--- /dev/null
+From 5c4bfa17f3ec46becec4b23d12323f7605ebd696 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Fri, 9 Jul 2010 23:51:54 +0000
+Subject: 9p: strlen() doesn't count the terminator
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit 5c4bfa17f3ec46becec4b23d12323f7605ebd696 upstream.
+
+This is an off by one bug because strlen() doesn't count the NULL
+terminator. We strcpy() addr into a fixed length array of size
+UNIX_PATH_MAX later on.
+
+The addr variable is the name of the device being mounted.
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/9p/trans_fd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -948,7 +948,7 @@ p9_fd_create_unix(struct p9_client *clie
+
+ csocket = NULL;
+
+- if (strlen(addr) > UNIX_PATH_MAX) {
++ if (strlen(addr) >= UNIX_PATH_MAX) {
+ P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
+ addr);
+ return -ENAMETOOLONG;
--- /dev/null
+From bc57117856cf1e581135810b37d3b75f9d1749f5 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <borislav.petkov@amd.com>
+Date: Fri, 21 May 2010 21:25:03 +0200
+Subject: amd64_edac: Correct scrub rate setting
+
+From: Borislav Petkov <borislav.petkov@amd.com>
+
+commit bc57117856cf1e581135810b37d3b75f9d1749f5 upstream.
+
+Exit early when setting scrub rate on unknown/unsupported families.
+
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Acked-by: Doug Thompson <dougthompson@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/amd64_edac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -178,7 +178,7 @@ static int amd64_set_scrub_rate(struct m
+
+ default:
+ amd64_printk(KERN_ERR, "Unsupported family!\n");
+- break;
++ return -EINVAL;
+ }
+ return amd64_search_set_scrub_rate(pvt->misc_f3_ctl, *bandwidth,
+ min_scrubrate);
--- /dev/null
+From 9975a5f22a4fcc8d08035c65439900a983f891ad Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <borislav.petkov@amd.com>
+Date: Mon, 8 Mar 2010 18:29:35 +0100
+Subject: amd64_edac: Fix DCT base address selector
+
+From: Borislav Petkov <borislav.petkov@amd.com>
+
+commit 9975a5f22a4fcc8d08035c65439900a983f891ad upstream.
+
+The correct check is to verify whether in high range we're below 4GB
+and not to extract the DctSelBaseAddr again. See "2.8.5 Routing DRAM
+Requests" in the F10h BKDG.
+
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Acked-by: Doug Thompson <dougthompson@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/amd64_edac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -1430,7 +1430,7 @@ static inline u64 f10_get_base_addr_offs
+ u64 chan_off;
+
+ if (hi_range_sel) {
+- if (!(dct_sel_base_addr & 0xFFFFF800) &&
++ if (!(dct_sel_base_addr & 0xFFFF0000) &&
+ hole_valid && (sys_addr >= 0x100000000ULL))
+ chan_off = hole_off << 16;
+ else
--- /dev/null
+From 962b70a1eb22c467b95756a290c694e73da17f41 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <borislav.petkov@amd.com>
+Date: Tue, 3 Aug 2010 16:51:28 +0200
+Subject: amd64_edac: Fix operator precendence error
+
+From: Borislav Petkov <borislav.petkov@amd.com>
+
+commit 962b70a1eb22c467b95756a290c694e73da17f41 upstream.
+
+The bitwise AND is of higher precedence, make that explicit.
+
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/amd64_edac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -1679,7 +1679,7 @@ static void f10_map_sysaddr_to_csrow(str
+ * ganged. Otherwise @chan should already contain the channel at
+ * this point.
+ */
+- if (dct_ganging_enabled(pvt) && pvt->nbcfg & K8_NBCFG_CHIPKILL)
++ if (dct_ganging_enabled(pvt) && (pvt->nbcfg & K8_NBCFG_CHIPKILL))
+ chan = get_channel_from_ecc_syndrome(mci, syndrome);
+
+ if (chan >= 0)
--- /dev/null
+From 06c4648d46d1b757d6b9591a86810be79818b60c Mon Sep 17 00:00:00 2001
+From: Ian Campbell <Ian.Campbell@citrix.com>
+Date: Wed, 26 May 2010 00:09:42 +0000
+Subject: arp_notify: allow drivers to explicitly request a notification event.
+
+From: Ian Campbell <Ian.Campbell@citrix.com>
+
+commit 06c4648d46d1b757d6b9591a86810be79818b60c upstream.
+
+Currently such notifications are only generated when the device comes up or the
+address changes. However one use case for these notifications is to enable
+faster network recovery after a virtual machine migration (by causing switches
+to relearn their MAC tables). A migration appears to the network stack as a
+temporary loss of carrier and therefore does not trigger either of the current
+conditions. Rather than adding carrier up as a trigger (which can cause issues
+when interfaces a flapping) simply add an interface which the driver can use
+to explicitly trigger the notification.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Stephen Hemminger <shemminger@linux-foundation.org>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: netdev@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/netdevice.h | 2 ++
+ include/linux/notifier.h | 1 +
+ net/ipv4/devinet.c | 1 +
+ net/sched/sch_generic.c | 18 ++++++++++++++++++
+ 4 files changed, 22 insertions(+)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1775,6 +1775,8 @@ extern void netif_carrier_on(struct net_
+
+ extern void netif_carrier_off(struct net_device *dev);
+
++extern void netif_notify_peers(struct net_device *dev);
++
+ /**
+ * netif_dormant_on - mark device as dormant.
+ * @dev: network device
+--- a/include/linux/notifier.h
++++ b/include/linux/notifier.h
+@@ -210,6 +210,7 @@ static inline int notifier_to_errno(int
+ #define NETDEV_POST_INIT 0x0010
+ #define NETDEV_UNREGISTER_BATCH 0x0011
+ #define NETDEV_BONDING_DESLAVE 0x0012
++#define NETDEV_NOTIFY_PEERS 0x0012
+
+ #define SYS_DOWN 0x0001 /* Notify of system down */
+ #define SYS_RESTART SYS_DOWN
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -1081,6 +1081,7 @@ static int inetdev_event(struct notifier
+ }
+ ip_mc_up(in_dev);
+ /* fall through */
++ case NETDEV_NOTIFY_PEERS:
+ case NETDEV_CHANGEADDR:
+ /* Send gratuitous ARP to notify of link change */
+ if (IN_DEV_ARP_NOTIFY(in_dev)) {
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -327,6 +327,24 @@ void netif_carrier_off(struct net_device
+ }
+ EXPORT_SYMBOL(netif_carrier_off);
+
++/**
++ * netif_notify_peers - notify network peers about existence of @dev
++ * @dev: network device
++ *
++ * Generate traffic such that interested network peers are aware of
++ * @dev, such as by generating a gratuitous ARP. This may be used when
++ * a device wants to inform the rest of the network about some sort of
++ * reconfiguration such as a failover event or virtual machine
++ * migration.
++ */
++void netif_notify_peers(struct net_device *dev)
++{
++ rtnl_lock();
++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev);
++ rtnl_unlock();
++}
++EXPORT_SYMBOL(netif_notify_peers);
++
+ /* "NOOP" scheduler: the best scheduler, recommended for all interfaces
+ under all circumstances. It is difficult to invent anything faster or
+ cheaper.
