--- /dev/null
+From 5a7aadfe2fcb0f69e2acc1fbefe22a096e792fc9 Mon Sep 17 00:00:00 2001
+From: Matt Helsley <matthltc@us.ibm.com>
+Date: Fri, 26 Mar 2010 23:51:44 +0100
+Subject: Freezer: Fix buggy resume test for tasks frozen with cgroup freezer
+
+From: Matt Helsley <matthltc@us.ibm.com>
+
+commit 5a7aadfe2fcb0f69e2acc1fbefe22a096e792fc9 upstream.
+
+When the cgroup freezer is used to freeze tasks we do not want to thaw
+those tasks during resume. Currently we test the cgroup freezer
+state of the resuming tasks to see if the cgroup is FROZEN. If so
+then we don't thaw the task. However, the FREEZING state also indicates
+that the task should remain frozen.
+
+This also avoids a problem pointed out by Oren Ladaan: the freezer state
+transition from FREEZING to FROZEN is updated lazily when userspace reads
+or writes the freezer.state file in the cgroup filesystem. This means that
+resume will thaw tasks in cgroups which should be in the FROZEN state if
+there is no read/write of the freezer.state file to trigger this
+transition before suspend.
+
+NOTE: Another "simple" solution would be to always update the cgroup
+freezer state during resume. However it's a bad choice for several reasons:
+Updating the cgroup freezer state is somewhat expensive because it requires
+walking all the tasks in the cgroup and checking if they are each frozen.
+Worse, this could easily make resume run in N^2 time where N is the number
+of tasks in the cgroup. Finally, updating the freezer state from this code
+path requires trickier locking because of the way locks must be ordered.
+
+Instead of updating the freezer state we rely on the fact that lazy
+updates only manage the transition from FREEZING to FROZEN. We know that
+a cgroup with the FREEZING state may actually be FROZEN so test for that
+state too. This makes sense in the resume path even for partially-frozen
+cgroups -- those that really are FREEZING but not FROZEN.
+
+Reported-by: Oren Ladaan <orenl@cs.columbia.edu>
+Signed-off-by: Matt Helsley <matthltc@us.ibm.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/freezer.h | 7 +++++--
+ kernel/cgroup_freezer.c | 9 ++++++---
+ kernel/power/process.c | 2 +-
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+--- a/include/linux/freezer.h
++++ b/include/linux/freezer.h
+@@ -64,9 +64,12 @@ extern bool freeze_task(struct task_stru
+ extern void cancel_freezing(struct task_struct *p);
+
+ #ifdef CONFIG_CGROUP_FREEZER
+-extern int cgroup_frozen(struct task_struct *task);
++extern int cgroup_freezing_or_frozen(struct task_struct *task);
+ #else /* !CONFIG_CGROUP_FREEZER */
+-static inline int cgroup_frozen(struct task_struct *task) { return 0; }
++static inline int cgroup_freezing_or_frozen(struct task_struct *task)
++{
++ return 0;
++}
+ #endif /* !CONFIG_CGROUP_FREEZER */
+
+ /*
+--- a/kernel/cgroup_freezer.c
++++ b/kernel/cgroup_freezer.c
+@@ -47,17 +47,20 @@ static inline struct freezer *task_freez
+ struct freezer, css);
+ }
+
+-int cgroup_frozen(struct task_struct *task)
++int cgroup_freezing_or_frozen(struct task_struct *task)
+ {
+ struct freezer *freezer;
+ enum freezer_state state;
+
+ task_lock(task);
+ freezer = task_freezer(task);
+- state = freezer->state;
++ if (!freezer->css.cgroup->parent)
++ state = CGROUP_THAWED; /* root cgroup can't be frozen */
++ else
++ state = freezer->state;
+ task_unlock(task);
+
+- return state == CGROUP_FROZEN;
++ return (state == CGROUP_FREEZING) || (state == CGROUP_FROZEN);
+ }
+
+ /*
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -145,7 +145,7 @@ static void thaw_tasks(bool nosig_only)
+ if (nosig_only && should_send_signal(p))
+ continue;
+
+- if (cgroup_frozen(p))
++ if (cgroup_freezing_or_frozen(p))
+ continue;
+
+ thaw_process(p);
--- /dev/null
+From be6b38bcb175613f239e0b302607db346472c6b6 Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Thu, 18 Mar 2010 09:05:00 -0700
+Subject: iwlwifi: counting number of tfds can be free for 4965
+
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit be6b38bcb175613f239e0b302607db346472c6b6 upstream.
