radeon_modeset_cp_init(dev);
+@@ -3231,7 +3233,7 @@ int radeon_driver_load(struct drm_device
+ 		drm_irq_install(dev);
+ 	}
+ 
+-
++	radeon_pm_init(dev);
+ 	return ret;
+ modeset_fail:
+ 	dev->driver->driver_features &= ~DRIVER_MODESET;
+@@ -3303,6 +3305,8 @@ int radeon_driver_unload(struct drm_devi
+ {
+ 	drm_radeon_private_t *dev_priv = dev->dev_private;
+ 
++	radeon_pm_exit(dev);
++
+ 	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ 		drm_irq_uninstall(dev);
+ 		radeon_modeset_cleanup(dev);
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_cs.c.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_cs.c
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_cs.c.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_cs.c	2009-03-03 20:53:05.000000000 +0000
+@@ -41,6 +41,8 @@ int radeon_cs_ioctl(struct drm_device *d
+ 	long size;
+ 	int r, i;
+ 
++	radeon_pm_timer_reset(dev);
++
+ 	mutex_lock(&dev_priv->cs.cs_mutex);
+ 	/* set command stream id to 0 which is fake id */
+ 	cs_id = 0;
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_drv.h.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_drv.h
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_drv.h.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_drv.h	2009-03-03 20:53:05.000000000 +0000
+@@ -612,6 +612,9 @@ extern int radeon_modeset_cp_resume(stru
+ /* radeon_pm.c */
+ int radeon_suspend(struct drm_device *dev, pm_message_t state);
+ int radeon_resume(struct drm_device *dev);
++void radeon_pm_init(struct drm_device *dev);
++void radeon_pm_exit(struct drm_device *dev);
++void radeon_pm_timer_reset(struct drm_device *dev);
+ 
+ /* Flags for stats.boxes
+  */
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_irq.c.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_irq.c
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_irq.c.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_irq.c	2009-03-03 20:53:05.000000000 +0000
+@@ -185,8 +185,10 @@ irqreturn_t radeon_driver_irq_handler(DR
+ 	struct drm_device *dev = (struct drm_device *) arg;
+ 	drm_radeon_private_t *dev_priv =
+ 	    (drm_radeon_private_t *) dev->dev_private;
++	struct radeon_powermanagement_info *power = &dev_priv->mode_info.power;
+ 	u32 stat;
+ 	u32 r500_disp_int;
++	unsigned long flags;
+ 
+ 	/* Only consider the bits we're interested in - others could be used
+ 	 * outside the DRM
+@@ -206,15 +208,47 @@ irqreturn_t radeon_driver_irq_handler(DR
+ 
+ 	/* VBLANK interrupt */
+ 	if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RS690) {
+-		if (r500_disp_int & R500_D1_VBLANK_INTERRUPT)
++		if (r500_disp_int & R500_D1_VBLANK_INTERRUPT) {
++			spin_lock_irqsave(&power->power_lock, flags);
++			if (power->reclock_head & 1) {
++				power->reclock_head &= ~1;
++				schedule_work(&power->reclock_work);
++				drm_vblank_put(dev, 0);
++			}
++			spin_unlock_irqrestore(&power->power_lock, flags);
+ 			drm_handle_vblank(dev, 0);
+-		if (r500_disp_int & R500_D2_VBLANK_INTERRUPT)
++		}
++		if (r500_disp_int & R500_D2_VBLANK_INTERRUPT) {
++			spin_lock_irqsave(&power->power_lock, flags);
++			if (power->reclock_head & 2) {
++				power->reclock_head &= ~2;
++				schedule_work(&power->reclock_work);
++				drm_vblank_put(dev, 1);
++			}
++			spin_unlock_irqrestore(&power->power_lock, flags);
+ 			drm_handle_vblank(dev, 1);
++		}
+ 	} else {
+-		if (stat & RADEON_CRTC_VBLANK_STAT)
++		if (stat & RADEON_CRTC_VBLANK_STAT) {
++			spin_lock_irqsave(&power->power_lock, flags);
++			if (power->reclock_head & 1) {
++				power->reclock_head &= ~1;
++				schedule_work(&power->reclock_work);
++				drm_vblank_put(dev, 0);
++			}
++			spin_unlock_irqrestore(&power->power_lock, flags);
+ 			drm_handle_vblank(dev, 0);
+-		if (stat & RADEON_CRTC2_VBLANK_STAT)
++		}
++		if (stat & RADEON_CRTC2_VBLANK_STAT) {
++			spin_lock_irqsave(&power->power_lock, flags);
++			if (power->reclock_head & 2) {
++				power->reclock_head &= ~2;
++				schedule_work(&power->reclock_work);
++				drm_vblank_put(dev, 1);
++			}
++			spin_unlock_irqrestore(&power->power_lock, flags);
+ 			drm_handle_vblank(dev, 1);
++		}
+ 	}
+ 	return IRQ_HANDLED;
+ }
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_mode.h.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_mode.h
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_mode.h.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_mode.h	2009-03-03 20:53:05.000000000 +0000
+@@ -173,6 +173,22 @@ struct radeon_i2c_chan {
+ 	struct radeon_i2c_bus_rec rec;
+ };
+ 
++struct radeon_powermanagement_info {
++	struct timer_list idle_power_timer;
++	struct work_struct reclock_work;
++	struct drm_device *dev;
++	uint32_t orig_memory_clock;
++	uint32_t orig_engine_clock;
++	uint32_t *mc_arb_init_values;
++	uint8_t orig_fbdiv;
++	int new_mem_clock;
++	int new_engine_clock;
++	int current_clock_state;
++	int reclock_head;
++	struct mutex pll_mutex;
++	spinlock_t power_lock;
++};
++
+ struct radeon_mode_info {
+ 	struct atom_context *atom_context;
+ 	struct radeon_bios_connector bios_connector[RADEON_MAX_BIOS_CONNECTOR];
+@@ -182,6 +198,9 @@ struct radeon_mode_info {
+ 	struct radeon_pll mpll;
+ 	uint32_t mclk;
+ 	uint32_t sclk;
++
++	/* power management */
++	struct radeon_powermanagement_info power;
+ };
+ 
+ struct radeon_crtc {
+@@ -307,6 +326,12 @@ extern int radeon_crtc_cursor_move(struc
+ 
+ extern bool radeon_atom_get_clock_info(struct drm_device *dev);
+ extern bool radeon_combios_get_clock_info(struct drm_device *dev);
++extern void radeon_atom_get_engine_clock(struct drm_device *dev, int *engine_clock);
++extern void radeon_atom_get_memory_clock(struct drm_device *dev, int *memory_clock);
++extern void radeon_atom_set_engine_clock(struct drm_device *dev, int engine_clock);
++extern void radeon_atom_set_memory_clock(struct drm_device *dev, int memory_clock);
++extern void radeon_atom_initialize_memory_controller(struct drm_device *dev);
++extern void radeon_atom_get_mc_arb_info(struct drm_device *dev);
+ extern void radeon_atombios_get_lvds_info(struct radeon_encoder *encoder);
+ extern void radeon_atombios_get_tmds_info(struct radeon_encoder *encoder);
+ extern bool radeon_combios_get_lvds_info(struct radeon_encoder *encoder);
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_pm.c.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_pm.c
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_pm.c.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_pm.c	2009-03-03 20:53:05.000000000 +0000
+@@ -31,6 +31,8 @@
+ 
+ #include "drm_crtc_helper.h"
+ 
++#define RADEON_DOWNCLOCK_IDLE_MS 30
++
+ int radeon_suspend(struct drm_device *dev, pm_message_t state)
+ {
+ 	struct drm_radeon_private *dev_priv = dev->dev_private;
+@@ -255,3 +257,214 @@ bool radeon_set_pcie_lanes(struct drm_de
+ 		return false;
+ }
+ 
++static void radeon_pm_set_engine_clock(struct drm_device *dev, int freq)
++{
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++
++	if (dev_priv->is_atom_bios)
++		radeon_atom_set_engine_clock(dev, freq);
++}
++
++static void radeon_pm_set_memory_clock(struct drm_device *dev, int freq)
++{
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++	struct radeon_powermanagement_info *power = &dev_priv->mode_info.power;
++
++	mutex_lock(&power->pll_mutex);
++	radeon_do_cp_idle(dev_priv);
++	if (dev_priv->is_atom_bios) {
++		int mpll, spll, hclk, sclk, fbdiv, index, factor;
++		switch (dev_priv->chip_family) {
++		case CHIP_R520:
++		case CHIP_RV530:
++		case CHIP_RV560:
++		case CHIP_RV570:
++		case CHIP_R580:
++			mpll = RADEON_READ_PLL(dev_priv, MPLL_FUNC_CNTL);
++			fbdiv = (mpll & 0x1fe0) >> 5;
++
++			/* Set new fbdiv */
++			factor = power->orig_memory_clock / freq;
++			fbdiv = power->orig_fbdiv / factor;
++
++			mpll &= ~0x1fe0;
++			mpll |= ((fbdiv << 5) | (1 << 24));
++			mpll &= ~(1 << 25);
++
++			spll = RADEON_READ_PLL(dev_priv, SPLL_FUNC_CNTL);
++
++			hclk = fbdiv << 5;
++			hclk += 0x20;
++			hclk *= 8;
++
++			sclk = spll & 0x1fe0;
++			sclk += 0x20;
++			sclk *= 6;
++			sclk = sclk >> 5;
++
++			index = (hclk/sclk);
++
++			R500_WRITE_MCIND(R530_MC_ARB_RATIO_CLK_SEQ,
++					 power->mc_arb_init_values[index]);
++			RADEON_WRITE_PLL(dev_priv, MPLL_FUNC_CNTL, mpll);
++			radeon_atom_initialize_memory_controller(dev);
++			break;
++		}
++	}
++
++	mutex_unlock(&power->pll_mutex);
++}
++
++static int radeon_pm_get_active_crtcs(struct drm_device *dev, int *crtcs)
++{
++	struct drm_crtc *crtc;
++	int count = 0;
++	struct radeon_crtc *radeon_crtc;
++	
++	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
++		radeon_crtc = to_radeon_crtc(crtc);
++		if (crtc->enabled) {
++			count++;
++			*crtcs |= (1 << radeon_crtc->crtc_id);
++		}
++	}
++	return count;
++}
++
++
++static void radeon_pm_perform_transition(struct drm_device *dev)
++{
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++	struct radeon_powermanagement_info *power = &dev_priv->mode_info.power;
++	int crtcs = 0, count;
++	unsigned long flags;
++
++	count = radeon_pm_get_active_crtcs(dev, &crtcs);
++
++	spin_lock_irqsave(&power->power_lock, flags);
++	switch (count) {
++	case 0:
++		schedule_work(&power->reclock_work);
++		break;
++	case 1:
++		if (power->reclock_head)
++			break;
++		if (crtcs & 1) {
++			power->reclock_head |= 1;
++			drm_vblank_get(dev, 0);
++		} else {
++			power->reclock_head |= 2;
++			drm_vblank_get(dev, 1);
++		}
++		break;
++	default:
++		/* Too many active heads */
++		break;
++	}
++	spin_unlock_irqrestore(&power->power_lock, flags);
++}
++
++
++static int radeon_pm_set_runtime_power(struct drm_device *dev, int value)
++{
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++	struct radeon_powermanagement_info *power = &dev_priv->mode_info.power;
++
++	if (power->current_clock_state == value)
++		return 1;
++
++	switch (value) {
++	case 0:
++		power->new_engine_clock = 100*100;
++		power->new_mem_clock = 100*100;
++		break;
++	case 1:
++		power->new_engine_clock = power->orig_engine_clock;
++		power->new_mem_clock = power->orig_memory_clock;
++		break;
++	}
++
++	power->current_clock_state = value;
++	radeon_pm_perform_transition(dev);
++
++	return 0;
++}
++
++static void radeon_pm_idle_timeout(unsigned long d)
++{
++	struct drm_device *dev = (struct drm_device *)d;
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++
++	radeon_pm_set_runtime_power(dev, 0);
++}
++
++static void radeon_pm_reclock_callback(struct work_struct *work)
++{
++	struct radeon_powermanagement_info *power =
++		container_of(work, struct radeon_powermanagement_info,
++			     reclock_work);
++	struct drm_device *dev = power->dev;	
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++
++	mutex_lock(&dev_priv->cs.cs_mutex);
++	radeon_pm_set_memory_clock(dev, power->new_mem_clock);
++	radeon_pm_set_engine_clock(dev, power->new_engine_clock);
++	mutex_unlock(&dev_priv->cs.cs_mutex);
++}
++
++void radeon_pm_timer_reset(struct drm_device *dev)
++{
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++	struct radeon_powermanagement_info *power = &dev_priv->mode_info.power;
++
++	if (!drm_core_check_feature(dev, DRIVER_MODESET))
++		return;
++
++	radeon_pm_set_runtime_power(dev, 1);
++
++	mod_timer(&power->idle_power_timer,
++		  jiffies + msecs_to_jiffies(RADEON_DOWNCLOCK_IDLE_MS));
++}
++
++void radeon_pm_init(struct drm_device *dev)
++{
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++	struct radeon_powermanagement_info *power = &dev_priv->mode_info.power;
++
++	power->dev = dev;
++
++	if (!drm_core_check_feature(dev, DRIVER_MODESET))
++		return;
++
++	if (dev_priv->is_atom_bios) {
++		int mpll;
++		radeon_atom_get_mc_arb_info(dev);
++		radeon_atom_get_engine_clock(dev, &power->orig_engine_clock);
++		radeon_atom_get_memory_clock(dev, &power->orig_memory_clock);
++
++		mpll = RADEON_READ_PLL(dev_priv, MPLL_FUNC_CNTL);
++		dev_priv->mode_info.power.orig_fbdiv = (mpll & 0x1fe0) >> 5;
++	}
++
++	setup_timer(&power->idle_power_timer, radeon_pm_idle_timeout,
++		    (unsigned long)dev);
++	INIT_WORK(&power->reclock_work, radeon_pm_reclock_callback);
++
++	spin_lock_init(&power->power_lock);
++
++	power->current_clock_state = 1;
++	power->reclock_head = 0;
++
++	radeon_pm_timer_reset(dev);
++}
++
++void radeon_pm_exit(struct drm_device *dev)
++{
++	drm_radeon_private_t *dev_priv = dev->dev_private;
++	struct radeon_powermanagement_info *power = &dev_priv->mode_info.power;
++
++	if (!drm_core_check_feature(dev, DRIVER_MODESET))
++		return;
++
++	del_timer_sync(&power->idle_power_timer);
++}
+diff -up linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_reg.h.mjg linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_reg.h
+--- linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_reg.h.mjg	2009-03-03 19:41:48.000000000 +0000
++++ linux-2.6.28.x86_64/drivers/gpu/drm/radeon/radeon_reg.h	2009-03-03 20:53:05.000000000 +0000
+@@ -303,6 +303,28 @@
+ #       define RADEON_PLL_WR_EN             (1 << 7)
+ #       define RADEON_PLL_DIV_SEL           (3 << 8)
+ #       define RADEON_PLL2_DIV_SEL_MASK     ~(3 << 8)
++#define SPLL_FUNC_CNTL                     0x0000
++#define MPLL_FUNC_CNTL                     0x0004
++#define GENERAL_PWRMGT                     0x0008
++#      define RADEON_GLOBAL_PWRMGT_EN      (1 << 0)
++#define SCLK_PWRMGT_CNTL                   0x0009
++#      define RADEON_SCLK_PWRMGT_OFF       (1 << 0)
++#define MCLK_PWRMGT_CNTL                   0x000a
++#      define RADEON_MCLK_PWRMGT_OFF       (1 << 0)
++#define DYN_PWRMGT_SCLK_CNTL               0x000b
++#      define RADEON_ENGINE_DYNCLK_MODE    (1 << 0)
++#      define RADEON_STATIC_SCREEN_EN      (1 << 20)
++#      define RADEON_CLIENT_SELECT_POWER_EN (1 << 21)
++#define DYN_SCLK_PWMEN_PIPE                0x000d
++#      define RADEON_PIPE_3D_NOT_AUTO      (1 << 8)
++#define DYN_SCLK_VOL_CNTL                  0x000e
++#      define RADEON_IO_CG_VOLTAGE_DROP    (1 << 0)
++#      define RADEON_VOLTAGE_DROP_SYNC     (1 << 2)
++#define CP_DYN_CNTL                        0x000f
++#      define RADEON_CP_FORCEON            (1 << 0)
++#      define RADEON_CP_LOWER_POWER_IGNORE (1 << 20)
++#      define RADEON_CP_NORMAL_POWER_IGNORE (1 << 21)
++#      define RADEON_CP_NORMAL_POWER_BUSY  (1 << 24)
+ #define RADEON_CLK_PWRMGT_CNTL              0x0014
+ #       define RADEON_ENGIN_DYNCLK_MODE     (1 << 12)
+ #       define RADEON_ACTIVE_HILO_LAT_MASK  (3 << 13)
+@@ -3961,7 +3983,48 @@
+ #	define AVIVO_I2C_RESET						(1 << 8)
+ 
+ #define R600_GENERAL_PWRMGT                                        0x618
++#	define R600_GLOBAL_PWRMGT_EN                               (1 << 0)
++#	define R600_STATIC_PM_EN                                   (1 << 1)
++#	define R600_MOBILE_SU                                      (1 << 2)
++#	define R600_THERMAL_PROTECTION_DIS                         (1 << 3)
++#	define R600_THERMAL_PROTECTION_TYPE                        (1 << 4)
++#	define R600_ENABLE_GEN2PCIE                                (1 << 5)
++#	define R600_SW_GPIO_INDEX                                  (1 << 6)
++#	define R600_LOW_VOLT_D2_ACPI                               (1 << 8)
++#	define R600_LOW_VOLT_D3_ACPI                               (1 << 9)
++#	define R600_VOLT_PWRMGT_EN                                 (1 << 10)
+ #	define R600_OPEN_DRAIN_PADS				   (1 << 11)
++#	define R600_AVP_SCLK_EN                                    (1 << 12)
++#	define R600_IDCT_SCLK_EN                                   (1 << 13)
++#	define R600_GPU_COUNTER_ACPI                               (1 << 14)
++#	define R600_COUNTER_CLK                                    (1 << 15)
++#	define R600_BACKBIAS_PAD_EN                                (1 << 16)
++#	define R600_BACKBIAS_VALUE                                 (1 << 17)
++#	define R600_BACKBIAS_DPM_CNTL                              (1 << 18)
++#	define R600_SPREAD_SPECTRUM_INDEX                          (1 << 19)
++#	define R600_DYN_SPREAD_SPECTRUM_EN                         (1 << 21)
++
++#define R600_SCLK_PWRMGT_CNTL                                     0x620
++#	define R600_SCLK_PWRMGT_OFF                                (1 << 0)
++#	define R600_SCLK_TURNOFF                                   (1 << 1)
++#	define R600_SPLL_TURNOFF                                   (1 << 2)
++#	define R600_SU_SCLK_USE_BCLK                               (1 << 3)
++#	define R600_DYNAMIC_GFX_ISLAND_PWR_DOWN                    (1 << 4)
++#	define R600_DYNAMIC_GFX_ISLAND_LP                          (1 << 5)
++#	define R600_CLK_TURN_ON_STAGGER                            (1 << 6)
++#	define R600_CLK_TURN_OFF_STAGGER                           (1 << 7)
++#	define R600_FIR_FORCE_TREND_SEL                            (1 << 8)
++#	define R600_FIR_TREND_MODE                                 (1 << 9)
++#	define R600_DYN_GFX_CLK_OFF_EN                             (1 << 10)
++#	define R600_VDDC3D_TURNOFF_D1                              (1 << 11)
++#	define R600_VDDC3D_TURNOFF_D2                              (1 << 12)
++#	define R600_VDDC3D_TURNOFF_D3                              (1 << 13)
++#	define R600_SPLL_TURNOFF_D2                                (1 << 14)
++#	define R600_SCLK_LOW_D1                                    (1 << 15)
++#	define R600_DYN_GFX_CLK_OFF_MC_EN                          (1 << 16)
++
++#define R600_MCLK_PWRMGT_CNTL                                     0x624
++#      define R600_MPLL_PWRMGT_OFF                                (1 << 0)
+ 
+ #define R600_LOWER_GPIO_ENABLE                                     0x710
+ #define R600_CTXSW_VID_LOWER_GPIO_CNTL                             0x718
+@@ -5331,5 +5394,6 @@
+ #   define R500_RS_IP_OFFSET_EN 			(1 << 31)
+ 
+ #define R500_DYN_SCLK_PWMEM_PIPE                        0x000d /* PLL */
++#define R530_MC_ARB_RATIO_CLK_SEQ			0x0016 /* MC */
+ 
+ #endif

find-provides

@@ -0,0 +1,44 @@
+#!/usr/bin/python
+#
+# find-provides: munge the provides dependencies from the kabideps file
+#
+# This software may be freely redistributed under the terms of the GNU
+# General Public License (GPL).
+#
+# Takes a directory prefix, then outputs the kabideps file contents.
+
+__author__ = "Jon Masters <jcm@redhat.com>"
+__version__ = "1.0"
+__date__ = "Tue 25 Jul 2006 04:00 GMT"
+__copyright__ = "Copyright (C) 2006 Red Hat, Inc"
+__license__ = "GPL"
+
+import os
+import re
+import string
+import sys
+
+false = 0
+true = 1
+
+kabideps=""
+
+p = re.compile('^(.*)/symvers-(.*).gz$')
+while true:
+	foo = sys.stdin.readline()
+	if foo == "":
+		break
+	string.split(foo)
+	m = p.match(foo)
+	if m:
+		kabideps=sys.argv[1] + "/kernel-" + m.group(2) + "-kabideps"
+	
+if kabideps == "":
+	sys.exit(0)
+
+if not (os.path.isfile(kabideps)):
+	sys.stderr.write(sys.argv[0] + ": cannot locate kabideps file: " + kabideps + "\n")
+	sys.exit(1)
+
+sys.stderr.write(sys.argv[0] + ": processing kABI: " + kabideps)
+os.system("cat " + kabideps)