--- /dev/null
+From 31e79a5954b78fbed15de2c8974d5a2b6019199a Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Mon, 12 Jul 2010 23:16:34 +0200
+Subject: ath9k: another fix for the A-MPDU buffer leak
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 31e79a5954b78fbed15de2c8974d5a2b6019199a upstream.
+
+The patch 'ath9k: fix a buffer leak in A-MPDU completion' addressed the
+issue of running out of buffers/descriptors in the tx path if a STA is
+deleted while tx status feedback is still pending.
+The remaining issue is that the skbs of the buffers are not reclaimed,
+leaving a memory leak.
+This patch fixes this issue by running the buffers through
+ath_tx_complete_buf(), ensuring that the pending frames counter is also
+updated.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -329,7 +329,6 @@ static void ath_tx_complete_aggr(struct
+ int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
+ bool rc_update = true;
+ struct ieee80211_tx_rate rates[4];
+- unsigned long flags;
+
+ skb = bf->bf_mpdu;
+ hdr = (struct ieee80211_hdr *)skb->data;
+@@ -346,9 +345,21 @@ static void ath_tx_complete_aggr(struct
+ if (!sta) {
+ rcu_read_unlock();
+
+- spin_lock_irqsave(&sc->tx.txbuflock, flags);
+- list_splice_tail_init(bf_q, &sc->tx.txbuf);
+- spin_unlock_irqrestore(&sc->tx.txbuflock, flags);
++ INIT_LIST_HEAD(&bf_head);
++ while (bf) {
++ bf_next = bf->bf_next;
++
++ bf->bf_state.bf_type |= BUF_XRETRY;
++ if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) ||
++ !bf->bf_stale || bf_next != NULL)
++ list_move_tail(&bf->list, &bf_head);
++
++ ath_tx_rc_status(bf, ts, 0, 0, false);
++ ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
++ 0, 0);
++
++ bf = bf_next;
++ }
+ return;
+ }
+
--- /dev/null
+From 4c85ab11ca56da1aa59b58c80cc6a356515cc645 Mon Sep 17 00:00:00 2001
+From: John W. Linville <linville@tuxdriver.com>
+Date: Wed, 28 Jul 2010 10:06:35 -0400
+Subject: ath9k: enable serialize_regmode for non-PCIE AR9160
+
+From: John W. Linville <linville@tuxdriver.com>
+
+commit 4c85ab11ca56da1aa59b58c80cc6a356515cc645 upstream.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=16476
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -537,7 +537,8 @@ static int __ath9k_hw_init(struct ath_hw
+
+ if (ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
+ if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
+- (AR_SREV_9280(ah) && !ah->is_pciexpress)) {
++ ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) &&
++ !ah->is_pciexpress)) {
+ ah->config.serialize_regmode =
+ SER_REG_MODE_ON;
+ } else {
--- /dev/null
+From 73e194639d90594d06d0c10019c0ab4638869135 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 7 Jul 2010 19:42:09 +0200
+Subject: ath9k: fix a buffer leak in A-MPDU completion
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 73e194639d90594d06d0c10019c0ab4638869135 upstream.
+
+When ath_tx_complete_aggr() is called, it's responsible for returning
+all buffers in the linked list. This was not done when the STA lookup
+failed, leading to a race condition that could leak a few buffers when
+a STA just disconnected.
+Fix this by immediately returning all buffers to the free list in this case.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -329,6 +329,7 @@ static void ath_tx_complete_aggr(struct
+ int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
+ bool rc_update = true;
+ struct ieee80211_tx_rate rates[4];
++ unsigned long flags;
+
+ skb = bf->bf_mpdu;
+ hdr = (struct ieee80211_hdr *)skb->data;
+@@ -344,6 +345,10 @@ static void ath_tx_complete_aggr(struct
+ sta = ieee80211_find_sta_by_hw(hw, hdr->addr1);
+ if (!sta) {
+ rcu_read_unlock();
++
++ spin_lock_irqsave(&sc->tx.txbuflock, flags);
++ list_splice_tail_init(bf_q, &sc->tx.txbuf);
++ spin_unlock_irqrestore(&sc->tx.txbuflock, flags);
+ return;
+ }
+
--- /dev/null
+From 2b40994cabd2f545d5c11d3a65dcee6f6f9155f8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 7 Jul 2010 19:42:08 +0200
+Subject: ath9k: fix a potential buffer leak in the STA teardown path
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 2b40994cabd2f545d5c11d3a65dcee6f6f9155f8 upstream.
+
+It looks like it might be possible for a TID to be paused, while still
+holding some queued buffers, however ath_tx_node_cleanup currently only
+iterates over active TIDs.
+Fix this by always checking every allocated TID for the STA that is being
+cleaned up.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 56 +++++++++++++++++-----------------
+ 1 file changed, 28 insertions(+), 28 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2449,37 +2449,37 @@ void ath_tx_node_init(struct ath_softc *
+
+ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
+ {
+- int i;
+- struct ath_atx_ac *ac, *ac_tmp;
+- struct ath_atx_tid *tid, *tid_tmp;
++ struct ath_atx_ac *ac;
++ struct ath_atx_tid *tid;
+ struct ath_txq *txq;
++ int i, tidno;
+
+- for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+- if (ATH_TXQ_SETUP(sc, i)) {
+- txq = &sc->tx.txq[i];
+-
+- spin_lock_bh(&txq->axq_lock);
+-
+- list_for_each_entry_safe(ac,
+- ac_tmp, &txq->axq_acq, list) {
+- tid = list_first_entry(&ac->tid_q,
+- struct ath_atx_tid, list);
+- if (tid && tid->an != an)
+- continue;
+- list_del(&ac->list);
+- ac->sched = false;
+-
+- list_for_each_entry_safe(tid,
+- tid_tmp, &ac->tid_q, list) {
+- list_del(&tid->list);
+- tid->sched = false;
+- ath_tid_drain(sc, txq, tid);
+- tid->state &= ~AGGR_ADDBA_COMPLETE;
+- tid->state &= ~AGGR_CLEANUP;
+- }
+- }
++ for (tidno = 0, tid = &an->tid[tidno];
++ tidno < WME_NUM_TID; tidno++, tid++) {
++ i = tid->ac->qnum;
+
+- spin_unlock_bh(&txq->axq_lock);
++ if (!ATH_TXQ_SETUP(sc, i))
++ continue;
++
++ txq = &sc->tx.txq[i];
++ ac = tid->ac;
++
++ spin_lock_bh(&txq->axq_lock);
++
++ if (tid->sched) {
++ list_del(&tid->list);
++ tid->sched = false;
+ }
++
++ if (ac->sched) {
++ list_del(&ac->list);
++ tid->ac->sched = false;
++ }
++
++ ath_tid_drain(sc, txq, tid);
++ tid->state &= ~AGGR_ADDBA_COMPLETE;
++ tid->state &= ~AGGR_CLEANUP;
++
++ spin_unlock_bh(&txq->axq_lock);
+ }
+ }
--- /dev/null
+From 78c4653a2274479547e259e1f416d2b3d04c42a8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 25 Jun 2010 01:26:16 +0200
+Subject: ath9k: fix retry count for A-MPDU rate control status reports
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 78c4653a2274479547e259e1f416d2b3d04c42a8 upstream.
