--- /dev/null
+From de3584bd62d87b4c250129fbc46ca52c80330add Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 21 Nov 2011 10:44:00 +0100
+Subject: cfg80211: fix regulatory NULL dereference
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit de3584bd62d87b4c250129fbc46ca52c80330add upstream.
+
+By the time userspace returns with a response to
+the regulatory domain request, the wiphy causing
+the request might have gone away. If this is so,
+reject the update but mark the request as having
+been processed anyway.
+
+Cc: Luis R. Rodriguez <lrodriguez@qca.qualcomm.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/reg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2026,6 +2026,10 @@ static int __set_regdom(const struct iee
+ }
+
+ request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
++ if (!request_wiphy) {
++ reg_set_request_processed();
++ return -ENODEV;
++ }
+
+ if (!last_request->intersect) {
+ int r;
--- /dev/null
+From 884a45d964dd395eda945842afff5e16bcaedf56 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Tue, 22 Nov 2011 07:44:47 -0800
+Subject: cgroup_freezer: fix freezing groups with stopped tasks
+
+From: Michal Hocko <mhocko@suse.cz>
+
+commit 884a45d964dd395eda945842afff5e16bcaedf56 upstream.
+
+2d3cbf8b (cgroup_freezer: update_freezer_state() does incorrect state
+transitions) removed is_task_frozen_enough and replaced it with a simple
+frozen call. This, however, breaks freezing for a group with stopped tasks
+because those cannot be frozen and so the group remains in CGROUP_FREEZING
+state (update_if_frozen doesn't count stopped tasks) and never reaches
+CGROUP_FROZEN.
+
+Let's add is_task_frozen_enough back and use it at the original locations
+(update_if_frozen and try_to_freeze_cgroup). Semantically we consider
+stopped tasks as frozen enough so we should consider both cases when
+testing frozen tasks.
+
+Testcase:
+mkdir /dev/freezer
+mount -t cgroup -o freezer none /dev/freezer
+mkdir /dev/freezer/foo
+sleep 1h &
+pid=$!
+kill -STOP $pid
+echo $pid > /dev/freezer/foo/tasks
+echo FROZEN > /dev/freezer/foo/freezer.state
+while true
+do
+ cat /dev/freezer/foo/freezer.state
+ [ "`cat /dev/freezer/foo/freezer.state`" = "FROZEN" ] && break
+ sleep 1
+done
+echo OK
+
+Signed-off-by: Michal Hocko <mhocko@suse.cz>
+Acked-by: Li Zefan <lizf@cn.fujitsu.com>
+Cc: Tomasz Buchert <tomasz.buchert@inria.fr>
+Cc: Paul Menage <paul@paulmenage.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/cgroup_freezer.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/kernel/cgroup_freezer.c
++++ b/kernel/cgroup_freezer.c
+@@ -153,6 +153,13 @@ static void freezer_destroy(struct cgrou
+ kfree(cgroup_freezer(cgroup));
+ }
+
++/* task is frozen or will freeze immediately when next it gets woken */
++static bool is_task_frozen_enough(struct task_struct *task)
++{
++ return frozen(task) ||
++ (task_is_stopped_or_traced(task) && freezing(task));
++}
++
+ /*
+ * The call to cgroup_lock() in the freezer.state write method prevents
+ * a write to that file racing against an attach, and hence the
+@@ -231,7 +238,7 @@ static void update_if_frozen(struct cgro
+ cgroup_iter_start(cgroup, &it);
+ while ((task = cgroup_iter_next(cgroup, &it))) {
+ ntotal++;
+- if (frozen(task))
++ if (is_task_frozen_enough(task))
+ nfrozen++;
+ }
+
+@@ -284,7 +291,7 @@ static int try_to_freeze_cgroup(struct c
+ while ((task = cgroup_iter_next(cgroup, &it))) {
+ if (!freeze_task(task, true))
+ continue;
+- if (frozen(task))
++ if (is_task_frozen_enough(task))
+ continue;
+ if (!freezing(task) && !freezer_should_skip(task))
+ num_cant_freeze_now++;
--- /dev/null
+From 52553ddffad76ccf192d4dd9ce88d5818f57f62a Mon Sep 17 00:00:00 2001
+From: Edward Donovan <edward.donovan@numble.net>
+Date: Sun, 27 Nov 2011 23:07:34 -0500
+Subject: genirq: fix regression in irqfixup, irqpoll
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Edward Donovan <edward.donovan@numble.net>
+
+commit 52553ddffad76ccf192d4dd9ce88d5818f57f62a upstream.