fix-abrtd.patch

@@ -0,0 +1,774 @@
+diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
+index b639dcf..346b694 100644
+--- a/fs/binfmt_aout.c
++++ b/fs/binfmt_aout.c
+@@ -32,7 +32,7 @@
+ 
+ static int load_aout_binary(struct linux_binprm *, struct pt_regs * regs);
+ static int load_aout_library(struct file*);
+-static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
++static int aout_core_dump(struct coredump_params *cprm);
+ 
+ static struct linux_binfmt aout_format = {
+ 	.module		= THIS_MODULE,
+@@ -89,8 +89,9 @@ if (file->f_op->llseek) { \
+  * dumping of the process results in another error..
+  */
+ 
+-static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
++static int aout_core_dump(struct coredump_params *cprm)
+ {
++	struct file *file = cprm->file;
+ 	mm_segment_t fs;
+ 	int has_dumped = 0;
+ 	unsigned long dump_start, dump_size;
+@@ -108,16 +109,16 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
+ 	current->flags |= PF_DUMPCORE;
+        	strncpy(dump.u_comm, current->comm, sizeof(dump.u_comm));
+ 	dump.u_ar0 = offsetof(struct user, regs);
+-	dump.signal = signr;
+-	aout_dump_thread(regs, &dump);
++	dump.signal = cprm->signr;
++	aout_dump_thread(cprm->regs, &dump);
+ 
+ /* If the size of the dump file exceeds the rlimit, then see what would happen
+    if we wrote the stack, but not the data area.  */
+-	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
++	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
+ 		dump.u_dsize = 0;
+ 
+ /* Make sure we have enough room to write the stack and data areas. */
+-	if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
++	if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
+ 		dump.u_ssize = 0;
+ 
+ /* make sure we actually have a data and stack area to dump */
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index b9b3bb5..4ee5bb2 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -45,7 +45,7 @@ static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
+  * don't even try.
+  */
+ #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
+-static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
++static int elf_core_dump(struct coredump_params *cprm);
+ #else
+ #define elf_core_dump	NULL
+ #endif
+@@ -1277,8 +1277,9 @@ static int writenote(struct memelfnote *men, struct file *file,
+ }
+ #undef DUMP_WRITE
+ 
+-#define DUMP_WRITE(addr, nr)	\
+-	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
++#define DUMP_WRITE(addr, nr)				\
++	if ((size += (nr)) > cprm->limit ||		\
++	    !dump_write(cprm->file, (addr), (nr)))	\
+ 		goto end_coredump;
+ 
+ static void fill_elf_header(struct elfhdr *elf, int segs,
+@@ -1906,7 +1907,7 @@ static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
+  * and then they are actually written out.  If we run out of core limit
+  * we just truncate.
+  */
+-static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
++static int elf_core_dump(struct coredump_params *cprm)
+ {
+ 	int has_dumped = 0;
+ 	mm_segment_t fs;
+@@ -1952,7 +1953,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
+ 	 * notes.  This also sets up the file header.
+ 	 */
+ 	if (!fill_note_info(elf, segs + 1, /* including notes section */
+-			    &info, signr, regs))
++			    &info, cprm->signr, cprm->regs))
+ 		goto cleanup;
+ 
+ 	has_dumped = 1;
+@@ -2014,14 +2015,14 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
+ #endif
+ 
+  	/* write out the notes section */
+-	if (!write_note_info(&info, file, &foffset))
++	if (!write_note_info(&info, cprm->file, &foffset))
+ 		goto end_coredump;
+ 
+-	if (elf_coredump_extra_notes_write(file, &foffset))
++	if (elf_coredump_extra_notes_write(cprm->file, &foffset))
+ 		goto end_coredump;
+ 
+ 	/* Align to page */
+-	if (!dump_seek(file, dataoff - foffset))
++	if (!dump_seek(cprm->file, dataoff - foffset))
+ 		goto end_coredump;
+ 
+ 	for (vma = first_vma(current, gate_vma); vma != NULL;
+@@ -2038,12 +2039,13 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
+ 			page = get_dump_page(addr);
+ 			if (page) {
+ 				void *kaddr = kmap(page);
+-				stop = ((size += PAGE_SIZE) > limit) ||
+-					!dump_write(file, kaddr, PAGE_SIZE);
++				stop = ((size += PAGE_SIZE) > cprm->limit) ||
++					!dump_write(cprm->file, kaddr,
++						    PAGE_SIZE);
+ 				kunmap(page);
+ 				page_cache_release(page);
+ 			} else
+-				stop = !dump_seek(file, PAGE_SIZE);
++				stop = !dump_seek(cprm->file, PAGE_SIZE);
+ 			if (stop)
+ 				goto end_coredump;
+ 		}
+diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
+index 38502c6..917e1b4 100644
+--- a/fs/binfmt_elf_fdpic.c
++++ b/fs/binfmt_elf_fdpic.c
+@@ -76,7 +76,7 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *,
+ 					     struct file *, struct mm_struct *);
+ 
+ #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
+-static int elf_fdpic_core_dump(long, struct pt_regs *, struct file *, unsigned long limit);
++static int elf_fdpic_core_dump(struct coredump_params *cprm);
+ #endif
+ 
+ static struct linux_binfmt elf_fdpic_format = {
+@@ -1325,8 +1325,9 @@ static int writenote(struct memelfnote *men, struct file *file)
+ #undef DUMP_WRITE
+ #undef DUMP_SEEK
+ 
+-#define DUMP_WRITE(addr, nr)	\
+-	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
++#define DUMP_WRITE(addr, nr)				\
++	if ((size += (nr)) > cprm->limit ||		\
++	    !dump_write(cprm->file, (addr), (nr)))	\
+ 		goto end_coredump;
+ 
+ static inline void fill_elf_fdpic_header(struct elfhdr *elf, int segs)
+@@ -1581,8 +1582,7 @@ static int elf_fdpic_dump_segments(struct file *file, size_t *size,
+  * and then they are actually written out.  If we run out of core limit
+  * we just truncate.
+  */
+-static int elf_fdpic_core_dump(long signr, struct pt_regs *regs,
+-			       struct file *file, unsigned long limit)
++static int elf_fdpic_core_dump(struct coredump_params *cprm)
+ {
+ #define	NUM_NOTES	6
+ 	int has_dumped = 0;
+@@ -1641,7 +1641,7 @@ static int elf_fdpic_core_dump(long signr, struct pt_regs *regs,
+ 		goto cleanup;
+ #endif
+ 
+-	if (signr) {
++	if (cprm->signr) {
+ 		struct core_thread *ct;
+ 		struct elf_thread_status *tmp;
+ 
+@@ -1660,14 +1660,14 @@ static int elf_fdpic_core_dump(long signr, struct pt_regs *regs,
+ 			int sz;
+ 
+ 			tmp = list_entry(t, struct elf_thread_status, list);
+-			sz = elf_dump_thread_status(signr, tmp);
++			sz = elf_dump_thread_status(cprm->signr, tmp);
+ 			thread_status_size += sz;
+ 		}
+ 	}
+ 
+ 	/* now collect the dump for the current */
+-	fill_prstatus(prstatus, current, signr);
+-	elf_core_copy_regs(&prstatus->pr_reg, regs);
++	fill_prstatus(prstatus, current, cprm->signr);
++	elf_core_copy_regs(&prstatus->pr_reg, cprm->regs);
+ 
+ 	segs = current->mm->map_count;
+ #ifdef ELF_CORE_EXTRA_PHDRS
+@@ -1702,7 +1702,7 @@ static int elf_fdpic_core_dump(long signr, struct pt_regs *regs,
+ 
+   	/* Try to dump the FPU. */
+ 	if ((prstatus->pr_fpvalid =
+-	     elf_core_copy_task_fpregs(current, regs, fpu)))
++	     elf_core_copy_task_fpregs(current, cprm->regs, fpu)))
+ 		fill_note(notes + numnote++,
+ 			  "CORE", NT_PRFPREG, sizeof(*fpu), fpu);
+ #ifdef ELF_CORE_COPY_XFPREGS
+@@ -1773,7 +1773,7 @@ static int elf_fdpic_core_dump(long signr, struct pt_regs *regs,
+ 
+  	/* write out the notes section */
+ 	for (i = 0; i < numnote; i++)
+-		if (!writenote(notes + i, file))
++		if (!writenote(notes + i, cprm->file))
+ 			goto end_coredump;
+ 
+ 	/* write out the thread status notes section */
+@@ -1782,14 +1782,15 @@ static int elf_fdpic_core_dump(long signr, struct pt_regs *regs,
+ 				list_entry(t, struct elf_thread_status, list);
+ 
+ 		for (i = 0; i < tmp->num_notes; i++)
+-			if (!writenote(&tmp->notes[i], file))
++			if (!writenote(&tmp->notes[i], cprm->file))
+ 				goto end_coredump;
+ 	}
+ 
+-	if (!dump_seek(file, dataoff))
++	if (!dump_seek(cprm->file, dataoff))
+ 		goto end_coredump;
+ 
+-	if (elf_fdpic_dump_segments(file, &size, &limit, mm_flags) < 0)
++	if (elf_fdpic_dump_segments(cprm->file, &size, &cprm->limit,
++				    mm_flags) < 0)
+ 		goto end_coredump;
+ 
+ #ifdef ELF_CORE_WRITE_EXTRA_DATA
+diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
+index a279665..d4a00ea 100644
+--- a/fs/binfmt_flat.c
++++ b/fs/binfmt_flat.c
+@@ -87,7 +87,7 @@ static int load_flat_shared_library(int id, struct lib_info *p);
+ #endif
+ 
+ static int load_flat_binary(struct linux_binprm *, struct pt_regs * regs);
+-static int flat_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
++static int flat_core_dump(struct coredump_params *cprm);
+ 
+ static struct linux_binfmt flat_format = {
+ 	.module		= THIS_MODULE,
+@@ -102,10 +102,10 @@ static struct linux_binfmt flat_format = {
+  * Currently only a stub-function.
+  */
+ 
+-static int flat_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
++static int flat_core_dump(struct coredump_params *cprm)
+ {
+ 	printk("Process %s:%d received signr %d and should have core dumped\n",
+-			current->comm, current->pid, (int) signr);
++			current->comm, current->pid, (int) cprm->signr);
+ 	return(1);
+ }
+ 
+diff --git a/fs/binfmt_som.c b/fs/binfmt_som.c
+index eff74b9..2a9b533 100644
+--- a/fs/binfmt_som.c
++++ b/fs/binfmt_som.c
+@@ -43,7 +43,7 @@ static int load_som_library(struct file *);
+  * don't even try.
+  */
+ #if 0
+-static int som_core_dump(long signr, struct pt_regs *regs, unsigned long limit);
++static int som_core_dump(struct coredump_params *cprm);
+ #else
+ #define som_core_dump	NULL
+ #endif
+diff --git a/fs/exec.c b/fs/exec.c
+index ba112bd..08ec506 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1749,6 +1749,50 @@ static void wait_for_dump_helpers(struct file *file)
+ }
+ 
+ 
++/*
++ * uhm_pipe_setup
++ * helper function to customize the process used
++ * to collect the core in userspace.  Specifically
++ * it sets up a pipe and installs it as fd 0 (stdin)
++ * for the process.  Returns 0 on success, or
++ * PTR_ERR on failure.
++ * Note that it also sets the core limit to 1.  This
++ * is a special value that we use to trap recursive
++ * core dumps
++ */
++static int umh_pipe_setup(struct subprocess_info *info)
++{
++	struct file *rp, *wp;
++	struct fdtable *fdt;
++	struct coredump_params *cp = (struct coredump_params *)info->data;
++	struct files_struct *cf = current->files;
++
++	wp = create_write_pipe(0);
++	if (IS_ERR(wp))
++		return PTR_ERR(wp);
++
++	rp = create_read_pipe(wp, 0);
++	if (IS_ERR(rp)) {
++		free_write_pipe(wp);
++		return PTR_ERR(rp);
++	}
++
++	cp->file = wp;
++
++	sys_close(0);
++	fd_install(0, rp);
++	spin_lock(&cf->file_lock);
++	fdt = files_fdtable(cf);
++	FD_SET(0, fdt->open_fds);
++	FD_CLR(0, fdt->close_on_exec);
++	spin_unlock(&cf->file_lock);
++
++	/* and disallow core files too */
++	current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};
++
++	return 0;
++}
++
+ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ {
+ 	struct core_state core_state;
+@@ -1756,17 +1800,20 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ 	struct mm_struct *mm = current->mm;
+ 	struct linux_binfmt * binfmt;
+ 	struct inode * inode;
+-	struct file * file;
+ 	const struct cred *old_cred;
+ 	struct cred *cred;
+ 	int retval = 0;
+ 	int flag = 0;
+ 	int ispipe = 0;
+-	unsigned long core_limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
+ 	char **helper_argv = NULL;
+ 	int helper_argc = 0;
+ 	int dump_count = 0;
+ 	static atomic_t core_dump_count = ATOMIC_INIT(0);
++	struct coredump_params cprm = {
++		.signr = signr,
++		.regs = regs,
++		.limit = current->signal->rlim[RLIMIT_CORE].rlim_cur,
++	};
+ 
+ 	audit_core_dumps(signr);
+ 
+@@ -1822,19 +1869,19 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ 	ispipe = format_corename(corename, signr);
+ 	unlock_kernel();
+ 
+-	if ((!ispipe) && (core_limit < binfmt->min_coredump))
++	if ((!ispipe) && (cprm.limit < binfmt->min_coredump))
+ 		goto fail_unlock;
+ 
+  	if (ispipe) {
+-		if (core_limit == 0) {
++		if (cprm.limit == 1) {
+ 			/*
+ 			 * Normally core limits are irrelevant to pipes, since
+ 			 * we're not writing to the file system, but we use
+-			 * core_limit of 0 here as a speacial value. Any
+-			 * non-zero limit gets set to RLIM_INFINITY below, but
++			 * cprm.limit of 1 here as a speacial value. Any
++			 * non-1 limit gets set to RLIM_INFINITY below, but
+ 			 * a limit of 0 skips the dump.  This is a consistent
+ 			 * way to catch recursive crashes.  We can still crash
+-			 * if the core_pattern binary sets RLIM_CORE =  !0
++			 * if the core_pattern binary sets RLIM_CORE =  !1
+ 			 * but it runs as root, and can do lots of stupid things
+ 			 * Note that we use task_tgid_vnr here to grab the pid
+ 			 * of the process group leader.  That way we get the
+@@ -1842,7 +1889,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ 			 * core_pattern process dies.
+ 			 */
+ 			printk(KERN_WARNING
+-				"Process %d(%s) has RLIMIT_CORE set to 0\n",
++				"Process %d(%s) has RLIMIT_CORE set to 1\n",
+ 				task_tgid_vnr(current), current->comm);
+ 			printk(KERN_WARNING "Aborting core\n");
+ 			goto fail_unlock;
+@@ -1863,25 +1910,30 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ 			goto fail_dropcount;
+ 		}
+ 
+-		core_limit = RLIM_INFINITY;
++		cprm.limit = RLIM_INFINITY;
+ 
+ 		/* SIGPIPE can happen, but it's just never processed */
+-		if (call_usermodehelper_pipe(helper_argv[0], helper_argv, NULL,
+-				&file)) {
++		cprm.file = NULL;
++		if (call_usermodehelper_fns(helper_argv[0], helper_argv, NULL,
++					    UMH_WAIT_EXEC, umh_pipe_setup,
++					    NULL, &cprm)) {
++			if (cprm.file)
++				filp_close(cprm.file, NULL);
++
+  			printk(KERN_INFO "Core dump to %s pipe failed\n",
+ 			       corename);
+ 			goto fail_dropcount;
+  		}
+  	} else
+- 		file = filp_open(corename,
++		cprm.file = filp_open(corename,
+ 				 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
+ 				 0600);
+-	if (IS_ERR(file))
++	if (IS_ERR(cprm.file))
+ 		goto fail_dropcount;
+-	inode = file->f_path.dentry->d_inode;
++	inode = cprm.file->f_path.dentry->d_inode;
+ 	if (inode->i_nlink > 1)
+ 		goto close_fail;	/* multiple links - don't dump */
+-	if (!ispipe && d_unhashed(file->f_path.dentry))
++	if (!ispipe && d_unhashed(cprm.file->f_path.dentry))
+ 		goto close_fail;
+ 
+ 	/* AK: actually i see no reason to not allow this for named pipes etc.,
+@@ -1894,21 +1946,22 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ 	 */
+ 	if (!ispipe && (inode->i_uid != current_fsuid()))
+ 		goto close_fail;
+-	if (!file->f_op)
++	if (!cprm.file->f_op)
+ 		goto close_fail;
+-	if (!file->f_op->write)
++	if (!cprm.file->f_op->write)
+ 		goto close_fail;
+-	if (!ispipe && do_truncate(file->f_path.dentry, 0, 0, file) != 0)
++	if (!ispipe &&
++	    do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file) != 0)
+ 		goto close_fail;
+ 
+-	retval = binfmt->core_dump(signr, regs, file, core_limit);
++	retval = binfmt->core_dump(&cprm);
+ 
+ 	if (retval)
+ 		current->signal->group_exit_code |= 0x80;
+ close_fail:
+ 	if (ispipe && core_pipe_limit)
+-		wait_for_dump_helpers(file);
+-	filp_close(file, NULL);
++		wait_for_dump_helpers(cprm.file);
++	filp_close(cprm.file, NULL);
+ fail_dropcount:
+ 	if (dump_count)
+ 		atomic_dec(&core_dump_count);
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index aece486..cd4349b 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -68,6 +68,14 @@ struct linux_binprm{
+ 
+ #define BINPRM_MAX_RECURSION 4
+ 
++/* Function parameter for binfmt->coredump */
++struct coredump_params {
++	long signr;
++	struct pt_regs *regs;
++	struct file *file;
++	unsigned long limit;
++};
++
+ /*
+  * This structure defines the functions that are used to load the binary formats that
+  * linux accepts.
+@@ -77,7 +85,7 @@ struct linux_binfmt {
+ 	struct module *module;
+ 	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
+ 	int (*load_shlib)(struct file *);
+-	int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
++	int (*core_dump)(struct coredump_params *cprm);
+ 	unsigned long min_coredump;	/* minimal dump size */
+ 	int hasvdso;
+ };
+diff --git a/include/linux/kmod.h b/include/linux/kmod.h
+index 384ca8b..ec69956 100644
+--- a/include/linux/kmod.h
++++ b/include/linux/kmod.h
+@@ -23,6 +23,7 @@
+ #include <linux/stddef.h>
+ #include <linux/errno.h>
+ #include <linux/compiler.h>
++#include <linux/workqueue.h>
+ 
+ #define KMOD_PATH_LEN 256
+ 
+@@ -44,7 +45,26 @@ static inline int request_module_nowait(const char *name, ...) { return -ENOSYS;
+ 
+ struct key;
+ struct file;
+-struct subprocess_info;
++
++enum umh_wait {
++	UMH_NO_WAIT = -1,	/* don't wait at all */
++	UMH_WAIT_EXEC = 0,	/* wait for the exec, but not the process */
++	UMH_WAIT_PROC = 1,	/* wait for the process to complete */
++};
++
++struct subprocess_info {
++	struct work_struct work;
++	struct completion *complete;
++	struct cred *cred;
++	char *path;
++	char **argv;
++	char **envp;
++	enum umh_wait wait;
++	int retval;
++	int (*init)(struct subprocess_info *info);
++	void (*cleanup)(struct subprocess_info *info);
++	void *data;
++};
+ 
+ /* Allocate a subprocess_info structure */
+ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv,
+@@ -55,14 +75,10 @@ void call_usermodehelper_setkeys(struct subprocess_info *info,
+ 				 struct key *session_keyring);
+ int call_usermodehelper_stdinpipe(struct subprocess_info *sub_info,
+ 				  struct file **filp);
+-void call_usermodehelper_setcleanup(struct subprocess_info *info,
+-				    void (*cleanup)(char **argv, char **envp));
+-
+-enum umh_wait {
+-	UMH_NO_WAIT = -1,	/* don't wait at all */
+-	UMH_WAIT_EXEC = 0,	/* wait for the exec, but not the process */
+-	UMH_WAIT_PROC = 1,	/* wait for the process to complete */
+-};
++void call_usermodehelper_setfns(struct subprocess_info *info,
++		    int (*init)(struct subprocess_info *info),
++		    void (*cleanup)(struct subprocess_info *info),
++		    void *data);
+ 
+ /* Actually execute the sub-process */
+ int call_usermodehelper_exec(struct subprocess_info *info, enum umh_wait wait);
+@@ -72,7 +88,10 @@ int call_usermodehelper_exec(struct subprocess_info *info, enum umh_wait wait);
+ void call_usermodehelper_freeinfo(struct subprocess_info *info);
+ 
+ static inline int
+-call_usermodehelper(char *path, char **argv, char **envp, enum umh_wait wait)
++call_usermodehelper_fns(char *path, char **argv, char **envp,
++			enum umh_wait wait,
++			int (*init)(struct subprocess_info *info),
++			void (*cleanup)(struct subprocess_info *), void *data)
+ {
+ 	struct subprocess_info *info;
+ 	gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;
+@@ -80,10 +99,18 @@ call_usermodehelper(char *path, char **argv, char **envp, enum umh_wait wait)
+ 	info = call_usermodehelper_setup(path, argv, envp, gfp_mask);
+ 	if (info == NULL)
+ 		return -ENOMEM;
++	call_usermodehelper_setfns(info, init, cleanup, data);
+ 	return call_usermodehelper_exec(info, wait);
+ }
+ 
+ static inline int
++call_usermodehelper(char *path, char **argv, char **envp, enum umh_wait wait)
++{
++	return call_usermodehelper_fns(path, argv, envp,
++				       wait, NULL, NULL, NULL);
++}
++
++static inline int
+ call_usermodehelper_keys(char *path, char **argv, char **envp,
+ 			 struct key *session_keyring, enum umh_wait wait)
+ {
+@@ -100,10 +127,6 @@ call_usermodehelper_keys(char *path, char **argv, char **envp,
+ 
+ extern void usermodehelper_init(void);
+ 
+-struct file;
+-extern int call_usermodehelper_pipe(char *path, char *argv[], char *envp[],
+-				    struct file **filp);
+-
+ extern int usermodehelper_disable(void);
+ extern void usermodehelper_enable(void);
+ 
+diff --git a/kernel/kmod.c b/kernel/kmod.c
+index 9fcb53a..7281229 100644
+--- a/kernel/kmod.c
++++ b/kernel/kmod.c
+@@ -124,19 +124,6 @@ int __request_module(bool wait, const char *fmt, ...)
+ EXPORT_SYMBOL(__request_module);
+ #endif /* CONFIG_MODULES */
+ 
+-struct subprocess_info {
+-	struct work_struct work;
+-	struct completion *complete;
+-	struct cred *cred;
+-	char *path;
+-	char **argv;
+-	char **envp;
+-	enum umh_wait wait;
+-	int retval;
+-	struct file *stdin;
+-	void (*cleanup)(char **argv, char **envp);
+-};
+-
+ /*
+  * This is the task which runs the usermode application
+  */
+@@ -158,26 +145,15 @@ static int ____call_usermodehelper(void *data)
+ 	commit_creds(sub_info->cred);
+ 	sub_info->cred = NULL;
+ 
+-	/* Install input pipe when needed */
+-	if (sub_info->stdin) {
+-		struct files_struct *f = current->files;
+-		struct fdtable *fdt;
+-		/* no races because files should be private here */
+-		sys_close(0);
+-		fd_install(0, sub_info->stdin);
+-		spin_lock(&f->file_lock);
+-		fdt = files_fdtable(f);
+-		FD_SET(0, fdt->open_fds);
+-		FD_CLR(0, fdt->close_on_exec);
+-		spin_unlock(&f->file_lock);
+-
+-		/* and disallow core files too */
+-		current->signal->rlim[RLIMIT_CORE] = (struct rlimit){0, 0};
+-	}
+-
+ 	/* We can run anywhere, unlike our parent keventd(). */
+ 	set_cpus_allowed_ptr(current, cpu_all_mask);
+ 
++	if (sub_info->init) {
++		retval = sub_info->init(sub_info);
++		if (retval)
++			goto fail;
++	}
++
+ 	/*
+ 	 * Our parent is keventd, which runs with elevated scheduling priority.
+ 	 * Avoid propagating that into the userspace child.
+@@ -187,6 +163,7 @@ static int ____call_usermodehelper(void *data)
+ 	retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);
+ 
+ 	/* Exec failed? */
++fail:
+ 	sub_info->retval = retval;
+ 	do_exit(0);
+ }
+@@ -194,7 +171,7 @@ static int ____call_usermodehelper(void *data)
+ void call_usermodehelper_freeinfo(struct subprocess_info *info)
+ {
+ 	if (info->cleanup)
+-		(*info->cleanup)(info->argv, info->envp);
++		(*info->cleanup)(info);
+ 	if (info->cred)
+ 		put_cred(info->cred);
+ 	kfree(info);
+@@ -406,50 +383,31 @@ void call_usermodehelper_setkeys(struct subprocess_info *info,
+ EXPORT_SYMBOL(call_usermodehelper_setkeys);
+ 
+ /**
+- * call_usermodehelper_setcleanup - set a cleanup function
++ * call_usermodehelper_setfns - set a cleanup/init function
+  * @info: a subprocess_info returned by call_usermodehelper_setup
+  * @cleanup: a cleanup function
++ * @init: an init function
++ * @data: arbitrary context sensitive data
++ *
++ * The init function is used to customize the helper process prior to
++ * exec.  A non-zero return code causes the process to error out, exit,
++ * and return the failure to the calling process
+  *
+- * The cleanup function is just befor ethe subprocess_info is about to
++ * The cleanup function is just before ethe subprocess_info is about to
+  * be freed.  This can be used for freeing the argv and envp.  The
+  * Function must be runnable in either a process context or the
+  * context in which call_usermodehelper_exec is called.
+  */
+-void call_usermodehelper_setcleanup(struct subprocess_info *info,
+-				    void (*cleanup)(char **argv, char **envp))
++void call_usermodehelper_setfns(struct subprocess_info *info,
++		    int (*init)(struct subprocess_info *info),
++		    void (*cleanup)(struct subprocess_info *info),
++		    void *data)
+ {
+ 	info->cleanup = cleanup;
++	info->init = init;
++	info->data = data;
+ }
+-EXPORT_SYMBOL(call_usermodehelper_setcleanup);
+-
+-/**
+- * call_usermodehelper_stdinpipe - set up a pipe to be used for stdin
+- * @sub_info: a subprocess_info returned by call_usermodehelper_setup
+- * @filp: set to the write-end of a pipe
+- *
+- * This constructs a pipe, and sets the read end to be the stdin of the
+- * subprocess, and returns the write-end in *@filp.
+- */
+-int call_usermodehelper_stdinpipe(struct subprocess_info *sub_info,
+-				  struct file **filp)
+-{
+-	struct file *f;
+-
+-	f = create_write_pipe(0);
+-	if (IS_ERR(f))
+-		return PTR_ERR(f);
+-	*filp = f;
+-
+-	f = create_read_pipe(f, 0);
+-	if (IS_ERR(f)) {
+-		free_write_pipe(*filp);
+-		return PTR_ERR(f);
+-	}
+-	sub_info->stdin = f;
+-
+-	return 0;
+-}
+-EXPORT_SYMBOL(call_usermodehelper_stdinpipe);
++EXPORT_SYMBOL(call_usermodehelper_setfns);
+ 
+ /**
+  * call_usermodehelper_exec - start a usermode application
+@@ -498,39 +456,6 @@ unlock:
+ }
+ EXPORT_SYMBOL(call_usermodehelper_exec);
+ 
+-/**
+- * call_usermodehelper_pipe - call a usermode helper process with a pipe stdin
+- * @path: path to usermode executable
+- * @argv: arg vector for process
+- * @envp: environment for process
+- * @filp: set to the write-end of a pipe
+- *
+- * This is a simple wrapper which executes a usermode-helper function
+- * with a pipe as stdin.  It is implemented entirely in terms of
+- * lower-level call_usermodehelper_* functions.
+- */
+-int call_usermodehelper_pipe(char *path, char **argv, char **envp,
+-			     struct file **filp)
+-{
+-	struct subprocess_info *sub_info;
+-	int ret;
+-
+-	sub_info = call_usermodehelper_setup(path, argv, envp, GFP_KERNEL);
+-	if (sub_info == NULL)
+-		return -ENOMEM;
+-
+-	ret = call_usermodehelper_stdinpipe(sub_info, filp);
+-	if (ret < 0)
+-		goto out;
+-
+-	return call_usermodehelper_exec(sub_info, UMH_WAIT_EXEC);
+-
+-  out:
+-	call_usermodehelper_freeinfo(sub_info);
+-	return ret;
+-}
+-EXPORT_SYMBOL(call_usermodehelper_pipe);
+-
+ void __init usermodehelper_init(void)
+ {
+ 	khelper_wq = create_singlethread_workqueue("khelper");
+diff --git a/kernel/sys.c b/kernel/sys.c
+index ce17760..0b8a55e 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1600,9 +1600,9 @@ SYSCALL_DEFINE3(getcpu, unsigned __user *, cpup, unsigned __user *, nodep,
+ 
+ char poweroff_cmd[POWEROFF_CMD_PATH_LEN] = "/sbin/poweroff";
+ 
+-static void argv_cleanup(char **argv, char **envp)
++static void argv_cleanup(struct subprocess_info *info)
+ {
+-	argv_free(argv);
++	argv_free(info->argv);
+ }
+ 
+ /**
+@@ -1636,7 +1636,7 @@ int orderly_poweroff(bool force)
+ 		goto out;
+ 	}
+ 
+-	call_usermodehelper_setcleanup(info, argv_cleanup);
++	call_usermodehelper_setfns(info, NULL, argv_cleanup, NULL);
+ 
+ 	ret = call_usermodehelper_exec(info, UMH_NO_WAIT);
+ 

fix-ima-null-ptr-deref.patch

@@ -0,0 +1,54 @@
+From: J. R. Okajima <hooanon05@yahoo.co.jp>
+Date: Sun, 7 Feb 2010 06:48:55 +0000 (+1100)
+Subject: ima: fix null pointer deref
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjmorris%2Fsecurity-testing-2.6.git;a=commitdiff_plain;h=8bb6795424b09db0eca1cccf7a17b93fc28ac7f7
+
+ima: fix null pointer deref
+
+The commit 6c21a7f "LSM: imbed ima calls in the security hooks"
+which moves the ima_file_free() call within security_file_free()
+brought a problem into pipe.c.
+In the error path of pipe(2), the allocated resources are freed by
+path_put() and put_filp() (in this order). Since security_file_free()
+refers f_dentry and ima_file_free() refers f_dentry->d_inode, path_put()
+should be called after put_filp().
+
+Signed-off-by: J. R. Okajima <hooanon05@yahoo.co.jp>
+Signed-off-by: James Morris <jmorris@namei.org>
+---
+
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 37ba29f..90b543d 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -1004,9 +1004,10 @@ struct file *create_write_pipe(int flags)
+ 
+ void free_write_pipe(struct file *f)
+ {
++	struct path path = f->f_path;
+ 	free_pipe_info(f->f_dentry->d_inode);
+-	path_put(&f->f_path);
+ 	put_filp(f);
++	path_put(&path);
+ }
+ 
+ struct file *create_read_pipe(struct file *wrf, int flags)
+@@ -1028,6 +1029,7 @@ int do_pipe_flags(int *fd, int flags)
+ 	struct file *fw, *fr;
+ 	int error;
+ 	int fdw, fdr;
++	struct path path;
+ 
+ 	if (flags & ~(O_CLOEXEC | O_NONBLOCK))
+ 		return -EINVAL;
+@@ -1061,8 +1063,9 @@ int do_pipe_flags(int *fd, int flags)
+  err_fdr:
+ 	put_unused_fd(fdr);
+  err_read_pipe:
+-	path_put(&fr->f_path);
++	path = fr->f_path;
+ 	put_filp(fr);
++	path_put(&path);
+  err_write_pipe:
+ 	free_write_pipe(fw);
+ 	return error;

genkey

@@ -0,0 +1,7 @@
+%pubring kernel.pub
+%secring kernel.sec
+Key-Type: DSA
+Key-Length: 512
+Name-Real: Red Hat, Inc.
+Name-Comment: Kernel Module GPG key
+%commit

hda_intel-prealloc-4mb-dmabuffer.patch

@@ -0,0 +1,35 @@
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c8d9178..7d3bb15 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1774,6 +1774,7 @@ azx_attach_pcm_stream(struct hda_bus *bus, struct hda_codec *codec,
+ 	struct azx_pcm *apcm;
+ 	int pcm_dev = cpcm->device;
+ 	int s, err;
++	size_t prealloc_min = 64*1024;	/* 64KB */
+ 
+ 	if (pcm_dev >= AZX_MAX_PCMS) {
+ 		snd_printk(KERN_ERR SFX "Invalid PCM device number %d\n",
+@@ -1807,10 +1808,21 @@ azx_attach_pcm_stream(struct hda_bus *bus, struct hda_codec *codec,
+ 		if (cpcm->stream[s].substreams)
+ 			snd_pcm_set_ops(pcm, s, &azx_pcm_ops);
+ 	}
++
+ 	/* buffer pre-allocation */
++
++	/* subtle, don't allocate a big buffer for modems...
++	 * also, don't just test 32BIT_MASK, since azx supports
++	 * 64-bit DMA in some cases.
++	 */
++	/* lennart wants a 2.2MB buffer for 2sec of 48khz */
++	if (pcm->dev_class == SNDRV_PCM_CLASS_GENERIC &&
++	    chip->pci->dma_mask >= DMA_32BIT_MASK)
++		prealloc_min = 4 * 1024 * 1024;	/* 4MB */
++
+ 	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV_SG,
+ 					      snd_dma_pci_data(chip->pci),
+-					      1024 * 64, 32 * 1024 * 1024);
++					      prealloc_min, 32 * 1024 * 1024);
+ 	return 0;
+ }
+ 

hdpvr-ir-enable.patch

@@ -0,0 +1,213 @@
+diff -Naurp a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
+--- a/drivers/media/video/hdpvr/hdpvr-core.c	2010-07-06 17:36:44.000000000 -0400
++++ b/drivers/media/video/hdpvr/hdpvr-core.c	2010-07-06 17:38:13.000000000 -0400
+@@ -363,9 +363,8 @@ static int hdpvr_probe(struct usb_interf
+ 		goto error;
+ 	}
+ 
+-#ifdef CONFIG_I2C
+-	/* until i2c is working properly */
+-	retval = 0; /* hdpvr_register_i2c_adapter(dev); */
++#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
++	retval = hdpvr_register_i2c_adapter(dev);
+ 	if (retval < 0) {
+ 		v4l2_err(&dev->v4l2_dev, "registering i2c adapter failed\n");
+ 		goto error;
+@@ -411,12 +410,9 @@ static void hdpvr_disconnect(struct usb_
+ 	mutex_unlock(&dev->io_mutex);
+ 
+ 	/* deregister I2C adapter */
+-#ifdef CONFIG_I2C
++#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
+ 	mutex_lock(&dev->i2c_mutex);
+-	if (dev->i2c_adapter)
+-		i2c_del_adapter(dev->i2c_adapter);
+-	kfree(dev->i2c_adapter);
+-	dev->i2c_adapter = NULL;
++	i2c_del_adapter(&dev->i2c_adapter);
+ 	mutex_unlock(&dev->i2c_mutex);
+ #endif /* CONFIG_I2C */
+ 
+diff -Naurp a/drivers/media/video/hdpvr/hdpvr.h b/drivers/media/video/hdpvr/hdpvr.h
+--- a/drivers/media/video/hdpvr/hdpvr.h	2010-02-24 13:52:17.000000000 -0500
++++ b/drivers/media/video/hdpvr/hdpvr.h	2010-07-06 17:42:20.000000000 -0400
+@@ -101,7 +101,7 @@ struct hdpvr_device {
+ 	struct work_struct	worker;
+ 
+ 	/* I2C adapter */
+-	struct i2c_adapter	*i2c_adapter;
++	struct i2c_adapter	i2c_adapter;
+ 	/* I2C lock */
+ 	struct mutex		i2c_mutex;
+ 
+diff -Naurp a/drivers/media/video/hdpvr/hdpvr-i2c.c b/drivers/media/video/hdpvr/hdpvr-i2c.c
+--- a/drivers/media/video/hdpvr/hdpvr-i2c.c	2010-07-06 17:36:51.000000000 -0400
++++ b/drivers/media/video/hdpvr/hdpvr-i2c.c	2010-07-06 17:45:50.000000000 -0400
+@@ -10,6 +10,8 @@
+  *
+  */
+ 
++#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
++
+ #include <linux/i2c.h>
+ 
+ #include "hdpvr.h"
+@@ -19,10 +21,13 @@
+ 
+ #define REQTYPE_I2C_READ	0xb1
+ #define REQTYPE_I2C_WRITE	0xb0
+-#define REQTYPE_I2C_WRITE_STATT	0xd0
++#define REQTYPE_I2C_WRITE_STAT	0xd0
++
++#define HDPVR_HW_Z8F0811_IR_TX_I2C_ADDR	0x70
++#define HDPVR_HW_Z8F0811_IR_RX_I2C_ADDR	0x71
+ 
+ static int hdpvr_i2c_read(struct hdpvr_device *dev, unsigned char addr,
+-			  char *data, int len)
++			  char *data, int len, int bus)
+ {
+ 	int ret;
+ 	char *buf = kmalloc(len, GFP_KERNEL);
+@@ -32,7 +37,7 @@ static int hdpvr_i2c_read(struct hdpvr_d
+ 	ret = usb_control_msg(dev->udev,
+ 			      usb_rcvctrlpipe(dev->udev, 0),
+ 			      REQTYPE_I2C_READ, CTRL_READ_REQUEST,
+-			      0x100|addr, 0, buf, len, 1000);
++			      bus<<8 | addr, 0, buf, len, 1000);
+ 
+ 	if (ret == len) {
+ 		memcpy(data, buf, len);
+@@ -46,7 +51,7 @@ static int hdpvr_i2c_read(struct hdpvr_d
+ }
+ 
+ static int hdpvr_i2c_write(struct hdpvr_device *dev, unsigned char addr,
+-			   char *data, int len)
++			   char *data, int len, int bus)
+ {
+ 	int ret;
+ 	char *buf = kmalloc(len, GFP_KERNEL);
+@@ -57,17 +62,17 @@ static int hdpvr_i2c_write(struct hdpvr_
+ 	ret = usb_control_msg(dev->udev,
+ 			      usb_sndctrlpipe(dev->udev, 0),
+ 			      REQTYPE_I2C_WRITE, CTRL_WRITE_REQUEST,
+-			      0x100|addr, 0, buf, len, 1000);
++			      bus<<8 | addr, 0, buf, len, 1000);
+ 
+ 	if (ret < 0)
+ 		goto error;
+ 
+ 	ret = usb_control_msg(dev->udev,
+ 			      usb_rcvctrlpipe(dev->udev, 0),
+-			      REQTYPE_I2C_WRITE_STATT, CTRL_READ_REQUEST,
++			      REQTYPE_I2C_WRITE_STAT, CTRL_READ_REQUEST,
+ 			      0, 0, buf, 2, 1000);
+ 
+-	if (ret == 2)
++	if (ret == 2 && buf[1] == (len - 1))
+ 		ret = 0;
+ 	else if (ret >= 0)
+ 		ret = -EIO;
+@@ -93,10 +98,10 @@ static int hdpvr_transfer(struct i2c_ada
+ 
+ 		if (msgs[i].flags & I2C_M_RD)
+ 			retval = hdpvr_i2c_read(dev, addr, msgs[i].buf,
+-						msgs[i].len);
++						msgs[i].len, 1);
+ 		else
+ 			retval = hdpvr_i2c_write(dev, addr, msgs[i].buf,
+-						 msgs[i].len);
++						 msgs[i].len, 1);
+ 	}
+ 
+ 	mutex_unlock(&dev->i2c_mutex);
+@@ -114,31 +119,61 @@ static struct i2c_algorithm hdpvr_algo =
+ 	.functionality = hdpvr_functionality,
+ };
+ 
++static struct i2c_adapter hdpvr_i2c_adap_template = {
++	.name		= "Hauppauge HD PVR I2C",
++	.owner		= THIS_MODULE,
++	.id		= I2C_HW_B_HDPVR,
++	.algo		= &hdpvr_algo,
++	.algo_data	= NULL,
++	.class		= I2C_CLASS_TV_ANALOG,
++};
++
++static struct i2c_board_info hdpvr_i2c_board_info = {
++	I2C_BOARD_INFO("ir_tx_z8f0811_haup", HDPVR_HW_Z8F0811_IR_TX_I2C_ADDR),
++	I2C_BOARD_INFO("ir_rx_z8f0811_haup", HDPVR_HW_Z8F0811_IR_RX_I2C_ADDR),
++};
++
++static int hdpvr_activate_ir(struct hdpvr_device *dev)
++{
++	char buffer[8];
++
++	mutex_lock(&dev->i2c_mutex);
++
++	hdpvr_i2c_read(dev, 0x54, buffer, 1, 0);
++
++	buffer[0] = 0;
++	buffer[1] = 0x8;
++	hdpvr_i2c_write(dev, 0x54, buffer, 2, 1);
++
++	buffer[1] = 0x18;
++	hdpvr_i2c_write(dev, 0x54, buffer, 2, 1);
++
++	mutex_unlock(&dev->i2c_mutex);
++	return 0;
++}
++
++
+ int hdpvr_register_i2c_adapter(struct hdpvr_device *dev)
+ {
+-	struct i2c_adapter *i2c_adap;
+ 	int retval = -ENOMEM;
+ 
+-	i2c_adap = kzalloc(sizeof(struct i2c_adapter), GFP_KERNEL);
+-	if (i2c_adap == NULL)
++	hdpvr_activate_ir(dev);
++
++	memcpy(&dev->i2c_adapter, &hdpvr_i2c_adap_template,
++	       sizeof(struct i2c_adapter));
++	dev->i2c_adapter.dev.parent = &dev->udev->dev;
++
++	i2c_set_adapdata(&dev->i2c_adapter, dev);
++
++	retval = i2c_add_adapter(&dev->i2c_adapter);
++
++	if (retval)
+ 		goto error;
+ 
+-	strlcpy(i2c_adap->name, "Hauppauge HD PVR I2C",
+-		sizeof(i2c_adap->name));
+-	i2c_adap->algo  = &hdpvr_algo;
+-	i2c_adap->class = I2C_CLASS_TV_ANALOG;
+-	i2c_adap->owner = THIS_MODULE;
+-	i2c_adap->dev.parent = &dev->udev->dev;
+-
+-	i2c_set_adapdata(i2c_adap, dev);
+-
+-	retval = i2c_add_adapter(i2c_adap);
+-
+-	if (!retval)
+-		dev->i2c_adapter = i2c_adap;
+-	else
+-		kfree(i2c_adap);
++	i2c_new_device(&dev->i2c_adapter, &hdpvr_i2c_board_info);
+ 
+ error:
+ 	return retval;
+ }
++
++#endif /* CONFIG_I2C */
+diff -Naurp a/drivers/media/video/hdpvr/Makefile b/drivers/media/video/hdpvr/Makefile
+--- a/drivers/media/video/hdpvr/Makefile	2010-07-06 17:36:38.000000000 -0400
++++ b/drivers/media/video/hdpvr/Makefile	2010-07-06 17:35:17.000000000 -0400
+@@ -1,6 +1,4 @@
+-hdpvr-objs	:= hdpvr-control.o hdpvr-core.o hdpvr-video.o
+-
+-hdpvr-$(CONFIG_I2C) += hdpvr-i2c.o
++hdpvr-objs	:= hdpvr-control.o hdpvr-core.o hdpvr-i2c.o hdpvr-video.o
+ 
+ obj-$(CONFIG_VIDEO_HDPVR) += hdpvr.o
+ 

ice1712-fix-revo71-mixer-names.patch

@@ -0,0 +1,42 @@
+diff --git a/sound/pci/ice1712/revo.c b/sound/pci/ice1712/revo.c
+index b508bb3..dc13e2d 100644
+--- a/sound/pci/ice1712/revo.c
++++ b/sound/pci/ice1712/revo.c
+@@ -197,26 +197,26 @@ static int revo51_i2c_init(struct snd_ice1712 *ice,
+ 
+ static const struct snd_akm4xxx_dac_channel revo71_front[] = {
+ 	{
+-		.name = "PCM Playback Volume",
++		.name = "Front Playback Volume",
+ 		.num_channels = 2,
+ 		/* front channels DAC supports muting */
+-		.switch_name = "PCM Playback Switch",
++		.switch_name = "Front Playback Switch",
+ 	},
+ };
+ 
+ static const struct snd_akm4xxx_dac_channel revo71_surround[] = {
+-	AK_DAC("PCM Center Playback Volume", 1),
+-	AK_DAC("PCM LFE Playback Volume", 1),
+-	AK_DAC("PCM Side Playback Volume", 2),
+-	AK_DAC("PCM Rear Playback Volume", 2),
++	AK_DAC("Center Playback Volume", 1),
++	AK_DAC("LFE Playback Volume", 1),
++	AK_DAC("Side Playback Volume", 2),
++	AK_DAC("Rear Playback Volume", 2),
+ };
+ 
+ static const struct snd_akm4xxx_dac_channel revo51_dac[] = {
+-	AK_DAC("PCM Playback Volume", 2),
+-	AK_DAC("PCM Center Playback Volume", 1),
+-	AK_DAC("PCM LFE Playback Volume", 1),
+-	AK_DAC("PCM Rear Playback Volume", 2),
+-	AK_DAC("PCM Headphone Volume", 2),
++	AK_DAC("Front Playback Volume", 2),
++	AK_DAC("Center Playback Volume", 1),
++	AK_DAC("LFE Playback Volume", 1),
++	AK_DAC("Rear Playback Volume", 2),
++	AK_DAC("Headphone Volume", 2),
+ };
+ 
+ static const char *revo51_adc_input_names[] = {

inet_diag-make-sure-we-run-the-same-bytecode-we-audited.patch

@@ -0,0 +1,105 @@
+From 9c6594941166d85bbf7f3bb4a79d01cb3d572eac Mon Sep 17 00:00:00 2001
+From: Nelson Elhage <nelhage@ksplice.com>
+Date: Wed, 3 Nov 2010 16:35:41 +0000
+Subject: inet_diag: Make sure we actually run the same bytecode we audited.
+
+We were using nlmsg_find_attr() to look up the bytecode by attribute when
+auditing, but then just using the first attribute when actually running
+bytecode. So, if we received a message with two attribute elements, where only
+the second had type INET_DIAG_REQ_BYTECODE, we would validate and run different
+bytecode strings.
+
+Fix this by consistently using nlmsg_find_attr everywhere.
+
+Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
+Signed-off-by: Thomas Graf <tgraf@infradead.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv4/inet_diag.c |   27 ++++++++++++++++-----------
+ 1 files changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index a706a47..6fe360f 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -489,9 +489,11 @@ static int inet_csk_diag_dump(struct sock *sk,
+ {
+ 	struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
+ 
+-	if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
++	if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
+ 		struct inet_diag_entry entry;
+-		struct rtattr *bc = (struct rtattr *)(r + 1);
++		const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
++							  sizeof(*r),
++							  INET_DIAG_REQ_BYTECODE);
+ 		struct inet_sock *inet = inet_sk(sk);
+ 
+ 		entry.family = sk->sk_family;
+@@ -511,7 +513,7 @@ static int inet_csk_diag_dump(struct sock *sk,
+ 		entry.dport = ntohs(inet->dport);
+ 		entry.userlocks = sk->sk_userlocks;
+ 
+-		if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
++		if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
+ 			return 0;
+ 	}
+ 
+@@ -526,9 +528,11 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
+ {
+ 	struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
+ 
+-	if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
++	if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
+ 		struct inet_diag_entry entry;
+-		struct rtattr *bc = (struct rtattr *)(r + 1);
++		const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
++							  sizeof(*r),
++							  INET_DIAG_REQ_BYTECODE);
+ 
+ 		entry.family = tw->tw_family;
+ #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
+@@ -547,7 +551,7 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
+ 		entry.dport = ntohs(tw->tw_dport);
+ 		entry.userlocks = 0;
+ 
+-		if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
++		if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
+ 			return 0;
+ 	}
+ 
+@@ -617,7 +621,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
+ 	struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
+ 	struct inet_connection_sock *icsk = inet_csk(sk);
+ 	struct listen_sock *lopt;
+-	struct rtattr *bc = NULL;
++	const struct nlattr *bc = NULL;
+ 	struct inet_sock *inet = inet_sk(sk);
+ 	int j, s_j;
+ 	int reqnum, s_reqnum;
+@@ -637,8 +641,9 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
+ 	if (!lopt || !lopt->qlen)
+ 		goto out;
+ 
+-	if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+-		bc = (struct rtattr *)(r + 1);
++	if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
++		bc = nlmsg_find_attr(cb->nlh, sizeof(*r),
++				     INET_DIAG_REQ_BYTECODE);
+ 		entry.sport = inet->num;
+ 		entry.userlocks = sk->sk_userlocks;
+ 	}
+@@ -671,8 +676,8 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
+ 					&ireq->rmt_addr;
+ 				entry.dport = ntohs(ireq->rmt_port);
+ 
+-				if (!inet_diag_bc_run(RTA_DATA(bc),
+-						    RTA_PAYLOAD(bc), &entry))
++				if (!inet_diag_bc_run(nla_data(bc),
++						      nla_len(bc), &entry))
+ 					continue;
+ 			}
+ 
+-- 
+1.7.3.2
+

ipc-shm-fix-information-leak-to-user.patch

@@ -0,0 +1,30 @@
+From: Vasiliy Kulikov <segooon@gmail.com>
+Date: Sat, 30 Oct 2010 14:22:49 +0000 (+0400)
+Subject: ipc: shm: fix information leak to userland
+X-Git-Tag: v2.6.37-rc1~24
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=3af54c9bd9e6f14f896aac1bb0e8405ae0bc7a44
+
+ipc: shm: fix information leak to userland
+
+The shmid_ds structure is copied to userland with shm_unused{,2,3}
+fields unitialized.  It leads to leaking of contents of kernel stack
+memory.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
+Cc: stable@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+
+diff --git a/ipc/shm.c b/ipc/shm.c
+index fd658a1..7d3bb22 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -479,6 +479,7 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_
+ 	    {
+ 		struct shmid_ds out;
+ 
++		memset(&out, 0, sizeof(out));
+ 		ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
+ 		out.shm_segsz	= in->shm_segsz;
+ 		out.shm_atime	= in->shm_atime;