+
+The 'bf_retries' field of the ath_buf structure was used for both
+software retries (AMPDU subframes) and hardware retries (legacy
+frames). This led to a wrong retry count being reported for the A-MPDU
+rate control stats.
+This patch changes the code to no longer use bf_retries for reporting
+retry counts, but instead always using the real on-chip retry count
+from the ath_tx_status.
+Additionally, if the first subframe of an A-MPDU was not acked, the tx
+status report is submitted along with the first acked subframe, which
+may not contain the correct rates in the tx info.
+This is easily corrected by saving the tx rate info before looping over
+subframes, and then copying it back once the A-MPDU status report is
+submitted.
+In my tests this change improves throughput visibly.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Reported-by: Björn Smedman <bjorn.smedman@venatech.se>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -328,6 +328,7 @@ static void ath_tx_complete_aggr(struct
+ u32 ba[WME_BA_BMP_SIZE >> 5];
+ int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
+ bool rc_update = true;
++ struct ieee80211_tx_rate rates[4];
+
+ skb = bf->bf_mpdu;
+ hdr = (struct ieee80211_hdr *)skb->data;
+@@ -335,6 +336,8 @@ static void ath_tx_complete_aggr(struct
+ tx_info = IEEE80211_SKB_CB(skb);
+ hw = bf->aphy->hw;
+
++ memcpy(rates, tx_info->control.rates, sizeof(rates));
++
+ rcu_read_lock();
+
+ /* XXX: use ieee80211_find_sta! */
+@@ -375,6 +378,9 @@ static void ath_tx_complete_aggr(struct
+ txfail = txpending = 0;
+ bf_next = bf->bf_next;
+
++ skb = bf->bf_mpdu;
++ tx_info = IEEE80211_SKB_CB(skb);
++
+ if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, bf->bf_seqno))) {
+ /* transmit completion, subframe is
+ * acked by block ack */
+@@ -428,6 +434,7 @@ static void ath_tx_complete_aggr(struct
+ spin_unlock_bh(&txq->axq_lock);
+
+ if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
++ memcpy(tx_info->control.rates, rates, sizeof(rates));
+ ath_tx_rc_status(bf, ts, nbad, txok, true);
+ rc_update = false;
+ } else {
+@@ -2050,7 +2057,7 @@ static void ath_tx_rc_status(struct ath_
+ tx_info->status.rates[i].idx = -1;
+ }
+
+- tx_info->status.rates[tx_rateindex].count = bf->bf_retries + 1;
++ tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1;
+ }
+
+ static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
+@@ -2161,7 +2168,6 @@ static void ath_tx_processq(struct ath_s
+ * This frame is sent out as a single frame.
+ * Use hardware retry status for this frame.
+ */
+- bf->bf_retries = ts.ts_longretry;
+ if (ts.ts_status & ATH9K_TXERR_XRETRY)
+ bf->bf_state.bf_type |= BUF_XRETRY;
+ ath_tx_rc_status(bf, &ts, 0, txok, true);
+@@ -2280,7 +2286,6 @@ void ath_tx_edma_tasklet(struct ath_soft
+ txok = !(txs.ts_status & ATH9K_TXERR_MASK);
+
+ if (!bf_isampdu(bf)) {
+- bf->bf_retries = txs.ts_longretry;
+ if (txs.ts_status & ATH9K_TXERR_XRETRY)
+ bf->bf_state.bf_type |= BUF_XRETRY;
+ ath_tx_rc_status(bf, &txs, 0, txok, true);
--- /dev/null
+From f860d526eb2939a1c37128900b5af2b6f3ff7f20 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 30 Jun 2010 02:07:48 +0200
+Subject: ath9k: fix TSF after reset on AR913x
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit f860d526eb2939a1c37128900b5af2b6f3ff7f20 upstream.
+
+When issuing a reset, the TSF value is lost in the hardware because of
+the 913x specific cold reset. As with some AR9280 cards, the TSF needs
+to be preserved in software here.
+
+Additionally, there's an issue that frequently prevents a successful
+TSF write directly after the chip reset. In this case, repeating the
+TSF write after the initval-writes usually works.
+
+This patch detects failed TSF writes and recovers from them, taking
+into account the delay caused by the initval writes.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Reported-by: Björn Smedman <bjorn.smedman@venatech.se>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1268,7 +1268,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+ macStaId1 = REG_READ(ah, AR_STA_ID1) & AR_STA_ID1_BASE_RATE_11B;
+
+ /* For chips on which RTC reset is done, save TSF before it gets cleared */
+- if (AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))
++ if (AR_SREV_9100(ah) ||
++ (AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL)))
+ tsf = ath9k_hw_gettsf64(ah);
+
+ saveLedState = REG_READ(ah, AR_CFG_LED) &
+@@ -1300,7 +1301,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+ }
+
+ /* Restore TSF */
+- if (tsf && AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))
++ if (tsf)
+ ath9k_hw_settsf64(ah, tsf);
+
+ if (AR_SREV_9280_10_OR_LATER(ah))
+@@ -1310,6 +1311,17 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+ if (r)
+ return r;
+
++ /*
++ * Some AR91xx SoC devices frequently fail to accept TSF writes
++ * right after the chip reset. When that happens, write a new
++ * value after the initvals have been applied, with an offset
++ * based on measured time difference
++ */
++ if (AR_SREV_9100(ah) && (ath9k_hw_gettsf64(ah) < tsf)) {
++ tsf += 1500;
++ ath9k_hw_settsf64(ah, tsf);
++ }
++
+ /* Setup MFP options for CCMP */
+ if (AR_SREV_9280_20_OR_LATER(ah)) {
+ /* Mask Retry(b11), PwrMgt(b12), MoreData(b13) to 0 in mgmt
--- /dev/null
+From 4cee78614cfa046a26c4fbf313d5bbacb3ad8efc Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 23 Jul 2010 03:53:16 +0200
+Subject: ath9k: fix yet another buffer leak in the tx aggregation code
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 4cee78614cfa046a26c4fbf313d5bbacb3ad8efc upstream.
+
+When an aggregation session is being cleaned up, while the tx status
+for some frames is being processed, the TID is flushed and its buffers
+are sent out.