+
+Forget one hunk in 4965 during "iwlwifi: error checking for number of tfds
+in queue" patch.
+
+Reported-by: Shanyu Zhao <shanyu.zhao@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-4965.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
+@@ -2034,16 +2034,14 @@ static void iwl4965_rx_reply_tx(struct i
+ tx_resp->failure_frame);
+
+ freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+- if (qc && likely(sta_id != IWL_INVALID_STATION))
+- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+ if (priv->mac80211_registered &&
+ (iwl_queue_space(&txq->q) > txq->q.low_mark))
+ iwl_wake_queue(priv, txq_id);
+ }
+
+- if (qc && likely(sta_id != IWL_INVALID_STATION))
+- iwl_txq_check_empty(priv, sta_id, tid, txq_id);
++ iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+
+ if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
+ IWL_ERR(priv, "TODO: Implement Tx ABORT REQUIRED!!!\n");
--- /dev/null
+From f6c8f1523a2de3b84340e45913cbcee8bee74570 Mon Sep 17 00:00:00 2001
+From: Reinette Chatre <reinette.chatre@intel.com>
+Date: Fri, 12 Mar 2010 11:13:26 -0800
+Subject: iwlwifi: fix regulatory
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+commit f6c8f1523a2de3b84340e45913cbcee8bee74570 upstream.
+
+Commit "cfg80211: convert bools into flags" mistakenly modified iwlwifi's
+regulatory settings instead of just converting it. Fix this.
+
+This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2172
+
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-agn.c | 2 +-
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -2461,7 +2461,7 @@ static int iwl_setup_mac(struct iwl_priv
+ BIT(NL80211_IFTYPE_STATION) |
+ BIT(NL80211_IFTYPE_ADHOC);
+
+- hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY |
++ hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
+ WIPHY_FLAG_DISABLE_BEACON_HINTS;
+
+ /*
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -3903,7 +3903,7 @@ static int iwl3945_setup_mac(struct iwl_
+ BIT(NL80211_IFTYPE_STATION) |
+ BIT(NL80211_IFTYPE_ADHOC);
+
+- hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY |
++ hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
+ WIPHY_FLAG_DISABLE_BEACON_HINTS;
+
+ hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
--- /dev/null
+From 8e1a53c615e8efe0fac670f2973da64758748a8a Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Sun, 28 Mar 2010 14:55:00 +0300
+Subject: iwlwifi: range checking issue
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit 8e1a53c615e8efe0fac670f2973da64758748a8a upstream.
+
+IWL_RATE_COUNT is 13 and IWL_RATE_COUNT_LEGACY is 12.
+
+IWL_RATE_COUNT_LEGACY is the right one here because iwl3945_rates
+doesn't support 60M and also that's how "rates" is defined in
+iwlcore_init_geos() from drivers/net/wireless/iwlwifi/iwl-core.c.
+
+ rates = kzalloc((sizeof(struct ieee80211_rate) * IWL_RATE_COUNT_LEGACY),
+ GFP_KERNEL);
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Acked-by: Zhu Yi <yi.zhu@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -1926,7 +1926,7 @@ static void iwl3945_init_hw_rates(struct
+ {
+ int i;
+
+- for (i = 0; i < IWL_RATE_COUNT; i++) {
++ for (i = 0; i < IWL_RATE_COUNT_LEGACY; i++) {
+ rates[i].bitrate = iwl3945_rates[i].ieee * 5;
+ rates[i].hw_value = i; /* Rate scaling will work on indexes */
+ rates[i].hw_value_short = i;
--- /dev/null
+From 4ae0a6c15efcc37e94e3f30e3533bdec03c53126 Mon Sep 17 00:00:00 2001
+From: Mike Christie <michaelc@cs.wisc.edu>
+Date: Tue, 9 Mar 2010 14:14:51 -0600
+Subject: [SCSI] libiscsi: Fix recovery slowdown regression
+
+From: Mike Christie <michaelc@cs.wisc.edu>
+
+commit 4ae0a6c15efcc37e94e3f30e3533bdec03c53126 upstream.