+
+Commit fa27271bc8d2("genirq: Fixup poll handling") introduced a
+regression that broke irqfixup/irqpoll for some hardware configurations.
+
+Amidst reorganizing 'try_one_irq', that patch removed a test that
+checked for 'action->handler' returning IRQ_HANDLED, before acting on
+the interrupt. Restoring this test back returns the functionality lost
+since 2.6.39. In the current set of tests, after 'action' is set, it
+must precede '!action->next' to take effect.
+
+With this and my previous patch to irq/spurious.c, c75d720fca8a, all
+IRQ regressions that I have encountered are fixed.
+
+Signed-off-by: Edward Donovan <edward.donovan@numble.net>
+Reported-and-tested-by: Rogério Brito <rbrito@ime.usp.br>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/irq/spurious.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/irq/spurious.c
++++ b/kernel/irq/spurious.c
+@@ -84,7 +84,9 @@ static int try_one_irq(int irq, struct i
+ */
+ action = desc->action;
+ if (!action || !(action->flags & IRQF_SHARED) ||
+- (action->flags & __IRQF_TIMER) || !action->next)
++ (action->flags & __IRQF_TIMER) ||
++ (action->handler(irq, action->dev_id) == IRQ_HANDLED) ||
++ !action->next)
+ goto out;
+
+ /* Already running on another processor */
--- /dev/null
+From 27c9cd7e601632b3794e1c3344d37b86917ffb43 Mon Sep 17 00:00:00 2001
+From: Jeff Ohlstein <johlstei@codeaurora.org>
+Date: Fri, 18 Nov 2011 15:47:10 -0800
+Subject: hrtimer: Fix extra wakeups from __remove_hrtimer()
+
+From: Jeff Ohlstein <johlstei@codeaurora.org>
+
+commit 27c9cd7e601632b3794e1c3344d37b86917ffb43 upstream.
+
+__remove_hrtimer() attempts to reprogram the clockevent device when
+the timer being removed is the next to expire. However,
+__remove_hrtimer() reprograms the clockevent *before* removing the
+timer from the timerqueue and thus when hrtimer_force_reprogram()
+finds the next timer to expire it finds the timer we're trying to
+remove.
+
+This is especially noticeable when the system switches to NOHz mode
+and the system tick is removed. The timer tick is removed from the
+system but the clockevent is programmed to wakeup in another HZ
+anyway.
+
+Silence the extra wakeup by removing the timer from the timerqueue
+before calling hrtimer_force_reprogram() so that we actually program
+the clockevent for the next timer to expire.
+
+This was broken by 998adc3 "hrtimers: Convert hrtimers to use
+timerlist infrastructure".
+
+Signed-off-by: Jeff Ohlstein <johlstei@codeaurora.org>
+Link: http://lkml.kernel.org/r/1321660030-8520-1-git-send-email-johlstei@codeaurora.org
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/hrtimer.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -885,10 +885,13 @@ static void __remove_hrtimer(struct hrti
+ struct hrtimer_clock_base *base,
+ unsigned long newstate, int reprogram)
+ {
++ struct timerqueue_node *next_timer;
+ if (!(timer->state & HRTIMER_STATE_ENQUEUED))
+ goto out;
+
+- if (&timer->node == timerqueue_getnext(&base->active)) {
++ next_timer = timerqueue_getnext(&base->active);
++ timerqueue_del(&base->active, &timer->node);
++ if (&timer->node == next_timer) {
+ #ifdef CONFIG_HIGH_RES_TIMERS
+ /* Reprogram the clock event device. if enabled */
+ if (reprogram && hrtimer_hres_active()) {
+@@ -901,7 +904,6 @@ static void __remove_hrtimer(struct hrti
+ }
+ #endif
+ }
+- timerqueue_del(&base->active, &timer->node);
+ if (!timerqueue_getnext(&base->active))
+ base->cpu_base->active_bases &= ~(1 << base->index);
+ out:
--- /dev/null
+From 24f50a9d165745fd0701c6e089d35f58a229ea69 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 24 Nov 2011 20:06:14 +0100
+Subject: mac80211: don't stop a single aggregation session twice
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 24f50a9d165745fd0701c6e089d35f58a229ea69 upstream.