+
+Unfortunately that left the pending un-acked frames unprocessed, thus
+leaking buffers. Fix this by reordering the code so that those frames
+are processed first, before the TID is flushed.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -510,6 +510,14 @@ static void ath_tx_complete_aggr(struct
+ bf = bf_next;
+ }
+
++ /* prepend un-acked frames to the beginning of the pending frame queue */
++ if (!list_empty(&bf_pending)) {
++ spin_lock_bh(&txq->axq_lock);
++ list_splice(&bf_pending, &tid->buf_q);
++ ath_tx_queue_tid(txq, tid);
++ spin_unlock_bh(&txq->axq_lock);
++ }
++
+ if (tid->state & AGGR_CLEANUP) {
+ if (tid->baw_head == tid->baw_tail) {
+ tid->state &= ~AGGR_ADDBA_COMPLETE;
+@@ -522,14 +530,6 @@ static void ath_tx_complete_aggr(struct
+ return;
+ }
+
+- /* prepend un-acked frames to the beginning of the pending frame queue */
+- if (!list_empty(&bf_pending)) {
+- spin_lock_bh(&txq->axq_lock);
+- list_splice(&bf_pending, &tid->buf_q);
+- ath_tx_queue_tid(txq, tid);
+- spin_unlock_bh(&txq->axq_lock);
+- }
+-
+ rcu_read_unlock();
+
+ if (needreset)
--- /dev/null
+From 23399016d9583d799ca98ce443a1410b13c3e96e Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 11 Jul 2010 12:48:40 +0200
+Subject: ath9k_hw: fix a sign error in the IQ calibration code
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 23399016d9583d799ca98ce443a1410b13c3e96e upstream.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9002_calib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+@@ -239,7 +239,7 @@ static void ar9002_hw_iqcalibrate(struct
+ if (qCoff > 15)
+ qCoff = 15;
+ else if (qCoff <= -16)
+- qCoff = 16;
++ qCoff = -16;
+
+ ath_print(common, ATH_DBG_CALIBRATE,
+ "Chn %d : iCoff = 0x%x qCoff = 0x%x\n",
--- /dev/null
+From 03b4776c408d2f4bf3a5d204e223724d154716d1 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 11 Jul 2010 12:48:41 +0200
+Subject: ath9k_hw: fix an off-by-one error in the PDADC boundaries calculation
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 03b4776c408d2f4bf3a5d204e223724d154716d1 upstream.
+
+PDADC values were only generated for values surrounding the target
+index, however not for the target index itself, leading to a minor
+error in the generated curve.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/eeprom_def.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
+@@ -729,7 +729,7 @@ static void ath9k_hw_get_def_gain_bounda
+ vpdTableI[i][sizeCurrVpdTable - 2]);
+ vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+
+- if (tgtIndex > maxIndex) {
++ if (tgtIndex >= maxIndex) {
+ while ((ss <= tgtIndex) &&
+ (k < (AR5416_NUM_PDADC_VALUES - 1))) {
+ tmpVal = (int16_t)((vpdTableI[i][sizeCurrVpdTable - 1] +
--- /dev/null
+From 601e0cb165e65dc185b31fe7ebd2c0169ea47306 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 11 Jul 2010 12:48:39 +0200
+Subject: ath9k_hw: fix antenna diversity on AR9285
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 601e0cb165e65dc185b31fe7ebd2c0169ea47306 upstream.
+
+On AR9285, the antenna switch configuration register uses more than just
+16 bits. Because of an arbitrary mask applied to the EEPROM value that
+stores this configuration, diversity was broken in some cases, leading
+to a significant degradation in signal strength.
+Fix this by changing the callback to return a 32 bit value and remove
+the arbitrary mask.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +-
+ drivers/net/wireless/ath/ath9k/eeprom.h | 2 +-
+ drivers/net/wireless/ath/ath9k/eeprom_4k.c | 4 ++--
+ drivers/net/wireless/ath/ath9k/eeprom_9287.c | 4 ++--
+ drivers/net/wireless/ath/ath9k/eeprom_def.c | 4 ++--
+ 5 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -944,7 +944,7 @@ static u8 ath9k_hw_ar9300_get_num_ant_co
+ return 1;
+ }
+
+-static u16 ath9k_hw_ar9300_get_eeprom_antenna_cfg(struct ath_hw *ah,
++static u32 ath9k_hw_ar9300_get_eeprom_antenna_cfg(struct ath_hw *ah,
+ struct ath9k_channel *chan)
+ {
+ return -EINVAL;
+--- a/drivers/net/wireless/ath/ath9k/eeprom.h
++++ b/drivers/net/wireless/ath/ath9k/eeprom.h
+@@ -669,7 +669,7 @@ struct eeprom_ops {
+ int (*get_eeprom_ver)(struct ath_hw *hw);
+ int (*get_eeprom_rev)(struct ath_hw *hw);
+ u8 (*get_num_ant_config)(struct ath_hw *hw, enum ieee80211_band band);
+- u16 (*get_eeprom_antenna_cfg)(struct ath_hw *hw,
++ u32 (*get_eeprom_antenna_cfg)(struct ath_hw *hw,
+ struct ath9k_channel *chan);
+ void (*set_board_values)(struct ath_hw *hw, struct ath9k_channel *chan);
+ void (*set_addac)(struct ath_hw *hw, struct ath9k_channel *chan);
+--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+@@ -1149,13 +1149,13 @@ static void ath9k_hw_4k_set_board_values
+ }
+ }
+
+-static u16 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
++static u32 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
+ struct ath9k_channel *chan)
+ {
+ struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
+ struct modal_eep_4k_header *pModal = &eep->modalHeader;
+
+- return pModal->antCtrlCommon & 0xFFFF;
++ return pModal->antCtrlCommon;
+ }
+
+ static u8 ath9k_hw_4k_get_num_ant_config(struct ath_hw *ah,
+--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+@@ -1131,13 +1131,13 @@ static u8 ath9k_hw_AR9287_get_num_ant_co
+ return 1;
+ }
+
+-static u16 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
++static u32 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
+ struct ath9k_channel *chan)
+ {
+ struct ar9287_eeprom *eep = &ah->eeprom.map9287;
+ struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
+
+- return pModal->antCtrlCommon & 0xFFFF;
++ return pModal->antCtrlCommon;
+ }
+
+ static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah,
+--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
+@@ -1437,14 +1437,14 @@ static u8 ath9k_hw_def_get_num_ant_confi
+ return num_ant_config;
+ }
+
+-static u16 ath9k_hw_def_get_eeprom_antenna_cfg(struct ath_hw *ah,
++static u32 ath9k_hw_def_get_eeprom_antenna_cfg(struct ath_hw *ah,
+ struct ath9k_channel *chan)
+ {
+ struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+ struct modal_eep_header *pModal =
+ &(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
+
+- return pModal->antCtrlCommon & 0xFFFF;
++ return pModal->antCtrlCommon;
+ }
+
+ static u16 ath9k_hw_def_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
--- /dev/null
+From 9cc2f3e881dcda5466c55ffe8dd0a9d1433469cb Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 11 Jul 2010 12:48:42 +0200
+Subject: ath9k_hw: prevent a fast channel change after a rx DMA stuck issue
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 9cc2f3e881dcda5466c55ffe8dd0a9d1433469cb upstream.
+
+If the receive path gets stuck, a full hardware reset is necessary to
+recover from it. If this happens during a scan, the whole scan might fail,
+as each channel change bypasses the full reset sequence.
+Fix this by resetting the fast channel change flag if stopping the
+receive path fails.
