--- /dev/null
+From 2ac2927a953a01c83df255118922cce1523d1a18 Mon Sep 17 00:00:00 2001
+From: Bob Copeland <me@bobcopeland.com>
+Date: Tue, 9 Feb 2010 13:06:54 -0500
+Subject: ath5k: use correct packet type when transmitting
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit 2ac2927a953a01c83df255118922cce1523d1a18 upstream.
+
+The hardware needs to know what type of frames are being
+sent in order to fill in various fields, for example the
+timestamp in probe responses (before this patch, it was
+always 0). Set it correctly when initializing the TX
+descriptor.
+
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/ath5k.h | 1 -
+ drivers/net/wireless/ath/ath5k/base.c | 26 +++++++++++++++++++++++++-
+ 2 files changed, 25 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/ath5k.h
++++ b/drivers/net/wireless/ath/ath5k/ath5k.h
+@@ -541,7 +541,6 @@ struct ath5k_txq_info {
+ /*
+ * Transmit packet types.
+ * used on tx control descriptor
+- * TODO: Use them inside base.c corectly
+ */
+ enum ath5k_pkt_type {
+ AR5K_PKT_TYPE_NORMAL = 0,
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1246,6 +1246,29 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc
+ return 0;
+ }
+
++static enum ath5k_pkt_type get_hw_packet_type(struct sk_buff *skb)
++{
++ struct ieee80211_hdr *hdr;
++ enum ath5k_pkt_type htype;
++ __le16 fc;
++
++ hdr = (struct ieee80211_hdr *)skb->data;
++ fc = hdr->frame_control;
++
++ if (ieee80211_is_beacon(fc))
++ htype = AR5K_PKT_TYPE_BEACON;
++ else if (ieee80211_is_probe_resp(fc))
++ htype = AR5K_PKT_TYPE_PROBE_RESP;
++ else if (ieee80211_is_atim(fc))
++ htype = AR5K_PKT_TYPE_ATIM;
++ else if (ieee80211_is_pspoll(fc))
++ htype = AR5K_PKT_TYPE_PSPOLL;
++ else
++ htype = AR5K_PKT_TYPE_NORMAL;
++
++ return htype;
++}
++
+ static int
+ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
+ struct ath5k_txq *txq)
+@@ -1300,7 +1323,8 @@ ath5k_txbuf_setup(struct ath5k_softc *sc
+ sc->vif, pktlen, info));
+ }
+ ret = ah->ah_setup_tx_desc(ah, ds, pktlen,
+- ieee80211_get_hdrlen_from_skb(skb), AR5K_PKT_TYPE_NORMAL,
++ ieee80211_get_hdrlen_from_skb(skb),
++ get_hw_packet_type(skb),
+ (sc->power_level * 2),
+ hw_rate,
+ info->control.rates[0].count, keyidx, ah->ah_tx_ant, flags,
--- /dev/null
+From 7bfbae10dc10a5c94a780d117a57e875d77e8e5a Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 24 Feb 2010 04:43:05 +0100
+Subject: ath9k: disable RIFS search for AR91xx based chips
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 7bfbae10dc10a5c94a780d117a57e875d77e8e5a upstream.
+
+While ath9k does not support RIFS yet, the ability to receive RIFS
+frames is currently enabled for most chipsets in the initvals.
+This is causing baseband related issues on AR9160 and AR9130 based
+chipsets, which can lock up under certain conditions.
+
+This patch fixes these issues by overriding the initvals, effectively
+disabling RIFS for all affected chipsets.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 10 ++++++++++
+ drivers/net/wireless/ath/ath9k/phy.h | 3 +++
+ 2 files changed, 13 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1345,6 +1345,16 @@ static void ath9k_hw_override_ini(struct
+ * Necessary to avoid issues on AR5416 2.0
+ */
+ REG_WRITE(ah, 0x9800 + (651 << 2), 0x11);
++
++ /*
++ * Disable RIFS search on some chips to avoid baseband
++ * hang issues.