+
+Nikolay noticed (by code review) that mac80211 can
+attempt to stop an aggregation session while it is
+already being stopped. So to fix it, check whether
+stop is already being done and bail out if so.
+
+Also move setting the STOPPING state into the lock
+so things are properly atomic.
+
+Reported-by: Nikolay Martynov <mar.kolya@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/agg-tx.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -162,6 +162,12 @@ int ___ieee80211_stop_tx_ba_session(stru
+ return -ENOENT;
+ }
+
++ /* if we're already stopping ignore any new requests to stop */
++ if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
++ spin_unlock_bh(&sta->lock);
++ return -EALREADY;
++ }
++
+ if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
+ /* not even started yet! */
+ ieee80211_assign_tid_tx(sta, tid, NULL);
+@@ -170,6 +176,8 @@ int ___ieee80211_stop_tx_ba_session(stru
+ return 0;
+ }
+
++ set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
++
+ spin_unlock_bh(&sta->lock);
+
+ #ifdef CONFIG_MAC80211_HT_DEBUG
+@@ -177,8 +185,6 @@ int ___ieee80211_stop_tx_ba_session(stru
+ sta->sta.addr, tid);
+ #endif /* CONFIG_MAC80211_HT_DEBUG */
+
+- set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+-
+ del_timer_sync(&tid_tx->addba_resp_timer);
+
+ /*
--- /dev/null
+From 2a1e0fd175dcfd72096ba9291d31e3b1b5342e60 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sun, 27 Nov 2011 15:29:44 +0200
+Subject: mac80211: fix race between the AGG SM and the Tx data path
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 2a1e0fd175dcfd72096ba9291d31e3b1b5342e60 upstream.
+
+When a packet is supposed to sent be as an a-MPDU, mac80211 sets
+IEEE80211_TX_CTL_AMPDU to let the driver know. On the other
+hand, mac80211 configures the driver for aggregration with the
+ampdu_action callback.
+There is race between these two mechanisms since the following
+scenario can occur when the BA agreement is torn down:
+
+Tx softIRQ drv configuration
+========== =================
+
+check OPERATIONAL bit
+Set the TX_CTL_AMPDU bit in the packet
+
+ clear OPERATIONAL bit
+ stop Tx AGG
+Pass Tx packet to the driver.
+
+In that case the driver would get a packet with TX_CTL_AMPDU set
+although it has already been notified that the BA session has been
+torn down.
+
+To fix this, we need to synchronize all the Qdisc activity after we
+cleared the OPERATIONAL bit. After that step, all the following
+packets will be buffered until the driver reports it is ready to get
+new packets for this RA / TID. This buffering allows not to run into
+another race that would send packets with TX_CTL_AMPDU unset while
+the driver hasn't been requested to tear down the BA session yet.
+
+This race occurs in practice and iwlwifi complains with a WARN_ON
+when it happens.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/agg-tx.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -194,6 +194,20 @@ int ___ieee80211_stop_tx_ba_session(stru
+ */
+ clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
+
++ /*
++ * There might be a few packets being processed right now (on
++ * another CPU) that have already gotten past the aggregation
++ * check when it was still OPERATIONAL and consequently have
++ * IEEE80211_TX_CTL_AMPDU set. In that case, this code might
++ * call into the driver at the same time or even before the
++ * TX paths calls into it, which could confuse the driver.
++ *
++ * Wait for all currently running TX paths to finish before
++ * telling the driver. New packets will not go through since
++ * the aggregation session is no longer OPERATIONAL.
++ */
++ synchronize_net();
++
+ tid_tx->stop_initiator = initiator;
+ tid_tx->tx_stop = tx;
+
--- /dev/null
+From e007b857e88097c96c45620bf3b04a4e309053d1 Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliad@wizery.com>
+Date: Thu, 24 Nov 2011 18:13:56 +0200
+Subject: nl80211: fix MAC address validation
+
+From: Eliad Peller <eliad@wizery.com>
+
+commit e007b857e88097c96c45620bf3b04a4e309053d1 upstream.