+
+This will reduce the number of error messages that look like this:
+ath: DMA failed to stop in 10 ms AR_CR=0x00000024 AR_DIAG_SW=0x40000020
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1233,9 +1233,11 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+
+ if (!ah->chip_fullsleep) {
+ ath9k_hw_abortpcurecv(ah);
+- if (!ath9k_hw_stopdmarecv(ah))
++ if (!ath9k_hw_stopdmarecv(ah)) {
+ ath_print(common, ATH_DBG_XMIT,
+ "Failed to stop receive dma\n");
++ bChannelChange = false;
++ }
+ }
+
+ if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
--- /dev/null
+From e75aa85892b2ee78c79edac720868cbef16e62eb Mon Sep 17 00:00:00 2001
+From: Tejun Heo <htejun@gmail.com>
+Date: Wed, 4 Aug 2010 17:59:39 +0200
+Subject: block_dev: always serialize exclusive open attempts
+
+From: Tejun Heo <htejun@gmail.com>
+
+commit e75aa85892b2ee78c79edac720868cbef16e62eb upstream.
+
+bd_prepare_to_claim() incorrectly allowed multiple attempts for
+exclusive open to progress in parallel if the attempting holders are
+identical. This triggered BUG_ON() as reported in the following bug.
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=16393
+
+__bd_abort_claiming() is used to finish claiming blocks and doesn't
+work if multiple openers are inside a claiming block. Allowing
+multiple parallel open attempts to continue doesn't gain anything as
+those are serialized down in the call chain anyway. Fix it by always
+allowing only single open attempt in a claiming block.
+
+This problem can easily be reproduced by adding a delay after
+bd_prepare_to_claim() and attempting to mount two partitions of a
+disk.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -681,8 +681,8 @@ retry:
+ if (!bd_may_claim(bdev, whole, holder))
+ return -EBUSY;
+
+- /* if someone else is claiming, wait for it to finish */
+- if (whole->bd_claiming && whole->bd_claiming != holder) {
++ /* if claiming is already in progress, wait for it to finish */
++ if (whole->bd_claiming) {
+ wait_queue_head_t *wq = bit_waitqueue(&whole->bd_claiming, 0);
+ DEFINE_WAIT(wait);
+
--- /dev/null
+From ccb6c1360f8dd43303c659db718e7e0b24175db5 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 13 Jul 2010 10:55:38 +0200
+Subject: cfg80211: don't get expired BSSes
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit ccb6c1360f8dd43303c659db718e7e0b24175db5 upstream.
+
+When kernel-internal users use cfg80211_get_bss()
+to get a reference to a BSS struct, they may end
+up getting one that would have been removed from
+the list if there had been any userspace access
+to the list. This leads to inconsistencies and
+problems.
+
+Fix it by making cfg80211_get_bss() ignore BSSes
+that cfg80211_bss_expire() would remove.
+
+Fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2180
+
+Reported-by: Jiajia Zheng <jiajia.zheng@intel.com>
+Tested-by: Jiajia Zheng <jiajia.zheng@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/scan.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -275,6 +275,7 @@ struct cfg80211_bss *cfg80211_get_bss(st
+ {
+ struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
+ struct cfg80211_internal_bss *bss, *res = NULL;
++ unsigned long now = jiffies;
+
+ spin_lock_bh(&dev->bss_lock);
+
+@@ -283,6 +284,10 @@ struct cfg80211_bss *cfg80211_get_bss(st
+ continue;
+ if (channel && bss->pub.channel != channel)
+ continue;
++ /* Don't get expired BSS structs */
++ if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
++ !atomic_read(&bss->hold))
++ continue;
+ if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
+ res = bss;
+ kref_get(&res->ref);
--- /dev/null
+From 643f82e32f14faf0d0944c804203a6681b6b0a1e Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 12 Jul 2010 14:46:43 +0200
+Subject: cfg80211: ignore spurious deauth
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 643f82e32f14faf0d0944c804203a6681b6b0a1e upstream.
+
+Ever since mac80211/drivers are no longer
+fully in charge of keeping track of the
+auth status, trying to make them do so will
+fail. Instead of warning and reporting the
+deauthentication to userspace, cfg80211 must
+simply ignore it so that spurious
+deauthentications, e.g. before starting
+authentication, aren't seen by userspace as
+actual deauthentications.
+
+Reported-by: Paul Stewart <pstew@google.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/mlme.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -44,10 +44,10 @@ void cfg80211_send_rx_auth(struct net_de
+ }
+ }
+
+- WARN_ON(!done);
+-
+- nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
+- cfg80211_sme_rx_auth(dev, buf, len);
++ if (done) {
++ nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
++ cfg80211_sme_rx_auth(dev, buf, len);
++ }
+
+ wdev_unlock(wdev);
+ }
--- /dev/null
+From 694f690d27dadccc8cb9d90532e76593b61fe098 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 4 Aug 2010 16:59:14 +0100
+Subject: CRED: Fix RCU warning due to previous patch fixing __task_cred()'s checks
+
+From: David Howells <dhowells@redhat.com>
+
+commit 694f690d27dadccc8cb9d90532e76593b61fe098 upstream.
+
+Commit 8f92054e7ca1 ("CRED: Fix __task_cred()'s lockdep check and banner
+comment") fixed the lockdep checks on __task_cred(). This has shown up
+a place in the signalling code where a lock should be held - namely that
+check_kill_permission() requires its callers to hold the RCU lock.
+
+Fix group_send_sig_info() to get the RCU read lock around its call to
+check_kill_permission().
+
+Without this patch, the following warning can occur:
+
+ ===================================================
+ [ INFO: suspicious rcu_dereference_check() usage. ]
+ ---------------------------------------------------
+ kernel/signal.c:660 invoked rcu_dereference_check() without protection!
+ ...
+
+Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/signal.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -637,7 +637,7 @@ static inline bool si_fromuser(const str
+
+ /*
+ * Bad permissions for sending the signal
+- * - the caller must hold at least the RCU read lock
++ * - the caller must hold the RCU read lock
+ */
+ static int check_kill_permission(int sig, struct siginfo *info,
+ struct task_struct *t)
+@@ -1127,11 +1127,14 @@ struct sighand_struct *lock_task_sighand
+
+ /*
+ * send signal info to all the members of a group
+- * - the caller must hold the RCU read lock at least
+ */
+ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
+ {
+- int ret = check_kill_permission(sig, info, p);
++ int ret;
++
++ rcu_read_lock();
++ ret = check_kill_permission(sig, info, p);
++ rcu_read_unlock();
+
+ if (!ret && sig)
+ ret = do_send_sig_info(sig, info, p, true);
--- /dev/null
+From ff847ac2d3e90edd94674c28bade25ae1e6a2e49 Mon Sep 17 00:00:00 2001
+From: Bruce Allan <bruce.w.allan@intel.com>
+Date: Tue, 27 Jul 2010 12:28:46 +0000
+Subject: e1000e: 82577/82578 PHY register access issues
+
+From: Bruce Allan <bruce.w.allan@intel.com>
+
+commit ff847ac2d3e90edd94674c28bade25ae1e6a2e49 upstream.
+
+The MAC-PHY interconnect on 82577/82578 uses a power management feature
+(called K1) which must be disabled when in 1Gbps due to a hardware issue on
+these parts. The #define bit setting used to enable/disable K1 is
+incorrect and can cause PHY register accesses to stop working altogether
+until the next device reset. This patch sets the register correctly.
+
+This issue is present in kernels since 2.6.32.