++ */
++ if (AR_SREV_9100(ah) || AR_SREV_9160(ah)) {
++ val = REG_READ(ah, AR_PHY_HEAVY_CLIP_FACTOR_RIFS);
++ val &= ~AR_PHY_RIFS_INIT_DELAY;
++ REG_WRITE(ah, AR_PHY_HEAVY_CLIP_FACTOR_RIFS, val);
++ }
+ }
+
+ static u32 ath9k_hw_def_ini_fixup(struct ath_hw *ah,
+--- a/drivers/net/wireless/ath/ath9k/phy.h
++++ b/drivers/net/wireless/ath/ath9k/phy.h
+@@ -384,6 +384,9 @@ bool ath9k_hw_set_rf_regs(struct ath_hw
+
+ #define AR_PHY_HEAVY_CLIP_ENABLE 0x99E0
+
++#define AR_PHY_HEAVY_CLIP_FACTOR_RIFS 0x99EC
++#define AR_PHY_RIFS_INIT_DELAY 0x03ff0000
++
+ #define AR_PHY_M_SLEEP 0x99f0
+ #define AR_PHY_REFCLKDLY 0x99f4
+ #define AR_PHY_REFCLKPD 0x99f8
--- /dev/null
+From d8728ee919282c7b01b65cd479ec1e2a9c5d3ba8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 19 Feb 2010 18:21:42 +0100
+Subject: ath9k: fix beacon timer restart after a card reset
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit d8728ee919282c7b01b65cd479ec1e2a9c5d3ba8 upstream.
+
+In AP mode, ath_beacon_config_ap only restarts the timer if a TSF
+restart is requested. Apparently this was added, because this function
+unconditionally sets the flag for TSF reset.
+
+The problem with this is, that ath9k_hw_reset() clobbers the timer
+registers (specified in the initvals), thus effectively disabling the
+SWBA interrupt whenever a card reset without TSF reset is issued
+(happens in a few places in the code).
+
+This patch fixes ath_beacon_config_ap to only issue the TSF reset flag
+when necessary, but reinitialize the timer unconditionally. Tests show,
+that this is enough to keep the SWBA interrupt going after a call to
+ath_reset()
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/beacon.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/beacon.c
++++ b/drivers/net/wireless/ath/ath9k/beacon.c
+@@ -525,16 +525,13 @@ static void ath_beacon_config_ap(struct
+ {
+ u32 nexttbtt, intval;
+
+- /* Configure the timers only when the TSF has to be reset */
+-
+- if (!(sc->sc_flags & SC_OP_TSF_RESET))
+- return;
+-
+ /* NB: the beacon interval is kept internally in TU's */
+ intval = conf->beacon_interval & ATH9K_BEACON_PERIOD;
+ intval /= ATH_BCBUF; /* for staggered beacons */
+ nexttbtt = intval;
+- intval |= ATH9K_BEACON_RESET_TSF;
++
++ if (sc->sc_flags & SC_OP_TSF_RESET)
++ intval |= ATH9K_BEACON_RESET_TSF;
+
+ /*
+ * In AP mode we enable the beacon timers and SWBA interrupts to
--- /dev/null
+From 5c0ba62fd4b2dce08055a89600f1d834f9f0fe9e Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 19 Feb 2010 01:46:36 +0100
+Subject: ath9k: fix rate control fallback rate selection
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 5c0ba62fd4b2dce08055a89600f1d834f9f0fe9e upstream.
+
+When selecting the tx fallback rate, rc.c used a separate variable
+'nrix' for storing the next rate index, however it did not use that as
+reference for further rate index lowering. Because of that, it ended up
+reusing the same rate for multiple multi-rate retry stages, thus
+decreasing delivery probability under changing link conditions.
+
+This patch removes the separate (unnecessary) variable and fixes
+fallback the way it was intended to work.