ipc-zero-struct-memory-for-compat-fns.patch

@@ -0,0 +1,73 @@
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+Date: Wed, 27 Oct 2010 22:34:17 +0000 (-0700)
+Subject: ipc: initialize structure memory to zero for compat functions
+X-Git-Tag: v2.6.37-rc1~85^2~50
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=03145beb455cf5c20a761e8451e30b8a74ba58d9
+
+ipc: initialize structure memory to zero for compat functions
+
+This takes care of leaking uninitialized kernel stack memory to
+userspace from non-zeroed fields in structs in compat ipc functions.
+
+Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Cc: Manfred Spraul <manfred@colorfullife.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+
+diff --git a/ipc/compat.c b/ipc/compat.c
+index 9dc2c7d..845a287 100644
+--- a/ipc/compat.c
++++ b/ipc/compat.c
+@@ -241,6 +241,8 @@ long compat_sys_semctl(int first, int second, int third, void __user *uptr)
+ 	struct semid64_ds __user *up64;
+ 	int version = compat_ipc_parse_version(&third);
+ 
++	memset(&s64, 0, sizeof(s64));
++
+ 	if (!uptr)
+ 		return -EINVAL;
+ 	if (get_user(pad, (u32 __user *) uptr))
+@@ -421,6 +423,8 @@ long compat_sys_msgctl(int first, int second, void __user *uptr)
+ 	int version = compat_ipc_parse_version(&second);
+ 	void __user *p;
+ 
++	memset(&m64, 0, sizeof(m64));
++
+ 	switch (second & (~IPC_64)) {
+ 	case IPC_INFO:
+ 	case IPC_RMID:
+@@ -594,6 +598,8 @@ long compat_sys_shmctl(int first, int second, void __user *uptr)
+ 	int err, err2;
+ 	int version = compat_ipc_parse_version(&second);
+ 
++	memset(&s64, 0, sizeof(s64));
++
+ 	switch (second & (~IPC_64)) {
+ 	case IPC_RMID:
+ 	case SHM_LOCK:
+diff --git a/ipc/compat_mq.c b/ipc/compat_mq.c
+index d8d1e9f..380ea4f 100644
+--- a/ipc/compat_mq.c
++++ b/ipc/compat_mq.c
+@@ -53,6 +53,9 @@ asmlinkage long compat_sys_mq_open(const char __user *u_name,
+ 	void __user *p = NULL;
+ 	if (u_attr && oflag & O_CREAT) {
+ 		struct mq_attr attr;
++
++		memset(&attr, 0, sizeof(attr));
++
+ 		p = compat_alloc_user_space(sizeof(attr));
+ 		if (get_compat_mq_attr(&attr, u_attr) ||
+ 		    copy_to_user(p, &attr, sizeof(attr)))
+@@ -127,6 +130,8 @@ asmlinkage long compat_sys_mq_getsetattr(mqd_t mqdes,
+ 	struct mq_attr __user *p = compat_alloc_user_space(2 * sizeof(*p));
+ 	long ret;
+ 
++	memset(&mqstat, 0, sizeof(mqstat));
++
+ 	if (u_mqstat) {
+ 		if (get_compat_mq_attr(&mqstat, u_mqstat) ||
+ 		    copy_to_user(p, &mqstat, sizeof(mqstat)))

iwlwifi-fix-internal-scan-race.patch

@@ -0,0 +1,123 @@
+From reinette.chatre@intel.com Thu May 13 17:49:59 2010
+Return-path: <reinette.chatre@intel.com>
+Envelope-to: linville@tuxdriver.com
+Delivery-date: Thu, 13 May 2010 17:49:59 -0400
+Received: from mga09.intel.com ([134.134.136.24])
+	by smtp.tuxdriver.com with esmtp (Exim 4.63)
+	(envelope-from <reinette.chatre@intel.com>)
+	id 1OCgI1-0007H3-Eg
+	for linville@tuxdriver.com; Thu, 13 May 2010 17:49:59 -0400
+Received: from orsmga002.jf.intel.com ([10.7.209.21])
+  by orsmga102.jf.intel.com with ESMTP; 13 May 2010 14:48:04 -0700
+X-ExtLoop1: 1
+X-IronPort-AV: E=Sophos;i="4.53,224,1272870000"; 
+   d="scan'208";a="517743256"
+Received: from rchatre-desk.amr.corp.intel.com.jf.intel.com (HELO localhost.localdomain) ([134.134.15.94])
+  by orsmga002.jf.intel.com with ESMTP; 13 May 2010 14:49:12 -0700
+From: Reinette Chatre <reinette.chatre@intel.com>
+To: linville@tuxdriver.com
+Cc: linux-wireless@vger.kernel.org, ipw3945-devel@lists.sourceforge.net, Reinette Chatre <reinette.chatre@intel.com>
+Subject: [PATCH 1/2] iwlwifi: fix internal scan race
+Date: Thu, 13 May 2010 14:49:44 -0700
+Message-Id: <1273787385-9248-2-git-send-email-reinette.chatre@intel.com>
+X-Mailer: git-send-email 1.6.3.3
+In-Reply-To: <1273787385-9248-1-git-send-email-reinette.chatre@intel.com>
+References: <1273787385-9248-1-git-send-email-reinette.chatre@intel.com>
+X-Spam-Score: -4.2 (----)
+X-Spam-Status: No
+Status: RO
+Content-Length: 3370
+Lines: 91
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+It is possible for internal scan to race against itself if the device is
+not returning the scan results from first requests. What happens in this
+case is the cleanup done during the abort of the first internal scan also
+cleans up part of the new scan, causing it to access memory it shouldn't.
+
+Here are details:
+* First internal scan is triggered and scan command sent to device.
+* After seven seconds there is no scan results so the watchdog timer
+  triggers a scan abort.
+* The scan abort succeeds and a SCAN_COMPLETE_NOTIFICATION is received for
+ failed scan.
+* During processing of SCAN_COMPLETE_NOTIFICATION we clear STATUS_SCANNING
+  and queue the "scan_completed" work.
+** At this time, since the problem that caused the internal scan in first
+   place is still present, a new internal scan is triggered.
+The behavior at this point is a bit different between 2.6.34 and 2.6.35
+since 2.6.35 has a lot of this synchronized. The rest of the race
+description will thus be generalized.
+** As part of preparing for the scan "is_internal_short_scan" is set to
+true.
+* At this point the completion work for fist scan is run. As part of this
+  there is some locking missing around the "is_internal_short_scan"
+  variable and it is set to "false".
+** Now the second scan runs and it considers itself a real (not internal0
+   scan and thus causes problems with wrong memory being accessed.
+
+The fix is twofold.
+* Since "is_internal_short_scan" should be protected by mutex, fix this in
+  scan completion work so that changes to it can be serialized.
+* Do not queue a new internal scan if one is in progress.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=15824
+
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+---
+ drivers/net/wireless/iwlwifi/iwl-scan.c |   21 ++++++++++++++++++---
+ 1 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
+index 2367286..a2c4855 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
+@@ -560,6 +560,11 @@ static void iwl_bg_start_internal_scan(struct work_struct *work)
+ 
+ 	mutex_lock(&priv->mutex);
+ 
++	if (priv->is_internal_short_scan == true) {
++		IWL_DEBUG_SCAN(priv, "Internal scan already in progress\n");
++		goto unlock;
++	}
++
+ 	if (!iwl_is_ready_rf(priv)) {
+ 		IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
+ 		goto unlock;
+@@ -957,17 +962,27 @@ void iwl_bg_scan_completed(struct work_struct *work)
+ {
+ 	struct iwl_priv *priv =
+ 	    container_of(work, struct iwl_priv, scan_completed);
++	bool internal = false;
+ 
+ 	IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
+ 
+ 	cancel_delayed_work(&priv->scan_check);
+ 
+-	if (!priv->is_internal_short_scan)
+-		ieee80211_scan_completed(priv->hw, false);
+-	else {
++	mutex_lock(&priv->mutex);
++	if (priv->is_internal_short_scan) {
+ 		priv->is_internal_short_scan = false;
+ 		IWL_DEBUG_SCAN(priv, "internal short scan completed\n");
++		internal = true;
+ 	}
++	mutex_unlock(&priv->mutex);
++
++	/*
++	 * Do not hold mutex here since this will cause mac80211 to call
++	 * into driver again into functions that will attempt to take
++	 * mutex.
++	 */
++	if (!internal)
++		ieee80211_scan_completed(priv->hw, false);
+ 
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ 		return;
+-- 
+1.6.3.3
+
+
+

iwlwifi-fix-scan-races.patch

@@ -0,0 +1,139 @@
+commit 88be026490ed89c2ffead81a52531fbac5507e01
+Author: Johannes Berg <johannes.berg@intel.com>
+Date:   Wed Apr 7 00:21:36 2010 -0700
+
+    iwlwifi: fix scan races
+    
+    When an internal scan is started, nothing protects the
+    is_internal_short_scan variable which can cause crashes,
+    cf. https://bugzilla.kernel.org/show_bug.cgi?id=15667.
+    Fix this by making the short scan request use the mutex
+    for locking, which requires making the request go to a
+    work struct so that it can sleep.
+    
+    Reported-by: Peter Zijlstra <peterz@infradead.org>
+    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index e4c2e1e..ba0fdba 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3330,6 +3330,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
+ 
+ 	cancel_delayed_work_sync(&priv->init_alive_start);
+ 	cancel_delayed_work(&priv->scan_check);
++	cancel_work_sync(&priv->start_internal_scan);
+ 	cancel_delayed_work(&priv->alive_start);
+ 	cancel_work_sync(&priv->beacon_update);
+ 	del_timer_sync(&priv->statistics_periodic);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index 894bcb8..1459cdb 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -3357,7 +3357,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
+ 	 */
+ 	IWL_DEBUG_INFO(priv, "perform radio reset.\n");
+ 	iwl_internal_short_hw_scan(priv);
+-	return;
+ }
+ 
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
+index 732590f..36940a9 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.h
++++ b/drivers/net/wireless/iwlwifi/iwl-core.h
+@@ -506,7 +506,7 @@ void iwl_init_scan_params(struct iwl_priv *priv);
+ int iwl_scan_cancel(struct iwl_priv *priv);
+ int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
+ int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
+-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
++void iwl_internal_short_hw_scan(struct iwl_priv *priv);
+ int iwl_force_reset(struct iwl_priv *priv, int mode);
+ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
+ 		       const u8 *ie, int ie_len, int left);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
+index 6054c5f..ef1720a 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
+@@ -1296,6 +1296,7 @@ struct iwl_priv {
+ 	struct work_struct tt_work;
+ 	struct work_struct ct_enter;
+ 	struct work_struct ct_exit;
++	struct work_struct start_internal_scan;
+ 
+ 	struct tasklet_struct irq_tasklet;
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
+index bd2f7c4..5062f4e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
+@@ -469,6 +469,8 @@ EXPORT_SYMBOL(iwl_init_scan_params);
+ 
+ static int iwl_scan_initiate(struct iwl_priv *priv)
+ {
++	WARN_ON(!mutex_is_locked(&priv->mutex));
++
+ 	IWL_DEBUG_INFO(priv, "Starting scan...\n");
+ 	set_bit(STATUS_SCANNING, &priv->status);
+ 	priv->is_internal_short_scan = false;
+@@ -546,24 +548,31 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
+  * internal short scan, this function should only been called while associated.
+  * It will reset and tune the radio to prevent possible RF related problem
+  */
+-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
++void iwl_internal_short_hw_scan(struct iwl_priv *priv)
+ {
+-	int ret = 0;
++	queue_work(priv->workqueue, &priv->start_internal_scan);
++}
++
++static void iwl_bg_start_internal_scan(struct work_struct *work)
++{
++	struct iwl_priv *priv =
++		container_of(work, struct iwl_priv, start_internal_scan);
++
++	mutex_lock(&priv->mutex);
+ 
+ 	if (!iwl_is_ready_rf(priv)) {
+-		ret = -EIO;
+ 		IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
+-		goto out;
++		goto unlock;
+ 	}
++
+ 	if (test_bit(STATUS_SCANNING, &priv->status)) {
+ 		IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
+-		ret = -EAGAIN;
+-		goto out;
++		goto unlock;
+ 	}
++
+ 	if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+ 		IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
+-		ret = -EAGAIN;
+-		goto out;
++		goto unlock;
+ 	}
+ 
+ 	priv->scan_bands = 0;
+@@ -576,9 +585,8 @@ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+ 	set_bit(STATUS_SCANNING, &priv->status);
+ 	priv->is_internal_short_scan = true;
+ 	queue_work(priv->workqueue, &priv->request_scan);
+-
+-out:
+-	return ret;
++ unlock:
++	mutex_unlock(&priv->mutex);
+ }
+ EXPORT_SYMBOL(iwl_internal_short_hw_scan);
+ 
+@@ -964,6 +972,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
+ 	INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
+ 	INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
+ 	INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
++	INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
+ 	INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
+ }
+ EXPORT_SYMBOL(iwl_setup_scan_deferred_work);

iwlwifi-manage-QoS-by-mac-stack.patch

@@ -0,0 +1,100 @@
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+To: kernel@lists.fedoraproject.org, "John W. Linville" <linville@redhat.com>
+Subject: [PATCH 1/4 2.6.32.y] mac80211: explicitly disable/enable QoS
+Date: Fri, 11 Jun 2010 17:03:13 +0200
+
+Add interface to disable/enable QoS (aka WMM or WME). Currently drivers
+enable it explicitly when ->conf_tx method is called, and newer disable.
+Disabling is needed for some APs, which do not support QoS, such
+we should send QoS frames to them.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ include/net/mac80211.h |    5 +++++
+ net/mac80211/mlme.c    |    9 ++++++++-
+ net/mac80211/util.c    |    5 +++++
+ 3 files changed, 18 insertions(+), 1 deletions(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index c39ed07..de904fc 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -572,11 +572,15 @@ struct ieee80211_rx_status {
+  *	may turn the device off as much as possible. Typically, this flag will
+  *	be set when an interface is set UP but not associated or scanning, but
+  *	it can also be unset in that case when monitor interfaces are active.
++ * @IEEE80211_CONF_QOS: Enable 802.11e QoS also know as WMM (Wireless
++ *      Multimedia). On some drivers (iwlwifi is one of know) we have
++ *      to enable/disable QoS explicitly.
+  */
+ enum ieee80211_conf_flags {
+ 	IEEE80211_CONF_RADIOTAP		= (1<<0),
+ 	IEEE80211_CONF_PS		= (1<<1),
+ 	IEEE80211_CONF_IDLE		= (1<<2),
++	IEEE80211_CONF_QOS		= (1<<3),
+ };
+ 
+ 
+@@ -599,6 +603,7 @@ enum ieee80211_conf_changed {
+ 	IEEE80211_CONF_CHANGE_CHANNEL		= BIT(6),
+ 	IEEE80211_CONF_CHANGE_RETRY_LIMITS	= BIT(7),
+ 	IEEE80211_CONF_CHANGE_IDLE		= BIT(8),
++	IEEE80211_CONF_CHANGE_QOS		= BIT(9),
+ };
+ 
+ /**
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 4a15df1..d3950b7 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -786,6 +786,9 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
+ 	int count;
+ 	u8 *pos;
+ 
++	if (!local->ops->conf_tx)
++		return;
++
+ 	if (!(ifmgd->flags & IEEE80211_STA_WMM_ENABLED))
+ 		return;
+ 
+@@ -844,11 +847,15 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
+ 		       wiphy_name(local->hw.wiphy), queue, aci, acm,
+ 		       params.aifs, params.cw_min, params.cw_max, params.txop);
+ #endif
+-		if (drv_conf_tx(local, queue, &params) && local->ops->conf_tx)
++		if (drv_conf_tx(local, queue, &params))
+ 			printk(KERN_DEBUG "%s: failed to set TX queue "
+ 			       "parameters for queue %d\n",
+ 			       wiphy_name(local->hw.wiphy), queue);
+ 	}
++
++	/* enable WMM or activate new settings */
++	local->hw.conf.flags |=	IEEE80211_CONF_QOS;
++	drv_config(local, IEEE80211_CONF_CHANGE_QOS);
+ }
+ 
+ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 31b1085..21f11cc 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -791,6 +791,11 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
+ 
+ 		drv_conf_tx(local, queue, &qparam);
+ 	}
++
++	/* after reinitialize QoS TX queues setting to default,
++	 * disable QoS at all */
++	local->hw.conf.flags &=	~IEEE80211_CONF_QOS;
++	drv_config(local, IEEE80211_CONF_CHANGE_QOS);
+ }
+ 
+ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
+-- 
+1.6.2.5
+
+_______________________________________________
+kernel mailing list
+kernel@lists.fedoraproject.org
+https://admin.fedoraproject.org/mailman/listinfo/kernel
+

iwlwifi-recover_from_tx_stall.patch

@@ -0,0 +1,13 @@
+https://bugzilla.redhat.com/show_bug.cgi?id=589777#c5
+
+diff -up linux-2.6.33.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c.orig linux-2.6.33.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c
+--- linux-2.6.33.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c.orig	2010-05-19 16:07:15.000000000 -0400
++++ linux-2.6.33.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-05-19 16:09:42.000000000 -0400
+@@ -2794,6 +2794,7 @@ static struct iwl_lib_ops iwl3945_lib = 
+ 	.post_associate = iwl3945_post_associate,
+ 	.isr = iwl_isr_legacy,
+ 	.config_ap = iwl3945_config_ap,
++	.recover_from_tx_stall = iwl_bg_monitor_recover,
+ };
+ 
+ static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {

iwlwifi-reset-card-during-probe.patch

@@ -0,0 +1,167 @@
+From linville@redhat.com Mon Mar 29 14:49:37 2010
+Return-path: <linville@redhat.com>
+Envelope-to: linville@tuxdriver.com
+Delivery-date: Mon, 29 Mar 2010 14:49:37 -0400
+Received: from mx1.redhat.com ([209.132.183.28])
+	by smtp.tuxdriver.com with esmtp (Exim 4.63)
+	(envelope-from <linville@redhat.com>)
+	id 1NwK1n-0004Zz-SW
+	for linville@tuxdriver.com; Mon, 29 Mar 2010 14:49:37 -0400
+Received: from int-mx04.intmail.prod.int.phx2.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.17])
+	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o2TInYO7028996
+	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
+	for <linville@tuxdriver.com>; Mon, 29 Mar 2010 14:49:35 -0400
+Received: from savage.usersys.redhat.com (savage.devel.redhat.com [10.11.231.4])
+	by int-mx04.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o2TInX27023483
+	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
+	for <linville@tuxdriver.com>; Mon, 29 Mar 2010 14:49:33 -0400
+Received: from savage.usersys.redhat.com (localhost.localdomain [127.0.0.1])
+	by savage.usersys.redhat.com (8.13.1/8.13.1) with ESMTP id o2TInXPn000652
+	for <linville@tuxdriver.com>; Mon, 29 Mar 2010 14:49:33 -0400
+Received: (from linville@localhost)
+	by savage.usersys.redhat.com (8.13.1/8.13.1/Submit) id o2TInWt7000651
+	for linville@tuxdriver.com; Mon, 29 Mar 2010 14:49:32 -0400
+Resent-Message-Id: <201003291849.o2TInWt7000651@savage.usersys.redhat.com>
+Received: from zmta03.collab.prod.int.phx2.redhat.com (LHLO
+ zmta03.collab.prod.int.phx2.redhat.com) (10.5.5.33) by
+ mail03.corp.redhat.com with LMTP; Fri, 26 Mar 2010 06:05:51 -0400 (EDT)
+Received: from localhost (localhost.localdomain [127.0.0.1])
+	by zmta03.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 038004CBE9;
+	Fri, 26 Mar 2010 06:05:51 -0400 (EDT)
+Received: from zmta03.collab.prod.int.phx2.redhat.com ([127.0.0.1])
+	by localhost (zmta03.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
+	with ESMTP id IVjBQyibLBw2; Fri, 26 Mar 2010 06:05:50 -0400 (EDT)
+Received: from int-mx04.intmail.prod.int.phx2.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.17])
+	by zmta03.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id BF0144CBE7;
+	Fri, 26 Mar 2010 06:05:50 -0400 (EDT)
+Received: from mx1.redhat.com (ext-mx08.extmail.prod.ext.phx2.redhat.com [10.5.110.12])
+	by int-mx04.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o2QA5m7L004056;
+	Fri, 26 Mar 2010 06:05:49 -0400
+Received: from bastion.fedoraproject.org (bastion.phx2.fedoraproject.org [10.5.126.11])
+	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o2QA5bS2028477;
+	Fri, 26 Mar 2010 06:05:37 -0400
+Received: from lists.fedoraproject.org (collab1.vpn.fedoraproject.org [192.168.1.21])
+	by bastion02.phx2.fedoraproject.org (Postfix) with ESMTP id 16EF710F96C;
+	Fri, 26 Mar 2010 10:05:37 +0000 (UTC)
+Received: from collab1.fedoraproject.org (localhost.localdomain [127.0.0.1])
+	by lists.fedoraproject.org (Postfix) with ESMTP id 1C8C93267AC;
+	Fri, 26 Mar 2010 10:05:19 +0000 (UTC)
+X-Original-To: kernel@lists.fedoraproject.org
+Delivered-To: kernel@lists.fedoraproject.org
+Received: from smtp-mm1.fedoraproject.org (smtp-mm1.fedoraproject.org
+	[80.239.156.217])
+	by lists.fedoraproject.org (Postfix) with ESMTP id 5FD26326780
+	for <kernel@lists.fedoraproject.org>;
+	Fri, 26 Mar 2010 10:05:14 +0000 (UTC)
+Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
+	by smtp-mm1.fedoraproject.org (Postfix) with ESMTP id 9BB6A87E5F
+	for <kernel@lists.fedoraproject.org>;
+	Fri, 26 Mar 2010 10:05:13 +0000 (UTC)
+Received: from int-mx08.intmail.prod.int.phx2.redhat.com
+	(int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.21])
+	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o2QA5CbS005173
+	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
+	Fri, 26 Mar 2010 06:05:12 -0400
+Received: from localhost (dhcp-0-189.brq.redhat.com [10.34.0.189])
+	by int-mx08.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
+	id o2QA5BKo028563; Fri, 26 Mar 2010 06:05:11 -0400
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+To: kernel@lists.fedoraproject.org
+Subject: [PATCH 2/3] iwlwifi: reset card during probe
+Date: Fri, 26 Mar 2010 11:03:26 +0100
+Message-Id: <1269597807-2925-2-git-send-email-sgruszka@redhat.com>
+In-Reply-To: <1269597807-2925-1-git-send-email-sgruszka@redhat.com>
+References: <1269597807-2925-1-git-send-email-sgruszka@redhat.com>
+X-Scanned-By: MIMEDefang 2.67 on 10.5.11.17
+X-Scanned-By: MIMEDefang 2.67 on 10.5.11.17
+X-Scanned-By: MIMEDefang 2.67 on 10.5.110.12
+X-Scanned-By: MIMEDefang 2.67 on 10.5.11.21
+Cc: Stanislaw Gruszka <sgruszka@redhat.com>,
+        "John W. Linville" <linville@tuxdriver.com>
+X-BeenThere: kernel@lists.fedoraproject.org
+X-Mailman-Version: 2.1.9
+Precedence: list
+List-Id: "Fedora kernel development." <kernel.lists.fedoraproject.org>
+List-Unsubscribe: <https://admin.fedoraproject.org/mailman/listinfo/kernel>,
+	<mailto:kernel-request@lists.fedoraproject.org?subject=unsubscribe>
+List-Archive: <http://lists.fedoraproject.org/pipermail/kernel>
+List-Post: <mailto:kernel@lists.fedoraproject.org>
+List-Help: <mailto:kernel-request@lists.fedoraproject.org?subject=help>
+List-Subscribe: <https://admin.fedoraproject.org/mailman/listinfo/kernel>,
+	<mailto:kernel-request@lists.fedoraproject.org?subject=subscribe>
+MIME-Version: 1.0
+Content-Type: text/plain; charset="us-ascii"
+Content-Transfer-Encoding: 7bit
+Sender: kernel-bounces@lists.fedoraproject.org
+Errors-To: kernel-bounces@lists.fedoraproject.org
+X-RedHat-Spam-Score: -0.01  (T_RP_MATCHES_RCVD)
+Resent-From: linville@redhat.com
+Resent-Date: Mon, 29 Mar 2010 14:49:32 -0400
+Resent-To: linville@tuxdriver.com
+X-Spam-Score: -8.8 (--------)
+X-Spam-Status: No
+Content-Length: 2455
+Lines: 61
+
+RHBZ#557084 
+
+To ensure that card is in a sane state during probe we add a reset call.
+This change was prompted by users of kdump who was not able to bring up the
+wireless driver in the kdump kernel. The problem here was that the primary
+kernel, which is not running at the time, left the wireless card up and
+running. When the kdump kernel starts it is thus possible to immediately
+receive interrupts from firmware after registering interrupt, but without
+being ready to deal with interrupts from firmware yet.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/iwlwifi/iwl-agn.c      |    8 ++++++++
+ drivers/net/wireless/iwlwifi/iwl3945-base.c |    7 +++++++
+ 2 files changed, 15 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index 921dc4a..1661f3c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -2976,6 +2976,14 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	 * we should init now
+ 	 */
+ 	spin_lock_init(&priv->reg_lock);
++
++	/*
++	 * stop and reset the on-board processor just in case it is in a
++	 * strange state ... like being left stranded by a primary kernel
++	 * and this is now the kdump kernel trying to start up
++	 */
++	iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
++
+ 	iwl_hw_detect(priv);
+ 	IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n",
+ 		priv->cfg->name, priv->hw_rev);
+diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+index 5f26c93..3726b01 100644
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -4032,6 +4032,13 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
+ 	IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s\n",
+ 		priv->cfg->name);
+ 
++	/*
++	 * stop and reset the on-board processor just in case it is in a
++	 * strange state ... like being left stranded by a primary kernel
++	 * and this is now the kdump kernel trying to start up
++	 */
++	iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
++
+ 	/***********************
+ 	 * 7. Setup Services
+ 	 * ********************/
+-- 
+1.6.2.5
+
+_______________________________________________
+kernel mailing list
+kernel@lists.fedoraproject.org
+https://admin.fedoraproject.org/mailman/listinfo/kernel
+
+

iwlwifi_-Adjusting-PLCP-error-threshold-for-1000-NIC.patch

@@ -0,0 +1,38 @@
+Back-port of the following upstream commit...
+
+commit 6c3872e1d52290dcd506473028867cacc6b7393d
+Author: Trieu 'Andrew' Nguyen <trieux.t.nguyen@intel.com>
+Date:   Mon Feb 8 13:53:05 2010 -0800
+
+    iwlwifi: Adjusting PLCP error threshold for 1000 NIC
+    
+    While testing the station with the NIC 1000 family, it is found that
+    the plcp error can easily exceed 50 value in 100mSecs.  This creates
+    unneccessary radio reset/tuning.  This patch raises the PLCP error
+    threshold of the NIC 1000 from 50 to 200 error count.
+    
+    Signed-off-by: Trieu 'Andrew' Nguyen <trieux.t.nguyen@intel.com>
+    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig	2010-03-22 14:23:01.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-22 15:33:38.000000000 -0400
+@@ -162,6 +162,6 @@ struct iwl_cfg iwl1000_bgn_cfg = {
+ 	.shadow_ram_support = false,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+-	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
+ };
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig	2010-03-22 15:24:28.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-22 15:33:00.000000000 -0400
+@@ -970,6 +970,7 @@ struct traffic_stats {
+ #define IWL_MAX_PLCP_ERR_THRESHOLD_MIN	(0)
+ #define IWL_MAX_PLCP_ERR_THRESHOLD_DEF	(50)
+ #define IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF	(100)
++#define IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF	(200)
+ #define IWL_MAX_PLCP_ERR_THRESHOLD_MAX	(255)
+ 
+ enum iwl_reset {

iwlwifi_-Logic-to-control-how-frequent-radio-should-be-reset-if-needed.patch

@@ -0,0 +1,82 @@
+Back-port of the following upstream commit...
+
+commit d4d59e88cb746165c6fe33eacb6f582d525c6ef1
+Author: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date:   Fri Jan 22 14:22:45 2010 -0800
+
+    iwlwifi: Logic to control how frequent radio should be reset if needed
+    
+    Add additional logic for internal scan routine to control how
+    frequent this function should be performed.
+    
+    The intent of this function is to reset/re-tune the radio and bring the
+    RF/PHY back to normal state, it does not make sense calling it too
+    frequent,
+    if reset the radio can not bring it back to normal state, it indicate
+    there are other reason to cause the radio not operate correctly.
+    
+    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig	2010-03-22 11:26:18.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-22 14:12:32.000000000 -0400
+@@ -1013,6 +1013,7 @@ struct iwl_priv {
+ 	unsigned long scan_start;
+ 	unsigned long scan_pass_start;
+ 	unsigned long scan_start_tsf;
++	unsigned long last_internal_scan_jiffies;
+ 	void *scan;
+ 	int scan_bands;
+ 	struct cfg80211_scan_request *scan_request;
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c.orig	2010-03-22 11:26:18.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c	2010-03-22 14:15:28.000000000 -0400
+@@ -206,7 +206,8 @@ static void iwl_rx_scan_results_notif(st
+ #endif
+ 
+ 	priv->last_scan_jiffies = jiffies;
+-	priv->next_scan_jiffies = 0;
++	if (!priv->is_internal_short_scan)
++		priv->next_scan_jiffies = 0;
+ }
+ 
+ /* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
+@@ -252,8 +253,11 @@ static void iwl_rx_scan_complete_notif(s
+ 			goto reschedule;
+ 	}
+ 
+-	priv->last_scan_jiffies = jiffies;
+-	priv->next_scan_jiffies = 0;
++	if (!priv->is_internal_short_scan)
++		priv->next_scan_jiffies = 0;
++	else
++		priv->last_internal_scan_jiffies = jiffies;
++
+ 	IWL_DEBUG_INFO(priv, "Setting scan to off\n");
+ 
+ 	clear_bit(STATUS_SCANNING, &priv->status);
+@@ -560,6 +564,8 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
+  * internal short scan, this function should only been called while associated.
+  * It will reset and tune the radio to prevent possible RF related problem
+  */
++#define IWL_DELAY_NEXT_INTERNAL_SCAN (HZ*1)
++
+ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+ {
+ 	int ret = 0;
+@@ -579,6 +585,13 @@ int iwl_internal_short_hw_scan(struct iw
+ 		ret = -EAGAIN;
+ 		goto out;
+ 	}
++	if (priv->last_internal_scan_jiffies &&
++	    time_after(priv->last_internal_scan_jiffies +
++		       IWL_DELAY_NEXT_INTERNAL_SCAN, jiffies)) {
++		IWL_DEBUG_SCAN(priv, "internal scan rejected\n");
++		goto out;
++	}
++
+ 	priv->scan_bands = 0;
+ 	if (priv->band == IEEE80211_BAND_5GHZ)
+ 		priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);

iwlwifi_-Recover-TX-flow-failure.patch

@@ -0,0 +1,137 @@
+This patch is not upstream yet...
+
+From 34c75818bfcd65e54fed9fe852fc41aba8cf233d Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Thu, 4 Mar 2010 13:38:59 -0800
+Subject: [PATCH 15/17] iwlwifi: Recover TX flow failure
+
+Monitors the tx statistics to detect the drop in throughput.
+When the throughput drops, the ratio of the actual_ack_count and the
+expected_ack_count also drops.  At the same time, the aggregated
+ba_timeout (the number of ba timeout retries) also rises.  If the
+actual_ack_count/expected_ack_count ratio is 0 and the number of ba
+timeout retries rises to BA_TIMEOUT_MAX, no tx packets can be delivered.
+Reloading the uCode and bring the system back to normal operational
+state.
+
+Signed-off-by: Trieu 'Andrew' Nguyen <trieux.t.nguyen@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c.orig	2010-03-22 15:48:54.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c	2010-03-22 16:06:01.000000000 -0400
+@@ -2559,10 +2559,21 @@ static int iwl_mac_ampdu_action(struct i
+ 			return ret;
+ 	case IEEE80211_AMPDU_TX_START:
+ 		IWL_DEBUG_HT(priv, "start Tx\n");
+-		return iwl_tx_agg_start(priv, sta->addr, tid, ssn);
++		ret = iwl_tx_agg_start(priv, sta->addr, tid, ssn);
++		if (ret == 0) {
++			priv->_agn.agg_tids_count++;
++			IWL_DEBUG_HT(priv, "priv->_agn.agg_tids_count = %u\n",
++				     priv->_agn.agg_tids_count);
++		}
++		return ret;
+ 	case IEEE80211_AMPDU_TX_STOP:
+ 		IWL_DEBUG_HT(priv, "stop Tx\n");
+ 		ret = iwl_tx_agg_stop(priv, sta->addr, tid);
++		if ((ret == 0) && (priv->_agn.agg_tids_count > 0)) {
++			priv->_agn.agg_tids_count--;
++			IWL_DEBUG_HT(priv, "priv->_agn.agg_tids_count = %u\n",
++				     priv->_agn.agg_tids_count);
++		}
+ 		if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ 			return 0;
+ 		else
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig	2010-03-22 16:08:56.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c	2010-03-22 16:08:53.000000000 -0400
+@@ -1494,6 +1494,7 @@ int iwl_init_drv(struct iwl_priv *priv)
+ 	priv->band = IEEE80211_BAND_2GHZ;
+ 
+ 	priv->iw_mode = NL80211_IFTYPE_STATION;
++	priv->_agn.agg_tids_count = 0;
+ 
+ 	priv->current_ht_config.sm_ps = WLAN_HT_CAP_SM_PS_DISABLED;
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig	2010-03-22 15:48:54.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-22 16:06:01.000000000 -0400
+@@ -1206,6 +1206,16 @@ struct iwl_priv {
+ 	u16 beacon_int;
+ 	struct ieee80211_vif *vif;
+ 
++	union {
++		struct {
++			/*
++			 * reporting the number of tids has AGG on. 0 means
++			 * no AGGREGATION
++			 */
++			u8 agg_tids_count;
++		} _agn;
++	};
++
+ 	/*Added for 3945 */
+ 	void *shared_virt;
+ 	dma_addr_t shared_phys;
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig	2010-03-22 16:02:35.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c	2010-03-22 16:06:01.000000000 -0400
+@@ -550,9 +550,18 @@ static void iwl_rx_calc_noise(struct iwl
+ 
+ #define REG_RECALIB_PERIOD (60)
+ 
++/* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
++#define ACK_CNT_RATIO (50)
++#define BA_TIMEOUT_CNT (5)
++#define BA_TIMEOUT_MAX (16)
++
+ #define PLCP_MSG "plcp_err exceeded %u, %u, %u, %u, %u, %d, %u mSecs\n"
+ /*
+- * This function checks for plcp error.
++ * This function checks for plcp error, ACK count ratios, aggregated BA
++ * timeout retries.
++ * - When the ACK count ratio is 0 and aggregated BA timeout retries is
++ * exceeding the BA_TIMEOUT_MAX, it will recover the failure by resetting
++ * the firmware.
+  * - When the plcp error is exceeding the thresholds, it will reset the radio
+  * to improve the throughput.
+  */
+@@ -562,6 +571,36 @@ void iwl_recover_from_statistics(struct 
+ 	int combined_plcp_delta;
+ 	unsigned int plcp_msec;
+ 	unsigned long plcp_received_jiffies;
++	int actual_ack_cnt_delta;
++	int expected_ack_cnt_delta;
++	int ba_timeout_delta;
++
++	actual_ack_cnt_delta =
++		le32_to_cpu(pkt->u.stats.tx.actual_ack_cnt) -
++		le32_to_cpu(priv->statistics.tx.actual_ack_cnt);
++	expected_ack_cnt_delta =
++		le32_to_cpu(pkt->u.stats.tx.expected_ack_cnt) -
++		le32_to_cpu(priv->statistics.tx.expected_ack_cnt);
++	ba_timeout_delta =
++		le32_to_cpu(pkt->u.stats.tx.agg.ba_timeout) -
++		le32_to_cpu(priv->statistics.tx.agg.ba_timeout);
++	if ((priv->_agn.agg_tids_count > 0) &&
++	    (expected_ack_cnt_delta > 0) &&
++	    (((actual_ack_cnt_delta * 100) / expected_ack_cnt_delta)
++		< ACK_CNT_RATIO) &&
++	    (ba_timeout_delta > BA_TIMEOUT_CNT)) {
++		IWL_DEBUG_RADIO(priv, "actual_ack_cnt delta = %d,"
++				" expected_ack_cnt = %d\n",
++				actual_ack_cnt_delta, expected_ack_cnt_delta);
++		IWL_DEBUG_RADIO(priv, "agg ba_timeout delta = %d\n",
++				ba_timeout_delta);
++		if ((actual_ack_cnt_delta == 0) &&
++		    (ba_timeout_delta >= BA_TIMEOUT_MAX)) {
++			IWL_DEBUG_RADIO(priv,
++					"call iwl_force_reset(IWL_FW_RESET)\n");
++			iwl_force_reset(priv, IWL_FW_RESET);
++		}
++	}
+ 
+ 	/*
+ 	 * check for plcp_err and trigger radio reset if it exceeds