+
+Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
+Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e1000e/hw.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/e1000e/hw.h
++++ b/drivers/net/e1000e/hw.h
+@@ -308,7 +308,7 @@ enum e1e_registers {
+ #define E1000_KMRNCTRLSTA_INBAND_PARAM 0x9 /* Kumeran InBand Parameters */
+ #define E1000_KMRNCTRLSTA_DIAG_NELPBK 0x1000 /* Nearend Loopback mode */
+ #define E1000_KMRNCTRLSTA_K1_CONFIG 0x7
+-#define E1000_KMRNCTRLSTA_K1_ENABLE 0x140E
++#define E1000_KMRNCTRLSTA_K1_ENABLE 0x0002
+ #define E1000_KMRNCTRLSTA_K1_DISABLE 0x1400
+
+ #define IFE_PHY_EXTENDED_STATUS_CONTROL 0x10
--- /dev/null
+From 36f2407fe52c55566221f8c68c8fb808abffd2f5 Mon Sep 17 00:00:00 2001
+From: Dean Nelson <dnelson@redhat.com>
+Date: Tue, 29 Jun 2010 18:12:05 +0000
+Subject: e1000e: don't inadvertently re-set INTX_DISABLE
+
+From: Dean Nelson <dnelson@redhat.com>
+
+commit 36f2407fe52c55566221f8c68c8fb808abffd2f5 upstream.
+
+Should e1000_test_msi() fail to see an msi interrupt, it attempts to
+fallback to legacy INTx interrupts. But an error in the code may prevent
+this from happening correctly.
+
+Before calling e1000_test_msi_interrupt(), e1000_test_msi() disables SERR
+by clearing the SERR bit from the just read PCI_COMMAND bits as it writes
+them back out.
+
+Upon return from calling e1000_test_msi_interrupt(), it re-enables SERR
+by writing out the version of PCI_COMMAND it had previously read.
+
+The problem with this is that e1000_test_msi_interrupt() calls
+pci_disable_msi(), which eventually ends up in pci_intx(). And because
+pci_intx() was called with enable set to 1, the INTX_DISABLE bit gets
+cleared from PCI_COMMAND, which is what we want. But when we get back to
+e1000_test_msi(), the INTX_DISABLE bit gets inadvertently re-set because
+of the attempt by e1000_test_msi() to re-enable SERR.
+
+The solution is to have e1000_test_msi() re-read the PCI_COMMAND bits as
+part of its attempt to re-enable SERR.
+
+During debugging/testing of this issue I found that not all the systems
+I ran on had the SERR bit set to begin with. And on some of the systems
+the same could be said for the INTX_DISABLE bit. Needless to say these
+latter systems didn't have a problem falling back to legacy INTx
+interrupts with the code as is.
+
+Signed-off-by: Dean Nelson <dnelson@redhat.com>
+Tested-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e1000e/netdev.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/e1000e/netdev.c
++++ b/drivers/net/e1000e/netdev.c
+@@ -3419,13 +3419,18 @@ static int e1000_test_msi(struct e1000_a
+
+ /* disable SERR in case the MSI write causes a master abort */
+ pci_read_config_word(adapter->pdev, PCI_COMMAND, &pci_cmd);
+- pci_write_config_word(adapter->pdev, PCI_COMMAND,
+- pci_cmd & ~PCI_COMMAND_SERR);
++ if (pci_cmd & PCI_COMMAND_SERR)
++ pci_write_config_word(adapter->pdev, PCI_COMMAND,
++ pci_cmd & ~PCI_COMMAND_SERR);
+
+ err = e1000_test_msi_interrupt(adapter);
+
+- /* restore previous setting of command word */
+- pci_write_config_word(adapter->pdev, PCI_COMMAND, pci_cmd);
++ /* re-enable SERR */
++ if (pci_cmd & PCI_COMMAND_SERR) {
++ pci_read_config_word(adapter->pdev, PCI_COMMAND, &pci_cmd);
++ pci_cmd |= PCI_COMMAND_SERR;
++ pci_write_config_word(adapter->pdev, PCI_COMMAND, pci_cmd);
++ }
+
+ /* success ! */
+ if (!err)
--- /dev/null
+From 5fa8517f038d51d571981fb495206cc30ed91b06 Mon Sep 17 00:00:00 2001
+From: Greg Rose <gregory.v.rose@intel.com>
+Date: Thu, 1 Jul 2010 13:38:16 +0000
+Subject: igb: Use only a single Tx queue in SR-IOV mode
+
+From: Greg Rose <gregory.v.rose@intel.com>
+
+commit 5fa8517f038d51d571981fb495206cc30ed91b06 upstream.
+
+The 82576 expects the second rx queue in any pool to receive L2 switch
+loop back packets sent from the second tx queue in another pool. The
+82576 VF driver does not enable the second rx queue so if the PF driver
+sends packets destined to a VF from its second tx queue then the VF
+driver will never see them. In SR-IOV mode limit the number of tx queues
+used by the PF driver to one. This patch fixes a bug reported in which
+the PF cannot communciate with the VF and should be considered for 2.6.34
+stable.
+
+Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
+Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/igb/igb_main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/igb/igb_main.c
++++ b/drivers/net/igb/igb_main.c
+@@ -630,9 +630,6 @@ static void igb_cache_ring_register(stru
+ for (; i < adapter->rss_queues; i++)
+ adapter->rx_ring[i]->reg_idx = rbase_offset +
+ Q_IDX_82576(i);
+- for (; j < adapter->rss_queues; j++)
+- adapter->tx_ring[j]->reg_idx = rbase_offset +
+- Q_IDX_82576(j);
+ }
+ case e1000_82575:
+ case e1000_82580:
+@@ -996,7 +993,10 @@ static void igb_set_interrupt_capability
+
+ /* Number of supported queues. */
+ adapter->num_rx_queues = adapter->rss_queues;
+- adapter->num_tx_queues = adapter->rss_queues;
++ if (adapter->vfs_allocated_count)
++ adapter->num_tx_queues = 1;
++ else
++ adapter->num_tx_queues = adapter->rss_queues;
+
+ /* start with one vector for every rx queue */
+ numvecs = adapter->num_rx_queues;
--- /dev/null
+From d28232b461b8d54b09e59325dbac8b0913ce2049 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Thu, 29 Jul 2010 11:37:41 +0200
+Subject: iwlwifi: fix scan abort
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit d28232b461b8d54b09e59325dbac8b0913ce2049 upstream.
+
+Fix possible double priv->mutex lock introduced by commit
+a69b03e941abae00380fc6bc1877fb797a1b31e6
+"iwlwifi: cancel scan watchdog in iwl_bg_abort_scan" .
+We can not call cancel_delayed_work_sync(&priv->scan_check) with
+priv->mutex locked because workqueue function iwl_bg_scan_check()
+take that lock internally.
+
+We do not need to synchronize when canceling priv->scan_check work.