+
+We could be failing/stopping a connection due to libiscsi starting
+recovery/cleanup, but the xmit path or scsi eh thread path
+could be dropping the connection at the same time.
+
+As a result the session->state gets set to failed instead of in
+recovery. We end up not blocking the session
+and so the replacement timeout never gets started and we only end up
+failing the IO when scsi_softirq_done sees that the
+cmd has been running for (cmd->allowed + 1) * rq->timeout secs.
+
+We used to fail the IO right away so users are seeing a long
+delay when using dm-multipath. This problem was added in
+2.6.28.
+
+Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libiscsi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -3027,14 +3027,15 @@ static void iscsi_start_session_recovery
+ session->state = ISCSI_STATE_TERMINATE;
+ else if (conn->stop_stage != STOP_CONN_RECOVER)
+ session->state = ISCSI_STATE_IN_RECOVERY;
++
++ old_stop_stage = conn->stop_stage;
++ conn->stop_stage = flag;
+ spin_unlock_bh(&session->lock);
+
+ del_timer_sync(&conn->transport_timer);
+ iscsi_suspend_tx(conn);
+
+ spin_lock_bh(&session->lock);
+- old_stop_stage = conn->stop_stage;
+- conn->stop_stage = flag;
+ conn->c_stage = ISCSI_CONN_STOPPED;
+ spin_unlock_bh(&session->lock);
+
--- /dev/null
+From 533866b12cce484994163b1e201778cbac4c04c5 Mon Sep 17 00:00:00 2001
+From: Porsch, Marco <marco.porsch@siemens.com>
+Date: Wed, 24 Feb 2010 09:53:13 +0100
+Subject: mac80211: fix PREQ processing and one small bug
+
+From: Porsch, Marco <marco.porsch@siemens.com>
+
+commit 533866b12cce484994163b1e201778cbac4c04c5 upstream.
+
+1st) a PREQ should only be processed, if it has the same SN and better
+metric (instead of better or equal).
+2nd) next_hop[ETH_ALEN] now actually used to buffer
+mpath->next_hop->sta.addr for use out of lock.
+
+Signed-off-by: Marco Porsch <marco.porsch@siemens.com>
+Acked-by: Javier Cardona <javier@cozybit.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/mesh_hwmp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -391,7 +391,7 @@ static u32 hwmp_route_info_get(struct ie
+ if (SN_GT(mpath->sn, orig_sn) ||
+ (mpath->sn == orig_sn &&
+ action == MPATH_PREQ &&
+- new_metric > mpath->metric)) {
++ new_metric >= mpath->metric)) {
+ process = false;
+ fresh_info = false;
+ }
+@@ -611,7 +611,7 @@ static void hwmp_prep_frame_process(stru
+
+ mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr,
+ cpu_to_le32(orig_sn), 0, target_addr,
+- cpu_to_le32(target_sn), mpath->next_hop->sta.addr, hopcount,
++ cpu_to_le32(target_sn), next_hop, hopcount,
+ ttl, cpu_to_le32(lifetime), cpu_to_le32(metric),
+ 0, sdata);
+ rcu_read_unlock();
--- /dev/null
+From 7236fe29fd72d17074574ba312e7f1bb9d10abaa Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 22 Mar 2010 13:42:43 -0700
+Subject: mac80211: move netdev queue enabling to correct spot
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 7236fe29fd72d17074574ba312e7f1bb9d10abaa upstream.