+This should result in increased throughput and better link stability.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/rc.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/rc.c
++++ b/drivers/net/wireless/ath/ath9k/rc.c
+@@ -668,7 +668,7 @@ static void ath_get_rate(void *priv, str
+ struct ieee80211_tx_rate *rates = tx_info->control.rates;
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ __le16 fc = hdr->frame_control;
+- u8 try_per_rate, i = 0, rix, nrix;
++ u8 try_per_rate, i = 0, rix;
+ int is_probe = 0;
+
+ if (rate_control_send_low(sta, priv_sta, txrc))
+@@ -688,26 +688,25 @@ static void ath_get_rate(void *priv, str
+
+ rate_table = sc->cur_rate_table;
+ rix = ath_rc_get_highest_rix(sc, ath_rc_priv, rate_table, &is_probe);
+- nrix = rix;
+
+ if (is_probe) {
+ /* set one try for probe rates. For the
+ * probes don't enable rts */
+ ath_rc_rate_set_series(rate_table, &rates[i++], txrc,
+- 1, nrix, 0);
++ 1, rix, 0);
+
+ /* Get the next tried/allowed rate. No RTS for the next series
+ * after the probe rate
+ */
+- ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &nrix);
++ ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &rix);
+ ath_rc_rate_set_series(rate_table, &rates[i++], txrc,
+- try_per_rate, nrix, 0);
++ try_per_rate, rix, 0);
+
+ tx_info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+ } else {
+ /* Set the choosen rate. No RTS for first series entry. */
+ ath_rc_rate_set_series(rate_table, &rates[i++], txrc,
+- try_per_rate, nrix, 0);
++ try_per_rate, rix, 0);
+ }
+
+ /* Fill in the other rates for multirate retry */
+@@ -716,10 +715,10 @@ static void ath_get_rate(void *priv, str
+ if (i + 1 == 4)
+ try_per_rate = 4;
+
+- ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &nrix);
++ ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &rix);
+ /* All other rates in the series have RTS enabled */
+ ath_rc_rate_set_series(rate_table, &rates[i], txrc,
+- try_per_rate, nrix, 1);
++ try_per_rate, rix, 1);
+ }
+
+ /*
--- /dev/null
+From 14acdde6e527950f66c084dbf19bad6fbfcaeedc Mon Sep 17 00:00:00 2001
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+Date: Fri, 18 Dec 2009 11:26:04 -0500
+Subject: ath9k: re-enable ps by default for new single chip families
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 14acdde6e527950f66c084dbf19bad6fbfcaeedc upstream.
+
+The newer single chip hardware family of chipsets have not been
+experiencing issues with power saving set by default with recent
+fixes merged (even into stable). The remaining issues are only
+reported with AR5416 and since enabling PS by default can increase
+power savings considerably best to take advantage of that feature
+as this has been tested properly.
+
+For more details on this issue see the bug report:
+
+http://bugzilla.kernel.org/show_bug.cgi?id=14267
+
+We leave AR5416 with PS disabled by default, that seems to require
+some more work.
+
+Cc: Peter Stuge <peter@stuge.se>
+Cc: Justin P. Mattock <justinmattock@gmail.com>
+Cc: Kristoffer Ericson <kristoffer.ericson@gmail.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1849,6 +1849,8 @@ bad_free_hw:
+
+ void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ {
++ struct ath_hw *ah = sc->sc_ah;
++
+ hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+ IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+ IEEE80211_HW_SIGNAL_DBM |
+@@ -1866,7 +1868,8 @@ void ath_set_hw_capab(struct ath_softc *
+ BIT(NL80211_IFTYPE_ADHOC) |
+ BIT(NL80211_IFTYPE_MESH_POINT);
+
+- hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
++ if (AR_SREV_5416(ah))
++ hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+ hw->queues = 4;
+ hw->max_rates = 4;
--- /dev/null
+From 0866b03c7d7dee8a34ffa527ecda426c0f405518 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 3 Feb 2010 13:33:44 -0600
+Subject: b43/b43legacy: Wake queues in wireless_core_start
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 0866b03c7d7dee8a34ffa527ecda426c0f405518 upstream.
+
+If b43 or b43legacy are deauthenticated or disconnected, there is a
+possibility that a reconnection is tried with the queues stopped in
+mac80211. To prevent this, start the queues before setting
+STAT_INITIALIZED.