+
+MAC addresses have a fixed length. The current
+policy allows passing < ETH_ALEN bytes, which
+might result in reading beyond the buffer.
+
+Signed-off-by: Eliad Peller <eliad@wizery.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/nl80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -83,8 +83,8 @@ static const struct nla_policy nl80211_p
+ [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
+ [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
+
+- [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
+- [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
++ [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
++ [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
+
+ [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
+ [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
--- /dev/null
+From 32d3a3922d617a5a685a5e2d24b20d0e88f192a9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20B=C3=BCsch?= <m@bues.ch>
+Date: Wed, 16 Nov 2011 23:48:31 +0100
+Subject: p54spi: Add missing spin_lock_init
+
+From: =?UTF-8?q?Michael=20B=C3=BCsch?= <m@bues.ch>
+
+commit 32d3a3922d617a5a685a5e2d24b20d0e88f192a9 upstream.
+
+The tx_lock is not initialized properly. Add spin_lock_init().
+
+Signed-off-by: Michael Buesch <m@bues.ch>
+Acked-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/p54/p54spi.c
++++ b/drivers/net/wireless/p54/p54spi.c
+@@ -657,6 +657,7 @@ static int __devinit p54spi_probe(struct
+ init_completion(&priv->fw_comp);
+ INIT_LIST_HEAD(&priv->tx_pending);
+ mutex_init(&priv->mutex);
++ spin_lock_init(&priv->tx_lock);
+ SET_IEEE80211_DEV(hw, &spi->dev);
+ priv->common.open = p54spi_op_start;
+ priv->common.stop = p54spi_op_stop;
--- /dev/null
+From 2d1618170eb493d18f66f2ac03775409a6fb97c6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20B=C3=BCsch?= <m@bues.ch>
+Date: Wed, 16 Nov 2011 23:55:46 +0100
+Subject: p54spi: Fix workqueue deadlock
+
+From: =?UTF-8?q?Michael=20B=C3=BCsch?= <m@bues.ch>
+
+commit 2d1618170eb493d18f66f2ac03775409a6fb97c6 upstream.
+
+priv->work must not be synced while priv->mutex is locked, because
+the mutex is taken in the work handler.
+Move cancel_work_sync down to after the device shutdown code.
+This is safe, because the work handler checks fw_state and bails out
+early in case of a race.
+
+Signed-off-by: Michael Buesch <m@bues.ch>
+Acked-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54spi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54spi.c
++++ b/drivers/net/wireless/p54/p54spi.c
+@@ -589,8 +589,6 @@ static void p54spi_op_stop(struct ieee80
+
+ WARN_ON(priv->fw_state != FW_STATE_READY);
+
+- cancel_work_sync(&priv->work);
+-
+ p54spi_power_off(priv);
+ spin_lock_irqsave(&priv->tx_lock, flags);
+ INIT_LIST_HEAD(&priv->tx_pending);
+@@ -598,6 +596,8 @@ static void p54spi_op_stop(struct ieee80
+
+ priv->fw_state = FW_STATE_OFF;
+ mutex_unlock(&priv->mutex);
++
++ cancel_work_sync(&priv->work);
+ }
+
+ static int __devinit p54spi_probe(struct spi_device *spi)
--- /dev/null
+From 4ba7d9997869d25bd223dea7536fc1ce9fab3b3b Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 16 Nov 2011 11:09:17 +0100
+Subject: rt2800pci: handle spurious interrupts
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 4ba7d9997869d25bd223dea7536fc1ce9fab3b3b upstream.