+We can avoid races (sending double abort command or send no
+command at all) using STATUS_SCAN_ABORT bit. Moreover
+current iwl_bg_scan_check() code seems to be broken, as
+we should not send abort commands when currently aborting.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-scan.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
+@@ -420,11 +420,10 @@ void iwl_bg_scan_check(struct work_struc
+ return;
+
+ mutex_lock(&priv->mutex);
+- if (test_bit(STATUS_SCANNING, &priv->status) ||
+- test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+- IWL_DEBUG_SCAN(priv, "Scan completion watchdog resetting "
+- "adapter (%dms)\n",
+- jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
++ if (test_bit(STATUS_SCANNING, &priv->status) &&
++ !test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
++ IWL_DEBUG_SCAN(priv, "Scan completion watchdog (%dms)\n",
++ jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
+
+ if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
+ iwl_send_scan_abort(priv);
+@@ -489,12 +488,11 @@ void iwl_bg_abort_scan(struct work_struc
+ !test_bit(STATUS_GEO_CONFIGURED, &priv->status))
+ return;
+
+- mutex_lock(&priv->mutex);
+-
+- cancel_delayed_work_sync(&priv->scan_check);
+- set_bit(STATUS_SCAN_ABORTING, &priv->status);
+- iwl_send_scan_abort(priv);
++ cancel_delayed_work(&priv->scan_check);
+
++ mutex_lock(&priv->mutex);
++ if (test_bit(STATUS_SCAN_ABORTING, &priv->status))
++ iwl_send_scan_abort(priv);
+ mutex_unlock(&priv->mutex);
+ }
+ EXPORT_SYMBOL(iwl_bg_abort_scan);
--- /dev/null
+From c937019761a758f2749b1f3a032b7a91fb044753 Mon Sep 17 00:00:00 2001
+From: John W. Linville <linville@tuxdriver.com>
+Date: Mon, 21 Jun 2010 17:14:07 -0400
+Subject: mac80211: avoid scheduling while atomic in mesh_rx_plink_frame
+
+From: John W. Linville <linville@tuxdriver.com>
+
+commit c937019761a758f2749b1f3a032b7a91fb044753 upstream.
+
+While mesh_rx_plink_frame holds sta->lock...
+
+mesh_rx_plink_frame ->
+ mesh_plink_inc_estab_count ->
+ ieee80211_bss_info_change_notify
+
+...but ieee80211_bss_info_change_notify is allowed to sleep. A driver
+taking advantage of that allowance can cause a scheduling while
+atomic bug. Similar paths exist for mesh_plink_dec_estab_count,
+so work around those as well.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=16099
+
+Also, correct a minor kerneldoc comment error (mismatched function names).
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/mesh_plink.c | 42 +++++++++++++++++++++++++++++++-----------
+ 1 file changed, 31 insertions(+), 11 deletions(-)
+
+--- a/net/mac80211/mesh_plink.c
++++ b/net/mac80211/mesh_plink.c
+@@ -65,7 +65,6 @@ void mesh_plink_inc_estab_count(struct i
+ {
+ atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
+ mesh_accept_plinks_update(sdata);
+- ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ }
+
+ static inline
+@@ -73,7 +72,6 @@ void mesh_plink_dec_estab_count(struct i
+ {
+ atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
+ mesh_accept_plinks_update(sdata);
+- ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ }
+
+ /**
+@@ -115,7 +113,7 @@ static struct sta_info *mesh_plink_alloc
+ }
+
+ /**
+- * mesh_plink_deactivate - deactivate mesh peer link
++ * __mesh_plink_deactivate - deactivate mesh peer link
+ *
+ * @sta: mesh peer link to deactivate
+ *
+@@ -123,18 +121,23 @@ static struct sta_info *mesh_plink_alloc
+ *
+ * Locking: the caller must hold sta->lock
+ */
+-static void __mesh_plink_deactivate(struct sta_info *sta)
++static bool __mesh_plink_deactivate(struct sta_info *sta)
+ {
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
++ bool deactivated = false;
+
+- if (sta->plink_state == PLINK_ESTAB)
++ if (sta->plink_state == PLINK_ESTAB) {
+ mesh_plink_dec_estab_count(sdata);
++ deactivated = true;
++ }
+ sta->plink_state = PLINK_BLOCKED;
+ mesh_path_flush_by_nexthop(sta);
++
++ return deactivated;
+ }
+
+ /**
+- * __mesh_plink_deactivate - deactivate mesh peer link
++ * mesh_plink_deactivate - deactivate mesh peer link
+ *
+ * @sta: mesh peer link to deactivate
+ *
+@@ -142,9 +145,15 @@ static void __mesh_plink_deactivate(stru
+ */
+ void mesh_plink_deactivate(struct sta_info *sta)
+ {
++ struct ieee80211_sub_if_data *sdata = sta->sdata;
++ bool deactivated;
++
+ spin_lock_bh(&sta->lock);
+- __mesh_plink_deactivate(sta);
++ deactivated = __mesh_plink_deactivate(sta);
+ spin_unlock_bh(&sta->lock);
++
++ if (deactivated)
++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ }
+
+ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
+@@ -381,10 +390,16 @@ int mesh_plink_open(struct sta_info *sta
+
+ void mesh_plink_block(struct sta_info *sta)
+ {
++ struct ieee80211_sub_if_data *sdata = sta->sdata;
++ bool deactivated;
++
+ spin_lock_bh(&sta->lock);
+- __mesh_plink_deactivate(sta);
++ deactivated = __mesh_plink_deactivate(sta);
+ sta->plink_state = PLINK_BLOCKED;
+ spin_unlock_bh(&sta->lock);
++
++ if (deactivated)
++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ }
+
+
+@@ -397,6 +412,7 @@ void mesh_rx_plink_frame(struct ieee8021
+ enum plink_event event;
+ enum plink_frame_type ftype;
+ size_t baselen;
++ bool deactivated;
+ u8 ie_len;
+ u8 *baseaddr;
+ __le16 plid, llid, reason;
+@@ -651,8 +667,9 @@ void mesh_rx_plink_frame(struct ieee8021
+ case CNF_ACPT:
+ del_timer(&sta->plink_timer);
+ sta->plink_state = PLINK_ESTAB;
+- mesh_plink_inc_estab_count(sdata);
+ spin_unlock_bh(&sta->lock);
++ mesh_plink_inc_estab_count(sdata);
++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
+ sta->sta.addr);
+ break;
+@@ -684,8 +701,9 @@ void mesh_rx_plink_frame(struct ieee8021
+ case OPN_ACPT:
+ del_timer(&sta->plink_timer);
+ sta->plink_state = PLINK_ESTAB;
+- mesh_plink_inc_estab_count(sdata);
+ spin_unlock_bh(&sta->lock);
++ mesh_plink_inc_estab_count(sdata);
++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
+ sta->sta.addr);
+ mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
+@@ -702,11 +720,13 @@ void mesh_rx_plink_frame(struct ieee8021
+ case CLS_ACPT:
+ reason = cpu_to_le16(MESH_CLOSE_RCVD);
+ sta->reason = reason;
+- __mesh_plink_deactivate(sta);
++ deactivated = __mesh_plink_deactivate(sta);
+ sta->plink_state = PLINK_HOLDING;
+ llid = sta->llid;
+ mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
+ spin_unlock_bh(&sta->lock);
++ if (deactivated)
++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
+ plid, reason);
+ break;
--- /dev/null
+From d9b68e5e88248bb24fd4e455588bea1d56108fd6 Mon Sep 17 00:00:00 2001
+From: Kyle McMartin <kyle@mcmartin.ca>
+Date: Tue, 3 Aug 2010 20:38:08 -0400
+Subject: parisc: pass through '\t' to early (iodc) console
+
+From: Kyle McMartin <kyle@mcmartin.ca>
+
+commit d9b68e5e88248bb24fd4e455588bea1d56108fd6 upstream.