iwlwifi_-Recover-TX-flow-stall-due-to-stuck-queue.patch

@@ -0,0 +1,446 @@
+This patch is not yet upstream...
+
+From a5e660b4e294556822913627544f661e59b39716 Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Mon, 1 Mar 2010 17:23:50 -0800
+Subject: [PATCH 13/17] iwlwifi: Recover TX flow stall due to stuck queue
+
+Monitors the internal TX queues periodically.  When a queue is stuck
+for some unknown conditions causing the throughput to drop and the
+transfer is stop, the driver will force firmware reload and bring the
+system back to normal operational state.
+
+The iwlwifi devices behave differently in this regard so this feature is
+made part of the ops infrastructure so we can have more control on how to
+monitor and recover from tx queue stall case per device.
+
+Signed-off-by: Trieu 'Andrew' Nguyen <trieux.t.nguyen@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig	2010-03-22 15:33:38.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-22 15:48:54.000000000 -0400
+@@ -135,6 +135,7 @@ static struct iwl_lib_ops iwl1000_lib = 
+ 		.temperature = iwl5000_temperature,
+ 		.set_ct_kill = iwl1000_set_ct_threshold,
+ 	 },
++	.recover_from_tx_stall = iwl_bg_monitor_recover,
+ };
+ 
+ static struct iwl_ops iwl1000_ops = {
+@@ -163,5 +164,6 @@ struct iwl_cfg iwl1000_bgn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c.orig	2010-03-22 15:44:04.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c	2010-03-22 15:48:54.000000000 -0400
+@@ -2453,6 +2453,13 @@ static void iwl3945_alive_start(struct i
+ 	/* After the ALIVE response, we can send commands to 3945 uCode */
+ 	set_bit(STATUS_ALIVE, &priv->status);
+ 
++	if (priv->cfg->ops->lib->recover_from_tx_stall) {
++		/* Enable timer to monitor the driver queues */
++		mod_timer(&priv->monitor_recover,
++			jiffies +
++			msecs_to_jiffies(priv->cfg->monitor_recover_period));
++	}
++
+ 	if (iwl_is_rfkill(priv))
+ 		return;
+ 
+@@ -3730,6 +3737,13 @@ static void iwl3945_setup_deferred_work(
+ 
+ 	iwl3945_hw_setup_deferred_work(priv);
+ 
++	if (priv->cfg->ops->lib->recover_from_tx_stall) {
++		init_timer(&priv->monitor_recover);
++		priv->monitor_recover.data = (unsigned long)priv;
++		priv->monitor_recover.function =
++			priv->cfg->ops->lib->recover_from_tx_stall;
++	}
++
+ 	tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
+ 		     iwl3945_irq_tasklet, (unsigned long)priv);
+ }
+@@ -3742,6 +3756,8 @@ static void iwl3945_cancel_deferred_work
+ 	cancel_delayed_work(&priv->scan_check);
+ 	cancel_delayed_work(&priv->alive_start);
+ 	cancel_work_sync(&priv->beacon_update);
++	if (priv->cfg->ops->lib->recover_from_tx_stall)
++		del_timer_sync(&priv->monitor_recover);
+ }
+ 
+ static struct attribute *iwl3945_sysfs_entries[] = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c.orig	2010-03-22 14:20:28.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-03-22 15:48:54.000000000 -0400
+@@ -2897,6 +2897,7 @@ static struct iwl_cfg iwl3945_bg_cfg = {
+ 	.ht_greenfield_support = false,
+ 	.broken_powersave = true,
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ static struct iwl_cfg iwl3945_abg_cfg = {
+@@ -2913,6 +2914,7 @@ static struct iwl_cfg iwl3945_abg_cfg = 
+ 	.ht_greenfield_support = false,
+ 	.broken_powersave = true,
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct pci_device_id iwl3945_hw_card_ids[] = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c.orig	2010-03-22 14:24:14.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-03-22 15:48:54.000000000 -0400
+@@ -2364,6 +2364,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
+ 	.ht_greenfield_support = false,
+ 	.broken_powersave = true,
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ /* Module firmware */
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c.orig	2010-03-22 14:27:05.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-03-22 15:48:54.000000000 -0400
+@@ -1579,6 +1579,7 @@ struct iwl_lib_ops iwl5000_lib = {
+ 		.temperature = iwl5000_temperature,
+ 		.set_ct_kill = iwl5000_set_ct_threshold,
+ 	 },
++	.recover_from_tx_stall = iwl_bg_monitor_recover,
+ };
+ 
+ static struct iwl_lib_ops iwl5150_lib = {
+@@ -1631,6 +1632,7 @@ static struct iwl_lib_ops iwl5150_lib = 
+ 		.temperature = iwl5150_temperature,
+ 		.set_ct_kill = iwl5150_set_ct_threshold,
+ 	 },
++	.recover_from_tx_stall = iwl_bg_monitor_recover,
+ };
+ 
+ struct iwl_ops iwl5000_ops = {
+@@ -1673,6 +1675,7 @@ struct iwl_cfg iwl5300_agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct iwl_cfg iwl5100_bg_cfg = {
+@@ -1691,6 +1694,7 @@ struct iwl_cfg iwl5100_bg_cfg = {
+ 	.need_pll_cfg = true,
+ 	.ht_greenfield_support = true,
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct iwl_cfg iwl5100_abg_cfg = {
+@@ -1709,6 +1713,7 @@ struct iwl_cfg iwl5100_abg_cfg = {
+ 	.valid_rx_ant = ANT_AB,
+ 	.need_pll_cfg = true,
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct iwl_cfg iwl5100_agn_cfg = {
+@@ -1728,6 +1733,7 @@ struct iwl_cfg iwl5100_agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct iwl_cfg iwl5350_agn_cfg = {
+@@ -1747,6 +1753,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct iwl_cfg iwl5150_agn_cfg = {
+@@ -1766,6 +1773,7 @@ struct iwl_cfg iwl5150_agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c.orig	2010-03-22 14:28:04.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-22 15:51:12.000000000 -0400
+@@ -137,6 +137,7 @@ static struct iwl_lib_ops iwl6000_lib = 
+ 		.temperature = iwl5000_temperature,
+ 		.set_ct_kill = iwl6000_set_ct_threshold,
+ 	 },
++	.recover_from_tx_stall = iwl_bg_monitor_recover,
+ };
+ 
+ static struct iwl_hcmd_utils_ops iwl6000_hcmd_utils = {
+@@ -177,6 +178,7 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ /*
+@@ -202,6 +204,7 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct iwl_cfg iwl6050_2agn_cfg = {
+@@ -224,6 +227,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct iwl_cfg iwl6000_3agn_cfg = {
+@@ -246,6 +250,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ struct iwl_cfg iwl6050_3agn_cfg = {
+@@ -268,6 +273,7 @@ struct iwl_cfg iwl6050_3agn_cfg = {
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
+ 	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
++	.monitor_recover_period = IWL_MONITORING_PERIOD,
+ };
+ 
+ MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c	2010-03-22 15:48:54.000000000 -0400
+@@ -1755,6 +1755,13 @@ static void iwl_alive_start(struct iwl_p
+ 	/* After the ALIVE response, we can send host commands to the uCode */
+ 	set_bit(STATUS_ALIVE, &priv->status);
+ 
++	if (priv->cfg->ops->lib->recover_from_tx_stall) {
++		/* Enable timer to monitor the driver queues */
++		mod_timer(&priv->monitor_recover,
++			jiffies +
++			msecs_to_jiffies(priv->cfg->monitor_recover_period));
++	}
++
+ 	if (iwl_is_rfkill(priv))
+ 		return;
+ 
+@@ -2829,6 +2836,13 @@ static void iwl_setup_deferred_work(stru
+ 	priv->statistics_periodic.data = (unsigned long)priv;
+ 	priv->statistics_periodic.function = iwl_bg_statistics_periodic;
+ 
++	if (priv->cfg->ops->lib->recover_from_tx_stall) {
++		init_timer(&priv->monitor_recover);
++		priv->monitor_recover.data = (unsigned long)priv;
++		priv->monitor_recover.function =
++			priv->cfg->ops->lib->recover_from_tx_stall;
++	}
++
+ 	if (!priv->cfg->use_isr_legacy)
+ 		tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
+ 			iwl_irq_tasklet, (unsigned long)priv);
+@@ -2847,6 +2861,8 @@ static void iwl_cancel_deferred_work(str
+ 	cancel_delayed_work(&priv->alive_start);
+ 	cancel_work_sync(&priv->beacon_update);
+ 	del_timer_sync(&priv->statistics_periodic);
++	if (priv->cfg->ops->lib->recover_from_tx_stall)
++		del_timer_sync(&priv->monitor_recover);
+ }
+ 
+ static struct attribute *iwl_sysfs_entries[] = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig	2010-03-22 15:40:48.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c	2010-03-22 15:48:54.000000000 -0400
+@@ -3107,6 +3107,99 @@ int iwl_force_reset(struct iwl_priv *pri
+ 	}
+ 	return 0;
+ }
++EXPORT_SYMBOL(iwl_force_reset);
++
++/**
++ * iwl_bg_monitor_recover - Timer callback to check for stuck queue and recover
++ *
++ * During normal condition (no queue is stuck), the timer is continually set to
++ * execute every monitor_recover_period milliseconds after the last timer
++ * expired.  When the queue read_ptr is at the same place, the timer is
++ * shorten to 100mSecs.  This is
++ *      1) to reduce the chance that the read_ptr may wrap around (not stuck)
++ *      2) to detect the stuck queues quicker before the station and AP can
++ *      disassociate each other.
++ *
++ * This function monitors all the tx queues and recover from it if any
++ * of the queues are stuck.
++ * 1. It first check the cmd queue for stuck conditions.  If it is stuck,
++ *      it will recover by resetting the firmware and return.
++ * 2. Then, it checks for station association.  If it associates it will check
++ *      other queues.  If any queue is stuck, it will recover by resetting
++ *      the firmware.
++ * Note: It the number of times the queue read_ptr to be at the same place to
++ *      be MAX_REPEAT+1 in order to consider to be stuck.
++ */
++/*
++ * The maximum number of times the read pointer of the tx queue at the
++ * same place without considering to be stuck.
++ */
++#define MAX_REPEAT      (2)
++static int iwl_check_stuck_queue(struct iwl_priv *priv, int cnt)
++{
++	struct iwl_tx_queue *txq;
++	struct iwl_queue *q;
++
++	txq = &priv->txq[cnt];
++	q = &txq->q;
++	/* queue is empty, skip */
++	if (q->read_ptr != q->write_ptr) {
++		if (q->read_ptr == q->last_read_ptr) {
++			/* a queue has not been read from last time */
++			if (q->repeat_same_read_ptr > MAX_REPEAT) {
++				IWL_ERR(priv,
++					"queue %d stuck %d time. Fw reload.\n",
++					q->id, q->repeat_same_read_ptr);
++				q->repeat_same_read_ptr = 0;
++				iwl_force_reset(priv, IWL_FW_RESET);
++			} else {
++				q->repeat_same_read_ptr++;
++				IWL_DEBUG_RADIO(priv,
++						"queue %d, not read %d time\n",
++						q->id,
++						q->repeat_same_read_ptr);
++				mod_timer(&priv->monitor_recover, jiffies +
++					msecs_to_jiffies(IWL_ONE_HUNDRED_MSECS));
++			}
++			return 1;
++		} else {
++			q->last_read_ptr = q->read_ptr;
++			q->repeat_same_read_ptr = 0;
++		}
++	}
++	return 0;
++}
++
++void iwl_bg_monitor_recover(unsigned long data)
++{
++	struct iwl_priv *priv = (struct iwl_priv *)data;
++	int cnt;
++
++	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
++		return;
++
++	/* monitor and check for stuck cmd queue */
++	if (iwl_check_stuck_queue(priv, IWL_CMD_QUEUE_NUM))
++		return;
++
++	/* monitor and check for other stuck queues */
++	if (iwl_is_associated(priv)) {
++		for (cnt = 0; cnt < priv->hw_params.max_txq_num; cnt++) {
++			/* skip as we already checked the command queue */
++			if (cnt == IWL_CMD_QUEUE_NUM)
++				continue;
++			if (iwl_check_stuck_queue(priv, cnt))
++				return;
++		}
++	}
++	/*
++	 * Reschedule the timer to occur in
++	 * priv->cfg->monitor_recover_period
++	 */
++	mod_timer(&priv->monitor_recover,
++		jiffies + msecs_to_jiffies(priv->cfg->monitor_recover_period));
++}
++EXPORT_SYMBOL(iwl_bg_monitor_recover);
+ 
+ #ifdef CONFIG_PM
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig	2010-03-22 15:24:28.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h	2010-03-22 15:48:54.000000000 -0400
+@@ -183,6 +183,8 @@ struct iwl_lib_ops {
+ 
+ 	/* temperature */
+ 	struct iwl_temp_ops temp_ops;
++	/* recover from tx queue stall */
++	void (*recover_from_tx_stall)(unsigned long data);
+ };
+ 
+ struct iwl_ops {
+@@ -260,6 +262,8 @@ struct iwl_cfg {
+ 	const bool broken_powersave;
+ 	bool use_rts_for_ht;
+ 	u8 plcp_delta_threshold;
++	/* timer period for monitor the driver queues */
++	u32 monitor_recover_period;
+ };
+ 
+ /***************************
+@@ -543,6 +547,9 @@ static inline u16 iwl_pcie_link_ctl(stru
+ 	pci_read_config_word(priv->pci_dev, pos + PCI_EXP_LNKCTL, &pci_lnk_ctl);
+ 	return pci_lnk_ctl;
+ }
++
++void iwl_bg_monitor_recover(unsigned long data);
++
+ #ifdef CONFIG_PM
+ int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state);
+ int iwl_pci_resume(struct pci_dev *pdev);
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig	2010-03-22 15:37:04.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-22 15:48:54.000000000 -0400
+@@ -184,6 +184,10 @@ struct iwl_queue {
+ 	int n_bd;              /* number of BDs in this queue */
+ 	int write_ptr;       /* 1-st empty entry (index) host_w*/
+ 	int read_ptr;         /* last used entry (index) host_r*/
++	/* use for monitoring and recovering the stuck queue */
++	int last_read_ptr;      /* storing the last read_ptr */
++	/* number of time read_ptr and last_read_ptr are the same */
++	u8 repeat_same_read_ptr;
+ 	dma_addr_t dma_addr;   /* physical addr for BD's */
+ 	int n_window;	       /* safe queue window */
+ 	u32 id;
+@@ -976,6 +980,11 @@ struct traffic_stats {
+ #define IWL_DELAY_NEXT_FORCE_RF_RESET  (HZ*3)
+ #define IWL_DELAY_NEXT_FORCE_FW_RELOAD (HZ*5)
+ 
++/* timer constants use to monitor and recover stuck tx queues in mSecs */
++#define IWL_MONITORING_PERIOD  (1000)
++#define IWL_ONE_HUNDRED_MSECS   (100)
++#define IWL_SIXTY_SECS          (60000)
++
+ enum iwl_reset {
+ 	IWL_RF_RESET = 0,
+ 	IWL_FW_RESET,
+@@ -1275,6 +1284,7 @@ struct iwl_priv {
+ 	u32 disable_tx_power_cal;
+ 	struct work_struct run_time_calib_work;
+ 	struct timer_list statistics_periodic;
++	struct timer_list monitor_recover;
+ 	bool hw_ready;
+ 	/*For 3945*/
+ #define IWL_DEFAULT_TX_POWER 0x0F
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-tx.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-tx.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-tx.c.orig	2010-03-22 11:07:02.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-tx.c	2010-03-22 15:48:54.000000000 -0400
+@@ -291,6 +291,8 @@ static int iwl_queue_init(struct iwl_pri
+ 		q->high_mark = 2;
+ 
+ 	q->write_ptr = q->read_ptr = 0;
++	q->last_read_ptr = 0;
++	q->repeat_same_read_ptr = 0;
+ 
+ 	return 0;
+ }

iwlwifi_-Tune-radio-to-prevent-unexpected-behavior.patch

@@ -0,0 +1,369 @@
+Back-port of the following upstream commit...
+
+commit 3e4fb5faefb57824f2e42305b3d5907845af978c
+Author: Trieu 'Andrew' Nguyen <trieux.t.nguyen@intel.com>
+Date:   Fri Jan 22 14:22:46 2010 -0800
+
+    iwlwifi: Tune radio to prevent unexpected behavior
+    
+    We have seen the throughput dropped due to external noisy environment
+    and the radio is out of tune.  There are lot of plcp errors indicating
+    this condition. Eventually the station can get de-authenticated by the
+    Access Point.  By resetting and tuning the radio, the plcp errors are
+    reduced or eliminated and the throughput starts to rise.
+    
+    To prevent unexpected behavior such as drop in throughput or deauthentication,
+    - The change provides the driver feature to monitor and tune the radio base on
+    the statistics notification from the uCode.
+    - It also allows the setting of the plcp error rate threshold via
+    the plcp_delta under debugfs interface.
+    
+    Signed-off-by: Trieu 'Andrew' Nguyen <trieux.t.nguyen@intel.com>
+    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-22 14:23:01.000000000 -0400
+@@ -162,5 +162,6 @@ struct iwl_cfg iwl1000_bgn_cfg = {
+ 	.shadow_ram_support = false,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c.orig	2010-03-22 10:23:59.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-03-22 14:20:28.000000000 -0400
+@@ -2896,6 +2896,7 @@ static struct iwl_cfg iwl3945_bg_cfg = {
+ 	.use_isr_legacy = true,
+ 	.ht_greenfield_support = false,
+ 	.broken_powersave = true,
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+ static struct iwl_cfg iwl3945_abg_cfg = {
+@@ -2911,6 +2912,7 @@ static struct iwl_cfg iwl3945_abg_cfg = 
+ 	.use_isr_legacy = true,
+ 	.ht_greenfield_support = false,
+ 	.broken_powersave = true,
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+ struct pci_device_id iwl3945_hw_card_ids[] = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c.orig	2010-03-22 11:22:14.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-03-22 14:24:14.000000000 -0400
+@@ -2363,6 +2363,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
+ 	.use_isr_legacy = true,
+ 	.ht_greenfield_support = false,
+ 	.broken_powersave = true,
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+ /* Module firmware */
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c.orig	2010-03-22 11:22:14.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-03-22 14:27:05.000000000 -0400
+@@ -1672,6 +1672,7 @@ struct iwl_cfg iwl5300_agn_cfg = {
+ 	.need_pll_cfg = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+ };
+ 
+ struct iwl_cfg iwl5100_bg_cfg = {
+@@ -1689,6 +1690,7 @@ struct iwl_cfg iwl5100_bg_cfg = {
+ 	.valid_rx_ant = ANT_AB,
+ 	.need_pll_cfg = true,
+ 	.ht_greenfield_support = true,
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+ };
+ 
+ struct iwl_cfg iwl5100_abg_cfg = {
+@@ -1706,6 +1708,7 @@ struct iwl_cfg iwl5100_abg_cfg = {
+ 	.valid_tx_ant = ANT_B,
+ 	.valid_rx_ant = ANT_AB,
+ 	.need_pll_cfg = true,
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+ };
+ 
+ struct iwl_cfg iwl5100_agn_cfg = {
+@@ -1724,6 +1727,7 @@ struct iwl_cfg iwl5100_agn_cfg = {
+ 	.need_pll_cfg = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+ };
+ 
+ struct iwl_cfg iwl5350_agn_cfg = {
+@@ -1742,6 +1746,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
+ 	.need_pll_cfg = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+ };
+ 
+ struct iwl_cfg iwl5150_agn_cfg = {
+@@ -1760,6 +1765,7 @@ struct iwl_cfg iwl5150_agn_cfg = {
+ 	.need_pll_cfg = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+ };
+ 
+ MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-22 14:28:04.000000000 -0400
+@@ -176,6 +176,7 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
+ 	.shadow_ram_support = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+ /*
+@@ -200,6 +201,7 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
+ 	.shadow_ram_support = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+ struct iwl_cfg iwl6050_2agn_cfg = {
+@@ -221,6 +223,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
+ 	.shadow_ram_support = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+ struct iwl_cfg iwl6000_3agn_cfg = {
+@@ -242,6 +245,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
+ 	.shadow_ram_support = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+ struct iwl_cfg iwl6050_3agn_cfg = {
+@@ -263,6 +267,7 @@ struct iwl_cfg iwl6050_3agn_cfg = {
+ 	.shadow_ram_support = true,
+ 	.ht_greenfield_support = true,
+ 	.use_rts_for_ht = true, /* use rts/cts protection */
++	.plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+ };
+ 
+ MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig	2010-03-22 11:26:18.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h	2010-03-22 14:29:11.000000000 -0400
+@@ -214,6 +214,8 @@ struct iwl_mod_params {
+  * @max_ll_items: max number of OTP blocks
+  * @shadow_ram_support: shadow support for OTP memory
+  * @use_rts_for_ht: use rts/cts protection for HT traffic
++ * @plcp_delta_threshold: plcp error rate threshold used to trigger
++ *	radio tuning when there is a high receiving plcp error rate
+  *
+  * We enable the driver to be backward compatible wrt API version. The
+  * driver specifies which APIs it supports (with @ucode_api_max being the
+@@ -257,6 +259,7 @@ struct iwl_cfg {
+ 	const bool ht_greenfield_support;
+ 	const bool broken_powersave;
+ 	bool use_rts_for_ht;
++	u8 plcp_delta_threshold;
+ };
+ 
+ /***************************
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debugfs.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debugfs.c.orig	2010-03-22 11:33:02.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debugfs.c	2010-03-22 14:31:01.000000000 -0400
+@@ -853,6 +853,47 @@ static ssize_t iwl_dbgfs_current_sleep_c
+ 	return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+ }
+ 
++static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,
++					char __user *user_buf,
++					size_t count, loff_t *ppos) {
++
++	struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
++	int pos = 0;
++	char buf[12];
++	const size_t bufsz = sizeof(buf);
++	ssize_t ret;
++
++	pos += scnprintf(buf + pos, bufsz - pos, "%u\n",
++			priv->cfg->plcp_delta_threshold);
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
++	return ret;
++}
++
++static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
++					const char __user *user_buf,
++					size_t count, loff_t *ppos) {
++
++	struct iwl_priv *priv = file->private_data;
++	char buf[8];
++	int buf_size;
++	int plcp;
++
++	memset(buf, 0, sizeof(buf));
++	buf_size = min(count, sizeof(buf) -  1);
++	if (copy_from_user(buf, user_buf, buf_size))
++		return -EFAULT;
++	if (sscanf(buf, "%d", &plcp) != 1)
++		return -EINVAL;
++	if ((plcp <= IWL_MAX_PLCP_ERR_THRESHOLD_MIN) ||
++		(plcp > IWL_MAX_PLCP_ERR_THRESHOLD_MAX))
++		priv->cfg->plcp_delta_threshold =
++			IWL_MAX_PLCP_ERR_THRESHOLD_DEF;
++	else
++		priv->cfg->plcp_delta_threshold = plcp;
++	return count;
++}
++
+ DEBUGFS_READ_WRITE_FILE_OPS(sram);
+ DEBUGFS_WRITE_FILE_OPS(log_event);
+ DEBUGFS_READ_FILE_OPS(nvm);
+@@ -1647,6 +1688,7 @@ DEBUGFS_READ_FILE_OPS(sensitivity);
+ DEBUGFS_READ_FILE_OPS(chain_noise);
+ DEBUGFS_READ_FILE_OPS(tx_power);
+ DEBUGFS_WRITE_FILE_OPS(internal_scan);
++DEBUGFS_READ_WRITE_FILE_OPS(plcp_delta);
+ 
+ /*
+  * Create the debugfs files and directories
+@@ -1697,6 +1739,7 @@ int iwl_dbgfs_register(struct iwl_priv *
+ 	DEBUGFS_ADD_FILE(tx_queue, debug);
+ 	DEBUGFS_ADD_FILE(tx_power, debug);
+ 	DEBUGFS_ADD_FILE(internal_scan, debug);
++	DEBUGFS_ADD_FILE(plcp_delta, debug);
+ 	if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
+ 		DEBUGFS_ADD_FILE(ucode_rx_stats, debug);
+ 		DEBUGFS_ADD_FILE(ucode_tx_stats, debug);
+@@ -1752,6 +1795,7 @@ void iwl_dbgfs_unregister(struct iwl_pri
+ 	DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_queue);
+ 	DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_power);
+ 	DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_internal_scan);
++	DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_plcp_delta);
+ 	if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
+ 		DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
+ 			file_ucode_rx_stats);
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debug.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debug.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debug.h.orig	2010-03-22 11:27:31.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-03-22 14:20:28.000000000 -0400
+@@ -109,6 +109,7 @@ struct iwl_debugfs {
+ 		struct dentry *file_chain_noise;
+ 		struct dentry *file_tx_power;
+ 		struct dentry *file_internal_scan;
++		struct dentry *file_plcp_delta;
+ 	} dbgfs_debug_files;
+ 	u32 sram_offset;
+ 	u32 sram_len;
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig	2010-03-22 14:12:32.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-22 14:20:28.000000000 -0400
+@@ -963,6 +963,15 @@ struct traffic_stats {
+ 
+ #define IWL_MAX_NUM_QUEUES	20 /* FIXME: do dynamic allocation */
+ 
++/*
++ * This is the threshold value of plcp error rate per 100mSecs.  It is
++ * used to set and check for the validity of plcp_delta.
++ */
++#define IWL_MAX_PLCP_ERR_THRESHOLD_MIN	(0)
++#define IWL_MAX_PLCP_ERR_THRESHOLD_DEF	(50)
++#define IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF	(100)
++#define IWL_MAX_PLCP_ERR_THRESHOLD_MAX	(255)
++
+ struct iwl_priv {
+ 
+ 	/* ieee device used by generic ieee processing code */
+@@ -991,6 +1000,9 @@ struct iwl_priv {
+ 	/* ucode beacon time */
+ 	u32 ucode_beacon_time;
+ 
++	/* storing the jiffies when the plcp error rate is received */
++	unsigned long plcp_jiffies;
++
+ 	/* we allocate array of iwl4965_channel_info for NIC's valid channels.
+ 	 *    Access via channel # using indirect index array */
+ 	struct iwl_channel_info *channel_info;	/* channel info array */
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c	2010-03-22 15:18:59.000000000 -0400
+@@ -550,11 +550,15 @@ static void iwl_rx_calc_noise(struct iwl
+ 
+ #define REG_RECALIB_PERIOD (60)
+ 
++#define PLCP_MSG "plcp_err exceeded %u, %u, %u, %u, %u, %d, %u mSecs\n"
+ void iwl_rx_statistics(struct iwl_priv *priv,
+ 			      struct iwl_rx_mem_buffer *rxb)
+ {
+ 	int change;
+ 	struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
++	int combined_plcp_delta;
++	unsigned int plcp_msec;
++	unsigned long plcp_received_jiffies;
+ 
+ 	IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
+ 		     (int)sizeof(priv->statistics),
+@@ -566,6 +570,56 @@ void iwl_rx_statistics(struct iwl_priv *
+ 		    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
+ 		   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
+ 
++	/*
++	 * check for plcp_err and trigger radio reset if it exceeds
++	 * the plcp error threshold plcp_delta.
++	 */
++	plcp_received_jiffies = jiffies;
++	plcp_msec = jiffies_to_msecs((long) plcp_received_jiffies -
++					(long) priv->plcp_jiffies);
++	priv->plcp_jiffies = plcp_received_jiffies;
++	/*
++	 * check to make sure plcp_msec is not 0 to prevent division
++	 * by zero.
++	 */
++	if (plcp_msec) {
++		combined_plcp_delta =
++			(le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err) -
++			le32_to_cpu(priv->statistics.rx.ofdm.plcp_err)) +
++			(le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err) -
++			le32_to_cpu(priv->statistics.rx.ofdm_ht.plcp_err));
++
++		if ((combined_plcp_delta > 0) &&
++			((combined_plcp_delta * 100) / plcp_msec) >
++			priv->cfg->plcp_delta_threshold) {
++			/*
++			 * if plcp_err exceed the threshold, the following
++			 * data is printed in csv format:
++			 *    Text: plcp_err exceeded %d,
++			 *    Received ofdm.plcp_err,
++			 *    Current ofdm.plcp_err,
++			 *    Received ofdm_ht.plcp_err,
++			 *    Current ofdm_ht.plcp_err,
++			 *    combined_plcp_delta,
++			 *    plcp_msec
++			 */
++			IWL_DEBUG_RADIO(priv, PLCP_MSG,
++				priv->cfg->plcp_delta_threshold,
++				le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err),
++				le32_to_cpu(priv->statistics.rx.ofdm.plcp_err),
++				le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err),
++				le32_to_cpu(
++					priv->statistics.rx.ofdm_ht.plcp_err),
++				combined_plcp_delta, plcp_msec);
++
++			/*
++			 * Reset the RF radio due to the high plcp
++			 * error rate
++			 */
++			iwl_force_rf_reset(priv);
++		}
++	}
++
+ 	memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
+ 
+ 	set_bit(STATUS_STATISTICS, &priv->status);

iwlwifi_-add-function-to-reset_tune-radio-if-needed.patch

@@ -0,0 +1,374 @@
+Back-port of the following upstream commit...
+
+commit afbdd69af0e6a0c40676d4d4b94a0a4414708eaa
+Author: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date:   Fri Jan 22 14:22:43 2010 -0800
+
+    iwlwifi: add function to reset/tune radio if needed
+    
+    Adding "radio reset" function to help reset and stabilize the radio.
+    
+    During normal operation, sometime for unknown reason, radio encounter
+    problem and can not recover by itself; the best way to
+    recover from it is to reset and re-tune the radio. Currently, there is
+    no RF reset command available, but since radio will get reset when
+    switching channel, use internal hw scan request to force radio
+    reset and get back to normal operation state.
+    
+    The internal hw scan will only perform passive scan on the first
+    available channel (not the channel being used) in associated state. The
+    request should be ignored if already performing scan operation or STA is
+    not in associated state.
+    
+    Also include an "internal_scan" debugfs file to help trigger the
+    internal scan from user mode.
+    
+    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig	2010-03-22 10:23:59.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c	2010-03-22 11:26:18.000000000 -0400
+@@ -3035,6 +3035,30 @@ void iwl_update_stats(struct iwl_priv *p
+ EXPORT_SYMBOL(iwl_update_stats);
+ #endif
+ 
++void iwl_force_rf_reset(struct iwl_priv *priv)
++{
++	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
++		return;
++
++	if (!iwl_is_associated(priv)) {
++		IWL_DEBUG_SCAN(priv, "force reset rejected: not associated\n");
++		return;
++	}
++	/*
++	 * There is no easy and better way to force reset the radio,
++	 * the only known method is switching channel which will force to
++	 * reset and tune the radio.
++	 * Use internal short scan (single channel) operation to should
++	 * achieve this objective.
++	 * Driver should reset the radio when number of consecutive missed
++	 * beacon, or any other uCode error condition detected.
++	 */
++	IWL_DEBUG_INFO(priv, "perform radio reset.\n");
++	iwl_internal_short_hw_scan(priv);
++	return;
++}
++EXPORT_SYMBOL(iwl_force_rf_reset);
++
+ #ifdef CONFIG_PM
+ 
+ int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig	2010-03-22 10:23:59.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h	2010-03-22 11:26:18.000000000 -0400
+@@ -461,6 +461,8 @@ void iwl_init_scan_params(struct iwl_pri
+ int iwl_scan_cancel(struct iwl_priv *priv);
+ int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
+ int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
++int iwl_internal_short_hw_scan(struct iwl_priv *priv);
++void iwl_force_rf_reset(struct iwl_priv *priv);
+ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
+ 		       const u8 *ie, int ie_len, int left);
+ void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debugfs.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debugfs.c.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debugfs.c	2010-03-22 11:33:02.000000000 -0400
+@@ -1614,6 +1614,27 @@ static ssize_t iwl_dbgfs_tx_power_read(s
+ 	return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+ }
+ 
++static ssize_t iwl_dbgfs_internal_scan_write(struct file *file,
++					const char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct iwl_priv *priv = file->private_data;
++	char buf[8];
++	int buf_size;
++	int scan;
++
++	memset(buf, 0, sizeof(buf));
++	buf_size = min(count, sizeof(buf) -  1);
++	if (copy_from_user(buf, user_buf, buf_size))
++		return -EFAULT;
++	if (sscanf(buf, "%d", &scan) != 1)
++		return -EINVAL;
++
++	iwl_internal_short_hw_scan(priv);
++
++	return count;
++}
++
+ DEBUGFS_READ_WRITE_FILE_OPS(rx_statistics);
+ DEBUGFS_READ_WRITE_FILE_OPS(tx_statistics);
+ DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
+@@ -1625,6 +1646,7 @@ DEBUGFS_READ_FILE_OPS(ucode_general_stat
+ DEBUGFS_READ_FILE_OPS(sensitivity);
+ DEBUGFS_READ_FILE_OPS(chain_noise);
+ DEBUGFS_READ_FILE_OPS(tx_power);
++DEBUGFS_WRITE_FILE_OPS(internal_scan);
+ 
+ /*
+  * Create the debugfs files and directories
+@@ -1674,6 +1696,7 @@ int iwl_dbgfs_register(struct iwl_priv *
+ 	DEBUGFS_ADD_FILE(rx_queue, debug);
+ 	DEBUGFS_ADD_FILE(tx_queue, debug);
+ 	DEBUGFS_ADD_FILE(tx_power, debug);
++	DEBUGFS_ADD_FILE(internal_scan, debug);
+ 	if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
+ 		DEBUGFS_ADD_FILE(ucode_rx_stats, debug);
+ 		DEBUGFS_ADD_FILE(ucode_tx_stats, debug);
+@@ -1728,6 +1751,7 @@ void iwl_dbgfs_unregister(struct iwl_pri
+ 	DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_queue);
+ 	DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_queue);
+ 	DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_power);
++	DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_internal_scan);
+ 	if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
+ 		DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
+ 			file_ucode_rx_stats);
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debug.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debug.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debug.h.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-03-22 11:27:31.000000000 -0400
+@@ -108,6 +108,7 @@ struct iwl_debugfs {
+ 		struct dentry *file_sensitivity;
+ 		struct dentry *file_chain_noise;
+ 		struct dentry *file_tx_power;
++		struct dentry *file_internal_scan;
+ 	} dbgfs_debug_files;
+ 	u32 sram_offset;
+ 	u32 sram_len;
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig	2010-03-22 10:23:59.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-22 11:26:18.000000000 -0400
+@@ -1016,6 +1016,7 @@ struct iwl_priv {
+ 	void *scan;
+ 	int scan_bands;
+ 	struct cfg80211_scan_request *scan_request;
++	bool is_internal_short_scan;
+ 	u8 scan_tx_ant[IEEE80211_NUM_BANDS];
+ 	u8 mgmt_tx_ant;
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c	2010-03-22 11:26:18.000000000 -0400
+@@ -316,6 +316,72 @@ u16 iwl_get_passive_dwell_time(struct iw
+ }
+ EXPORT_SYMBOL(iwl_get_passive_dwell_time);
+ 
++static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
++				     enum ieee80211_band band,
++				     struct iwl_scan_channel *scan_ch)
++{
++	const struct ieee80211_supported_band *sband;
++	const struct iwl_channel_info *ch_info;
++	u16 passive_dwell = 0;
++	u16 active_dwell = 0;
++	int i, added = 0;
++	u16 channel = 0;
++
++	sband = iwl_get_hw_mode(priv, band);
++	if (!sband) {
++		IWL_ERR(priv, "invalid band\n");
++		return added;
++	}
++
++	active_dwell = iwl_get_active_dwell_time(priv, band, 0);
++	passive_dwell = iwl_get_passive_dwell_time(priv, band);
++
++	if (passive_dwell <= active_dwell)
++		passive_dwell = active_dwell + 1;
++
++	/* only scan single channel, good enough to reset the RF */
++	/* pick the first valid not in-use channel */
++	if (band == IEEE80211_BAND_5GHZ) {
++		for (i = 14; i < priv->channel_count; i++) {
++			if (priv->channel_info[i].channel !=
++			    le16_to_cpu(priv->staging_rxon.channel)) {
++				channel = priv->channel_info[i].channel;
++				ch_info = iwl_get_channel_info(priv,
++					band, channel);
++				if (is_channel_valid(ch_info))
++					break;
++			}
++		}
++	} else {
++		for (i = 0; i < 14; i++) {
++			if (priv->channel_info[i].channel !=
++			    le16_to_cpu(priv->staging_rxon.channel)) {
++					channel =
++						priv->channel_info[i].channel;
++					ch_info = iwl_get_channel_info(priv,
++						band, channel);
++					if (is_channel_valid(ch_info))
++						break;
++			}
++		}
++	}
++	if (channel) {
++		scan_ch->channel = cpu_to_le16(channel);
++		scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
++		scan_ch->active_dwell = cpu_to_le16(active_dwell);
++		scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
++		/* Set txpower levels to defaults */
++		scan_ch->dsp_atten = 110;
++		if (band == IEEE80211_BAND_5GHZ)
++			scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
++		else
++			scan_ch->tx_gain = ((1 << 5) | (5 << 3));
++		added++;
++	} else
++		IWL_ERR(priv, "no valid channel found\n");
++	return added;
++}
++
+ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
+ 				     enum ieee80211_band band,
+ 				     u8 is_active, u8 n_probes,
+@@ -422,6 +488,7 @@ static int iwl_scan_initiate(struct iwl_
+ 
+ 	IWL_DEBUG_INFO(priv, "Starting scan...\n");
+ 	set_bit(STATUS_SCANNING, &priv->status);
++	priv->is_internal_short_scan = false;
+ 	priv->scan_start = jiffies;
+ 	priv->scan_pass_start = priv->scan_start;
+ 
+@@ -489,6 +556,45 @@ out_unlock:
+ }
+ EXPORT_SYMBOL(iwl_mac_hw_scan);
+ 
++/*
++ * internal short scan, this function should only been called while associated.
++ * It will reset and tune the radio to prevent possible RF related problem
++ */
++int iwl_internal_short_hw_scan(struct iwl_priv *priv)
++{
++	int ret = 0;
++
++	if (!iwl_is_ready_rf(priv)) {
++		ret = -EIO;
++		IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
++		goto out;
++	}
++	if (test_bit(STATUS_SCANNING, &priv->status)) {
++		IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
++		ret = -EAGAIN;
++		goto out;
++	}
++	if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
++		IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
++		ret = -EAGAIN;
++		goto out;
++	}
++	priv->scan_bands = 0;
++	if (priv->band == IEEE80211_BAND_5GHZ)
++		priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
++	else
++		priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
++
++	IWL_DEBUG_SCAN(priv, "Start internal short scan...\n");
++	set_bit(STATUS_SCANNING, &priv->status);
++	priv->is_internal_short_scan = true;
++	queue_work(priv->workqueue, &priv->request_scan);
++
++out:
++	return ret;
++}
++EXPORT_SYMBOL(iwl_internal_short_hw_scan);
++
+ #define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
+ 
+ void iwl_bg_scan_check(struct work_struct *data)
+@@ -552,7 +658,8 @@ u16 iwl_fill_probe_req(struct iwl_priv *
+ 	if (WARN_ON(left < ie_len))
+ 		return len;
+ 
+-	memcpy(pos, ies, ie_len);
++	if (ies)
++		memcpy(pos, ies, ie_len);
+ 	len += ie_len;
+ 	left -= ie_len;
+ 
+@@ -654,7 +761,6 @@ static void iwl_bg_request_scan(struct w
+ 		unsigned long flags;
+ 
+ 		IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
+-
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		interval = priv->beacon_int;
+ 		spin_unlock_irqrestore(&priv->lock, flags);
+@@ -672,7 +778,9 @@ static void iwl_bg_request_scan(struct w
+ 			       scan_suspend_time, interval);
+ 	}
+ 
+-	if (priv->scan_request->n_ssids) {
++	if (priv->is_internal_short_scan) {
++		IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
++	} else if (priv->scan_request->n_ssids) {
+ 		int i, p = 0;
+ 		IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
+ 		for (i = 0; i < priv->scan_request->n_ssids; i++) {
+@@ -740,24 +848,38 @@ static void iwl_bg_request_scan(struct w
+ 	rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
+ 	rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
+ 	scan->rx_chain = cpu_to_le16(rx_chain);
+-	cmd_len = iwl_fill_probe_req(priv,
+-				(struct ieee80211_mgmt *)scan->data,
+-				priv->scan_request->ie,
+-				priv->scan_request->ie_len,
+-				IWL_MAX_SCAN_SIZE - sizeof(*scan));
++	if (!priv->is_internal_short_scan) {
++		cmd_len = iwl_fill_probe_req(priv,
++					(struct ieee80211_mgmt *)scan->data,
++					priv->scan_request->ie,
++					priv->scan_request->ie_len,
++					IWL_MAX_SCAN_SIZE - sizeof(*scan));
++	} else {
++		cmd_len = iwl_fill_probe_req(priv,
++					(struct ieee80211_mgmt *)scan->data,
++					NULL, 0,
++					IWL_MAX_SCAN_SIZE - sizeof(*scan));
+ 
++	}
+ 	scan->tx_cmd.len = cpu_to_le16(cmd_len);
+-
+ 	if (iwl_is_monitor_mode(priv))
+ 		scan->filter_flags = RXON_FILTER_PROMISC_MSK;
+ 
+ 	scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
+ 			       RXON_FILTER_BCON_AWARE_MSK);
+ 
+-	scan->channel_count =
+-		iwl_get_channels_for_scan(priv, band, is_active, n_probes,
+-			(void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
+-
++	if (priv->is_internal_short_scan) {
++		scan->channel_count =
++			iwl_get_single_channel_for_scan(priv, band,
++				(void *)&scan->data[le16_to_cpu(
++				scan->tx_cmd.len)]);
++	} else {
++		scan->channel_count =
++			iwl_get_channels_for_scan(priv, band,
++				is_active, n_probes,
++				(void *)&scan->data[le16_to_cpu(
++				scan->tx_cmd.len)]);
++	}
+ 	if (scan->channel_count == 0) {
+ 		IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
+ 		goto done;
+@@ -818,7 +940,12 @@ void iwl_bg_scan_completed(struct work_s
+ 
+ 	cancel_delayed_work(&priv->scan_check);
+ 
+-	ieee80211_scan_completed(priv->hw, false);
++	if (!priv->is_internal_short_scan)
++		ieee80211_scan_completed(priv->hw, false);
++	else {
++		priv->is_internal_short_scan = false;
++		IWL_DEBUG_SCAN(priv, "internal short scan completed\n");
++	}
+ 
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ 		return;