+
+In b43, a similar change has been in place (twice) in the
+wireless_core_init() routine. Remove the duplicate and add similar
+code to b43legacy.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/main.c | 3 +--
+ drivers/net/wireless/b43legacy/main.c | 2 ++
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -3970,6 +3970,7 @@ static int b43_wireless_core_start(struc
+ }
+
+ /* We are ready to run. */
++ ieee80211_wake_queues(dev->wl->hw);
+ b43_set_status(dev, B43_STAT_STARTED);
+
+ /* Start data flow (TX/RX). */
+@@ -4379,8 +4380,6 @@ static int b43_wireless_core_init(struct
+
+ ieee80211_wake_queues(dev->wl->hw);
+
+- ieee80211_wake_queues(dev->wl->hw);
+-
+ b43_set_status(dev, B43_STAT_INITIALIZED);
+
+ out:
+--- a/drivers/net/wireless/b43legacy/main.c
++++ b/drivers/net/wireless/b43legacy/main.c
+@@ -2921,6 +2921,7 @@ static int b43legacy_wireless_core_start
+ goto out;
+ }
+ /* We are ready to run. */
++ ieee80211_wake_queues(dev->wl->hw);
+ b43legacy_set_status(dev, B43legacy_STAT_STARTED);
+
+ /* Start data flow (TX/RX) */
+@@ -3341,6 +3342,7 @@ static int b43legacy_wireless_core_init(
+ b43legacy_security_init(dev);
+ b43legacy_rng_init(wl);
+
++ ieee80211_wake_queues(dev->wl->hw);
+ b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
+
+ b43legacy_leds_init(dev);
--- /dev/null
+From 3f0e0b220f80075ce15483b20458192c0ac27426 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 8 Jan 2010 18:15:13 +0100
+Subject: mac80211: do not transmit frames on unconfigured 4-addr vlan interfaces
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 3f0e0b220f80075ce15483b20458192c0ac27426 upstream.
+
+If frames are transmitted on 4-addr ap vlan interfaces with no station,
+they end up being transmitted unencrypted, even if the ap interface
+uses WPA. This patch add some sanity checking to make sure that this
+does not happen.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/tx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1052,8 +1052,11 @@ ieee80211_tx_prepare(struct ieee80211_su
+
+ hdr = (struct ieee80211_hdr *) skb->data;
+
+- if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
++ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+ tx->sta = rcu_dereference(sdata->u.vlan.sta);
++ if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
++ return TX_DROP;
++ }
+ if (!tx->sta)
+ tx->sta = sta_info_get(local, hdr->addr1);
+
--- /dev/null
+From caf66e581172dc5032bb84841a91bc7b77ad9876 Mon Sep 17 00:00:00 2001
+From: John W. Linville <linville@tuxdriver.com>
+Date: Thu, 25 Feb 2010 12:02:45 -0500
+Subject: netdevice.h: check for CONFIG_WLAN instead of CONFIG_WLAN_80211
+
+From: John W. Linville <linville@tuxdriver.com>
+
+commit caf66e581172dc5032bb84841a91bc7b77ad9876 upstream.
+
+In "wireless: remove WLAN_80211 and WLAN_PRE80211 from Kconfig" I
+inadvertantly missed a line in include/linux/netdevice.h. I thereby
+effectively reverted "net: Set LL_MAX_HEADER properly for wireless." by
+accident. :-( Now we should check there for CONFIG_WLAN instead.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Reported-by: Christoph Egger <siccegge@stud.informatik.uni-erlangen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/netdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -136,7 +136,7 @@ static inline bool dev_xmit_complete(int
+ * used.
+ */
+
+-#if defined(CONFIG_WLAN_80211) || defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
++#if defined(CONFIG_WLAN) || defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+ # if defined(CONFIG_MAC80211_MESH)
+ # define LL_MAX_HEADER 128
+ # else
--- /dev/null
+From 2c08522e5d2f0af2d6f05be558946dcbf8173683 Mon Sep 17 00:00:00 2001
+From: Tim Gardner <tim.gardner@canonical.com>
+Date: Tue, 23 Feb 2010 14:55:21 +0100
+Subject: netfilter: xt_recent: fix buffer overflow
+
+From: Tim Gardner <tim.gardner@canonical.com>
+
+commit 2c08522e5d2f0af2d6f05be558946dcbf8173683 upstream.