+
+The firmware handles '\t' internally, so stop trying to emulate it
+(which, incidentally, had a bug in it.)
+
+Fixes a really weird hang at bootup in rcu_bootup_announce, which,
+as far as I can tell, is the first printk in the core kernel to use
+a tab as the first character.
+
+Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/parisc/kernel/firmware.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+--- a/arch/parisc/kernel/firmware.c
++++ b/arch/parisc/kernel/firmware.c
+@@ -1123,7 +1123,6 @@ static char __attribute__((aligned(64)))
+ */
+ int pdc_iodc_print(const unsigned char *str, unsigned count)
+ {
+- static int posx; /* for simple TAB-Simulation... */
+ unsigned int i;
+ unsigned long flags;
+
+@@ -1133,19 +1132,12 @@ int pdc_iodc_print(const unsigned char *
+ iodc_dbuf[i+0] = '\r';
+ iodc_dbuf[i+1] = '\n';
+ i += 2;
+- posx = 0;
+ goto print;
+- case '\t':
+- while (posx & 7) {
+- iodc_dbuf[i] = ' ';
+- i++, posx++;
+- }
+- break;
+ case '\b': /* BS */
+- posx -= 2;
++ i--; /* overwrite last */
+ default:
+ iodc_dbuf[i] = str[i];
+- i++, posx++;
++ i++;
+ break;
+ }
+ }
parisc-led.c-fix-potential-stack-overflow-in-led_proc_write.patch
arm-imx-gpio-add-spinlock-protection.patch
+block_dev-always-serialize-exclusive-open-attempts.patch
+parisc-pass-through-t-to-early-iodc-console.patch
+amd64_edac-fix-dct-base-address-selector.patch
+amd64_edac-correct-scrub-rate-setting.patch
+amd64_edac-fix-operator-precendence-error.patch
+arp_notify-allow-drivers-to-explicitly-request-a-notification-event.patch
+xen-netfront-explicitly-generate-arp_notify-event-after-migration.patch
+e1000e-don-t-inadvertently-re-set-intx_disable.patch
+e1000e-82577-82578-phy-register-access-issues.patch
+9p-strlen-doesn-t-count-the-terminator.patch
+igb-use-only-a-single-tx-queue-in-sr-iov-mode.patch
+ath9k-enable-serialize_regmode-for-non-pcie-ar9160.patch
+ath9k-fix-a-potential-buffer-leak-in-the-sta-teardown-path.patch
+ath9k_hw-prevent-a-fast-channel-change-after-a-rx-dma-stuck-issue.patch
+ath9k_hw-fix-a-sign-error-in-the-iq-calibration-code.patch
+ath9k_hw-fix-an-off-by-one-error-in-the-pdadc-boundaries-calculation.patch
+ath9k-fix-retry-count-for-a-mpdu-rate-control-status-reports.patch
+ath9k-fix-a-buffer-leak-in-a-mpdu-completion.patch
+ath9k-another-fix-for-the-a-mpdu-buffer-leak.patch
+ath9k-fix-tsf-after-reset-on-ar913x.patch
+ath9k-fix-yet-another-buffer-leak-in-the-tx-aggregation-code.patch
+ath9k_hw-fix-antenna-diversity-on-ar9285.patch
+iwlwifi-fix-scan-abort.patch
+ssb-handle-alternate-ssprom-location.patch
+cfg80211-ignore-spurious-deauth.patch
+cfg80211-don-t-get-expired-bsses.patch
+mac80211-avoid-scheduling-while-atomic-in-mesh_rx_plink_frame.patch
+cred-fix-rcu-warning-due-to-previous-patch-fixing-__task_cred-s-checks.patch
--- /dev/null
+From 9d1ac34ec3a67713308ae0883c3359c557f14d17 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Fri, 14 May 2010 22:08:58 -0500
+Subject: ssb: Handle alternate SSPROM location
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 9d1ac34ec3a67713308ae0883c3359c557f14d17 upstream.
+
+In kernel Bugzilla #15825 (2 users), in a wireless mailing list thread
+(http://lists.infradead.org/pipermail/b43-dev/2010-May/000124.html), and on a
+netbook owned by John Linville
+(http://marc.info/?l=linux-wireless&m=127230751408818&w=4), there are reports
+of ssb failing to detect an SPROM at the normal location. After studying the
+MMIO trace dump for the Broadcom wl driver, it was determined that the affected
+boxes had a relocated SPROM.
+
+This patch fixes all systems that have reported this problem.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ssb/driver_chipcommon.c | 1 +
+ drivers/ssb/pci.c | 15 +++++++++++++--
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/ssb/driver_chipcommon.c
++++ b/drivers/ssb/driver_chipcommon.c
+@@ -235,6 +235,7 @@ void ssb_chipcommon_init(struct ssb_chip
+ return; /* We don't have a ChipCommon */
+ if (cc->dev->id.revision >= 11)
+ cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
++ ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
+ ssb_pmu_init(cc);
+ chipco_powercontrol_init(cc);
+ ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -626,11 +626,22 @@ static int ssb_pci_sprom_get(struct ssb_
+ return -ENODEV;
+ }
+ if (bus->chipco.dev) { /* can be unavailible! */
+- bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
+- SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
++ /*
++ * get SPROM offset: SSB_SPROM_BASE1 except for
++ * chipcommon rev >= 31 or chip ID is 0x4312 and
++ * chipcommon status & 3 == 2
++ */
++ if (bus->chipco.dev->id.revision >= 31)
++ bus->sprom_offset = SSB_SPROM_BASE31;
++ else if (bus->chip_id == 0x4312 &&
++ (bus->chipco.status & 0x03) == 2)
++ bus->sprom_offset = SSB_SPROM_BASE31;
++ else
++ bus->sprom_offset = SSB_SPROM_BASE1;
+ } else {
+ bus->sprom_offset = SSB_SPROM_BASE1;
+ }
++ ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
+
+ buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
+ if (!buf)
--- /dev/null
+From 592970675c9522bde588b945388c7995c8b51328 Mon Sep 17 00:00:00 2001
+From: Ian Campbell <Ian.Campbell@citrix.com>
+Date: Wed, 26 May 2010 00:09:43 +0000
+Subject: xen: netfront: explicitly generate arp_notify event after migration.
+
+From: Ian Campbell <Ian.Campbell@citrix.com>
+
+commit 592970675c9522bde588b945388c7995c8b51328 upstream.
+
+Use newly introduced netif_notify_peers() method to ensure a gratuitous ARP is
+generated after a migration.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Stephen Hemminger <shemminger@linux-foundation.org>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: netdev@vger.kernel.org
+Cc: xen-devel@lists.xensource.com
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/xen-netfront.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1621,6 +1621,7 @@ static void backend_changed(struct xenbu
+ if (xennet_connect(netdev) != 0)
+ break;
+ xenbus_switch_state(dev, XenbusStateConnected);
++ netif_notify_peers(netdev);
+ break;
+
+ case XenbusStateClosing:
projects / thirdparty / kernel / stable-queue.git / commitdiff