iwlwifi_-add-internal-short-scan-support-for-3945.patch

@@ -0,0 +1,85 @@
+commit 4f4d4088b05155d4904e29d5c00316395ce32f27
+Author: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date:   Wed Feb 24 08:28:30 2010 -0800
+
+    iwlwifi: add internal short scan support for 3945
+    
+    Add internal short scan support for 3945 NIC, This allows 3945 NIC
+    to support radio reset request like the other series of NICs.
+    
+    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+index dd33251..252df12 100644
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -2799,7 +2799,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
+ 		.len = sizeof(struct iwl3945_scan_cmd),
+ 		.flags = CMD_SIZE_HUGE,
+ 	};
+-	int rc = 0;
+ 	struct iwl3945_scan_cmd *scan;
+ 	struct ieee80211_conf *conf = NULL;
+ 	u8 n_probes = 0;
+@@ -2827,7 +2826,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
+ 	if (test_bit(STATUS_SCAN_HW, &priv->status)) {
+ 		IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests  "
+ 				"Ignoring second request.\n");
+-		rc = -EIO;
+ 		goto done;
+ 	}
+ 
+@@ -2862,7 +2860,7 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
+ 		priv->scan = kmalloc(sizeof(struct iwl3945_scan_cmd) +
+ 				     IWL_MAX_SCAN_SIZE, GFP_KERNEL);
+ 		if (!priv->scan) {
+-			rc = -ENOMEM;
++			IWL_DEBUG_SCAN(priv, "Fail to allocate scan memory\n");
+ 			goto done;
+ 		}
+ 	}
+@@ -2905,7 +2903,9 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
+ 			       scan_suspend_time, interval);
+ 	}
+ 
+-	if (priv->scan_request->n_ssids) {
++	if (priv->is_internal_short_scan) {
++		IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
++	} else if (priv->scan_request->n_ssids) {
+ 		int i, p = 0;
+ 		IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
+ 		for (i = 0; i < priv->scan_request->n_ssids; i++) {
+@@ -2952,13 +2952,20 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
+ 		goto done;
+ 	}
+ 
+-	scan->tx_cmd.len = cpu_to_le16(
++	if (!priv->is_internal_short_scan) {
++		scan->tx_cmd.len = cpu_to_le16(
+ 			iwl_fill_probe_req(priv,
+ 				(struct ieee80211_mgmt *)scan->data,
+ 				priv->scan_request->ie,
+ 				priv->scan_request->ie_len,
+ 				IWL_MAX_SCAN_SIZE - sizeof(*scan)));
+-
++	} else {
++		scan->tx_cmd.len = cpu_to_le16(
++			iwl_fill_probe_req(priv,
++				(struct ieee80211_mgmt *)scan->data,
++				NULL, 0,
++				IWL_MAX_SCAN_SIZE - sizeof(*scan)));
++	}
+ 	/* select Rx antennas */
+ 	scan->flags |= iwl3945_get_antenna_flags(priv);
+ 
+@@ -2980,8 +2987,7 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
+ 	scan->len = cpu_to_le16(cmd.len);
+ 
+ 	set_bit(STATUS_SCAN_HW, &priv->status);
+-	rc = iwl_send_cmd_sync(priv, &cmd);
+-	if (rc)
++	if (iwl_send_cmd_sync(priv, &cmd))
+ 		goto done;
+ 
+ 	queue_delayed_work(priv->workqueue, &priv->scan_check,

iwlwifi_-code-cleanup-for-connectivity-recovery.patch

@@ -0,0 +1,230 @@
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig	2010-03-22 16:42:34.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-22 16:42:57.000000000 -0400
+@@ -136,7 +136,8 @@ static struct iwl_lib_ops iwl1000_lib = 
+ 		.set_ct_kill = iwl1000_set_ct_threshold,
+ 	 },
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
+-	.recover_from_statistics = iwl_recover_from_statistics,
++	.check_plcp_health = iwl_good_plcp_health,
++	.check_ack_health = iwl_good_ack_health,
+ };
+ 
+ static struct iwl_ops iwl1000_ops = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c.orig	2010-03-22 16:42:34.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-03-22 16:42:57.000000000 -0400
+@@ -2340,7 +2340,7 @@ static struct iwl_lib_ops iwl4965_lib = 
+ 		.temperature = iwl4965_temperature_calib,
+ 		.set_ct_kill = iwl4965_set_ct_threshold,
+ 	},
+-	.recover_from_statistics = iwl_recover_from_statistics,
++	.check_plcp_health = iwl_good_plcp_health,
+ };
+ 
+ static struct iwl_ops iwl4965_ops = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c.orig	2010-03-22 16:42:34.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-03-22 16:42:57.000000000 -0400
+@@ -1580,7 +1580,8 @@ struct iwl_lib_ops iwl5000_lib = {
+ 		.set_ct_kill = iwl5000_set_ct_threshold,
+ 	 },
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
+-	.recover_from_statistics = iwl_recover_from_statistics,
++	.check_plcp_health = iwl_good_plcp_health,
++	.check_ack_health = iwl_good_ack_health,
+ };
+ 
+ static struct iwl_lib_ops iwl5150_lib = {
+@@ -1634,7 +1635,8 @@ static struct iwl_lib_ops iwl5150_lib = 
+ 		.set_ct_kill = iwl5150_set_ct_threshold,
+ 	 },
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
+-	.recover_from_statistics = iwl_recover_from_statistics,
++	.check_plcp_health = iwl_good_plcp_health,
++	.check_ack_health = iwl_good_ack_health,
+ };
+ 
+ struct iwl_ops iwl5000_ops = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c.orig	2010-03-22 16:42:34.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-22 16:42:57.000000000 -0400
+@@ -138,7 +138,8 @@ static struct iwl_lib_ops iwl6000_lib = 
+ 		.set_ct_kill = iwl6000_set_ct_threshold,
+ 	 },
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
+-	.recover_from_statistics = iwl_recover_from_statistics,
++	.check_plcp_health = iwl_good_plcp_health,
++	.check_ack_health = iwl_good_ack_health,
+ };
+ 
+ static struct iwl_hcmd_utils_ops iwl6000_hcmd_utils = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig	2010-03-22 16:42:34.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h	2010-03-22 16:42:57.000000000 -0400
+@@ -185,8 +185,11 @@ struct iwl_lib_ops {
+ 	struct iwl_temp_ops temp_ops;
+ 	/* recover from tx queue stall */
+ 	void (*recover_from_tx_stall)(unsigned long data);
+-	/* recover from errors showed in statistics */
+-	void (*recover_from_statistics)(struct iwl_priv *priv,
++	/* check for plcp health */
++	bool (*check_plcp_health)(struct iwl_priv *priv,
++					struct iwl_rx_packet *pkt);
++	/* check for ack health */
++	bool (*check_ack_health)(struct iwl_priv *priv,
+ 					struct iwl_rx_packet *pkt);
+ };
+ 
+@@ -401,7 +404,9 @@ int iwl_tx_queue_reclaim(struct iwl_priv
+ /* Handlers */
+ void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
+ 			       struct iwl_rx_mem_buffer *rxb);
+-void iwl_recover_from_statistics(struct iwl_priv *priv,
++bool iwl_good_plcp_health(struct iwl_priv *priv,
++				 struct iwl_rx_packet *pkt);
++bool iwl_good_ack_health(struct iwl_priv *priv,
+ 				 struct iwl_rx_packet *pkt);
+ void iwl_rx_statistics(struct iwl_priv *priv,
+ 			      struct iwl_rx_mem_buffer *rxb);
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig	2010-03-22 16:42:34.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c	2010-03-22 16:45:03.000000000 -0400
+@@ -555,24 +555,18 @@ static void iwl_rx_calc_noise(struct iwl
+ #define BA_TIMEOUT_CNT (5)
+ #define BA_TIMEOUT_MAX (16)
+ 
+-#define PLCP_MSG "plcp_err exceeded %u, %u, %u, %u, %u, %d, %u mSecs\n"
+-/*
+- * This function checks for plcp error, ACK count ratios, aggregated BA
+- * timeout retries.
+- * - When the ACK count ratio is 0 and aggregated BA timeout retries is
+- * exceeding the BA_TIMEOUT_MAX, it will recover the failure by resetting
+- * the firmware.
+- * - When the plcp error is exceeding the thresholds, it will reset the radio
+- * to improve the throughput.
++/**
++ * iwl_good_ack_health - checks for ACK count ratios, BA timeout retries.
++ *
++ * When the ACK count ratio is 0 and aggregated BA timeout retries exceeding
++ * the BA_TIMEOUT_MAX, reload firmware and bring system back to normal
++ * operation state.
+  */
+-void iwl_recover_from_statistics(struct iwl_priv *priv,
+-					struct iwl_rx_packet *pkt)
++bool iwl_good_ack_health(struct iwl_priv *priv,
++				struct iwl_rx_packet *pkt)
+ {
+-	int combined_plcp_delta;
+-	unsigned int plcp_msec;
+-	unsigned long plcp_received_jiffies;
+-	int actual_ack_cnt_delta;
+-	int expected_ack_cnt_delta;
++	bool rc = true;
++	int actual_ack_cnt_delta, expected_ack_cnt_delta;
+ 	int ba_timeout_delta;
+ 
+ 	actual_ack_cnt_delta =
+@@ -594,13 +588,27 @@ void iwl_recover_from_statistics(struct 
+ 				actual_ack_cnt_delta, expected_ack_cnt_delta);
+ 		IWL_DEBUG_RADIO(priv, "agg ba_timeout delta = %d\n",
+ 				ba_timeout_delta);
+-		if ((actual_ack_cnt_delta == 0) &&
+-		    (ba_timeout_delta >= BA_TIMEOUT_MAX)) {
+-			IWL_DEBUG_RADIO(priv,
+-					"call iwl_force_reset(IWL_FW_RESET)\n");
+-			iwl_force_reset(priv, IWL_FW_RESET);
+-		}
++		if (!actual_ack_cnt_delta &&
++		    (ba_timeout_delta >= BA_TIMEOUT_MAX))
++			rc = false;
+ 	}
++	return rc;
++}
++EXPORT_SYMBOL(iwl_good_ack_health);
++
++/**
++ * iwl_good_plcp_health - checks for plcp error.
++ *
++ * When the plcp error is exceeding the thresholds, reset the radio
++ * to improve the throughput.
++ */
++bool iwl_good_plcp_health(struct iwl_priv *priv,
++				struct iwl_rx_packet *pkt)
++{
++	bool rc = true;
++	int combined_plcp_delta;
++	unsigned int plcp_msec;
++	unsigned long plcp_received_jiffies;
+ 
+ 	/*
+ 	 * check for plcp_err and trigger radio reset if it exceeds
+@@ -635,7 +643,8 @@ void iwl_recover_from_statistics(struct 
+ 			 *    combined_plcp_delta,
+ 			 *    plcp_msec
+ 			 */
+-			IWL_DEBUG_RADIO(priv, PLCP_MSG,
++			IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
++				"%u, %u, %u, %u, %d, %u mSecs\n",
+ 				priv->cfg->plcp_delta_threshold,
+ 				le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err),
+ 				le32_to_cpu(priv->statistics.rx.ofdm.plcp_err),
+@@ -643,15 +652,42 @@ void iwl_recover_from_statistics(struct 
+ 				le32_to_cpu(
+ 				  priv->statistics.rx.ofdm_ht.plcp_err),
+ 				combined_plcp_delta, plcp_msec);
+-			/*
+-			 * Reset the RF radio due to the high plcp
+-			 * error rate
+-			 */
+-			iwl_force_reset(priv, IWL_RF_RESET);
++			rc = false;
++		}
++	}
++	return rc;
++}
++EXPORT_SYMBOL(iwl_good_plcp_health);
++
++static void iwl_recover_from_statistics(struct iwl_priv *priv,
++				struct iwl_rx_packet *pkt)
++{
++	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
++		return;
++	if (iwl_is_associated(priv)) {
++		if (priv->cfg->ops->lib->check_ack_health) {
++			if (!priv->cfg->ops->lib->check_ack_health(
++			    priv, pkt)) {
++				/*
++				 * low ack count detected
++				 * restart Firmware
++				 */
++				IWL_ERR(priv, "low ack count detected, "
++					"restart firmware\n");
++				iwl_force_reset(priv, IWL_FW_RESET);
++			}
++		} else if (priv->cfg->ops->lib->check_plcp_health) {
++			if (!priv->cfg->ops->lib->check_plcp_health(
++			    priv, pkt)) {
++				/*
++				 * high plcp error detected
++				 * reset Radio
++				 */
++				iwl_force_reset(priv, IWL_RF_RESET);
++			}
+ 		}
+ 	}
+ }
+-EXPORT_SYMBOL(iwl_recover_from_statistics);
+ 
+ void iwl_rx_statistics(struct iwl_priv *priv,
+ 			      struct iwl_rx_mem_buffer *rxb)
+@@ -670,8 +706,7 @@ void iwl_rx_statistics(struct iwl_priv *
+ 		    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
+ 		   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
+ 
+-	if (priv->cfg->ops->lib->recover_from_statistics)
+-		priv->cfg->ops->lib->recover_from_statistics(priv, pkt);
++	iwl_recover_from_statistics(priv, pkt);
+ 
+ 	memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
+ 

iwlwifi_-iwl_good_ack_health-only-apply-to-AGN-device.patch

@@ -0,0 +1,146 @@
+From 2386b8d18106262e27c9ca1a674a1018af29bdde Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Tue, 16 Mar 2010 10:46:31 -0700
+Subject: [PATCH 17/17] iwlwifi: iwl_good_ack_health() only apply to AGN device
+
+iwl_good_ack_health() check for expected and actual ack count which only
+apply to aggregation mode. Move the function to iwlagn module.
+
+Reported-by: Chantry Xavier <chantry.xavier@gmail.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+---
+ drivers/net/wireless/iwlwifi/iwl-agn.c  |   45 ++++++++++++++++++++++++++++++
+ drivers/net/wireless/iwlwifi/iwl-core.h |    2 +
+ drivers/net/wireless/iwlwifi/iwl-rx.c   |   46 -------------------------------
+ 3 files changed, 47 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index c22db6c..d57f215 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -1316,6 +1316,51 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
+ 		iwl_enable_interrupts(priv);
+ }
+ 
++/* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
++#define ACK_CNT_RATIO (50)
++#define BA_TIMEOUT_CNT (5)
++#define BA_TIMEOUT_MAX (16)
++
++/**
++ * iwl_good_ack_health - checks for ACK count ratios, BA timeout retries.
++ *
++ * When the ACK count ratio is 0 and aggregated BA timeout retries exceeding
++ * the BA_TIMEOUT_MAX, reload firmware and bring system back to normal
++ * operation state.
++ */
++bool iwl_good_ack_health(struct iwl_priv *priv,
++				struct iwl_rx_packet *pkt)
++{
++	bool rc = true;
++	int actual_ack_cnt_delta, expected_ack_cnt_delta;
++	int ba_timeout_delta;
++
++	actual_ack_cnt_delta =
++		le32_to_cpu(pkt->u.stats.tx.actual_ack_cnt) -
++		le32_to_cpu(priv->statistics.tx.actual_ack_cnt);
++	expected_ack_cnt_delta =
++		le32_to_cpu(pkt->u.stats.tx.expected_ack_cnt) -
++		le32_to_cpu(priv->statistics.tx.expected_ack_cnt);
++	ba_timeout_delta =
++		le32_to_cpu(pkt->u.stats.tx.agg.ba_timeout) -
++		le32_to_cpu(priv->statistics.tx.agg.ba_timeout);
++	if ((priv->_agn.agg_tids_count > 0) &&
++	    (expected_ack_cnt_delta > 0) &&
++	    (((actual_ack_cnt_delta * 100) / expected_ack_cnt_delta)
++		< ACK_CNT_RATIO) &&
++	    (ba_timeout_delta > BA_TIMEOUT_CNT)) {
++		IWL_DEBUG_RADIO(priv, "actual_ack_cnt delta = %d,"
++				" expected_ack_cnt = %d\n",
++				actual_ack_cnt_delta, expected_ack_cnt_delta);
++		IWL_DEBUG_RADIO(priv, "agg ba_timeout delta = %d\n",
++				ba_timeout_delta);
++		if (!actual_ack_cnt_delta &&
++		    (ba_timeout_delta >= BA_TIMEOUT_MAX))
++			rc = false;
++	}
++	return rc;
++}
++
+ 
+ /******************************************************************************
+  *
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
+index 8bf0c39..ca4a516 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.h
++++ b/drivers/net/wireless/iwlwifi/iwl-core.h
+@@ -584,6 +584,8 @@ void iwl_disable_ict(struct iwl_priv *priv);
+ int iwl_alloc_isr_ict(struct iwl_priv *priv);
+ void iwl_free_isr_ict(struct iwl_priv *priv);
+ irqreturn_t iwl_isr_ict(int irq, void *data);
++bool iwl_good_ack_health(struct iwl_priv *priv,
++			 struct iwl_rx_packet *pkt);
+ 
+ static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
+ {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
+index 1b2a3fc..054d169 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
+@@ -592,52 +592,6 @@ static void iwl_accumulative_statistics(struct iwl_priv *priv,
+ 
+ #define REG_RECALIB_PERIOD (60)
+ 
+-/* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
+-#define ACK_CNT_RATIO (50)
+-#define BA_TIMEOUT_CNT (5)
+-#define BA_TIMEOUT_MAX (16)
+-
+-/**
+- * iwl_good_ack_health - checks for ACK count ratios, BA timeout retries.
+- *
+- * When the ACK count ratio is 0 and aggregated BA timeout retries exceeding
+- * the BA_TIMEOUT_MAX, reload firmware and bring system back to normal
+- * operation state.
+- */
+-bool iwl_good_ack_health(struct iwl_priv *priv,
+-				struct iwl_rx_packet *pkt)
+-{
+-	bool rc = true;
+-	int actual_ack_cnt_delta, expected_ack_cnt_delta;
+-	int ba_timeout_delta;
+-
+-	actual_ack_cnt_delta =
+-		le32_to_cpu(pkt->u.stats.tx.actual_ack_cnt) -
+-		le32_to_cpu(priv->statistics.tx.actual_ack_cnt);
+-	expected_ack_cnt_delta =
+-		le32_to_cpu(pkt->u.stats.tx.expected_ack_cnt) -
+-		le32_to_cpu(priv->statistics.tx.expected_ack_cnt);
+-	ba_timeout_delta =
+-		le32_to_cpu(pkt->u.stats.tx.agg.ba_timeout) -
+-		le32_to_cpu(priv->statistics.tx.agg.ba_timeout);
+-	if ((priv->_agn.agg_tids_count > 0) &&
+-	    (expected_ack_cnt_delta > 0) &&
+-	    (((actual_ack_cnt_delta * 100) / expected_ack_cnt_delta)
+-		< ACK_CNT_RATIO) &&
+-	    (ba_timeout_delta > BA_TIMEOUT_CNT)) {
+-		IWL_DEBUG_RADIO(priv, "actual_ack_cnt delta = %d,"
+-				" expected_ack_cnt = %d\n",
+-				actual_ack_cnt_delta, expected_ack_cnt_delta);
+-		IWL_DEBUG_RADIO(priv, "agg ba_timeout delta = %d\n",
+-				ba_timeout_delta);
+-		if (!actual_ack_cnt_delta &&
+-		    (ba_timeout_delta >= BA_TIMEOUT_MAX))
+-			rc = false;
+-	}
+-	return rc;
+-}
+-EXPORT_SYMBOL(iwl_good_ack_health);
+-
+ /**
+  * iwl_good_plcp_health - checks for plcp error.
+  *
+-- 
+1.6.3.3
+

iwlwifi_-move-plcp-check-to-separated-function.patch

@@ -0,0 +1,179 @@
+This patch is not upstream yet...
+
+From 171e0b730fd471b8df0d138daf382b8f6835fb18 Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Thu, 4 Mar 2010 13:38:58 -0800
+Subject: [PATCH 14/17] iwlwifi: move plcp check to separated function
+
+Move the plcp error checking into stand alone function and pointed by ops
+to accommodate devices not needing this recovery.
+
+Signed-off-by: Trieu 'Andrew' Nguyen <trieux.t.nguyen@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c.orig	2010-03-22 15:48:54.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-22 15:56:08.000000000 -0400
+@@ -136,6 +136,7 @@ static struct iwl_lib_ops iwl1000_lib = 
+ 		.set_ct_kill = iwl1000_set_ct_threshold,
+ 	 },
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
++	.recover_from_statistics = iwl_recover_from_statistics,
+ };
+ 
+ static struct iwl_ops iwl1000_ops = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c.orig	2010-03-22 15:48:54.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-03-22 15:56:08.000000000 -0400
+@@ -2340,6 +2340,7 @@ static struct iwl_lib_ops iwl4965_lib = 
+ 		.temperature = iwl4965_temperature_calib,
+ 		.set_ct_kill = iwl4965_set_ct_threshold,
+ 	},
++	.recover_from_statistics = iwl_recover_from_statistics,
+ };
+ 
+ static struct iwl_ops iwl4965_ops = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c.orig	2010-03-22 15:48:54.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-03-22 15:56:08.000000000 -0400
+@@ -1580,6 +1580,7 @@ struct iwl_lib_ops iwl5000_lib = {
+ 		.set_ct_kill = iwl5000_set_ct_threshold,
+ 	 },
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
++	.recover_from_statistics = iwl_recover_from_statistics,
+ };
+ 
+ static struct iwl_lib_ops iwl5150_lib = {
+@@ -1633,6 +1634,7 @@ static struct iwl_lib_ops iwl5150_lib = 
+ 		.set_ct_kill = iwl5150_set_ct_threshold,
+ 	 },
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
++	.recover_from_statistics = iwl_recover_from_statistics,
+ };
+ 
+ struct iwl_ops iwl5000_ops = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c.orig	2010-03-22 15:51:12.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-22 15:56:08.000000000 -0400
+@@ -138,6 +138,7 @@ static struct iwl_lib_ops iwl6000_lib = 
+ 		.set_ct_kill = iwl6000_set_ct_threshold,
+ 	 },
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
++	.recover_from_statistics = iwl_recover_from_statistics,
+ };
+ 
+ static struct iwl_hcmd_utils_ops iwl6000_hcmd_utils = {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig	2010-03-22 15:48:54.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h	2010-03-22 15:56:08.000000000 -0400
+@@ -185,6 +185,9 @@ struct iwl_lib_ops {
+ 	struct iwl_temp_ops temp_ops;
+ 	/* recover from tx queue stall */
+ 	void (*recover_from_tx_stall)(unsigned long data);
++	/* recover from errors showed in statistics */
++	void (*recover_from_statistics)(struct iwl_priv *priv,
++					struct iwl_rx_packet *pkt);
+ };
+ 
+ struct iwl_ops {
+@@ -398,6 +401,8 @@ int iwl_tx_queue_reclaim(struct iwl_priv
+ /* Handlers */
+ void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
+ 			       struct iwl_rx_mem_buffer *rxb);
++void iwl_recover_from_statistics(struct iwl_priv *priv,
++				 struct iwl_rx_packet *pkt);
+ void iwl_rx_statistics(struct iwl_priv *priv,
+ 			      struct iwl_rx_mem_buffer *rxb);
+ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig	2010-03-22 15:24:28.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c	2010-03-22 16:02:35.000000000 -0400
+@@ -551,25 +551,18 @@ static void iwl_rx_calc_noise(struct iwl
+ #define REG_RECALIB_PERIOD (60)
+ 
+ #define PLCP_MSG "plcp_err exceeded %u, %u, %u, %u, %u, %d, %u mSecs\n"
+-void iwl_rx_statistics(struct iwl_priv *priv,
+-			      struct iwl_rx_mem_buffer *rxb)
++/*
++ * This function checks for plcp error.
++ * - When the plcp error is exceeding the thresholds, it will reset the radio
++ * to improve the throughput.
++ */
++void iwl_recover_from_statistics(struct iwl_priv *priv,
++					struct iwl_rx_packet *pkt)
+ {
+-	int change;
+-	struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+ 	int combined_plcp_delta;
+ 	unsigned int plcp_msec;
+ 	unsigned long plcp_received_jiffies;
+ 
+-	IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
+-		     (int)sizeof(priv->statistics),
+-		     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+-
+-	change = ((priv->statistics.general.temperature !=
+-		   pkt->u.stats.general.temperature) ||
+-		  ((priv->statistics.flag &
+-		    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
+-		   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
+-
+ 	/*
+ 	 * check for plcp_err and trigger radio reset if it exceeds
+ 	 * the plcp error threshold plcp_delta.
+@@ -590,11 +583,11 @@ void iwl_rx_statistics(struct iwl_priv *
+ 			le32_to_cpu(priv->statistics.rx.ofdm_ht.plcp_err));
+ 
+ 		if ((combined_plcp_delta > 0) &&
+-			((combined_plcp_delta * 100) / plcp_msec) >
++		    ((combined_plcp_delta * 100) / plcp_msec) >
+ 			priv->cfg->plcp_delta_threshold) {
+ 			/*
+-			 * if plcp_err exceed the threshold, the following
+-			 * data is printed in csv format:
++			 * if plcp_err exceed the threshold,
++			 * the following data is printed in csv format:
+ 			 *    Text: plcp_err exceeded %d,
+ 			 *    Received ofdm.plcp_err,
+ 			 *    Current ofdm.plcp_err,
+@@ -609,9 +602,8 @@ void iwl_rx_statistics(struct iwl_priv *
+ 				le32_to_cpu(priv->statistics.rx.ofdm.plcp_err),
+ 				le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err),
+ 				le32_to_cpu(
+-					priv->statistics.rx.ofdm_ht.plcp_err),
++				  priv->statistics.rx.ofdm_ht.plcp_err),
+ 				combined_plcp_delta, plcp_msec);
+-
+ 			/*
+ 			 * Reset the RF radio due to the high plcp
+ 			 * error rate
+@@ -619,6 +611,28 @@ void iwl_rx_statistics(struct iwl_priv *
+ 			iwl_force_reset(priv, IWL_RF_RESET);
+ 		}
+ 	}
++}
++EXPORT_SYMBOL(iwl_recover_from_statistics);
++
++void iwl_rx_statistics(struct iwl_priv *priv,
++			      struct iwl_rx_mem_buffer *rxb)
++{
++	int change;
++	struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
++
++
++	IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
++		     (int)sizeof(priv->statistics),
++		     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
++
++	change = ((priv->statistics.general.temperature !=
++		   pkt->u.stats.general.temperature) ||
++		  ((priv->statistics.flag &
++		    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
++		   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
++
++	if (priv->cfg->ops->lib->recover_from_statistics)
++		priv->cfg->ops->lib->recover_from_statistics(priv, pkt);
+ 
+ 	memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
+ 

iwlwifi_-multiple-force-reset-mode.patch

@@ -0,0 +1,152 @@
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig	2010-03-22 16:37:23.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c	2010-03-22 16:39:46.000000000 -0400
+@@ -3035,7 +3035,7 @@ void iwl_update_stats(struct iwl_priv *p
+ EXPORT_SYMBOL(iwl_update_stats);
+ #endif
+ 
+-void iwl_force_rf_reset(struct iwl_priv *priv)
++static void iwl_force_rf_reset(struct iwl_priv *priv)
+ {
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ 		return;
+@@ -3057,7 +3057,47 @@ void iwl_force_rf_reset(struct iwl_priv 
+ 	iwl_internal_short_hw_scan(priv);
+ 	return;
+ }
+-EXPORT_SYMBOL(iwl_force_rf_reset);
++
++#define IWL_DELAY_NEXT_FORCE_RESET (HZ*3)
++
++int iwl_force_reset(struct iwl_priv *priv, int mode)
++{
++	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
++		return -EINVAL;
++
++	if (priv->last_force_reset_jiffies &&
++	    time_after(priv->last_force_reset_jiffies +
++		       IWL_DELAY_NEXT_FORCE_RESET, jiffies)) {
++		IWL_DEBUG_INFO(priv, "force reset rejected\n");
++		return -EAGAIN;
++	}
++
++	IWL_DEBUG_INFO(priv, "perform force reset (%d)\n", mode);
++
++	switch (mode) {
++	case IWL_RF_RESET:
++		iwl_force_rf_reset(priv);
++		break;
++	case IWL_FW_RESET:
++		IWL_ERR(priv, "On demand firmware reload\n");
++		/* Set the FW error flag -- cleared on iwl_down */
++		set_bit(STATUS_FW_ERROR, &priv->status);
++		wake_up_interruptible(&priv->wait_command_queue);
++		/*
++		 * Keep the restart process from trying to send host
++		 * commands by clearing the INIT status bit
++		 */
++		clear_bit(STATUS_READY, &priv->status);
++		queue_work(priv->workqueue, &priv->restart);
++		break;
++	default:
++		IWL_DEBUG_INFO(priv, "invalid reset request.\n");
++		return -EINVAL;
++	}
++	priv->last_force_reset_jiffies = jiffies;
++
++	return 0;
++}
+ 
+ #ifdef CONFIG_PM
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h.orig	2010-03-22 16:37:23.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.h	2010-03-22 16:39:46.000000000 -0400
+@@ -465,7 +465,7 @@ int iwl_scan_cancel(struct iwl_priv *pri
+ int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
+ int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
+ int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+-void iwl_force_rf_reset(struct iwl_priv *priv);
++int iwl_force_reset(struct iwl_priv *priv, int mode);
+ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
+ 		       const u8 *ie, int ie_len, int left);
+ void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig	2010-03-22 16:37:23.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-22 16:39:46.000000000 -0400
+@@ -972,6 +972,11 @@ struct traffic_stats {
+ #define IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF	(100)
+ #define IWL_MAX_PLCP_ERR_THRESHOLD_MAX	(255)
+ 
++enum iwl_reset {
++	IWL_RF_RESET = 0,
++	IWL_FW_RESET,
++};
++
+ struct iwl_priv {
+ 
+ 	/* ieee device used by generic ieee processing code */
+@@ -1003,6 +1008,9 @@ struct iwl_priv {
+ 	/* storing the jiffies when the plcp error rate is received */
+ 	unsigned long plcp_jiffies;
+ 
++	/* force reset */
++	unsigned long last_force_reset_jiffies;
++
+ 	/* we allocate array of iwl4965_channel_info for NIC's valid channels.
+ 	 *    Access via channel # using indirect index array */
+ 	struct iwl_channel_info *channel_info;	/* channel info array */
+@@ -1025,7 +1033,6 @@ struct iwl_priv {
+ 	unsigned long scan_start;
+ 	unsigned long scan_pass_start;
+ 	unsigned long scan_start_tsf;
+-	unsigned long last_internal_scan_jiffies;
+ 	void *scan;
+ 	int scan_bands;
+ 	struct cfg80211_scan_request *scan_request;
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig	2010-03-22 16:37:23.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c	2010-03-22 16:39:46.000000000 -0400
+@@ -616,7 +616,7 @@ void iwl_rx_statistics(struct iwl_priv *
+ 			 * Reset the RF radio due to the high plcp
+ 			 * error rate
+ 			 */
+-			iwl_force_rf_reset(priv);
++			iwl_force_reset(priv, IWL_RF_RESET);
+ 		}
+ 	}
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c.orig	2010-03-22 16:37:23.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-scan.c	2010-03-22 16:39:46.000000000 -0400
+@@ -255,8 +255,6 @@ static void iwl_rx_scan_complete_notif(s
+ 
+ 	if (!priv->is_internal_short_scan)
+ 		priv->next_scan_jiffies = 0;
+-	else
+-		priv->last_internal_scan_jiffies = jiffies;
+ 
+ 	IWL_DEBUG_INFO(priv, "Setting scan to off\n");
+ 
+@@ -564,8 +562,6 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
+  * internal short scan, this function should only been called while associated.
+  * It will reset and tune the radio to prevent possible RF related problem
+  */
+-#define IWL_DELAY_NEXT_INTERNAL_SCAN (HZ*1)
+-
+ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+ {
+ 	int ret = 0;
+@@ -585,12 +581,6 @@ int iwl_internal_short_hw_scan(struct iw
+ 		ret = -EAGAIN;
+ 		goto out;
+ 	}
+-	if (priv->last_internal_scan_jiffies &&
+-	    time_after(priv->last_internal_scan_jiffies +
+-		       IWL_DELAY_NEXT_INTERNAL_SCAN, jiffies)) {
+-		IWL_DEBUG_SCAN(priv, "internal scan rejected\n");
+-		goto out;
+-	}
+ 
+ 	priv->scan_bands = 0;
+ 	if (priv->band == IEEE80211_BAND_5GHZ)