+
+e->index overflows e->stamps[] every ip_pkt_list_tot packets.
+
+Consider the case when ip_pkt_list_tot==1; the first packet received is stored
+in e->stamps[0] and e->index is initialized to 1. The next received packet
+timestamp is then stored at e->stamps[1] in recent_entry_update(),
+a buffer overflow because the maximum e->stamps[] index is 0.
+
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/xt_recent.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -173,10 +173,10 @@ recent_entry_init(struct recent_table *t
+
+ static void recent_entry_update(struct recent_table *t, struct recent_entry *e)
+ {
++ e->index %= ip_pkt_list_tot;
+ e->stamps[e->index++] = jiffies;
+ if (e->index > e->nstamps)
+ e->nstamps = e->index;
+- e->index %= ip_pkt_list_tot;
+ list_move_tail(&e->lru_list, &t->lru_list);
+ }
+
--- /dev/null
+From 8ccb92ad41cb311e52ad1b1fe77992c7f47a3b63 Mon Sep 17 00:00:00 2001
+From: Tim Gardner <tim.gardner@canonical.com>
+Date: Tue, 23 Feb 2010 14:59:12 +0100
+Subject: netfilter: xt_recent: fix false match
+
+From: Tim Gardner <tim.gardner@canonical.com>
+
+commit 8ccb92ad41cb311e52ad1b1fe77992c7f47a3b63 upstream.
+
+A rule with a zero hit_count will always match.
+
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/xt_recent.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -260,7 +260,7 @@ recent_mt(const struct sk_buff *skb, con
+ for (i = 0; i < e->nstamps; i++) {
+ if (info->seconds && time_after(time, e->stamps[i]))
+ continue;
+- if (++hits >= info->hit_count) {
++ if (info->hit_count && ++hits >= info->hit_count) {
+ ret = !ret;
+ break;
+ }
--- /dev/null
+From 60661933995bc7a09686c901439e17c2a4ea7d5d Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Date: Mon, 7 Dec 2009 23:25:52 +0400
+Subject: pata_hpt3x2n: always stretch UltraDMA timing
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 60661933995bc7a09686c901439e17c2a4ea7d5d upstream.
+
+The UltraDMA Tss timing must be stretched with ATA clock of 66 MHz, but the
+driver only does this when PCI clock is 66 MHz, whereas it always programs
+DPLL clock (which is used as the ATA clock) to 66 MHz.
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_hpt3x2n.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/ata/pata_hpt3x2n.c
++++ b/drivers/ata/pata_hpt3x2n.c
+@@ -25,7 +25,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt3x2n"
+-#define DRV_VERSION "0.3.8"
++#define DRV_VERSION "0.3.9"
+
+ enum {
+ HPT_PCI_FAST = (1 << 31),
+@@ -544,16 +544,16 @@ static int hpt3x2n_init_one(struct pci_d
+ pci_mhz);
+ /* Set our private data up. We only need a few flags so we use
+ it directly */
+- if (pci_mhz > 60) {
++ if (pci_mhz > 60)
+ hpriv = (void *)(PCI66 | USE_DPLL);
+- /*
+- * On HPT371N, if ATA clock is 66 MHz we must set bit 2 in
+- * the MISC. register to stretch the UltraDMA Tss timing.
+- * NOTE: This register is only writeable via I/O space.
+- */
+- if (dev->device == PCI_DEVICE_ID_TTI_HPT371)
+- outb(inb(iobase + 0x9c) | 0x04, iobase + 0x9c);
+- }
++
++ /*
++ * On HPT371N, if ATA clock is 66 MHz we must set bit 2 in
++ * the MISC. register to stretch the UltraDMA Tss timing.
++ * NOTE: This register is only writeable via I/O space.