+
+"mac80211: fix skb buffering issue" still left a race
+between enabling the hardware queues and the virtual
+interface queues. In hindsight it's totally obvious
+that enabling the netdev queues for a hardware queue
+when the hardware queue is enabled is wrong, because
+it could well possible that we can fill the hw queue
+with packets we already have pending. Thus, we must
+only enable the netdev queues once all the pending
+packets have been processed and sent off to the device.
+
+In testing, I haven't been able to trigger this race
+condition, but it's clearly there, possibly only when
+aggregation is being enabled.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/tx.c | 6 ++++++
+ net/mac80211/util.c | 12 ++++++------
+ 2 files changed, 12 insertions(+), 6 deletions(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1945,6 +1945,7 @@ static bool ieee80211_tx_pending_skb(str
+ void ieee80211_tx_pending(unsigned long data)
+ {
+ struct ieee80211_local *local = (struct ieee80211_local *)data;
++ struct ieee80211_sub_if_data *sdata;
+ unsigned long flags;
+ int i;
+ bool txok;
+@@ -1983,6 +1984,11 @@ void ieee80211_tx_pending(unsigned long
+ if (!txok)
+ break;
+ }
++
++ if (skb_queue_empty(&local->pending[i]))
++ list_for_each_entry_rcu(sdata, &local->interfaces, list)
++ netif_tx_wake_queue(
++ netdev_get_tx_queue(sdata->dev, i));
+ }
+ spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -280,13 +280,13 @@ static void __ieee80211_wake_queue(struc
+ /* someone still has this queue stopped */
+ return;
+
+- if (!skb_queue_empty(&local->pending[queue]))
++ if (skb_queue_empty(&local->pending[queue])) {
++ rcu_read_lock();
++ list_for_each_entry_rcu(sdata, &local->interfaces, list)
++ netif_tx_wake_queue(netdev_get_tx_queue(sdata->dev, queue));
++ rcu_read_unlock();
++ } else
+ tasklet_schedule(&local->tx_pending_tasklet);
+-
+- rcu_read_lock();
+- list_for_each_entry_rcu(sdata, &local->interfaces, list)
+- netif_tx_wake_queue(netdev_get_tx_queue(sdata->dev, queue));
+- rcu_read_unlock();
+ }
+
+ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
--- /dev/null
+From 74e2bd1fa3ae9695af566ad5a7a288898787b909 Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Wed, 3 Feb 2010 09:28:55 -0800
+Subject: mac80211: tear down all agg queues when restart/reconfig hw
+
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit 74e2bd1fa3ae9695af566ad5a7a288898787b909 upstream.
+
+When there is a need to restart/reconfig hw, tear down all the
+aggregation queues and let the mac80211 and driver get in-sync to have
+the opportunity to re-establish the aggregation queues again.
+
+Need to wait until driver re-establish all the station information before tear
+down the aggregation queues, driver(at least iwlwifi driver) will reject the
+stop aggregation queue request if station is not ready. But also need to make
+sure the aggregation queues are tear down before waking up the queues, so
+mac80211 will not sending frames with aggregation bit set.
+
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/util.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1145,6 +1145,14 @@ int ieee80211_reconfig(struct ieee80211_
+ }
+ }
+
++ rcu_read_lock();
++ if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
++ list_for_each_entry_rcu(sta, &local->sta_list, list) {
++ ieee80211_sta_tear_down_BA_sessions(sta);
++ }
++ }
++ rcu_read_unlock();
++
+ /* add back keys */
+ list_for_each_entry(sdata, &local->interfaces, list)
+ if (netif_running(sdata->dev))
--- /dev/null
+From b7b7fa43103a9fb30dbcc60cbd5161fdfc25f904 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@jeffreymahoney.com>
+Date: Mon, 29 Mar 2010 15:12:39 -0400
+Subject: reiserfs: Fix locking BUG during mount failure
+
+From: Jeff Mahoney <jeffm@jeffreymahoney.com>
+
+commit b7b7fa43103a9fb30dbcc60cbd5161fdfc25f904 upstream.
+
+Commit 8ebc423238341b52912c7295b045a32477b33f09 (reiserfs: kill-the-BKL)
+introduced a bug in the mount failure case.