iwlwifi_-separated-time-check-for-different-type-of-force-reset.patch

@@ -0,0 +1,120 @@
+Back-port of the following upstream commit...
+
+commit 8a472da431998b7357e6dc562e79a3061ed56cad
+Author: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date:   Thu Feb 18 22:03:06 2010 -0800
+
+    iwlwifi: separated time check for different type of force reset
+    
+    Use different timing duration check for different type of force reset,
+    force reset request can come from different source and based on
+    different reason; one type of reset request should not block other type of
+    reset request.
+    
+    Adding structure to keep track of different force reset request.
+    
+    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c.orig	2010-03-22 15:24:28.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-core.c	2010-03-22 15:40:48.000000000 -0400
+@@ -1497,6 +1497,12 @@ int iwl_init_drv(struct iwl_priv *priv)
+ 
+ 	priv->current_ht_config.sm_ps = WLAN_HT_CAP_SM_PS_DISABLED;
+ 
++	/* initialize force reset */
++	priv->force_reset[IWL_RF_RESET].reset_duration =
++		IWL_DELAY_NEXT_FORCE_RF_RESET;
++	priv->force_reset[IWL_FW_RESET].reset_duration =
++		IWL_DELAY_NEXT_FORCE_FW_RELOAD;
++
+ 	/* Choose which receivers/antennas to use */
+ 	if (priv->cfg->ops->hcmd->set_rxon_chain)
+ 		priv->cfg->ops->hcmd->set_rxon_chain(priv);
+@@ -3058,22 +3064,30 @@ static void iwl_force_rf_reset(struct iw
+ 	return;
+ }
+ 
+-#define IWL_DELAY_NEXT_FORCE_RESET (HZ*3)
+ 
+ int iwl_force_reset(struct iwl_priv *priv, int mode)
+ {
++	struct iwl_force_reset *force_reset;
++
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ 		return -EINVAL;
+ 
+-	if (priv->last_force_reset_jiffies &&
+-	    time_after(priv->last_force_reset_jiffies +
+-		       IWL_DELAY_NEXT_FORCE_RESET, jiffies)) {
++	if (mode >= IWL_MAX_FORCE_RESET) {
++		IWL_DEBUG_INFO(priv, "invalid reset request.\n");
++		return -EINVAL;
++	}
++	force_reset = &priv->force_reset[mode];
++	force_reset->reset_request_count++;
++	if (force_reset->last_force_reset_jiffies &&
++	    time_after(force_reset->last_force_reset_jiffies +
++	    force_reset->reset_duration, jiffies)) {
+ 		IWL_DEBUG_INFO(priv, "force reset rejected\n");
++		force_reset->reset_reject_count++;
+ 		return -EAGAIN;
+ 	}
+-
++	force_reset->reset_success_count++;
++	force_reset->last_force_reset_jiffies = jiffies;
+ 	IWL_DEBUG_INFO(priv, "perform force reset (%d)\n", mode);
+-
+ 	switch (mode) {
+ 	case IWL_RF_RESET:
+ 		iwl_force_rf_reset(priv);
+@@ -3090,12 +3104,7 @@ int iwl_force_reset(struct iwl_priv *pri
+ 		clear_bit(STATUS_READY, &priv->status);
+ 		queue_work(priv->workqueue, &priv->restart);
+ 		break;
+-	default:
+-		IWL_DEBUG_INFO(priv, "invalid reset request.\n");
+-		return -EINVAL;
+ 	}
+-	priv->last_force_reset_jiffies = jiffies;
+-
+ 	return 0;
+ }
+ 
+diff -up linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h.orig	2010-03-22 15:33:00.000000000 -0400
++++ linux-2.6.32.noarch/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-22 15:37:04.000000000 -0400
+@@ -973,9 +973,21 @@ struct traffic_stats {
+ #define IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF	(200)
+ #define IWL_MAX_PLCP_ERR_THRESHOLD_MAX	(255)
+ 
++#define IWL_DELAY_NEXT_FORCE_RF_RESET  (HZ*3)
++#define IWL_DELAY_NEXT_FORCE_FW_RELOAD (HZ*5)
++
+ enum iwl_reset {
+ 	IWL_RF_RESET = 0,
+ 	IWL_FW_RESET,
++	IWL_MAX_FORCE_RESET,
++};
++
++struct iwl_force_reset {
++	int reset_request_count;
++	int reset_success_count;
++	int reset_reject_count;
++	unsigned long reset_duration;
++	unsigned long last_force_reset_jiffies;
+ };
+ 
+ struct iwl_priv {
+@@ -1010,7 +1022,7 @@ struct iwl_priv {
+ 	unsigned long plcp_jiffies;
+ 
+ 	/* force reset */
+-	unsigned long last_force_reset_jiffies;
++	struct iwl_force_reset force_reset[IWL_MAX_FORCE_RESET];
+ 
+ 	/* we allocate array of iwl4965_channel_info for NIC's valid channels.
+ 	 *    Access via channel # using indirect index array */

l2tp-fix-oops-in-pppol2tp_xmit.patch

@@ -0,0 +1,78 @@
+From: James Chapman <jchapman@katalix.com>
+Date: Tue, 16 Mar 2010 06:46:31 +0000 (+0000)
+Subject: l2tp: Fix oops in pppol2tp_xmit
+X-Git-Tag: v2.6.34-rc2~28^2~10
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=3feec909
+
+l2tp: Fix oops in pppol2tp_xmit
+
+When transmitting L2TP frames, we derive the outgoing interface's UDP
+checksum hardware assist capabilities from the tunnel dst dev. This
+can sometimes be NULL, especially when routing protocols are used and
+routing changes occur. This patch just checks for NULL dst or dev
+pointers when checking for netdev hardware assist features.
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000c
+IP: [<f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp]
+*pde = 00000000
+Oops: 0000 [#1] SMP
+last sysfs file: /sys/class/net/lo/operstate
+Modules linked in: pppol2tp pppox ppp_generic slhc ipv6 dummy loop snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_timer snd soundcore snd_page_alloc evdev psmouse serio_raw processor button i2c_piix4 i2c_core ati_agp agpgart pcspkr ext3 jbd mbcache sd_mod ide_pci_generic atiixp ide_core ahci ata_generic floppy ehci_hcd ohci_hcd libata e1000e scsi_mod usbcore nls_base thermal fan thermal_sys [last unloaded: scsi_wait_scan]
+
+Pid: 0, comm: swapper Not tainted (2.6.32.8 #1)
+EIP: 0060:[<f89d074c>] EFLAGS: 00010297 CPU: 3
+EIP is at pppol2tp_xmit+0x341/0x4da [pppol2tp]
+EAX: 00000000 EBX: f64d1680 ECX: 000005b9 EDX: 00000000
+ESI: f6b91850 EDI: f64d16ac EBP: f6a0c4c0 ESP: f70a9cac
+ DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
+Process swapper (pid: 0, ti=f70a8000 task=f70a31c0 task.ti=f70a8000)
+Stack:
+ 000005a9 000005b9 f734c400 f66652c0 f7352e00 f67dc800 00000000 f6b91800
+<0> 000005a3 f70ef6c4 f67dcda9 000005a3 f89b192e 00000246 000005a3 f64d1680
+<0> f63633e0 f6363320 f64d1680 f65a7320 f65a7364 f65856c0 f64d1680 f679f02f
+Call Trace:
+ [<f89b192e>] ? ppp_push+0x459/0x50e [ppp_generic]
+ [<f89b217f>] ? ppp_xmit_process+0x3b6/0x430 [ppp_generic]
+ [<f89b2306>] ? ppp_start_xmit+0x10d/0x120 [ppp_generic]
+ [<c11c15cb>] ? dev_hard_start_xmit+0x21f/0x2b2
+ [<c11d0947>] ? sch_direct_xmit+0x48/0x10e
+ [<c11c19a0>] ? dev_queue_xmit+0x263/0x3a6
+ [<c11e2a9f>] ? ip_finish_output+0x1f7/0x221
+ [<c11df682>] ? ip_forward_finish+0x2e/0x30
+ [<c11de645>] ? ip_rcv_finish+0x295/0x2a9
+ [<c11c0b19>] ? netif_receive_skb+0x3e9/0x404
+ [<f814b791>] ? e1000_clean_rx_irq+0x253/0x2fc [e1000e]
+ [<f814cb7a>] ? e1000_clean+0x63/0x1fc [e1000e]
+ [<c1047eff>] ? sched_clock_local+0x15/0x11b
+ [<c11c1095>] ? net_rx_action+0x96/0x195
+ [<c1035750>] ? __do_softirq+0xaa/0x151
+ [<c1035828>] ? do_softirq+0x31/0x3c
+ [<c10358fe>] ? irq_exit+0x26/0x58
+ [<c1004b21>] ? do_IRQ+0x78/0x89
+ [<c1003729>] ? common_interrupt+0x29/0x30
+ [<c101ac28>] ? native_safe_halt+0x2/0x3
+ [<c1008c54>] ? default_idle+0x55/0x75
+ [<c1009045>] ? c1e_idle+0xd2/0xd5
+ [<c100233c>] ? cpu_idle+0x46/0x62
+Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 18 8b 4c 24 04 <8b> 40 0c 8d 79 11 f6 40 44 0e 8a 43 64 75 51 6a 00 8b 4c 24 08
+EIP: [<f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac
+CR2: 000000000000000c
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index 9fbb2eb..5861ee9 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -1180,7 +1180,8 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ 	/* Calculate UDP checksum if configured to do so */
+ 	if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)
+ 		skb->ip_summed = CHECKSUM_NONE;
+-	else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {
++	else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
++		 (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
+ 		skb->ip_summed = CHECKSUM_COMPLETE;
+ 		csum = skb_checksum(skb, 0, udp_len, 0);
+ 		uh->check = csum_tcpudp_magic(inet->inet_saddr,

linux-2.6-acpi-video-dos.patch

@@ -0,0 +1,17 @@
+Disable firmware video brightness change on AC/Battery switch by default
+
+-- mjg59
+
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index bac2901..93b1a9e 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -1818,7 +1818,7 @@ static int acpi_video_bus_put_devices(struct acpi_video_bus *video)
+ 
+ static int acpi_video_bus_start_devices(struct acpi_video_bus *video)
+ {
+-	return acpi_video_bus_DOS(video, 0, 0);
++	return acpi_video_bus_DOS(video, 0, 1);
+ }
+ 
+ static int acpi_video_bus_stop_devices(struct acpi_video_bus *video)

linux-2.6-ata-quirk.patch

@@ -0,0 +1,58 @@
+--- linux-2.6.20/arch/ia64/kernel/quirks.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.20_fix/arch/ia64/kernel/quirks.c	2007-02-13 13:56:34.000000000 -0500
+@@ -0,0 +1,45 @@
++/*
++ * This file contains work-arounds for ia64 platform bugs.
++ */
++#include <linux/pci.h>
++
++/*
++ * quirk_intel_ide_controller: If an ide/ata controller is
++ * at legacy mode, BIOS might initiates BAR(bar 0~3 and 5)
++ * with incorrect value. This quirk will reset the incorrect
++ * value to 0.
++ */
++static void __devinit quirk_intel_ide_controller(struct pci_dev *dev)
++{
++	unsigned int pos;
++	struct resource *res;
++	int fixed = 0;
++	u8 tmp8;
++
++	if ((dev->class >> 8) != PCI_CLASS_STORAGE_IDE)
++		return;
++
++	/* TODO: What if one channel is in native mode ... */
++	pci_read_config_byte(dev, PCI_CLASS_PROG, &tmp8);
++	if ((tmp8 & 5) == 5)
++		return;
++
++	for( pos = 0; pos < 6; pos ++ ) {
++		res = &dev->resource[pos];
++		if (!(res->flags & (IORESOURCE_IO | IORESOURCE_MEM)))
++			continue;
++
++		if (!res->start && res->end) {
++			res->start = res->end = 0;
++			res->flags = 0;
++			fixed = 1;
++		}
++	}
++	if (fixed)
++		printk(KERN_WARNING
++			"PCI device %s: BIOS resource configuration fixed.\n",
++			pci_name(dev));
++}
++
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_11, quirk_intel_ide_controller);
++
+--- linux-2.6.21.noarch/arch/ia64/kernel/Makefile~	2007-05-27 23:23:36.000000000 -0400
++++ linux-2.6.21.noarch/arch/ia64/kernel/Makefile	2007-05-27 23:23:48.000000000 -0400
+@@ -33,6 +33,7 @@ obj-$(CONFIG_CRASH_DUMP)	+= crash_dump.o
+ obj-$(CONFIG_IA64_UNCACHED_ALLOCATOR)	+= uncached.o
+ obj-$(CONFIG_AUDIT)		+= audit.o
+ obj-$(CONFIG_PCI_MSI)		+= msi_ia64.o
++obj-$(CONFIG_PCI)		+= quirks.o
+ mca_recovery-y			+= mca_drv.o mca_drv_asm.o
+ obj-$(CONFIG_IA64_MC_ERR_INJECT)+= err_inject.o
+ 

linux-2.6-autoload-wmi.patch

@@ -0,0 +1,244 @@
+From: Matthew Garrett <mjg@redhat.com>
+Date: Wed, 4 Nov 2009 19:17:53 +0000 (-0500)
+Subject: wmi: Add support for module autoloading
+X-Git-Tag: v2.6.33-rc1~47^2~5^2
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=1caab3c1a90be3aa4ec3599409d8fe044b077478
+
+wmi: Add support for module autoloading
+
+WMI provides interface-specific GUIDs that are exported from modules as
+modalises, but the core currently generates no events to trigger module
+loading. This patch adds support for registering devices for each WMI GUID
+and generating the appropriate uevent.
+
+Based heavily on a patch by Carlos Corbacho (<carlos@strangeworlds.co.uk>).
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Tested-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
+Acked-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
+Signed-off-by: Len Brown <len.brown@intel.com>
+---
+
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index 177f8d7..e425a86 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -30,6 +30,7 @@
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+ #include <linux/types.h>
++#include <linux/device.h>
+ #include <linux/list.h>
+ #include <linux/acpi.h>
+ #include <acpi/acpi_bus.h>
+@@ -65,6 +66,7 @@ struct wmi_block {
+ 	acpi_handle handle;
+ 	wmi_notify_handler handler;
+ 	void *handler_data;
++	struct device *dev;
+ };
+ 
+ static struct wmi_block wmi_blocks;
+@@ -195,6 +197,34 @@ static bool wmi_parse_guid(const u8 *src, u8 *dest)
+ 	return true;
+ }
+ 
++/*
++ * Convert a raw GUID to the ACII string representation
++ */
++static int wmi_gtoa(const char *in, char *out)
++{
++	int i;
++
++	for (i = 3; i >= 0; i--)
++		out += sprintf(out, "%02X", in[i] & 0xFF);
++
++	out += sprintf(out, "-");
++	out += sprintf(out, "%02X", in[5] & 0xFF);
++	out += sprintf(out, "%02X", in[4] & 0xFF);
++	out += sprintf(out, "-");
++	out += sprintf(out, "%02X", in[7] & 0xFF);
++	out += sprintf(out, "%02X", in[6] & 0xFF);
++	out += sprintf(out, "-");
++	out += sprintf(out, "%02X", in[8] & 0xFF);
++	out += sprintf(out, "%02X", in[9] & 0xFF);
++	out += sprintf(out, "-");
++
++	for (i = 10; i <= 15; i++)
++		out += sprintf(out, "%02X", in[i] & 0xFF);
++
++	out = '\0';
++	return 0;
++}
++
+ static bool find_guid(const char *guid_string, struct wmi_block **out)
+ {
+ 	char tmp[16], guid_input[16];
+@@ -555,6 +585,138 @@ bool wmi_has_guid(const char *guid_string)
+ EXPORT_SYMBOL_GPL(wmi_has_guid);
+ 
+ /*
++ * sysfs interface
++ */
++static ssize_t show_modalias(struct device *dev, struct device_attribute *attr,
++			     char *buf)
++{
++	char guid_string[37];
++	struct wmi_block *wblock;
++
++	wblock = dev_get_drvdata(dev);
++	if (!wblock)
++		return -ENOMEM;
++
++	wmi_gtoa(wblock->gblock.guid, guid_string);
++
++	return sprintf(buf, "wmi:%s\n", guid_string);
++}
++static DEVICE_ATTR(modalias, S_IRUGO, show_modalias, NULL);
++
++static int wmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env)
++{
++	char guid_string[37];
++
++	struct wmi_block *wblock;
++
++	if (add_uevent_var(env, "MODALIAS="))
++		return -ENOMEM;
++
++	wblock = dev_get_drvdata(dev);
++	if (!wblock)
++		return -ENOMEM;
++
++	wmi_gtoa(wblock->gblock.guid, guid_string);
++
++	strcpy(&env->buf[env->buflen - 1], "wmi:");
++	memcpy(&env->buf[env->buflen - 1 + 4], guid_string, 36);
++	env->buflen += 40;
++
++	return 0;
++}
++
++static void wmi_dev_free(struct device *dev)
++{
++	kfree(dev);
++}
++
++static struct class wmi_class = {
++	.name = "wmi",
++	.dev_release = wmi_dev_free,
++	.dev_uevent = wmi_dev_uevent,
++};
++
++static int wmi_create_devs(void)
++{
++	int result;
++	char guid_string[37];
++	struct guid_block *gblock;
++	struct wmi_block *wblock;
++	struct list_head *p;
++	struct device *guid_dev;
++
++	/* Create devices for all the GUIDs */
++	list_for_each(p, &wmi_blocks.list) {
++		wblock = list_entry(p, struct wmi_block, list);
++
++		guid_dev = kzalloc(sizeof(struct device), GFP_KERNEL);
++		if (!guid_dev)
++			return -ENOMEM;
++
++		wblock->dev = guid_dev;
++
++		guid_dev->class = &wmi_class;
++		dev_set_drvdata(guid_dev, wblock);
++
++		gblock = &wblock->gblock;
++
++		wmi_gtoa(gblock->guid, guid_string);
++		dev_set_name(guid_dev, guid_string);
++
++		result = device_register(guid_dev);
++		if (result)
++			return result;
++
++		result = device_create_file(guid_dev, &dev_attr_modalias);
++		if (result)
++			return result;
++	}
++
++	return 0;
++}
++
++static void wmi_remove_devs(void)
++{
++	struct guid_block *gblock;
++	struct wmi_block *wblock;
++	struct list_head *p;
++	struct device *guid_dev;
++
++	/* Delete devices for all the GUIDs */
++	list_for_each(p, &wmi_blocks.list) {
++		wblock = list_entry(p, struct wmi_block, list);
++
++		guid_dev = wblock->dev;
++		gblock = &wblock->gblock;
++
++		device_remove_file(guid_dev, &dev_attr_modalias);
++
++		device_unregister(guid_dev);
++	}
++}
++
++static void wmi_class_exit(void)
++{
++	wmi_remove_devs();
++	class_unregister(&wmi_class);
++}
++
++static int wmi_class_init(void)
++{
++	int ret;
++
++	ret = class_register(&wmi_class);
++	if (ret)
++		return ret;
++
++	ret = wmi_create_devs();
++	if (ret)
++		wmi_class_exit();
++
++	return ret;
++}
++
++/*
+  * Parse the _WDG method for the GUID data blocks
+  */
+ static __init acpi_status parse_wdg(acpi_handle handle)
+@@ -709,10 +871,17 @@ static int __init acpi_wmi_init(void)
+ 
+ 	if (result < 0) {
+ 		printk(KERN_INFO PREFIX "Error loading mapper\n");
+-	} else {
+-		printk(KERN_INFO PREFIX "Mapper loaded\n");
++		return -ENODEV;
++	}
++
++	result = wmi_class_init();
++	if (result) {
++		acpi_bus_unregister_driver(&acpi_wmi_driver);
++		return result;
+ 	}
+ 
++	printk(KERN_INFO PREFIX "Mapper loaded\n");
++
+ 	return result;
+ }
+ 
+@@ -721,6 +890,8 @@ static void __exit acpi_wmi_exit(void)
+ 	struct list_head *p, *tmp;
+ 	struct wmi_block *wblock;
+ 
++	wmi_class_exit();
++
+ 	acpi_bus_unregister_driver(&acpi_wmi_driver);
+ 
+ 	list_for_each_safe(p, tmp, &wmi_blocks.list) {

linux-2.6-b43_-Rewrite-DMA-Tx-status-handling-sanity-checks.patch

@@ -0,0 +1,182 @@
+Back-port of the following upstream commit...
+
+commit 07681e211d736ba2394ab7f29f77e93adecd22c5
+Author: Michael Buesch <mb@bu3sch.de>
+Date:   Thu Nov 19 22:24:29 2009 +0100
+
+    b43: Rewrite DMA Tx status handling sanity checks
+    
+    This rewrites the error handling policies in the TX status handler.
+    It tries to be error-tolerant as in "try hard to not crash the machine".
+    It won't recover from errors (that are bugs in the firmware or driver),
+    because that's impossible. However, it will return a more or less useful
+    error message and bail out. It also tries hard to use rate-limited messages
+    to not flood the syslog in case of a failure.
+    
+    Signed-off-by: Michael Buesch <mb@bu3sch.de>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+diff -up linux-2.6.32.noarch/drivers/net/wireless/b43/dma.c.orig linux-2.6.32.noarch/drivers/net/wireless/b43/dma.c
+--- linux-2.6.32.noarch/drivers/net/wireless/b43/dma.c.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/b43/dma.c	2010-03-17 14:02:28.000000000 -0400
+@@ -770,7 +770,7 @@ static void free_all_descbuffers(struct 
+ 	for (i = 0; i < ring->nr_slots; i++) {
+ 		desc = ring->ops->idx2desc(ring, i, &meta);
+ 
+-		if (!meta->skb) {
++		if (!meta->skb || b43_dma_ptr_is_poisoned(meta->skb)) {
+ 			B43_WARN_ON(!ring->tx);
+ 			continue;
+ 		}
+@@ -822,7 +822,7 @@ struct b43_dmaring *b43_setup_dmaring(st
+ 				      enum b43_dmatype type)
+ {
+ 	struct b43_dmaring *ring;
+-	int err;
++	int i, err;
+ 	dma_addr_t dma_test;
+ 
+ 	ring = kzalloc(sizeof(*ring), GFP_KERNEL);
+@@ -837,6 +837,8 @@ struct b43_dmaring *b43_setup_dmaring(st
+ 			     GFP_KERNEL);
+ 	if (!ring->meta)
+ 		goto err_kfree_ring;
++	for (i = 0; i < ring->nr_slots; i++)
++		ring->meta->skb = B43_DMA_PTR_POISON;
+ 
+ 	ring->type = type;
+ 	ring->dev = dev;
+@@ -1147,11 +1149,13 @@ struct b43_dmaring *parse_cookie(struct 
+ 	case 0x5000:
+ 		ring = dma->tx_ring_mcast;
+ 		break;
+-	default:
+-		B43_WARN_ON(1);
+ 	}
+ 	*slot = (cookie & 0x0FFF);
+-	B43_WARN_ON(!(ring && *slot >= 0 && *slot < ring->nr_slots));
++	if (unlikely(!ring || *slot < 0 || *slot >= ring->nr_slots)) {
++		b43dbg(dev->wl, "TX-status contains "
++		       "invalid cookie: 0x%04X\n", cookie);
++		return NULL;
++	}
+ 
+ 	return ring;
+ }
+@@ -1400,19 +1404,40 @@ void b43_dma_handle_txstatus(struct b43_
+ 	struct b43_dmaring *ring;
+ 	struct b43_dmadesc_generic *desc;
+ 	struct b43_dmadesc_meta *meta;
+-	int slot;
++	int slot, firstused;
+ 	bool frame_succeed;
+ 
+ 	ring = parse_cookie(dev, status->cookie, &slot);
+ 	if (unlikely(!ring))
+ 		return;
+-
+ 	B43_WARN_ON(!ring->tx);
++
++	/* Sanity check: TX packets are processed in-order on one ring.
++	 * Check if the slot deduced from the cookie really is the first
++	 * used slot. */
++	firstused = ring->current_slot - ring->used_slots + 1;
++	if (firstused < 0)
++		firstused = ring->nr_slots + firstused;
++	if (unlikely(slot != firstused)) {
++		/* This possibly is a firmware bug and will result in
++		 * malfunction, memory leaks and/or stall of DMA functionality. */
++		b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. "
++		       "Expected %d, but got %d\n",
++		       ring->index, firstused, slot);
++		return;
++	}
++
+ 	ops = ring->ops;
+ 	while (1) {
+-		B43_WARN_ON(!(slot >= 0 && slot < ring->nr_slots));
++		B43_WARN_ON(slot < 0 || slot >= ring->nr_slots);
+ 		desc = ops->idx2desc(ring, slot, &meta);
+ 
++		if (b43_dma_ptr_is_poisoned(meta->skb)) {
++			b43dbg(dev->wl, "Poisoned TX slot %d (first=%d) "
++			       "on ring %d\n",
++			       slot, firstused, ring->index);
++			break;
++		}
+ 		if (meta->skb)
+ 			unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len,
+ 					 1);
+@@ -1423,7 +1448,14 @@ void b43_dma_handle_txstatus(struct b43_
+ 		if (meta->is_last_fragment) {
+ 			struct ieee80211_tx_info *info;
+ 
+-			BUG_ON(!meta->skb);
++			if (unlikely(!meta->skb)) {
++				/* This is a scatter-gather fragment of a frame, so
++				 * the skb pointer must not be NULL. */
++				b43dbg(dev->wl, "TX status unexpected NULL skb "
++				       "at slot %d (first=%d) on ring %d\n",
++				       slot, firstused, ring->index);
++				break;
++			}
+ 
+ 			info = IEEE80211_SKB_CB(meta->skb);
+ 
+@@ -1441,20 +1473,29 @@ void b43_dma_handle_txstatus(struct b43_
+ #endif /* DEBUG */
+ 			ieee80211_tx_status(dev->wl->hw, meta->skb);
+ 
+-			/* skb is freed by ieee80211_tx_status() */
+-			meta->skb = NULL;
++			/* skb will be freed by ieee80211_tx_status().
++			 * Poison our pointer. */
++			meta->skb = B43_DMA_PTR_POISON;
+ 		} else {
+ 			/* No need to call free_descriptor_buffer here, as
+ 			 * this is only the txhdr, which is not allocated.
+ 			 */
+-			B43_WARN_ON(meta->skb);
++			if (unlikely(meta->skb)) {
++				b43dbg(dev->wl, "TX status unexpected non-NULL skb "
++				       "at slot %d (first=%d) on ring %d\n",
++				       slot, firstused, ring->index);
++				break;
++			}
+ 		}
+ 
+ 		/* Everything unmapped and free'd. So it's not used anymore. */
+ 		ring->used_slots--;
+ 
+-		if (meta->is_last_fragment)
++		if (meta->is_last_fragment) {
++			/* This is the last scatter-gather
++			 * fragment of the frame. We are done. */
+ 			break;
++		}
+ 		slot = next_slot(ring, slot);
+ 	}
+ 	if (ring->stopped) {
+diff -up linux-2.6.32.noarch/drivers/net/wireless/b43/dma.h.orig linux-2.6.32.noarch/drivers/net/wireless/b43/dma.h
+--- linux-2.6.32.noarch/drivers/net/wireless/b43/dma.h.orig	2009-12-02 22:51:21.000000000 -0500
++++ linux-2.6.32.noarch/drivers/net/wireless/b43/dma.h	2010-03-17 13:57:57.000000000 -0400
+@@ -1,7 +1,7 @@
+ #ifndef B43_DMA_H_
+ #define B43_DMA_H_
+ 
+-#include <linux/ieee80211.h>
++#include <linux/err.h>
+ 
+ #include "b43.h"
+ 
+@@ -165,6 +165,10 @@ struct b43_dmadesc_generic {
+ #define B43_RXRING_SLOTS		64
+ #define B43_DMA0_RX_BUFFERSIZE		IEEE80211_MAX_FRAME_LEN
+ 
++/* Pointer poison */
++#define B43_DMA_PTR_POISON		((void *)ERR_PTR(-ENOMEM))
++#define b43_dma_ptr_is_poisoned(ptr)	(unlikely((ptr) == B43_DMA_PTR_POISON))
++
+ 
+ struct sk_buff;
+ struct b43_private;

linux-2.6-build-nonintconfig.patch

@@ -0,0 +1,128 @@
+diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
+index 6d69c7c..ff84d12 100644
+--- a/scripts/kconfig/Makefile
++++ b/scripts/kconfig/Makefile
+@@ -58,6 +58,11 @@ localyesconfig: $(obj)/streamline_config.pl $(obj)/conf
+ 	fi
+ 	$(Q)rm -f .tmp.config
+ 
++nonint_oldconfig: $(obj)/conf
++	$< -b $(Kconfig)
++loose_nonint_oldconfig: $(obj)/conf
++	$< -B $(Kconfig)
++
+ # Create new linux.pot file
+ # Adjust charset to UTF-8 in .po file to accept UTF-8 in Kconfig files
+ # The symlink is used to repair a deficiency in arch/um
+diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
+index 9960d1c..ac8d455 100644
+--- a/scripts/kconfig/conf.c
++++ b/scripts/kconfig/conf.c
+@@ -23,6 +23,8 @@ enum {
+ 	ask_all,
+ 	ask_new,
+ 	ask_silent,
++	dont_ask,
++	dont_ask_dont_tell,
+ 	set_default,
+ 	set_yes,
+ 	set_mod,
+@@ -360,7 +362,10 @@ static void conf(struct menu *menu)
+ 
+ 		switch (prop->type) {
+ 		case P_MENU:
+-			if (input_mode == ask_silent && rootEntry != menu) {
++			if ((input_mode == ask_silent ||
++			     input_mode == dont_ask ||
++			     input_mode == dont_ask_dont_tell) &&
++			    rootEntry != menu) {
+ 				check_conf(menu);
+ 				return;
+ 			}
+@@ -406,6 +411,8 @@ conf_childs:
+ 		indent -= 2;
+ }
+ 
++static int return_value;
++
+ static void check_conf(struct menu *menu)
+ {
+ 	struct symbol *sym;
+@@ -418,12 +425,21 @@ static void check_conf(struct menu *menu)
+ 	if (sym && !sym_has_value(sym)) {
+ 		if (sym_is_changable(sym) ||
+ 		    (sym_is_choice(sym) && sym_get_tristate_value(sym) == yes)) {
++			if (input_mode == dont_ask ||
++			    input_mode == dont_ask_dont_tell) {
++				if (input_mode == dont_ask &&
++				    sym->name && !sym_is_choice_value(sym)) {
++					fprintf(stderr,"CONFIG_%s\n",sym->name);
++					++return_value;
++				}
++			} else {
+ 			if (!conf_cnt++)
+ 				printf(_("*\n* Restart config...\n*\n"));
+ 			rootEntry = menu_get_parent_menu(menu);
+ 			conf(rootEntry);
+ 		}
+ 	}
++	}
+ 
+ 	for (child = menu->list; child; child = child->next)
+ 		check_conf(child);
+@@ -439,7 +455,7 @@ int main(int ac, char **av)
+ 	bindtextdomain(PACKAGE, LOCALEDIR);
+ 	textdomain(PACKAGE);
+ 
+-	while ((opt = getopt(ac, av, "osdD:nmyrh")) != -1) {
++ 	while ((opt = getopt(ac, av, "osbBdD:nmyrh")) != -1) {
+ 		switch (opt) {
+ 		case 'o':
+ 			input_mode = ask_silent;
+@@ -448,6 +464,12 @@ int main(int ac, char **av)
+ 			input_mode = ask_silent;
+ 			sync_kconfig = 1;
+ 			break;
++		case 'b':
++			input_mode = dont_ask;
++			break;
++		case 'B':
++			input_mode = dont_ask_dont_tell;
++			break;
+ 		case 'd':
+ 			input_mode = set_default;
+ 			break;
+@@ -525,6 +547,8 @@ int main(int ac, char **av)
+ 	case ask_silent:
+ 	case ask_all:
+ 	case ask_new:
++	case dont_ask:
++	case dont_ask_dont_tell:
+ 		conf_read(NULL);
+ 		break;
+ 	case set_no:
+@@ -586,12 +610,16 @@ int main(int ac, char **av)
+ 		conf(&rootmenu);
+ 		input_mode = ask_silent;
+ 		/* fall through */
++	case dont_ask:
++	case dont_ask_dont_tell:
+ 	case ask_silent:
+ 		/* Update until a loop caused no more changes */
+ 		do {
+ 			conf_cnt = 0;
+ 			check_conf(&rootmenu);
+-		} while (conf_cnt);
++		} while (conf_cnt &&
++			 (input_mode != dont_ask &&
++			  input_mode != dont_ask_dont_tell));
+ 		break;
+ 	}
+ 
+@@ -613,5 +641,5 @@ int main(int ac, char **av)
+ 			exit(1);
+ 		}
+ 	}
+-	return 0;
++	return return_value;
+ }

linux-2.6-cantiga-iommu-gfx.patch

@@ -0,0 +1,26 @@
+diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
+index 4173125..baa32a0 100644
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -340,7 +340,7 @@ int dmar_disabled = 0;
+ int dmar_disabled = 1;
+ #endif /*CONFIG_DMAR_DEFAULT_ON*/
+ 
+-static int __initdata dmar_map_gfx = 1;
++static int dmar_map_gfx = 1;
+ static int dmar_forcedac;
+ static int intel_iommu_strict;
+ 
+@@ -3728,6 +3728,12 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
+ 	 */
+ 	printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
+ 	rwbf_quirk = 1;
++
++	/* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
++	if (dev->revision == 0x07) {
++		printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
++		dmar_map_gfx = 0;
++	}
+ }
+ 
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);

linux-2.6-compile-fixes.patch

@@ -0,0 +1,6 @@
+#
+# Small compile fixes (For more involved fixes, please use a separate patch).
+#
+# Please add the errors from gcc before the diffs to save others having
+# to do a compile to figure out what your diff is fixing. Thanks.
+#