++ */
++ if (dev->device == PCI_DEVICE_ID_TTI_HPT371)
++ outb(inb(iobase + 0x9c) | 0x04, iobase + 0x9c);
+
+ /* Now kick off ATA set up */
+ return ata_pci_sff_init_one(dev, ppi, &hpt3x2n_sht, hpriv);
--- /dev/null
+From 83ab0aa0d5623d823444db82c3b3c34d7ec364ae Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 17 Feb 2010 09:05:48 +0100
+Subject: sched: Don't use possibly stale sched_class
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 83ab0aa0d5623d823444db82c3b3c34d7ec364ae upstream.
+
+setscheduler() saves task->sched_class outside of the rq->lock held
+region for a check after the setscheduler changes have become
+effective. That might result in checking a stale value.
+
+rtmutex_setprio() has the same problem, though it is protected by
+p->pi_lock against setscheduler(), but for correctness sake (and to
+avoid bad examples) it needs to be fixed as well.
+
+Retrieve task->sched_class inside of the rq->lock held region.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -6065,7 +6065,7 @@ void rt_mutex_setprio(struct task_struct
+ unsigned long flags;
+ int oldprio, on_rq, running;
+ struct rq *rq;
+- const struct sched_class *prev_class = p->sched_class;
++ const struct sched_class *prev_class;
+
+ BUG_ON(prio < 0 || prio > MAX_PRIO);
+
+@@ -6073,6 +6073,7 @@ void rt_mutex_setprio(struct task_struct
+ update_rq_clock(rq);
+
+ oldprio = p->prio;
++ prev_class = p->sched_class;
+ on_rq = p->se.on_rq;
+ running = task_current(rq, p);
+ if (on_rq)
+@@ -6292,7 +6293,7 @@ static int __sched_setscheduler(struct t
+ {
+ int retval, oldprio, oldpolicy = -1, on_rq, running;
+ unsigned long flags;
+- const struct sched_class *prev_class = p->sched_class;
++ const struct sched_class *prev_class;
+ struct rq *rq;
+ int reset_on_fork;
+
+@@ -6406,6 +6407,7 @@ recheck:
+ p->sched_reset_on_fork = reset_on_fork;
+
+ oldprio = p->prio;
++ prev_class = p->sched_class;
+ __setscheduler(rq, p, policy, param->sched_priority);
+
+ if (running)
--- /dev/null
+From 28f5318167adf23b16c844b9c2253f355cb21796 Mon Sep 17 00:00:00 2001
+From: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
+Date: Mon, 8 Feb 2010 15:35:55 +0530
+Subject: sched: Fix sched_mv_power_savings for !SMT
+
+From: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
+
+commit 28f5318167adf23b16c844b9c2253f355cb21796 upstream.
+
+Fix for sched_mc_powersavigs for pre-Nehalem platforms.
+Child sched domain should clear SD_PREFER_SIBLING if parent will have
+SD_POWERSAVINGS_BALANCE because they are contradicting.
+
+Sets the flags correctly based on sched_mc_power_savings.
+
+Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <20100208100555.GD2931@dirshya.in.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/sched.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -878,7 +878,10 @@ static inline int sd_balance_for_mc_powe
+ if (sched_smt_power_savings)
+ return SD_POWERSAVINGS_BALANCE;
+
+- return SD_PREFER_SIBLING;
++ if (!sched_mc_power_savings)
++ return SD_PREFER_SIBLING;
++
++ return 0;
+ }
+
+ static inline int sd_balance_for_package_power(void)
--- /dev/null
+From 9000f05c6d1607f79c0deacf42b09693be673f4c Mon Sep 17 00:00:00 2001
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Date: Fri, 12 Feb 2010 17:14:22 -0800
+Subject: sched: Fix SMT scheduler regression in find_busiest_queue()
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+commit 9000f05c6d1607f79c0deacf42b09693be673f4c upstream.
+
+Fix a SMT scheduler performance regression that is leading to a scenario
+where SMT threads in one core are completely idle while both the SMT threads
+in another core (on the same socket) are busy.
+
+This is caused by this commit (with the problematic code highlighted)
+
+ commit bdb94aa5dbd8b55e75f5a50b61312fe589e2c2d1
+ Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
+ Date: Tue Sep 1 10:34:38 2009 +0200
+
+ sched: Try to deal with low capacity
+
+ @@ -4203,15 +4223,18 @@ find_busiest_queue()
+ ...