+
+The error label releases the lock before calling journal_release_error,
+but it requires that the lock be held. do_journal_release unlocks and
+retakes it. When it releases it without it held, we trigger a BUG().
+
+The error_alloc label skips the unlock since the lock isn't held yet
+but none of the other conditions that are clean up exist yet either.
+
+This patch returns immediately after the kzalloc failure and moves
+the reiserfs_write_unlock after the journal_release_error call.
+
+This was reported in https://bugzilla.novell.com/show_bug.cgi?id=591807
+
+Reported-by: Thomas Siedentopf <thomas.siedentopf@novell.com>
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Cc: Thomas Siedentopf <thomas.siedentopf@novell.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/reiserfs/super.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1619,10 +1619,8 @@ static int reiserfs_fill_super(struct su
+ save_mount_options(s, data);
+
+ sbi = kzalloc(sizeof(struct reiserfs_sb_info), GFP_KERNEL);
+- if (!sbi) {
+- errval = -ENOMEM;
+- goto error_alloc;
+- }
++ if (!sbi)
++ return -ENOMEM;
+ s->s_fs_info = sbi;
+ /* Set default values for options: non-aggressive tails, RO on errors */
+ REISERFS_SB(s)->s_mount_opt |= (1 << REISERFS_SMALLTAIL);
+@@ -1879,12 +1877,12 @@ static int reiserfs_fill_super(struct su
+ return (0);
+
+ error:
+- reiserfs_write_unlock(s);
+-error_alloc:
+ if (jinit_done) { /* kill the commit thread, free journal ram */
+ journal_release_error(NULL, s);
+ }
+
++ reiserfs_write_unlock(s);
++
+ reiserfs_free_bitmap_cache(s);
+ if (SB_BUFFER_WITH_SB(s))
+ brelse(SB_BUFFER_WITH_SB(s));
drm-radeon-kms-don-t-print-error-on-erestartsys.patch
drm-radeon-kms-fix-pal-tv-out-support-on-legacy-igp-chips.patch
drm-return-enodev-if-the-inode-mapping-changes.patch
-drm-radeon-kms-atom-spread-spectrum-fix.patch
+sh-fix-fdpic-binary-loader.patch
+sh-enable-the-mmu-in-start_secondary.patch
+reiserfs-fix-locking-bug-during-mount-failure.patch
+libiscsi-fix-recovery-slowdown-regression.patch
+x86-kgdb-always-initialize-the-hw-breakpoint-attribute.patch
+freezer-fix-buggy-resume-test-for-tasks-frozen-with-cgroup-freezer.patch
+iwlwifi-fix-regulatory.patch
+iwlwifi-counting-number-of-tfds-can-be-free-for-4965.patch
+iwlwifi-range-checking-issue.patch
+setup-correct-int-pipe-type-in-ar9170_usb_exec_cmd.patch
+mac80211-fix-preq-processing-and-one-small-bug.patch
+mac80211-move-netdev-queue-enabling-to-correct-spot.patch
+mac80211-tear-down-all-agg-queues-when-restart-reconfig-hw.patch
+wireless-convert-reg_regdb_search_lock-to-mutex.patch
--- /dev/null
+From 2d20c72c021d96f8b9230396c8e3782f204214ec Mon Sep 17 00:00:00 2001
+From: Valentin Longchamp <valentin.longchamp@epfl.ch>
+Date: Fri, 26 Mar 2010 11:44:33 +0100
+Subject: setup correct int pipe type in ar9170_usb_exec_cmd
+
+From: Valentin Longchamp <valentin.longchamp@epfl.ch>
+
+commit 2d20c72c021d96f8b9230396c8e3782f204214ec upstream.
+
+An int urb is constructed but we fill it in with a bulk pipe type.
+
+Commit f661c6f8c67bd55e93348f160d590ff9edf08904 implemented a pipe type
+check when CONFIG_USB_DEBUG is enabled. The check failed for all the ar9170
+usb transfers and the driver could not configure the wifi dongle.