linux-2.6-crash-driver.patch

@@ -0,0 +1,363 @@
+diff --git a/arch/ia64/include/asm/crash.h b/arch/ia64/include/asm/crash.h
+new file mode 100644
+index 0000000..541af84
+--- /dev/null
++++ b/arch/ia64/include/asm/crash.h
+@@ -0,0 +1,90 @@
++#ifndef _ASM_IA64_CRASH_H
++#define _ASM_IA64_CRASH_H
++
++/*
++ * linux/include/asm-ia64/crash.h
++ *
++ * Copyright (c) 2004 Red Hat, Inc. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2, or (at your option)
++ * any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ *
++ */
++
++#ifdef __KERNEL__
++
++#include <linux/efi.h>
++#include <linux/mm.h>
++#include <asm/mmzone.h>
++
++static inline void *
++map_virtual(u64 offset, struct page **pp)
++{
++	struct page *page;
++	unsigned long pfn;
++	u32 type;
++
++	if (REGION_NUMBER(offset) == 5) {
++		char byte;
++
++		if (__get_user(byte, (char *)offset) == 0)
++			return (void *)offset;
++		else
++			return NULL;
++	}
++
++	switch (type = efi_mem_type(offset)) 
++	{
++	case EFI_LOADER_CODE:
++	case EFI_LOADER_DATA:
++	case EFI_BOOT_SERVICES_CODE:
++	case EFI_BOOT_SERVICES_DATA:
++	case EFI_CONVENTIONAL_MEMORY:
++		break;
++
++	default:
++		printk(KERN_INFO
++		    "crash memory driver: invalid memory type for %lx: %d\n", 
++			offset, type);
++		return NULL;
++	}
++
++	pfn = offset >> PAGE_SHIFT;
++
++	if (!pfn_valid(pfn)) {
++		printk(KERN_INFO
++			"crash memory driver: invalid pfn: %lx )\n", pfn);
++		return NULL;
++	}
++
++	page = pfn_to_page(pfn);
++
++	if (!page->virtual) {
++		printk(KERN_INFO
++		    "crash memory driver: offset: %lx page: %lx page->virtual: NULL\n", 
++			offset, (unsigned long)page);
++		return NULL;
++	}
++
++	return (page->virtual + (offset & (PAGE_SIZE-1)));
++}
++
++static inline void unmap_virtual(struct page *page) 
++{ 
++	return;
++}
++
++#endif /* __KERNEL__ */
++
++#endif /* _ASM_IA64_CRASH_H */
+diff --git a/arch/ia64/kernel/ia64_ksyms.c b/arch/ia64/kernel/ia64_ksyms.c
+index 14d39e3..cf3d040 100644
+--- a/arch/ia64/kernel/ia64_ksyms.c
++++ b/arch/ia64/kernel/ia64_ksyms.c
+@@ -84,6 +84,9 @@ EXPORT_SYMBOL(ia64_save_scratch_fpregs);
+ #include <asm/unwind.h>
+ EXPORT_SYMBOL(unw_init_running);
+ 
++#include <linux/efi.h>
++EXPORT_SYMBOL_GPL(efi_mem_type);
++
+ #if defined(CONFIG_IA64_ESI) || defined(CONFIG_IA64_ESI_MODULE)
+ extern void esi_call_phys (void);
+ EXPORT_SYMBOL_GPL(esi_call_phys);
+diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h
+new file mode 100644
+index 0000000..dfcc006
+--- /dev/null
++++ b/arch/x86/include/asm/crash.h
+@@ -0,0 +1,75 @@
++#ifndef _ASM_I386_CRASH_H
++#define _ASM_I386_CRASH_H
++
++/*
++ * linux/include/asm-i386/crash.h
++ *
++ * Copyright (c) 2004 Red Hat, Inc. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2, or (at your option)
++ * any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ *
++ */
++
++#ifdef __KERNEL__
++
++#include <linux/mm.h>
++#include <linux/highmem.h>
++#include <asm/mmzone.h>
++
++extern int page_is_ram(unsigned long);
++
++static inline void *
++map_virtual(u64 offset, struct page **pp)
++{
++	struct page *page;
++	unsigned long pfn;
++	void *vaddr;
++
++	pfn = (unsigned long)(offset >> PAGE_SHIFT);
++
++	if (!page_is_ram(pfn)) {
++		printk(KERN_INFO
++		    "crash memory driver: !page_is_ram(pfn: %lx)\n", pfn);
++		return NULL;
++	}
++
++	if (!pfn_valid(pfn)) {
++		printk(KERN_INFO
++		    "crash memory driver: invalid pfn: %lx )\n", pfn);
++		return NULL;
++	}
++
++	page = pfn_to_page(pfn);
++
++	vaddr = kmap(page);
++	if (!vaddr) {
++		printk(KERN_INFO
++		    "crash memory driver: pfn: %lx kmap(page: %lx) failed\n", 
++			pfn, (unsigned long)page);
++		return NULL;
++	}
++
++	*pp = page;
++	return (vaddr + (offset & (PAGE_SIZE-1)));
++}
++
++static inline void unmap_virtual(struct page *page) 
++{ 
++	kunmap(page);
++}
++
++#endif /* __KERNEL__ */
++
++#endif /* _ASM_I386_CRASH_H */
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index 334e63c..8e1ccbc 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -60,6 +60,7 @@ int page_is_ram(unsigned long pagenr)
+ 	}
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(page_is_ram);
+ 
+ /*
+  * Fix up the linear direct mapping of the kernel to avoid cache attribute
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index 08a6f50..8bc5e9a 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -484,6 +484,8 @@ config LEGACY_PTYS
+ 	  security.  This option enables these legacy devices; on most
+ 	  systems, it is safe to say N.
+ 
++config CRASH
++        tristate "Crash Utility memory driver"
+ 
+ config LEGACY_PTY_COUNT
+ 	int "Maximum number of legacy PTY in use"
+diff --git a/drivers/char/Makefile b/drivers/char/Makefile
+index 19a79dd..0bee860 100644
+--- a/drivers/char/Makefile
++++ b/drivers/char/Makefile
+@@ -112,6 +112,8 @@ obj-$(CONFIG_PS3_FLASH)		+= ps3flash.o
+ obj-$(CONFIG_JS_RTC)		+= js-rtc.o
+ js-rtc-y = rtc.o
+ 
++obj-$(CONFIG_CRASH)		+= crash.o
++
+ # Files generated that shall be removed upon make clean
+ clean-files := consolemap_deftbl.c defkeymap.c
+ 
+diff --git a/drivers/char/crash.c b/drivers/char/crash.c
+new file mode 100644
+index 0000000..e5437de
+--- /dev/null
++++ b/drivers/char/crash.c
+@@ -0,0 +1,128 @@
++/*
++ *  linux/drivers/char/crash.c
++ *
++ *  Copyright (C) 2004  Dave Anderson <anderson@redhat.com>
++ *  Copyright (C) 2004  Red Hat, Inc.
++ */
++
++/******************************************************************************
++ *
++ *   This program is free software; you can redistribute it and/or modify
++ *   it under the terms of the GNU General Public License as published by
++ *   the Free Software Foundation; either version 2, or (at your option)
++ *   any later version.
++ *
++ *   This program is distributed in the hope that it will be useful,
++ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *   GNU General Public License for more details.
++ *
++ *   You should have received a copy of the GNU General Public License
++ *   along with this program; if not, write to the Free Software
++ *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ *
++ *****************************************************************************/
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/miscdevice.h>
++#include <linux/init.h>
++#include <asm/io.h>
++#include <asm/uaccess.h>
++#include <asm/types.h>
++#include <asm/crash.h>
++
++#define CRASH_VERSION   "1.0"
++
++/*
++ *  These are the file operation functions that allow crash utility
++ *  access to physical memory.
++ */
++
++static loff_t 
++crash_llseek(struct file * file, loff_t offset, int orig)
++{
++	switch (orig) {
++	case 0:
++		file->f_pos = offset;
++		return file->f_pos;
++	case 1:
++		file->f_pos += offset;
++		return file->f_pos;
++	default:
++		return -EINVAL;
++	}
++}
++
++/*
++ *  Determine the page address for an address offset value, 
++ *  get a virtual address for it, and copy it out.
++ *  Accesses must fit within a page.
++ */
++static ssize_t
++crash_read(struct file *file, char *buf, size_t count, loff_t *poff)
++{
++	void *vaddr;
++	struct page *page;
++	u64 offset;
++	ssize_t read;
++
++	offset = *poff;
++	if (offset >> PAGE_SHIFT != (offset+count-1) >> PAGE_SHIFT) 
++		return -EINVAL;
++
++	vaddr = map_virtual(offset, &page);
++	if (!vaddr)
++		return -EFAULT;
++
++	if (copy_to_user(buf, vaddr, count)) {
++		unmap_virtual(page);
++		return -EFAULT;
++	}
++	unmap_virtual(page);
++
++	read = count;
++	*poff += read;
++	return read;
++}
++
++static struct file_operations crash_fops = {
++	.owner = THIS_MODULE,
++	.llseek = crash_llseek,
++	.read = crash_read,
++};
++
++static struct miscdevice crash_dev = {
++	MISC_DYNAMIC_MINOR,
++	"crash",
++	&crash_fops
++};
++
++static int __init
++crash_init(void)
++{
++	int ret;
++
++	ret = misc_register(&crash_dev);
++	if (ret) {
++		printk(KERN_ERR 
++		    "crash memory driver: cannot misc_register (MISC_DYNAMIC_MINOR)\n");
++		goto out;
++	}
++	
++	ret = 0;
++	printk(KERN_INFO "crash memory driver: version %s\n", CRASH_VERSION);
++out:
++	return ret;
++}
++
++static void __exit
++crash_cleanup_module(void)
++{
++	misc_deregister(&crash_dev);
++}
++
++module_init(crash_init);
++module_exit(crash_cleanup_module);
++
++MODULE_LICENSE("GPL");

linux-2.6-debug-always-inline-kzalloc.patch

@@ -0,0 +1,25 @@
+From 76ec0e2e6d6edf81abc0331d5e7873ef7b2f6019 Mon Sep 17 00:00:00 2001
+From: Kyle McMartin <kyle@phobos.i.jkkm.org>
+Date: Wed, 8 Jul 2009 13:06:01 -0400
+Subject: [PATCH 6/6] fedora: linux-2.6-debug-always-inline-kzalloc.patch
+
+---
+ include/linux/slab.h |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index 2da8372..d4ef74f 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -310,7 +310,7 @@ static inline void *kmem_cache_zalloc(struct kmem_cache *k, gfp_t flags)
+  * @size: how many bytes of memory are required.
+  * @flags: the type of memory to allocate (see kmalloc).
+  */
+-static inline void *kzalloc(size_t size, gfp_t flags)
++static __always_inline void *kzalloc(size_t size, gfp_t flags)
+ {
+ 	return kmalloc(size, flags | __GFP_ZERO);
+ }
+-- 
+1.6.2.5
+

linux-2.6-debug-nmi-timeout.patch

@@ -0,0 +1,45 @@
+From 899dd25ae272c73407c1477ec223982d0b57a668 Mon Sep 17 00:00:00 2001
+From: Kyle McMartin <kyle@phobos.i.jkkm.org>
+Date: Wed, 8 Jul 2009 13:03:06 -0400
+Subject: [PATCH 2/6] fedora: linux-2.6-debug-nmi-timeout.patch
+
+---
+ arch/x86/kernel/apic/nmi.c |    2 +-
+ lib/Kconfig.debug          |    8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/nmi.c b/arch/x86/kernel/apic/nmi.c
+index b3025b4..e82a450 100644
+--- a/arch/x86/kernel/apic/nmi.c
++++ b/arch/x86/kernel/apic/nmi.c
+@@ -436,7 +436,7 @@ nmi_watchdog_tick(struct pt_regs *regs, unsigned reason)
+ 		 * wait a few IRQs (5 seconds) before doing the oops ...
+ 		 */
+ 		local_inc(&__get_cpu_var(alert_counter));
+-		if (local_read(&__get_cpu_var(alert_counter)) == 5 * nmi_hz)
++		if (local_read(&__get_cpu_var(alert_counter)) == CONFIG_DEBUG_NMI_TIMEOUT * nmi_hz)
+ 			/*
+ 			 * die_nmi will return ONLY if NOTIFY_STOP happens..
+ 			 */
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 12327b2..2790b4f 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -245,6 +245,14 @@ config SCHEDSTATS
+ 	  application, you can say N to avoid the very slight overhead
+ 	  this adds.
+ 
++config DEBUG_NMI_TIMEOUT
++	int "Number of seconds before NMI timeout"
++	depends on X86
++	default 5
++	help
++	  This value is the number of seconds the NMI watchdog will tick
++	  before it decides the machine has hung.
++
+ config TIMER_STATS
+ 	bool "Collect kernel timers statistics"
+ 	depends on DEBUG_KERNEL && PROC_FS
+-- 
+1.6.2.5
+

linux-2.6-debug-sizeof-structs.patch

@@ -0,0 +1,31 @@
+diff --git a/init/main.c b/init/main.c
+index 7449819..98cfaae 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -369,6 +369,10 @@ static void __init setup_nr_cpu_ids(void)
+ 	nr_cpu_ids = find_last_bit(cpumask_bits(cpu_possible_mask),NR_CPUS) + 1;
+ }
+ 
++#include <linux/ext3_fs_i.h>
++#include <linux/skbuff.h>
++#include <linux/sched.h>
++
+ /* Called by boot processor to activate the rest. */
+ static void __init smp_init(void)
+ {
+@@ -391,6 +395,15 @@ static void __init smp_init(void)
+ 	/* Any cleanup work */
+ 	printk(KERN_INFO "Brought up %ld CPUs\n", (long)num_online_cpus());
+ 	smp_cpus_done(setup_max_cpus);
++
++	printk(KERN_DEBUG "sizeof(vma)=%u bytes\n", (unsigned int) sizeof(struct vm_area_struct));
++	printk(KERN_DEBUG "sizeof(page)=%u bytes\n", (unsigned int) sizeof(struct page));
++	printk(KERN_DEBUG "sizeof(inode)=%u bytes\n", (unsigned int) sizeof(struct inode));
++	printk(KERN_DEBUG "sizeof(dentry)=%u bytes\n", (unsigned int) sizeof(struct dentry));
++	printk(KERN_DEBUG "sizeof(ext3inode)=%u bytes\n", (unsigned int) sizeof(struct ext3_inode_info));
++	printk(KERN_DEBUG "sizeof(buffer_head)=%u bytes\n", (unsigned int) sizeof(struct buffer_head));
++	printk(KERN_DEBUG "sizeof(skbuff)=%u bytes\n", (unsigned int) sizeof(struct sk_buff));
++	printk(KERN_DEBUG "sizeof(task_struct)=%u bytes\n", (unsigned int) sizeof(struct task_struct));
+ }
+ 
+ #endif

linux-2.6-debug-taint-vm.patch

@@ -0,0 +1,65 @@
+From b04c57d9dc889462951312be2ac81ff6c702e954 Mon Sep 17 00:00:00 2001
+From: Kyle McMartin <kyle@phobos.i.jkkm.org>
+Date: Wed, 8 Jul 2009 13:05:09 -0400
+Subject: [PATCH 3/6] fedora: linux-2.6-debug-taint-vm.patch
+
+---
+ kernel/panic.c  |    4 +++-
+ mm/slab.c       |    8 ++++----
+ mm/slub.c       |    2 +-
+ 4 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 984b3ec..6d1c3be 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -199,6 +199,7 @@ const char *print_tainted(void)
+ 
+ 	return buf;
+ }
++EXPORT_SYMBOL(print_tainted);
+ 
+ int test_taint(unsigned flag)
+ {
+diff --git a/mm/slab.c b/mm/slab.c
+index e74a16e..7bc287e 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -1803,8 +1803,8 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
+ 			/* Print header */
+ 			if (lines == 0) {
+ 				printk(KERN_ERR
+-					"Slab corruption: %s start=%p, len=%d\n",
+-					cachep->name, realobj, size);
++					"Slab corruption (%s): %s start=%p, len=%d\n",
++					print_tainted(), cachep->name, realobj, size);
+ 				print_objinfo(cachep, objp, 0);
+ 			}
+ 			/* Hexdump the affected line */
+@@ -2902,8 +2902,8 @@ static void check_slabp(struct kmem_cache *cachep, struct slab *slabp)
+ 	if (entries != cachep->num - slabp->inuse) {
+ bad:
+ 		printk(KERN_ERR "slab: Internal list corruption detected in "
+-				"cache '%s'(%d), slabp %p(%d). Hexdump:\n",
+-			cachep->name, cachep->num, slabp, slabp->inuse);
++				"cache '%s'(%d), slabp %p(%d). Tainted(%s). Hexdump:\n",
++			cachep->name, cachep->num, slabp, slabp->inuse, print_tainted());
+ 		for (i = 0;
+ 		     i < sizeof(*slabp) + cachep->num * sizeof(kmem_bufctl_t);
+ 		     i++) {
+diff --git a/mm/slub.c b/mm/slub.c
+index 819f056..8eff0f4 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -433,7 +433,7 @@ static void slab_bug(struct kmem_cache *s, char *fmt, ...)
+ 	va_end(args);
+ 	printk(KERN_ERR "========================================"
+ 			"=====================================\n");
+-	printk(KERN_ERR "BUG %s: %s\n", s->name, buf);
++	printk(KERN_ERR "BUG %s (%s): %s\n", s->name, print_tainted(), buf);
+ 	printk(KERN_ERR "----------------------------------------"
+ 			"-------------------------------------\n\n");
+ }
+-- 
+1.6.2.5
+

linux-2.6-debug-vm-would-have-oomkilled.patch

@@ -0,0 +1,52 @@
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 0d949c5..8fb2bd9 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -72,6 +72,7 @@ extern int sysctl_overcommit_ratio;
+ extern int sysctl_panic_on_oom;
+ extern int sysctl_oom_kill_allocating_task;
+ extern int sysctl_oom_dump_tasks;
++extern int sysctl_would_have_oomkilled;
+ extern int max_threads;
+ extern int core_uses_pid;
+ extern int suid_dumpable;
+@@ -1073,6 +1074,14 @@ static struct ctl_table vm_table[] = {
+ 		.proc_handler	= &proc_dointvec,
+ 	},
+ 	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "would_have_oomkilled",
++		.data		= &sysctl_would_have_oomkilled,
++		.maxlen		= sizeof(sysctl_would_have_oomkilled),
++		.mode		= 0644,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
+ 		.ctl_name	= VM_OVERCOMMIT_RATIO,
+ 		.procname	= "overcommit_ratio",
+ 		.data		= &sysctl_overcommit_ratio,
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index ea2147d..788fe84 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -31,6 +31,7 @@
+ int sysctl_panic_on_oom;
+ int sysctl_oom_kill_allocating_task;
+ int sysctl_oom_dump_tasks;
++int sysctl_would_have_oomkilled;
+ static DEFINE_SPINLOCK(zone_scan_lock);
+ /* #define DEBUG */
+ 
+@@ -356,6 +357,12 @@ static void __oom_kill_task(struct task_struct *p, int verbose)
+ 		return;
+ 	}
+ 
++	if (sysctl_would_have_oomkilled == 1) {
++		printk(KERN_ERR "Would have killed process %d (%s). But continuing instead.\n",
++				task_pid_nr(p), p->comm);
++		return;
++	}
++
+ 	if (verbose)
+ 		printk(KERN_ERR "Killed process %d (%s)\n",
+ 				task_pid_nr(p), p->comm);

linux-2.6-defaults-acpi-video.patch

@@ -0,0 +1,13 @@
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index d8d7596..a1b7117 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -71,7 +71,7 @@ MODULE_AUTHOR("Bruno Ducrot");
+ MODULE_DESCRIPTION("ACPI Video Driver");
+ MODULE_LICENSE("GPL");
+ 
+-static int brightness_switch_enabled = 1;
++static int brightness_switch_enabled = 0;
+ module_param(brightness_switch_enabled, bool, 0644);
+ 
+ static int acpi_video_bus_add(struct acpi_device *device);

linux-2.6-defaults-alsa-hda-beep-off.patch

@@ -0,0 +1,13 @@
+diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c
+index 3ecd7e7..2762b40 100644
+--- a/sound/pci/hda/hda_beep.c
++++ b/sound/pci/hda/hda_beep.c
+@@ -122,7 +122,7 @@ int snd_hda_attach_beep_device(struct hda_codec *codec, int nid)
+ 	beep->nid = nid;
+ 	beep->dev = input_dev;
+ 	beep->codec = codec;
+-	beep->enabled = 1;
++	beep->enabled = 0;
+ 	codec->beep = beep;
+ 
+ 	INIT_WORK(&beep->beep_work, &snd_hda_generate_beep);

linux-2.6-defaults-aspm.patch

@@ -0,0 +1,12 @@
+diff -up linux-2.6.30.noarch/drivers/pci/pcie/aspm.c.mjg linux-2.6.30.noarch/drivers/pci/pcie/aspm.c
+--- linux-2.6.30.noarch/drivers/pci/pcie/aspm.c.mjg	2009-07-16 22:01:11.000000000 +0100
++++ linux-2.6.30.noarch/drivers/pci/pcie/aspm.c	2009-07-16 22:01:30.000000000 +0100
+@@ -65,7 +65,7 @@ static LIST_HEAD(link_list);
+ #define POLICY_DEFAULT 0	/* BIOS default setting */
+ #define POLICY_PERFORMANCE 1	/* high performance */
+ #define POLICY_POWERSAVE 2	/* high power saving */
+-static int aspm_policy;
++static int aspm_policy = POLICY_POWERSAVE;
+ static const char *policy_str[] = {
+ 	[POLICY_DEFAULT] = "default",
+ 	[POLICY_PERFORMANCE] = "performance",

linux-2.6-defaults-pci_no_msi.patch

@@ -0,0 +1,92 @@
+--- linux-2.6.30.noarch/Documentation/kernel-parameters.txt~	2009-06-24 14:25:04.000000000 -0400
++++ linux-2.6.30.noarch/Documentation/kernel-parameters.txt	2009-06-24 14:25:32.000000000 -0400
+@@ -1811,6 +1811,9 @@ and is between 256 and 4096 characters. 
+ 		check_enable_amd_mmconf [X86] check for and enable
+ 				properly configured MMIO access to PCI
+ 				config space on AMD family 10h CPU
++		msi		[MSI] If the PCI_MSI kernel config parameter is
++				enabled, this kernel boot option can be used to
++				enable the use of MSI interrupts system-wide.
+ 		nomsi		[MSI] If the PCI_MSI kernel config parameter is
+ 				enabled, this kernel boot option can be used to
+ 				disable the use of MSI interrupts system-wide.
+diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
+index 2a4501d..209758c 100644
+--- a/drivers/pci/Kconfig
++++ b/drivers/pci/Kconfig
+@@ -21,6 +21,18 @@ config PCI_MSI
+ 
+ 	   If you don't know what to do here, say N.
+ 
++config PCI_MSI_DEFAULT_ON
++	def_bool y
++	prompt "Use Message Signaled Interrupts by default"
++	depends on PCI_MSI
++	help
++	  Selecting this option will enable use of PCI MSI where applicable
++	  by default. Support for MSI can be disabled through the use of the
++	  pci=nomsi boot flag. Conversely, if this option is not selected,
++	  support for PCI MSI can be enabled by passing the pci=msi flag.
++
++	  If you don't know what to do here, say N.
++
+ config PCI_LEGACY
+ 	bool "Enable deprecated pci_find_* API"
+ 	depends on PCI
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index 896a15d..53df583 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -23,7 +23,11 @@
+ #include "pci.h"
+ #include "msi.h"
+ 
++#ifdef CONFIG_PCI_MSI_DEFAULT_ON
+ static int pci_msi_enable = 1;
++#else
++static int pci_msi_enable = 0;
++#endif /*CONFIG_PCI_MSI_DEFAULT_ON*/
+ 
+ /* Arch hooks */
+ 
+@@ -786,6 +790,11 @@ int pci_msi_enabled(void)
+ }
+ EXPORT_SYMBOL(pci_msi_enabled);
+ 
++void pci_yes_msi(void)
++{
++	pci_msi_enable = 1;
++}
++
+ void pci_msi_init_pci_dev(struct pci_dev *dev)
+ {
+ 	INIT_LIST_HEAD(&dev->msi_list);
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 17bd932..e9bc9fe 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2393,6 +2393,8 @@ static int __init pci_setup(char *str)
+ 		if (*str && (str = pcibios_setup(str)) && *str) {
+ 			if (!strcmp(str, "nomsi")) {
+ 				pci_no_msi();
++			} else if (!strcmp(str, "msi")) {
++				pci_yes_msi();
+ 			} else if (!strcmp(str, "noaer")) {
+ 				pci_no_aer();
+ 			} else if (!strcmp(str, "nodomains")) {
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 26ddf78..85efe81 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -111,9 +111,11 @@ extern unsigned int pci_pm_d3_delay;
+ 
+ #ifdef CONFIG_PCI_MSI
+ void pci_no_msi(void);
++void pci_yes_msi(void);
+ extern void pci_msi_init_pci_dev(struct pci_dev *dev);
+ #else
+ static inline void pci_no_msi(void) { }
++static inline void pci_yes_msi(void) { }
+ static inline void pci_msi_init_pci_dev(struct pci_dev *dev) { }
+ #endif
+ 

linux-2.6-defaults-pciehp.patch

@@ -0,0 +1,13 @@
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index e7f3c9e..4f2b037 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -41,7 +41,7 @@ int pciehp_debug;
+ int pciehp_poll_mode;
+ int pciehp_poll_time;
+ int pciehp_force;
+-int pciehp_passive;
++int pciehp_passive=1;
+ struct workqueue_struct *pciehp_wq;
+ 
+ #define DRIVER_VERSION	"0.4"

linux-2.6-dell-laptop-rfkill-fix.patch

@@ -0,0 +1,323 @@
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index 7c237e6..80f1e48 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -88,19 +88,26 @@ static int input_defuzz_abs_event(int value, int old_val, int fuzz)
+  */
+ static void input_pass_event(struct input_dev *dev,
+ 			     unsigned int type, unsigned int code, int value)
+-{
+-	struct input_handle *handle;
++
++{	struct input_handle *handle;
+ 
+ 	rcu_read_lock();
+ 
+ 	handle = rcu_dereference(dev->grab);
+-	if (handle)
++	if (handle) {
+ 		handle->handler->event(handle, type, code, value);
+-	else
+-		list_for_each_entry_rcu(handle, &dev->h_list, d_node)
+-			if (handle->open)
+-				handle->handler->event(handle,
+-							type, code, value);
++		goto out;
++	}
++
++	handle = rcu_dereference(dev->filter);
++	if (handle && handle->handler->filter(handle, type, code, value))
++		goto out;
++
++	list_for_each_entry_rcu(handle, &dev->h_list, d_node)
++		if (handle->open)
++			handle->handler->event(handle,
++					       type, code, value);
++out:
+ 	rcu_read_unlock();
+ }
+ 
+@@ -375,12 +382,15 @@ int input_grab_device(struct input_handle *handle)
+ }
+ EXPORT_SYMBOL(input_grab_device);
+ 
+-static void __input_release_device(struct input_handle *handle)
++static void __input_release_device(struct input_handle *handle, bool filter)
+ {
+ 	struct input_dev *dev = handle->dev;
+ 
+-	if (dev->grab == handle) {
+-		rcu_assign_pointer(dev->grab, NULL);
++	if (handle == (filter ? dev->filter : dev->grab)) {
++		if (filter)
++			rcu_assign_pointer(dev->filter, NULL);
++		else
++			rcu_assign_pointer(dev->grab, NULL);
+ 		/* Make sure input_pass_event() notices that grab is gone */
+ 		synchronize_rcu();
+ 
+@@ -404,12 +414,65 @@ void input_release_device(struct input_handle *handle)
+ 	struct input_dev *dev = handle->dev;
+ 
+ 	mutex_lock(&dev->mutex);
+-	__input_release_device(handle);
++	__input_release_device(handle, false);
+ 	mutex_unlock(&dev->mutex);
+ }
+ EXPORT_SYMBOL(input_release_device);
+ 
+ /**
++ * input_filter_device - allow input events to be filtered from higher layers
++ * @handle: input handle that wants to filter the device
++ *
++ * When a device is filtered by an input handle all events generated by
++ * the device are to this handle. If the filter function returns true then
++ * the event is discarded rather than being passed to any other input handles,
++ * otherwise it is passed to them as normal. Grabs will be handled before
++ * filters, so a grabbed device will not deliver events to a filter function.
++ */
++int input_filter_device(struct input_handle *handle)
++{
++	struct input_dev *dev = handle->dev;
++	int retval;
++
++	retval = mutex_lock_interruptible(&dev->mutex);
++	if (retval)
++		return retval;
++
++	if (dev->filter) {
++		retval = -EBUSY;
++		goto out;
++	}
++
++	rcu_assign_pointer(dev->filter, handle);
++	synchronize_rcu();
++
++ out:
++	mutex_unlock(&dev->mutex);
++	return retval;
++}
++EXPORT_SYMBOL(input_filter_device);
++
++/**
++ * input_unfilter_device - removes a filter from a device
++ * @handle: input handle that owns the device
++ *
++ * Removes the filter from a device so that other input handles can
++ * start receiving unfiltered input events. Upon release all handlers
++ * attached to the device have their start() method called so they
++ * have a change to synchronize device state with the rest of the
++ * system.
++ */
++void input_unfilter_device(struct input_handle *handle)
++{
++	struct input_dev *dev = handle->dev;
++
++	mutex_lock(&dev->mutex);
++	__input_release_device(handle, true);
++	mutex_unlock(&dev->mutex);
++}
++EXPORT_SYMBOL(input_unfilter_device);
++
++/**
+  * input_open_device - open input device
+  * @handle: handle through which device is being accessed
+  *
+@@ -482,7 +545,9 @@ void input_close_device(struct input_handle *handle)
+ 
+ 	mutex_lock(&dev->mutex);
+ 
+-	__input_release_device(handle);
++	/* Release both grabs and filters */
++	__input_release_device(handle, false);
++	__input_release_device(handle, true);
+ 
+ 	if (!--dev->users && dev->close)
+ 		dev->close(dev);
+diff --git a/include/linux/input.h b/include/linux/input.h
+index 8b3bc3e..e28f116 100644
+--- a/include/linux/input.h
++++ b/include/linux/input.h
+@@ -1118,6 +1118,7 @@ struct input_dev {
+ 	int (*event)(struct input_dev *dev, unsigned int type, unsigned int code, int value);
+ 
+ 	struct input_handle *grab;
++	struct input_handle *filter;
+ 
+ 	spinlock_t event_lock;
+ 	struct mutex mutex;
+@@ -1218,6 +1219,7 @@ struct input_handler {
+ 	void *private;
+ 
+ 	void (*event)(struct input_handle *handle, unsigned int type, unsigned int code, int value);
++	bool (*filter)(struct input_handle *handle, unsigned int type, unsigned int code, int value);
+ 	int (*connect)(struct input_handler *handler, struct input_dev *dev, const struct input_device_id *id);
+ 	void (*disconnect)(struct input_handle *handle);
+ 	void (*start)(struct input_handle *handle);
+@@ -1295,6 +1297,9 @@ void input_unregister_handle(struct input_handle *);
+ int input_grab_device(struct input_handle *);
+ void input_release_device(struct input_handle *);
+ 
++int input_filter_device(struct input_handle *);
++void input_unfilter_device(struct input_handle *);
++
+ int input_open_device(struct input_handle *);
+ void input_close_device(struct input_handle *);
+ 
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 74909c4..71a4149 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -22,6 +22,7 @@
+ #include <linux/rfkill.h>
+ #include <linux/power_supply.h>
+ #include <linux/acpi.h>
++#include <linux/input.h>
+ #include "../../firmware/dcdbas.h"
+ 
+ #define BRIGHTNESS_TOKEN 0x7d
+@@ -206,6 +207,16 @@ static const struct rfkill_ops dell_rfkill_ops = {
+ 	.query = dell_rfkill_query,
+ };
+ 
++static void dell_rfkill_update(void)
++{
++	if (wifi_rfkill)
++		dell_rfkill_query(wifi_rfkill, (void *)1);
++	if (bluetooth_rfkill)
++		dell_rfkill_query(bluetooth_rfkill, (void *)2);
++	if (wwan_rfkill)
++		dell_rfkill_query(wwan_rfkill, (void *)3);
++}
++
+ static int dell_setup_rfkill(void)
+ {
+ 	struct calling_interface_buffer buffer;
+@@ -310,6 +321,90 @@ static struct backlight_ops dell_ops = {
+ 	.update_status  = dell_send_intensity,
+ };
+ 
++static const struct input_device_id dell_input_ids[] = {
++	{
++		.bustype = 0x11,
++		.vendor = 0x01,
++		.product = 0x01,
++		.version = 0xab41,
++		.flags = INPUT_DEVICE_ID_MATCH_BUS |
++			 INPUT_DEVICE_ID_MATCH_VENDOR |
++			 INPUT_DEVICE_ID_MATCH_PRODUCT |
++			 INPUT_DEVICE_ID_MATCH_VERSION
++	},
++	{ },
++};
++
++static bool dell_input_filter(struct input_handle *handle, unsigned int type,
++			     unsigned int code, int value)
++{
++	if (type == EV_KEY && code == KEY_WLAN && value == 1) {
++		dell_rfkill_update();
++		return 1;
++	}
++
++	return 0;
++}
++
++static void dell_input_event(struct input_handle *handle, unsigned int type,
++			     unsigned int code, int value)
++{
++}
++
++static int dell_input_connect(struct input_handler *handler,
++			      struct input_dev *dev,
++			      const struct input_device_id *id)
++{
++	struct input_handle *handle;
++	int error;
++
++	handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL);
++	if (!handle)
++		return -ENOMEM;
++
++	handle->dev = dev;
++	handle->handler = handler;
++	handle->name = "dell-laptop";
++
++	error = input_register_handle(handle);
++	if (error)
++		goto err_free_handle;
++
++	error = input_open_device(handle);
++	if (error)
++		goto err_unregister_handle;
++
++	error = input_filter_device(handle);
++	if (error)
++		goto err_close_handle;
++
++	return 0;
++
++err_close_handle:
++	input_close_device(handle);
++err_unregister_handle:
++	input_unregister_handle(handle);
++err_free_handle:
++	kfree(handle);
++	return error;
++}
++
++static void dell_input_disconnect(struct input_handle *handle)
++{
++	input_close_device(handle);
++	input_unregister_handle(handle);
++	kfree(handle);
++}
++
++static struct input_handler dell_input_handler = {
++	.name = "dell-laptop",
++	.filter = dell_input_filter,
++	.event = dell_input_event,
++	.connect = dell_input_connect,
++	.disconnect = dell_input_disconnect,
++	.id_table = dell_input_ids,
++};
++
+ static int __init dell_init(void)
+ {
+ 	struct calling_interface_buffer buffer;
+@@ -333,6 +428,10 @@ static int __init dell_init(void)
+ 		goto out;
+ 	}
+ 
++	if (input_register_handler(&dell_input_handler))
++		printk(KERN_INFO
++		       "dell-laptop: Could not register input filter\n");
++
+ #ifdef CONFIG_ACPI
+ 	/* In the event of an ACPI backlight being available, don't
+ 	 * register the platform controller.
+@@ -388,6 +487,7 @@ static void __exit dell_exit(void)
+ 		rfkill_unregister(bluetooth_rfkill);
+ 	if (wwan_rfkill)
+ 		rfkill_unregister(wwan_rfkill);
++	input_unregister_handler(&dell_input_handler);
+ }
+ 
+ module_init(dell_init);
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 71a4149..e559fa1 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -198,8 +198,8 @@ static void dell_rfkill_query(struct rfkill *rfkill, void *data)
+ 	dell_send_request(&buffer, 17, 11);
+ 	status = buffer.output[1];
+ 
+-	if (status & BIT(bit))
+-		rfkill_set_hw_state(rfkill, !!(status & BIT(16)));
++	rfkill_set_sw_state(rfkill, !!(status & BIT(bit)));
++	rfkill_set_hw_state(rfkill, !(status & BIT(16)));
+ }
+ 
+ static const struct rfkill_ops dell_rfkill_ops = {
+-- 
+1.6.3.3
+

linux-2.6-driver-level-usb-autosuspend.diff

@@ -0,0 +1,62 @@
+commit 7d0d20a25c6f477fb198b85510c78156d7d7c5af
+Author: Matthew Garrett <mjg@redhat.com>
+Date:   Tue Jun 9 20:11:47 2009 +0100
+
+    usb: Allow drivers to enable USB autosuspend on a per-device basis
+    
+    USB autosuspend is currently only enabled by default for hubs. On other
+    hardware the decision is made by userspace. This is unnecessary in cases
+    where we know that the hardware supports autosuspend, so this patch adds
+    a function to allow drivers to enable it at probe time.
+    
+    Signed-off-by: Matthew Garrett <mjg@redhat.com>
+
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index 4f86447..f7caf00 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1575,6 +1575,22 @@ void usb_autopm_put_interface_async(struct usb_interface *intf)
+ EXPORT_SYMBOL_GPL(usb_autopm_put_interface_async);
+ 
+ /**
++ * usb_device_autosuspend_enable - enable autosuspend on a device
++ * @udev: the usb_device to be autosuspended
++ *
++ * This routine should be called by an interface driver when it knows that
++ * the device in question supports USB autosuspend.
++ *
++ */
++void usb_device_autosuspend_enable(struct usb_device *udev)
++{
++	udev->autosuspend_disabled = 0;
++	udev->autoresume_disabled = 0;
++	usb_external_suspend_device(udev, PMSG_USER_SUSPEND);
++}
++EXPORT_SYMBOL_GPL(usb_device_autosuspend_enable);
++
++/**
+  * usb_autopm_get_interface - increment a USB interface's PM-usage counter
+  * @intf: the usb_interface whose counter should be incremented
+  *
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index a34fa89..0c22c64 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -543,6 +543,7 @@ extern struct usb_device *usb_find_device(u16 vendor_id, u16 product_id);
+ 
+ /* USB autosuspend and autoresume */
+ #ifdef CONFIG_USB_SUSPEND
++extern void usb_device_autosuspend_enable(struct usb_device *udev);
+ extern int usb_autopm_set_interface(struct usb_interface *intf);
+ extern int usb_autopm_get_interface(struct usb_interface *intf);
+ extern void usb_autopm_put_interface(struct usb_interface *intf);
+@@ -568,6 +569,9 @@ static inline void usb_mark_last_busy(struct usb_device *udev)
+ 
+ #else
+ 
++static inline void usb_device_autosuspend_enable(struct usb_device *udev)
++{ }
++
+ static inline int usb_autopm_set_interface(struct usb_interface *intf)
+ { return 0; }
+ 