+ for_each_cpu(i, sched_group_cpus(group)) {
+ + unsigned long power = power_of(i);
+
+ ...
+
+ - wl = weighted_cpuload(i);
+ + wl = weighted_cpuload(i) * SCHED_LOAD_SCALE;
+ + wl /= power;
+
+ - if (rq->nr_running == 1 && wl > imbalance)
+ + if (capacity && rq->nr_running == 1 && wl > imbalance)
+ continue;
+
+On a SMT system, power of the HT logical cpu will be 589 and
+the scheduler load imbalance (for scenarios like the one mentioned above)
+can be approximately 1024 (SCHED_LOAD_SCALE). The above change of scaling
+the weighted load with the power will result in "wl > imbalance" and
+ultimately resulting in find_busiest_queue() return NULL, causing
+load_balance() to think that the load is well balanced. But infact
+one of the tasks can be moved to the idle core for optimal performance.
+
+We don't need to use the weighted load (wl) scaled by the cpu power to
+compare with imabalance. In that condition, we already know there is only a
+single task "rq->nr_running == 1" and the comparison between imbalance,
+wl is to make sure that we select the correct priority thread which matches
+imbalance. So we really need to compare the imabalnce with the original
+weighted load of the cpu and not the scaled load.
+
+But in other conditions where we want the most hammered(busiest) cpu, we can
+use scaled load to ensure that we consider the cpu power in addition to the
+actual load on that cpu, so that we can move the load away from the
+guy that is getting most hammered with respect to the actual capacity,
+as compared with the rest of the cpu's in that busiest group.
+
+Fix it.
+
+Reported-by: Ma Ling <ling.ma@intel.com>
+Initial-Analysis-by: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <1266023662.2808.118.camel@sbs-t61.sc.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -4119,12 +4119,23 @@ find_busiest_queue(struct sched_group *g
+ continue;
+
+ rq = cpu_rq(i);
+- wl = weighted_cpuload(i) * SCHED_LOAD_SCALE;
+- wl /= power;
++ wl = weighted_cpuload(i);
+
++ /*
++ * When comparing with imbalance, use weighted_cpuload()
++ * which is not scaled with the cpu power.
++ */
+ if (capacity && rq->nr_running == 1 && wl > imbalance)
+ continue;
+
++ /*
++ * For the load comparisons with the other cpu's, consider
++ * the weighted_cpuload() scaled with the cpu power, so that
++ * the load can be moved away from the cpu that is potentially
++ * running at a lower capacity.
++ */
++ wl = (wl * SCHED_LOAD_SCALE) / power;
++
+ if (wl > max_load) {
+ max_load = wl;
+ busiest = rq;
--- /dev/null
+From 76dadd76c265a0cdb5a76aa4eef03fcc9639b388 Mon Sep 17 00:00:00 2001
+From: Eric W. Biederman <ebiederm@xmission.com>
+Date: Sun, 28 Feb 2010 01:20:36 +0000
+Subject: scm: Only support SCM_RIGHTS on unix domain sockets.
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+commit 76dadd76c265a0cdb5a76aa4eef03fcc9639b388 upstream.