+
+This went unnoticed until now because most people don't have
+CONFIG_USB_DEBUG enabled.
+
+Signed-off-by: Valentin Longchamp <valentin.longchamp@epfl.ch>
+Acked-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ar9170/usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ar9170/usb.c
++++ b/drivers/net/wireless/ath/ar9170/usb.c
+@@ -414,7 +414,7 @@ static int ar9170_usb_exec_cmd(struct ar
+ spin_unlock_irqrestore(&aru->common.cmdlock, flags);
+
+ usb_fill_int_urb(urb, aru->udev,
+- usb_sndbulkpipe(aru->udev, AR9170_EP_CMD),
++ usb_sndintpipe(aru->udev, AR9170_EP_CMD),
+ aru->common.cmdbuf, plen + 4,
+ ar9170_usb_tx_urb_complete, NULL, 1);
+
--- /dev/null
+From 4bea3418c737891894b9d3d3e9f8bbd67d66fa38 Mon Sep 17 00:00:00 2001
+From: Matt Fleming <matt@console-pimps.org>
+Date: Sun, 28 Mar 2010 20:08:25 +0000
+Subject: sh: Enable the mmu in start_secondary()
+
+From: Matt Fleming <matt@console-pimps.org>
+
+commit 4bea3418c737891894b9d3d3e9f8bbd67d66fa38 upstream.
+
+For the boot, enable_mmu() is called from setup_arch() but we don't call
+setup_arch() for any of the other cpus. So turn on the non-boot cpu's
+mmu inside of start_secondary().
+
+I noticed this bug on an SMP board when trying to map I/O memory
+(smsc911x registers) into the kernel address space. Since the Address
+Translation bit in MMUCR wasn't set, accessing the virtual address where
+the smsc911x registers were supposedly mapped actually performed a
+physical address access.
+
+Signed-off-by: Matt Fleming <matt@console-pimps.org>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sh/kernel/smp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/sh/kernel/smp.c
++++ b/arch/sh/kernel/smp.c
+@@ -69,6 +69,7 @@ asmlinkage void __cpuinit start_secondar
+ unsigned int cpu;
+ struct mm_struct *mm = &init_mm;
+
++ enable_mmu();
+ atomic_inc(&mm->mm_count);
+ atomic_inc(&mm->mm_users);
+ current->active_mm = mm;
--- /dev/null
+From d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1 Mon Sep 17 00:00:00 2001
+From: Andrew Stubbs <ams@codesourcery.com>
+Date: Mon, 29 Mar 2010 12:04:19 +0900
+Subject: sh: Fix FDPIC binary loader
+
+From: Andrew Stubbs <ams@codesourcery.com>
+
+commit d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1 upstream.
+
+Ensure that the aux table is properly initialized, even when optional
+features are missing. Without this, the FDPIC loader did not work.
+
+Signed-off-by: Andrew Stubbs <ams@codesourcery.com>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sh/include/asm/elf.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/sh/include/asm/elf.h
++++ b/arch/sh/include/asm/elf.h
+@@ -211,7 +211,9 @@ extern void __kernel_vsyscall;
+
+ #define VSYSCALL_AUX_ENT \
+ if (vdso_enabled) \
+- NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE);
++ NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
++ else \
++ NEW_AUX_ENT(AT_IGNORE, 0);
+ #else
+ #define VSYSCALL_AUX_ENT
+ #endif /* CONFIG_VSYSCALL */
+@@ -219,7 +221,7 @@ extern void __kernel_vsyscall;
+ #ifdef CONFIG_SH_FPU
+ #define FPU_AUX_ENT NEW_AUX_ENT(AT_FPUCW, FPSCR_INIT)
+ #else
+-#define FPU_AUX_ENT
++#define FPU_AUX_ENT NEW_AUX_ENT(AT_IGNORE, 0)
+ #endif
+
+ extern int l1i_cache_shape, l1d_cache_shape, l2_cache_shape;
--- /dev/null
+From 368d06f5b0eefcbf37d677d3b65381310a251f03 Mon Sep 17 00:00:00 2001
+From: John W. Linville <linville@tuxdriver.com>
+Date: Tue, 16 Mar 2010 15:40:59 -0400
+Subject: wireless: convert reg_regdb_search_lock to mutex
+
+From: John W. Linville <linville@tuxdriver.com>
+
+commit 368d06f5b0eefcbf37d677d3b65381310a251f03 upstream.