linux-2.6-e1000-ich9.patch

@@ -0,0 +1,27 @@
+diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
+index 8f8139d..22c49ec 100644
+--- a/drivers/net/e1000e/ich8lan.c
++++ b/drivers/net/e1000e/ich8lan.c
+@@ -209,6 +209,12 @@ static s32 e1000_init_phy_params_ich8lan(struct e1000_hw *hw)
+ 
+ 	/* Verify phy id */
+ 	switch (phy->id) {
++	case 0x0:
++		if (hw->adapter->pdev->device == 0x10be)
++			hw_dbg(hw, "got 0 phy id, trying anyway");
++			/* Fall through to IGP03E1000 case below */
++		else
++			return -E1000_ERR_PHY;
+ 	case IGP03E1000_E_PHY_ID:
+ 		phy->type = e1000_phy_igp_3;
+ 		phy->autoneg_mask = AUTONEG_ADVERTISE_SPEED_DEFAULT;
+--- linux-2.6.25.noarch/drivers/net/e1000e/netdev.c~	2008-05-16 10:31:41.000000000 -0400
++++ linux-2.6.25.noarch/drivers/net/e1000e/netdev.c	2008-05-16 10:32:43.000000000 -0400
+@@ -4599,6 +4599,7 @@ static struct pci_device_id e1000_pci_tb
+ 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IGP_M), board_ich9lan },
+ 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IGP_M_AMT), board_ich9lan },
+ 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IGP_M_V), board_ich9lan },
++	{ PCI_VDEVICE(INTEL, 0x10be), board_ich9lan },
+ 
+ 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH10_R_BM_LM), board_ich9lan },
+ 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH10_R_BM_LF), board_ich9lan },

linux-2.6-enable-btusb-autosuspend.patch

@@ -0,0 +1,18 @@
+commit 8e962bd41a2cbf7f0e55191a757b87f793a725a8
+Author: Matthew Garrett <mjg@redhat.com>
+Date:   Tue Jun 9 20:47:51 2009 +0100
+
+    btusb: Enable autosuspend by default
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 44bc8bb..4c33417 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1020,6 +1020,7 @@ static int btusb_probe(struct usb_interface *intf,
+ 	}
+ 
+ 	usb_set_intfdata(intf, data);
++	usb_device_autosuspend_enable(data->udev);
+ 
+ 	return 0;
+ }

linux-2.6-execshield.patch

@@ -0,0 +1,988 @@
+diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
+index e8de2f6..538c2b6 100644
+--- a/arch/x86/include/asm/desc.h
++++ b/arch/x86/include/asm/desc.h
+@@ -5,6 +5,7 @@
+ #include <asm/ldt.h>
+ #include <asm/mmu.h>
+ #include <linux/smp.h>
++#include <linux/mm_types.h>
+ 
+ static inline void fill_ldt(struct desc_struct *desc,
+ 			    const struct user_desc *info)
+@@ -93,6 +94,9 @@ static inline int desc_empty(const void *ptr)
+ 
+ #define load_TLS(t, cpu) native_load_tls(t, cpu)
+ #define set_ldt native_set_ldt
++#ifdef CONFIG_X86_32
++#define load_user_cs_desc native_load_user_cs_desc
++#endif /*CONFIG_X86_32*/
+ 
+ #define write_ldt_entry(dt, entry, desc)	\
+ 	native_write_ldt_entry(dt, entry, desc)
+@@ -392,4 +396,25 @@ static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
+ }
+ 
++#ifdef CONFIG_X86_32
++static inline void set_user_cs(struct desc_struct *desc, unsigned long limit)
++{
++	limit = (limit - 1) / PAGE_SIZE;
++	desc->a = limit & 0xffff;
++	desc->b = (limit & 0xf0000) | 0x00c0fb00;
++}
++
++static inline void native_load_user_cs_desc(int cpu, struct mm_struct *mm)
++{
++	get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_CS] = (mm)->context.user_cs;
++}
++
++#define arch_add_exec_range arch_add_exec_range
++#define arch_remove_exec_range arch_remove_exec_range
++#define arch_flush_exec_range arch_flush_exec_range
++extern void arch_add_exec_range(struct mm_struct *mm, unsigned long limit);
++extern void arch_remove_exec_range(struct mm_struct *mm, unsigned long limit);
++extern void arch_flush_exec_range(struct mm_struct *mm);
++#endif /* CONFIG_X86_32 */
++
+ #endif /* _ASM_X86_DESC_H */
+diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
+index 80a1dee..8314c66 100644
+--- a/arch/x86/include/asm/mmu.h
++++ b/arch/x86/include/asm/mmu.h
+@@ -7,12 +7,19 @@
+ /*
+  * The x86 doesn't have a mmu context, but
+  * we put the segment information here.
++ *
++ * exec_limit is used to track the range PROT_EXEC
++ * mappings span.
+  */
+ typedef struct {
+ 	void *ldt;
+ 	int size;
+ 	struct mutex lock;
+ 	void *vdso;
++#ifdef CONFIG_X86_32
++	struct desc_struct user_cs;
++	unsigned long exec_limit;
++#endif
+ } mm_context_t;
+ 
+ #ifdef CONFIG_SMP
+diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
+index 8aebcc4..cbbd2b0 100644
+--- a/arch/x86/include/asm/paravirt.h
++++ b/arch/x86/include/asm/paravirt.h
+@@ -289,6 +289,12 @@ static inline void set_ldt(const void *addr, unsigned entries)
+ {
+ 	PVOP_VCALL2(pv_cpu_ops.set_ldt, addr, entries);
+ }
++#ifdef CONFIG_X86_32
++static inline void load_user_cs_desc(unsigned int cpu, struct mm_struct *mm)
++{
++	PVOP_VCALL2(pv_cpu_ops.load_user_cs_desc, cpu, mm);
++}
++#endif /*CONFIG_X86_32*/
+ static inline void store_gdt(struct desc_ptr *dtr)
+ {
+ 	PVOP_VCALL1(pv_cpu_ops.store_gdt, dtr);
+diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
+index dd0f5b3..c2727ef 100644
+--- a/arch/x86/include/asm/paravirt_types.h
++++ b/arch/x86/include/asm/paravirt_types.h
+@@ -118,6 +118,9 @@ struct pv_cpu_ops {
+ 	void (*store_gdt)(struct desc_ptr *);
+ 	void (*store_idt)(struct desc_ptr *);
+ 	void (*set_ldt)(const void *desc, unsigned entries);
++#ifdef CONFIG_X86_32
++	void (*load_user_cs_desc)(int cpu, struct mm_struct *mm);
++#endif
+ 	unsigned long (*store_tr)(void);
+ 	void (*load_tls)(struct thread_struct *t, unsigned int cpu);
+ #ifdef CONFIG_X86_64
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index c3429e8..62cc460 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -161,6 +161,9 @@ static inline int hlt_works(int cpu)
+ 
+ #define cache_line_size()	(boot_cpu_data.x86_cache_alignment)
+ 
++#define __HAVE_ARCH_ALIGN_STACK
++extern unsigned long arch_align_stack(unsigned long sp);
++
+ extern void cpu_detect(struct cpuinfo_x86 *c);
+ 
+ extern struct pt_regs *idle_regs(struct pt_regs *);
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index cc25c2b..6ce4863 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -798,6 +798,20 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
+ 	/* Filter out anything that depends on CPUID levels we don't have */
+ 	filter_cpuid_features(c, true);
+ 
++	/*
++	 *  emulation of NX with segment limits unfortunately means
++	 *  we have to disable the fast system calls, due to the way that
++	 *  sysexit clears the segment limits on return.
++	 *  If we have either disabled exec-shield on the boot command line,
++	 *  or we have NX, then we don't need to do this.
++	 */
++	if (exec_shield != 0) {
++#ifdef CONFIG_X86_PAE
++		if (!test_cpu_cap(c, X86_FEATURE_NX))
++#endif
++			clear_cpu_cap(c, X86_FEATURE_SEP);
++	}
++
+ 	/* If the model name is still unset, do table lookup. */
+ 	if (!c->x86_model_id[0]) {
+ 		const char *p;
+diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
+index 1b1739d..c2dda16 100644
+--- a/arch/x86/kernel/paravirt.c
++++ b/arch/x86/kernel/paravirt.c
+@@ -345,6 +345,9 @@ struct pv_cpu_ops pv_cpu_ops = {
+ 	.read_tscp = native_read_tscp,
+ 	.load_tr_desc = native_load_tr_desc,
+ 	.set_ldt = native_set_ldt,
++#ifdef CONFIG_X86_32
++	.load_user_cs_desc = native_load_user_cs_desc,
++#endif /*CONFIG_X86_32*/
+ 	.load_gdt = native_load_gdt,
+ 	.load_idt = native_load_idt,
+ 	.store_gdt = native_store_gdt,
+diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
+index 4cf7956..b2407dc 100644
+--- a/arch/x86/kernel/process_32.c
++++ b/arch/x86/kernel/process_32.c
+@@ -296,7 +296,10 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
+ void
+ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
+ {
++	int cpu;
++
+ 	set_user_gs(regs, 0);
++
+ 	regs->fs		= 0;
+ 	set_fs(USER_DS);
+ 	regs->ds		= __USER_DS;
+@@ -305,6 +308,11 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
+ 	regs->cs		= __USER_CS;
+ 	regs->ip		= new_ip;
+ 	regs->sp		= new_sp;
++
++	cpu = get_cpu();
++	load_user_cs_desc(cpu, current->mm);
++	put_cpu();
++
+ 	/*
+ 	 * Free the old FP and other extended state
+ 	 */
+@@ -364,6 +372,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ 	if (preload_fpu)
+ 		prefetch(next->xstate);
+ 
++	if (next_p->mm)
++		load_user_cs_desc(cpu, next_p->mm);
++
+ 	/*
+ 	 * Reload esp0.
+ 	 */
+@@ -497,3 +508,40 @@ unsigned long get_wchan(struct task_struct *p)
+ 	return 0;
+ }
+ 
++static void modify_cs(struct mm_struct *mm, unsigned long limit)
++{
++	mm->context.exec_limit = limit;
++	set_user_cs(&mm->context.user_cs, limit);
++	if (mm == current->mm) {
++		int cpu;
++
++		cpu = get_cpu();
++		load_user_cs_desc(cpu, mm);
++		put_cpu();
++	}
++}
++
++void arch_add_exec_range(struct mm_struct *mm, unsigned long limit)
++{
++	if (limit > mm->context.exec_limit)
++		modify_cs(mm, limit);
++}
++
++void arch_remove_exec_range(struct mm_struct *mm, unsigned long old_end)
++{
++	struct vm_area_struct *vma;
++	unsigned long limit = PAGE_SIZE;
++
++	if (old_end == mm->context.exec_limit) {
++		for (vma = mm->mmap; vma; vma = vma->vm_next)
++			if ((vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
++				limit = vma->vm_end;
++		modify_cs(mm, limit);
++	}
++}
++
++void arch_flush_exec_range(struct mm_struct *mm)
++{
++	mm->context.exec_limit = 0;
++	set_user_cs(&mm->context.user_cs, 0);
++}
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index 7e37dce..92ae538 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -115,6 +115,76 @@ die_if_kernel(const char *str, struct pt_regs *regs, long err)
+ 	if (!user_mode_vm(regs))
+ 		die(str, regs, err);
+ }
++
++static inline int
++__compare_user_cs_desc(const struct desc_struct *desc1,
++	const struct desc_struct *desc2)
++{
++	return ((desc1->limit0 != desc2->limit0) ||
++		(desc1->limit != desc2->limit) ||
++		(desc1->base0 != desc2->base0) ||
++		(desc1->base1 != desc2->base1) ||
++		(desc1->base2 != desc2->base2));
++}
++
++/*
++ * lazy-check for CS validity on exec-shield binaries:
++ *
++ * the original non-exec stack patch was written by
++ * Solar Designer <solar at openwall.com>. Thanks!
++ */
++static int
++check_lazy_exec_limit(int cpu, struct pt_regs *regs, long error_code)
++{
++	struct desc_struct *desc1, *desc2;
++	struct vm_area_struct *vma;
++	unsigned long limit;
++
++	if (current->mm == NULL)
++		return 0;
++
++	limit = -1UL;
++	if (current->mm->context.exec_limit != -1UL) {
++		limit = PAGE_SIZE;
++		spin_lock(&current->mm->page_table_lock);
++		for (vma = current->mm->mmap; vma; vma = vma->vm_next)
++			if ((vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
++				limit = vma->vm_end;
++		vma = get_gate_vma(current);
++		if (vma && (vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
++			limit = vma->vm_end;
++		spin_unlock(&current->mm->page_table_lock);
++		if (limit >= TASK_SIZE)
++			limit = -1UL;
++		current->mm->context.exec_limit = limit;
++	}
++	set_user_cs(&current->mm->context.user_cs, limit);
++
++	desc1 = &current->mm->context.user_cs;
++	desc2 = get_cpu_gdt_table(cpu) + GDT_ENTRY_DEFAULT_USER_CS;
++
++	if (__compare_user_cs_desc(desc1, desc2)) {
++		/*
++		 * The CS was not in sync - reload it and retry the
++		 * instruction. If the instruction still faults then
++		 * we won't hit this branch next time around.
++		 */
++		if (print_fatal_signals >= 2) {
++			printk(KERN_ERR "#GPF fixup (%ld[seg:%lx]) at %08lx, CPU#%d.\n",
++				error_code, error_code/8, regs->ip,
++				smp_processor_id());
++			printk(KERN_ERR "exec_limit: %08lx, user_cs: %08x/%08x, CPU_cs: %08x/%08x.\n",
++				current->mm->context.exec_limit,
++				desc1->a, desc1->b, desc2->a, desc2->b);
++		}
++
++		load_user_cs_desc(cpu, current->mm);
++
++		return 1;
++	}
++
++	return 0;
++}
+ #endif
+ 
+ static void __kprobes
+@@ -273,6 +343,29 @@ do_general_protection(struct pt_regs *regs, long error_code)
+ 	if (!user_mode(regs))
+ 		goto gp_in_kernel;
+ 
++#ifdef CONFIG_X86_32
++{
++	int cpu;
++	int ok;
++
++	cpu = get_cpu();
++	ok = check_lazy_exec_limit(cpu, regs, error_code);
++	put_cpu();
++
++	if (ok)
++		return;
++
++	if (print_fatal_signals) {
++		printk(KERN_ERR "#GPF(%ld[seg:%lx]) at %08lx, CPU#%d.\n",
++			error_code, error_code/8, regs->ip, smp_processor_id());
++		printk(KERN_ERR "exec_limit: %08lx, user_cs: %08x/%08x.\n",
++			current->mm->context.exec_limit,
++			current->mm->context.user_cs.a,
++			current->mm->context.user_cs.b);
++	}
++}
++#endif /*CONFIG_X86_32*/
++
+ 	tsk->thread.error_code = error_code;
+ 	tsk->thread.trap_no = 13;
+ 
+@@ -881,19 +974,37 @@ do_device_not_available(struct pt_regs *regs, long error_code)
+ }
+ 
+ #ifdef CONFIG_X86_32
++/*
++ * The fixup code for errors in iret jumps to here (iret_exc). It loses
++ * the original trap number and erorr code. The bogus trap 32 and error
++ * code 0 are what the vanilla kernel delivers via:
++ * DO_ERROR_INFO(32, SIGSEGV, "iret exception", iret_error, ILL_BADSTK, 0, 1)
++ *
++ * NOTE: Because of the final "1" in the macro we need to enable interrupts.
++ *
++ * In case of a general protection fault in the iret instruction, we
++ * need to check for a lazy CS update for exec-shield.
++ */
+ dotraplinkage void do_iret_error(struct pt_regs *regs, long error_code)
+ {
+-	siginfo_t info;
++	int ok;
++	int cpu;
++
+ 	local_irq_enable();
+ 
+-	info.si_signo = SIGILL;
+-	info.si_errno = 0;
+-	info.si_code = ILL_BADSTK;
+-	info.si_addr = NULL;
+-	if (notify_die(DIE_TRAP, "iret exception",
+-			regs, error_code, 32, SIGILL) == NOTIFY_STOP)
+-		return;
+-	do_trap(32, SIGILL, "iret exception", regs, error_code, &info);
++	cpu = get_cpu();
++	ok = check_lazy_exec_limit(cpu, regs, error_code);
++	put_cpu();
++
++	if (!ok && notify_die(DIE_TRAP, "iret exception", regs,
++		error_code, 32, SIGSEGV) != NOTIFY_STOP) {
++			siginfo_t info;
++			info.si_signo = SIGSEGV;
++			info.si_errno = 0;
++			info.si_code = ILL_BADSTK;
++			info.si_addr = 0;
++			do_trap(32, SIGSEGV, "iret exception", regs, error_code, &info);
++	}
+ }
+ #endif
+ 
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index 73ffd55..0cf2a7b 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -149,6 +149,12 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
+ 	set_nx();
+ 	if (nx_enabled)
+ 		printk(KERN_INFO "NX (Execute Disable) protection: active\n");
++#ifdef CONFIG_X86_32
++	else
++	if (exec_shield)
++		printk(KERN_INFO "Using x86 segment limits to approximate "
++			"NX protection\n");
++#endif
+ 
+ 	/* Enable PSE if available */
+ 	if (cpu_has_pse)
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index c8191de..7d84d01 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -124,13 +124,16 @@ static unsigned long mmap_legacy_base(void)
+  */
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
+-	if (mmap_is_legacy()) {
++	if (!(2 & exec_shield) && mmap_is_legacy()) {
+ 		mm->mmap_base = mmap_legacy_base();
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
++		if (!(current->personality & READ_IMPLIES_EXEC)
++		    && mmap_is_ia32())
++			mm->get_unmapped_exec_area = arch_get_unmapped_exec_area;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+ }
+diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
+index 513d8ed..c614a90 100644
+--- a/arch/x86/mm/setup_nx.c
++++ b/arch/x86/mm/setup_nx.c
+@@ -1,3 +1,4 @@
++#include <linux/sched.h>
+ #include <linux/spinlock.h>
+ #include <linux/errno.h>
+ #include <linux/init.h>
+@@ -27,6 +28,9 @@ static int __init noexec_setup(char *str)
+ 	} else if (!strncmp(str, "off", 3)) {
+ 		disable_nx = 1;
+ 		__supported_pte_mask &= ~_PAGE_NX;
++#ifdef CONFIG_X86_32
++		exec_shield = 0;
++#endif
+ 	}
+ 	return 0;
+ }
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 36fe08e..3806a45 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -6,6 +6,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
+ 
++#include <asm/desc.h>
+ #include <asm/tlbflush.h>
+ #include <asm/mmu_context.h>
+ #include <asm/apic.h>
+@@ -130,6 +131,12 @@ void smp_invalidate_interrupt(struct pt_regs *regs)
+ 	union smp_flush_state *f;
+ 
+ 	cpu = smp_processor_id();
++
++#ifdef CONFIG_X86_32
++	if (current->active_mm)
++		load_user_cs_desc(cpu, current->active_mm);
++#endif
++
+ 	/*
+ 	 * orig_rax contains the negated interrupt vector.
+ 	 * Use that to determine where the sender put the data.
+diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
+index 58bc00f..1fdafb5 100644
+--- a/arch/x86/vdso/vdso32-setup.c
++++ b/arch/x86/vdso/vdso32-setup.c
+@@ -331,7 +331,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+ 	if (compat)
+ 		addr = VDSO_HIGH_BASE;
+ 	else {
+-		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
++		addr = get_unmapped_area_prot(NULL, 0, PAGE_SIZE, 0, 0, 1);
+ 		if (IS_ERR_VALUE(addr)) {
+ 			ret = addr;
+ 			goto up_fail;
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 3439616..31e5c6f 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -323,6 +323,24 @@ static void xen_set_ldt(const void *addr, unsigned entries)
+ 	xen_mc_issue(PARAVIRT_LAZY_CPU);
+ }
+ 
++#ifdef CONFIG_X86_32
++static void xen_load_user_cs_desc(int cpu, struct mm_struct *mm)
++{
++	void *gdt;
++	xmaddr_t mgdt;
++	u64 descriptor;
++	struct desc_struct user_cs;
++
++	gdt = &get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_CS];
++	mgdt = virt_to_machine(gdt);
++
++	user_cs = mm->context.user_cs;
++	descriptor = (u64) user_cs.a | ((u64) user_cs.b) << 32;
++
++	HYPERVISOR_update_descriptor(mgdt.maddr, descriptor);
++}
++#endif /*CONFIG_X86_32*/
++
+ static void xen_load_gdt(const struct desc_ptr *dtr)
+ {
+ 	unsigned long va = dtr->address;
+@@ -949,6 +967,9 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
+ 
+ 	.load_tr_desc = paravirt_nop,
+ 	.set_ldt = xen_set_ldt,
++#ifdef CONFIG_X86_32
++	.load_user_cs_desc = xen_load_user_cs_desc,
++#endif /*CONFIG_X86_32*/
+ 	.load_gdt = xen_load_gdt,
+ 	.load_idt = xen_load_idt,
+ 	.load_tls = xen_load_tls,
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index b9b3bb5..1e55926 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -73,7 +73,7 @@ static struct linux_binfmt elf_format = {
+ 		.hasvdso	= 1
+ };
+ 
+-#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
++#define BAD_ADDR(x) IS_ERR_VALUE(x)
+ 
+ static int set_brk(unsigned long start, unsigned long end)
+ {
+@@ -721,6 +721,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 			break;
+ 		}
+ 
++	if (current->personality == PER_LINUX && (exec_shield & 2)) {
++		executable_stack = EXSTACK_DISABLE_X;
++		current->flags |= PF_RANDOMIZE;
++	}
++
+ 	/* Some simple consistency checks for the interpreter */
+ 	if (elf_interpreter) {
+ 		retval = -ELIBBAD;
+@@ -740,6 +745,15 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	if (retval)
+ 		goto out_free_dentry;
+ 
++#ifdef CONFIG_X86_32
++	/*
++	 * Turn off the CS limit completely if exec-shield disabled or
++	 * NX active:
++	 */
++	if (!exec_shield || executable_stack != EXSTACK_DISABLE_X || nx_enabled)
++		arch_add_exec_range(current->mm, -1);
++#endif
++
+ 	/* OK, This is the point of no return */
+ 	current->flags &= ~PF_FORKNOEXEC;
+ 	current->mm->def_flags = def_flags;
+@@ -747,7 +761,8 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
+ 	   may depend on the personality.  */
+ 	SET_PERSONALITY(loc->elf_ex);
+-	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
++	if (!(exec_shield & 2) &&
++			elf_read_implies_exec(loc->elf_ex, executable_stack))
+ 		current->personality |= READ_IMPLIES_EXEC;
+ 
+ 	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+@@ -912,7 +927,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 					    interpreter,
+ 					    &interp_map_addr,
+ 					    load_bias);
+-		if (!IS_ERR((void *)elf_entry)) {
++		if (!BAD_ADDR(elf_entry)) {
+ 			/*
+ 			 * load_elf_interp() returns relocation
+ 			 * adjustment
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 24c3956..88f944d 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1129,7 +1129,13 @@ extern int install_special_mapping(struct mm_struct *mm,
+ 				   unsigned long addr, unsigned long len,
+ 				   unsigned long flags, struct page **pages);
+ 
+-extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
++extern unsigned long get_unmapped_area_prot(struct file *, unsigned long, unsigned long, unsigned long, unsigned long, int);
++
++static inline unsigned long get_unmapped_area(struct file *file, unsigned long addr,
++		unsigned long len, unsigned long pgoff, unsigned long flags)
++{
++	return get_unmapped_area_prot(file, addr, len, pgoff, flags, 0);
++}
+ 
+ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+ 	unsigned long len, unsigned long prot,
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 84a524a..a81e0db 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -206,6 +206,9 @@ struct mm_struct {
+ 	unsigned long (*get_unmapped_area) (struct file *filp,
+ 				unsigned long addr, unsigned long len,
+ 				unsigned long pgoff, unsigned long flags);
++       unsigned long (*get_unmapped_exec_area) (struct file *filp,
++				unsigned long addr, unsigned long len,
++				unsigned long pgoff, unsigned long flags);
+ 	void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
+ 	unsigned long mmap_base;		/* base of mmap area */
+ 	unsigned long task_size;		/* size of task vm space */
+diff --git a/include/linux/resource.h b/include/linux/resource.h
+index 40fc7e6..68c2549 100644
+--- a/include/linux/resource.h
++++ b/include/linux/resource.h
+@@ -55,8 +55,11 @@ struct rlimit {
+ /*
+  * Limit the stack by to some sane default: root can always
+  * increase this limit if needed..  8MB seems reasonable.
++ *
++ * (2MB more to cover randomization effects.)
+  */
+-#define _STK_LIM	(8*1024*1024)
++#define _STK_LIM	(10*1024*1024)
++#define EXEC_STACK_BIAS	(2*1024*1024)
+ 
+ /*
+  * GPG2 wants 64kB of mlocked memory, to make sure pass phrases
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 75e6e60..0bce489 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -102,6 +102,9 @@ struct fs_struct;
+ struct bts_context;
+ struct perf_event_context;
+ 
++extern int exec_shield;
++extern int print_fatal_signals;
++
+ /*
+  * List of flags we want to share for kernel threads,
+  * if only because they are not used by them anyway.
+@@ -378,6 +381,10 @@ extern int sysctl_max_map_count;
+ extern unsigned long
+ arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
+ 		       unsigned long, unsigned long);
++
++extern unsigned long
++arch_get_unmapped_exec_area(struct file *, unsigned long, unsigned long,
++		       unsigned long, unsigned long);
+ extern unsigned long
+ arch_get_unmapped_area_topdown(struct file *filp, unsigned long addr,
+ 			  unsigned long len, unsigned long pgoff,
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 0d949c5..12ca319 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -88,6 +88,26 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max;
+ #ifndef CONFIG_MMU
+ extern int sysctl_nr_trim_pages;
+ #endif
++
++int exec_shield = (1<<0);
++/* exec_shield is a bitmask:
++ * 0: off; vdso at STACK_TOP, 1 page below TASK_SIZE
++ * (1<<0) 1: on [also on if !=0]
++ * (1<<1) 2: force noexecstack regardless of PT_GNU_STACK
++ * The old settings
++ * (1<<2) 4: vdso just below .text of main (unless too low)
++ * (1<<3) 8: vdso just below .text of PT_INTERP (unless too low)
++ * are ignored because the vdso is placed completely randomly
++ */
++
++static int __init setup_exec_shield(char *str)
++{
++	get_option(&str, &exec_shield);
++
++	return 1;
++}
++__setup("exec-shield=", setup_exec_shield);
++
+ #ifdef CONFIG_RCU_TORTURE_TEST
+ extern int rcutorture_runnable;
+ #endif /* #ifdef CONFIG_RCU_TORTURE_TEST */
+@@ -408,6 +428,14 @@ static struct ctl_table kern_table[] = {
+ 		.proc_handler	= &proc_dointvec,
+ 	},
+ 	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "exec-shield",
++		.data		= &exec_shield,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
+ 		.ctl_name	= KERN_CORE_USES_PID,
+ 		.procname	= "core_uses_pid",
+ 		.data		= &core_uses_pid,
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 73f5e4b..814b95f 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -29,6 +29,7 @@
+ #include <linux/rmap.h>
+ #include <linux/mmu_notifier.h>
+ #include <linux/perf_event.h>
++#include <linux/random.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/cacheflush.h>
+@@ -45,6 +46,18 @@
+ #define arch_rebalance_pgtables(addr, len)		(addr)
+ #endif
+ 
++/* No sane architecture will #define these to anything else */
++#ifndef arch_add_exec_range
++#define arch_add_exec_range(mm, limit)	do { ; } while (0)
++#endif
++#ifndef arch_flush_exec_range
++#define arch_flush_exec_range(mm)	do { ; } while (0)
++#endif
++#ifndef arch_remove_exec_range
++#define arch_remove_exec_range(mm, limit)	do { ; } while (0)
++#endif
++
++
+ static void unmap_region(struct mm_struct *mm,
+ 		struct vm_area_struct *vma, struct vm_area_struct *prev,
+ 		unsigned long start, unsigned long end);
+@@ -389,6 +402,9 @@ static inline void
+ {
+ 	struct vm_area_struct *next;
+ 
++	if (vma->vm_flags & VM_EXEC)
++		arch_add_exec_range(mm, vma->vm_end);
++
+ 	vma->vm_prev = prev;
+ 	if (prev) {
+ 		next = prev->vm_next;
+@@ -491,6 +506,8 @@ __vma_unlink(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	rb_erase(&vma->vm_rb, &mm->mm_rb);
+ 	if (mm->mmap_cache == vma)
+ 		mm->mmap_cache = prev;
++	if (vma->vm_flags & VM_EXEC)
++		arch_remove_exec_range(mm, vma->vm_end);
+ }
+ 
+ /*
+@@ -798,6 +815,8 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ 		} else					/* cases 2, 5, 7 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				end, prev->vm_pgoff, NULL);
++		if (prev->vm_flags & VM_EXEC)
++			arch_add_exec_range(mm, prev->vm_end);
+ 		return prev;
+ 	}
+ 
+@@ -970,7 +989,8 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+ 	/* Obtain the address to map to. we verify (or select) it and ensure
+ 	 * that it represents a valid section of the address space.
+ 	 */
+-	addr = get_unmapped_area(file, addr, len, pgoff, flags);
++	addr = get_unmapped_area_prot(file, addr, len, pgoff, flags,
++		prot & PROT_EXEC);
+ 	if (addr & ~PAGE_MASK)
+ 		return addr;
+ 
+@@ -1453,21 +1473,25 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
+ }
+ 
+ unsigned long
+-get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
+-		unsigned long pgoff, unsigned long flags)
++get_unmapped_area_prot(struct file *file, unsigned long addr, unsigned long len,
++		unsigned long pgoff, unsigned long flags, int exec)
+ {
+ 	unsigned long (*get_area)(struct file *, unsigned long,
+ 				  unsigned long, unsigned long, unsigned long);
+ 
+ 	unsigned long error = arch_mmap_check(addr, len, flags);
+ 	if (error)
+ 		return error;
+ 
+ 	/* Careful about overflows.. */
+ 	if (len > TASK_SIZE)
+ 		return -ENOMEM;
+ 
+-	get_area = current->mm->get_unmapped_area;
++	if (exec && current->mm->get_unmapped_exec_area)
++		get_area = current->mm->get_unmapped_exec_area;
++	else
++		get_area = current->mm->get_unmapped_area;
++
+ 	if (file && file->f_op && file->f_op->get_unmapped_area)
+ 		get_area = file->f_op->get_unmapped_area;
+ 	addr = get_area(file, addr, len, pgoff, flags);
+@@ -1473,8 +1497,76 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
+ 
+ 	return arch_rebalance_pgtables(addr, len);
+ }
++EXPORT_SYMBOL(get_unmapped_area_prot);
++
++#define SHLIB_BASE	0x00110000
++
++unsigned long
++arch_get_unmapped_exec_area(struct file *filp, unsigned long addr0,
++		unsigned long len0, unsigned long pgoff, unsigned long flags)
++{
++	unsigned long addr = addr0, len = len0;
++	struct mm_struct *mm = current->mm;
++	struct vm_area_struct *vma;
++	unsigned long tmp;
++
++	if (len > TASK_SIZE)
++		return -ENOMEM;
++
++	if (flags & MAP_FIXED)
++		return addr;
++
++	if (!addr)
++		addr = randomize_range(SHLIB_BASE, 0x01000000, len);
++
++	if (addr) {
++		addr = PAGE_ALIGN(addr);
++		vma = find_vma(mm, addr);
++		if (TASK_SIZE - len >= addr &&
++		    (!vma || addr + len <= vma->vm_start))
++			return addr;
++	}
++
++	addr = SHLIB_BASE;
++	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
++		/* At this point:  (!vma || addr < vma->vm_end). */
++		if (TASK_SIZE - len < addr)
++			return -ENOMEM;
++
++		if (!vma || addr + len <= vma->vm_start) {
++			/*
++			 * Must not let a PROT_EXEC mapping get into the
++			 * brk area:
++			 */
++			if (addr + len > mm->brk)
++				goto failed;
++
++			/*
++			 * Up until the brk area we randomize addresses
++			 * as much as possible:
++			 */
++			if (addr >= 0x01000000) {
++				tmp = randomize_range(0x01000000,
++					PAGE_ALIGN(max(mm->start_brk,
++					(unsigned long)0x08000000)), len);
++				vma = find_vma(mm, tmp);
++				if (TASK_SIZE - len >= tmp &&
++				    (!vma || tmp + len <= vma->vm_start))
++					return tmp;
++			}
++			/*
++			 * Ok, randomization didnt work out - return
++			 * the result of the linear search:
++			 */
++			return addr;
++		}
++		addr = vma->vm_end;
++	}
++
++failed:
++	return current->mm->get_unmapped_area(filp, addr0, len0, pgoff, flags);
++}
+ 
+-EXPORT_SYMBOL(get_unmapped_area);
+ 
+ /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
+ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+@@ -1549,6 +1641,14 @@ out:
+ 	return prev ? prev->vm_next : vma;
+ }
+ 
++static int over_stack_limit(unsigned long sz)
++{
++	if (sz < EXEC_STACK_BIAS)
++		return 0;
++	return (sz - EXEC_STACK_BIAS) >
++			current->signal->rlim[RLIMIT_STACK].rlim_cur;
++}
++
+ /*
+  * Verify that the stack growth is acceptable and
+  * update accounting. This is shared with both the
+@@ -1565,7 +1665,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+ 		return -ENOMEM;
+ 
+ 	/* Stack limit test */
+-	if (size > rlim[RLIMIT_STACK].rlim_cur)
++	if (over_stack_limit(size))
+ 		return -ENOMEM;
+ 
+ 	/* mlock limit tests */
+@@ -1875,10 +1975,14 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+ 	if (new->vm_ops && new->vm_ops->open)
+ 		new->vm_ops->open(new);
+ 
+-	if (new_below)
++	if (new_below) {
++		unsigned long old_end = vma->vm_end;
++
+ 		vma_adjust(vma, addr, vma->vm_end, vma->vm_pgoff +
+ 			((addr - new->vm_start) >> PAGE_SHIFT), new);
+-	else
++		if (vma->vm_flags & VM_EXEC)
++			arch_remove_exec_range(mm, old_end);
++	} else
+ 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
+ 
+ 	return 0;
+@@ -2128,6 +2232,7 @@ void exit_mmap(struct mm_struct *mm)
+ 
+ 	free_pgtables(tlb, vma, FIRST_USER_ADDRESS, 0);
+ 	tlb_finish_mmu(tlb, 0, end);
++	arch_flush_exec_range(mm);
+ 
+ 	/*
+ 	 * Walk the list again, actually closing and freeing it,
+diff --git a/mm/mprotect.c b/mm/mprotect.c
+index 8bc969d..3c9b4fc 100644
+--- a/mm/mprotect.c
++++ b/mm/mprotect.c
+@@ -26,9 +26,14 @@
+ #include <linux/perf_event.h>
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
++#include <asm/pgalloc.h>
+ #include <asm/cacheflush.h>
+ #include <asm/tlbflush.h>
+ 
++#ifndef arch_remove_exec_range
++#define arch_remove_exec_range(mm, limit)      do { ; } while (0)
++#endif
++
+ #ifndef pgprot_modify
+ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
+ {
+@@ -139,7 +144,7 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
+ 	struct mm_struct *mm = vma->vm_mm;
+ 	unsigned long oldflags = vma->vm_flags;
+ 	long nrpages = (end - start) >> PAGE_SHIFT;
+-	unsigned long charged = 0;
++	unsigned long charged = 0, old_end = vma->vm_end;
+ 	pgoff_t pgoff;
+ 	int error;
+ 	int dirty_accountable = 0;
+@@ -204,6 +209,9 @@ success:
+ 		dirty_accountable = 1;
+ 	}
+ 
++	if (oldflags & VM_EXEC)
++		arch_remove_exec_range(current->mm, old_end);
++
+ 	mmu_notifier_invalidate_range_start(mm, start, end);
+ 	if (is_vm_hugetlb_page(vma))
+ 		hugetlb_change_protection(vma, start, end, vma->vm_page_prot);
+diff --git a/mm/mremap.c b/mm/mremap.c
+index 97bff25..17a9fd7 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -414,10 +414,10 @@ unsigned long do_mremap(unsigned long addr,
+		if (vma->vm_flags & VM_MAYSHARE)
+			map_flags |= MAP_SHARED;
+
+-		new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
++		new_addr = get_unmapped_area_prot(vma->vm_file, 0, new_len,
+ 					vma->vm_pgoff +
+ 					((addr - vma->vm_start) >> PAGE_SHIFT),
+-					map_flags);
++					map_flags, vma->vm_flags & VM_EXEC);
+		if (new_addr & ~PAGE_MASK) {
+			ret = new_addr;
+			goto out;