+
+Some devices may generate spurious interrupts, we have to handle them
+otherwise interrupt line will be disabled with below message and driver
+will not work:
+
+[ 2052.114334] irq 17: nobody cared (try booting with the "irqpoll" option)
+[ 2052.114339] Pid: 0, comm: swapper Tainted: P 2.6.35.6-48.fc14.x86_64 #1
+[ 2052.114341] Call Trace:
+[ 2052.114342] <IRQ> [<ffffffff810a6e2b>] __report_bad_irq.clone.1+0x3d/0x8b
+[ 2052.114349] [<ffffffff810a6f93>] note_interrupt+0x11a/0x17f
+[ 2052.114352] [<ffffffff810a7a73>] handle_fasteoi_irq+0xa8/0xce
+[ 2052.114355] [<ffffffff8100c2ea>] handle_irq+0x88/0x90
+[ 2052.114357] [<ffffffff8146f034>] do_IRQ+0x5c/0xb4
+[ 2052.114360] [<ffffffff81469593>] ret_from_intr+0x0/0x11
+[ 2052.114361] <EOI> [<ffffffff8102b7f9>] ? native_safe_halt+0xb/0xd
+[ 2052.114366] [<ffffffff81010f03>] ? need_resched+0x23/0x2d
+[ 2052.114367] [<ffffffff8101102a>] default_idle+0x34/0x4f
+[ 2052.114370] [<ffffffff81008325>] cpu_idle+0xaa/0xcc
+[ 2052.114373] [<ffffffff81461f2a>] start_secondary+0x24d/0x28e
+[ 2052.114374] handlers:
+[ 2052.114375] [<ffffffff81332944>] (usb_hcd_irq+0x0/0x7c)
+[ 2052.114378] [<ffffffffa00697da>] (rt2800pci_interrupt+0x0/0x18d [rt2800pci])
+[ 2052.114384] Disabling IRQ #17
+
+Resolve:
+https://bugzilla.redhat.com/show_bug.cgi?id=658451
+
+Reported-and-tested-by: Amir Hedayaty <hedayaty@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2800pci.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -886,8 +886,13 @@ static irqreturn_t rt2800pci_interrupt(i
+ rt2x00pci_register_read(rt2x00dev, INT_SOURCE_CSR, ®);
+ rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+
++ /*
++ * Some devices can generate interrupts with empty CSR register, we
++ * "handle" such irq's to prevent interrupt controller treat them as
++ * spurious interrupts and disable irq line.
++ */
+ if (!reg)
+- return IRQ_NONE;
++ return IRQ_HANDLED;
+
+ if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+ return IRQ_HANDLED;
--- /dev/null
+From 68fa64ef606bcee688fce46d07aa68f175070156 Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Wed, 16 Nov 2011 23:16:15 +0100
+Subject: rt2x00: Fix efuse EEPROM reading on PPC32.
+
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+
+commit 68fa64ef606bcee688fce46d07aa68f175070156 upstream.
+
+Fix __le32 to __le16 conversion of the first word of an 8-word block
+of EEPROM read via the efuse method.
+
+Reported-and-tested-by: Ingvar Hagelund <ingvar@redpill-linpro.com>
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -3514,7 +3514,7 @@ static void rt2800_efuse_read(struct rt2
+ /* Apparently the data is read from end to start */
+ rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, ®);
+ /* The returned value is in CPU order, but eeprom is le */
+- rt2x00dev->eeprom[i] = cpu_to_le32(reg);
++ *(u32 *)&rt2x00dev->eeprom[i] = cpu_to_le32(reg);
+ rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, ®);
+ *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg);
+ rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, ®);
--- /dev/null
+From 23085d5796561625db4143a671f1de081f66ef08 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 16 Nov 2011 13:58:42 +0100
+Subject: rt2x00: handle spurious pci interrupts
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 23085d5796561625db4143a671f1de081f66ef08 upstream.