+
+Stanse discovered that kmalloc is being called with GFP_KERNEL while
+holding this spinlock. The spinlock can be a mutex instead, which also
+enables the removal of the unlock/lock around the lock/unlock of
+cfg80211_mutex and the call to set_regdom.
+
+Reported-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -324,7 +324,7 @@ struct reg_regdb_search_request {
+ };
+
+ static LIST_HEAD(reg_regdb_search_list);
+-static DEFINE_SPINLOCK(reg_regdb_search_lock);
++static DEFINE_MUTEX(reg_regdb_search_mutex);
+
+ static void reg_regdb_search(struct work_struct *work)
+ {
+@@ -332,7 +332,7 @@ static void reg_regdb_search(struct work_struct *work)
+ const struct ieee80211_regdomain *curdom, *regdom;
+ int i, r;
+
+- spin_lock(®_regdb_search_lock);
++ mutex_lock(®_regdb_search_mutex);
+ while (!list_empty(®_regdb_search_list)) {
+ request = list_first_entry(®_regdb_search_list,
+ struct reg_regdb_search_request,
+@@ -346,18 +346,16 @@ static void reg_regdb_search(struct work_struct *work)
+ r = reg_copy_regd(®dom, curdom);
+ if (r)
+ break;
+- spin_unlock(®_regdb_search_lock);
+ mutex_lock(&cfg80211_mutex);
+ set_regdom(regdom);
+ mutex_unlock(&cfg80211_mutex);
+- spin_lock(®_regdb_search_lock);
+ break;
+ }
+ }
+
+ kfree(request);
+ }
+- spin_unlock(®_regdb_search_lock);
++ mutex_unlock(®_regdb_search_mutex);
+ }
+
+ static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
+@@ -375,9 +373,9 @@ static void reg_regdb_query(const char *alpha2)
+
+ memcpy(request->alpha2, alpha2, 2);
+
+- spin_lock(®_regdb_search_lock);
++ mutex_lock(®_regdb_search_mutex);
+ list_add_tail(&request->list, ®_regdb_search_list);
+- spin_unlock(®_regdb_search_lock);
++ mutex_unlock(®_regdb_search_mutex);
+
+ schedule_work(®_regdb_work);
+ }
--- /dev/null
+From ab310b5edb8b601bcb02491ed6f7676da4fd1757 Mon Sep 17 00:00:00 2001
+From: Jason Wessel <jason.wessel@windriver.com>
+Date: Tue, 30 Mar 2010 14:05:07 -0500
+Subject: x86,kgdb: Always initialize the hw breakpoint attribute
+
+From: Jason Wessel <jason.wessel@windriver.com>
+
+commit ab310b5edb8b601bcb02491ed6f7676da4fd1757 upstream.
+
+It is required to call hw_breakpoint_init() on an attr before using it
+in any other calls. This fixes the problem where kgdb will sometimes
+fail to initialize on x86_64.
+
+Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+LKML-Reference: <1269975907-27602-1-git-send-email-jason.wessel@windriver.com>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/kgdb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/kgdb.c
++++ b/arch/x86/kernel/kgdb.c
+@@ -618,8 +618,8 @@ int kgdb_arch_init(void)
+ * portion of kgdb because this operation requires mutexs to
+ * complete.
+ */
++ hw_breakpoint_init(&attr);
+ attr.bp_addr = (unsigned long)kgdb_arch_init;
+- attr.type = PERF_TYPE_BREAKPOINT;
+ attr.bp_len = HW_BREAKPOINT_LEN_1;
+ attr.bp_type = HW_BREAKPOINT_W;
+ attr.disabled = 1;
projects / thirdparty / kernel / stable-queue.git / commitdiff