+
+We use scm_send and scm_recv on both unix domain and
+netlink sockets, but only unix domain sockets support
+everything required for file descriptor passing,
+so error if someone attempts to pass file descriptors
+over netlink sockets.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/scm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -156,6 +156,8 @@ int __scm_send(struct socket *sock, stru
+ switch (cmsg->cmsg_type)
+ {
+ case SCM_RIGHTS:
++ if (!sock->ops || sock->ops->family != PF_UNIX)
++ goto error;
+ err=scm_fp_copy(cmsg, &p->fp);
+ if (err<0)
+ goto error;
hwmon-tmp421-fix-temperature-conversions.patch
hwmon-tmp421-restore-missing-inputs.patch
hwmon-fix-off-by-one-kind-values.patch
+pata_hpt3x2n-always-stretch-ultradma-timing.patch
+scm-only-support-scm_rights-on-unix-domain-sockets.patch
+skbuff-align-sk_buff-cb-to-64-bit-and-close-some-potential-holes.patch
+netdevice.h-check-for-config_wlan-instead-of-config_wlan_80211.patch
+ath9k-re-enable-ps-by-default-for-new-single-chip-families.patch
+ath9k-fix-beacon-timer-restart-after-a-card-reset.patch
+ath9k-fix-rate-control-fallback-rate-selection.patch
+ath9k-disable-rifs-search-for-ar91xx-based-chips.patch
+ath5k-use-correct-packet-type-when-transmitting.patch
+b43-b43legacy-wake-queues-in-wireless_core_start.patch
+netfilter-xt_recent-fix-buffer-overflow.patch
+netfilter-xt_recent-fix-false-match.patch
+sunxvr500-additional-pci-id-for-sunxvr500-driver.patch
+mac80211-do-not-transmit-frames-on-unconfigured-4-addr-vlan-interfaces.patch
+sched-fix-sched_mv_power_savings-for-smt.patch
+sched-fix-smt-scheduler-regression-in-find_busiest_queue.patch
+sched-don-t-use-possibly-stale-sched_class.patch
--- /dev/null
+From da3f5cf1f8ebb0fab5c5fd09adb189166594ad6c Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 23 Feb 2010 11:45:51 +0000
+Subject: skbuff: align sk_buff::cb to 64 bit and close some potential holes
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit da3f5cf1f8ebb0fab5c5fd09adb189166594ad6c upstream.
+
+The alignment requirement for 64-bit load/store instructions on ARM is
+implementation defined. Some CPUs (such as Marvell Feroceon) do not
+generate an exception, if such an instruction is executed with an
+address that is not 64 bit aligned. In such a case, the Feroceon
+corrupts adjacent memory, which showed up in my tests as a crash in the
+rx path of ath9k that only occured with CONFIG_XFRM set.
+
+This crash happened, because the first field of the mac80211 rx status
+info in the cb is an u64, and changing it corrupted the skb->sp field.
+
+This patch also closes some potential pre-existing holes in the sk_buff
+struct surrounding the cb[] area.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/skbuff.h | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -315,22 +315,23 @@ struct sk_buff {
+ struct sk_buff *next;
+ struct sk_buff *prev;
+
+- struct sock *sk;
+ ktime_t tstamp;
++
++ struct sock *sk;
+ struct net_device *dev;
+
+- unsigned long _skb_dst;
+-#ifdef CONFIG_XFRM
+- struct sec_path *sp;
+-#endif
+ /*
+ * This is the control buffer. It is free to use for every
+ * layer. Please put your private variables there. If you
+ * want to keep them across layers you have to do a skb_clone()
+ * first. This is owned by whoever has the skb queued ATM.
+ */
+- char cb[48];
++ char cb[48] __aligned(8);
+
++ unsigned long _skb_dst;
++#ifdef CONFIG_XFRM
++ struct sec_path *sp;
++#endif
+ unsigned int len,
+ data_len;
+ __u16 mac_len,
--- /dev/null
+From 275143e9b237dd7e0b6d01660fd9b8acd9922fa7 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Fri, 26 Feb 2010 04:37:09 -0800
+Subject: sunxvr500: Additional PCI id for sunxvr500 driver
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 275143e9b237dd7e0b6d01660fd9b8acd9922fa7 upstream.
+
+Intergraph bought 3D Labs and some XVR-500 chips have Intergraph's
+vendor id.
+
+Reported-by: Jurij Smakov <jurij@wooyd.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/sunxvr500.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/sunxvr500.c
++++ b/drivers/video/sunxvr500.c
+@@ -400,6 +400,7 @@ static void __devexit e3d_pci_unregister
+
+ static struct pci_device_id e3d_pci_table[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_3DLABS, 0x7a0), },
++ { PCI_DEVICE(0x1091, 0x7a0), },
+ { PCI_DEVICE(PCI_VENDOR_ID_3DLABS, 0x7a2), },
+ { .vendor = PCI_VENDOR_ID_3DLABS,
+ .device = PCI_ANY_ID,
projects / thirdparty / kernel / stable-queue.git / commitdiff