+
+We have documented case of very bad performance issue on rt2800pci
+device, because it generate spurious interrupt, what cause irq line
+is disabled: https://bugzilla.redhat.com/show_bug.cgi?id=658451
+
+We already address that problem in separate patch by returning
+IRQ_HANDLED from interrupt handler. We think similar fix is needed for
+other rt2x00 PCI devices, because users report performance problems on
+these devices too.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2400pci.c | 2 +-
+ drivers/net/wireless/rt2x00/rt2500pci.c | 2 +-
+ drivers/net/wireless/rt2x00/rt61pci.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/rt2x00/rt2400pci.c
+@@ -1387,7 +1387,7 @@ static irqreturn_t rt2400pci_interrupt(i
+ rt2x00pci_register_write(rt2x00dev, CSR7, reg);
+
+ if (!reg)
+- return IRQ_NONE;
++ return IRQ_HANDLED;
+
+ if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+ return IRQ_HANDLED;
+--- a/drivers/net/wireless/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/rt2x00/rt2500pci.c
+@@ -1519,7 +1519,7 @@ static irqreturn_t rt2500pci_interrupt(i
+ rt2x00pci_register_write(rt2x00dev, CSR7, reg);
+
+ if (!reg)
+- return IRQ_NONE;
++ return IRQ_HANDLED;
+
+ if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+ return IRQ_HANDLED;
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2345,7 +2345,7 @@ static irqreturn_t rt61pci_interrupt(int
+ rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+
+ if (!reg && !reg_mcu)
+- return IRQ_NONE;
++ return IRQ_HANDLED;
+
+ if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+ return IRQ_HANDLED;
asoc-fsl_ssi-properly-initialize-the-sysfs-attribute-object.patch
asoc-wm8753-skip-noop-reconfiguration-of-dai-mode.patch
asoc-ensure-wm8731-register-cache-is-synced-when-resuming-from-disabled.patch
+sunrpc-ensure-we-return-eagain-in-xs_nospace-if-congestion-is-cleared.patch
+genirq-fix-regression-in-irqfixup-irqpoll.patch
+cgroup_freezer-fix-freezing-groups-with-stopped-tasks.patch
+timekeeping-add-arch_offset-hook-to-ktime_get-functions.patch
+hrtimer-fix-extra-wakeups-from-__remove_hrtimer.patch
+p54spi-add-missing-spin_lock_init.patch
+p54spi-fix-workqueue-deadlock.patch
+rt2800pci-handle-spurious-interrupts.patch
+rt2x00-handle-spurious-pci-interrupts.patch
+rt2x00-fix-efuse-eeprom-reading-on-ppc32.patch
+nl80211-fix-mac-address-validation.patch
+cfg80211-fix-regulatory-null-dereference.patch
+mac80211-don-t-stop-a-single-aggregation-session-twice.patch
+mac80211-fix-race-between-the-agg-sm-and-the-tx-data-path.patch
--- /dev/null
+From 24ca9a847791fd53d9b217330b15f3c285827a18 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 22 Nov 2011 14:44:28 +0200
+Subject: SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 24ca9a847791fd53d9b217330b15f3c285827a18 upstream.
+
+By returning '0' instead of 'EAGAIN' when the tests in xs_nospace() fail
+to find evidence of socket congestion, we are making the RPC engine believe
+that the message was incorrectly sent and so it disconnects the socket
+instead of just retrying.
+
+The bug appears to have been introduced by commit
+5e3771ce2d6a69e10fcc870cdf226d121d868491 (SUNRPC: Ensure that xs_nospace
+return values are propagated).
+
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/xprtsock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -485,7 +485,7 @@ static int xs_nospace(struct rpc_task *t
+ struct rpc_rqst *req = task->tk_rqstp;
+ struct rpc_xprt *xprt = req->rq_xprt;
+ struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+- int ret = 0;
++ int ret = -EAGAIN;
+
+ dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
+ task->tk_pid, req->rq_slen - req->rq_bytes_sent,
+@@ -497,7 +497,6 @@ static int xs_nospace(struct rpc_task *t
+ /* Don't race with disconnect */
+ if (xprt_connected(xprt)) {
+ if (test_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags)) {
+- ret = -EAGAIN;
+ /*
+ * Notify TCP that we're limited by the application
+ * window size
--- /dev/null
+From d004e024058a0eaca097513ce62cbcf978913e0a Mon Sep 17 00:00:00 2001
+From: Hector Palacios <hector.palacios@digi.com>
+Date: Mon, 14 Nov 2011 11:15:25 +0100
+Subject: timekeeping: add arch_offset hook to ktime_get functions
+
+From: Hector Palacios <hector.palacios@digi.com>
+
+commit d004e024058a0eaca097513ce62cbcf978913e0a upstream.
+
+ktime_get and ktime_get_ts were calling timekeeping_get_ns()
+but later they were not calling arch_gettimeoffset() so architectures
+using this mechanism returned 0 ns when calling these functions.
+
+This happened for example when running Busybox's ping which calls
+syscall(__NR_clock_gettime, CLOCK_MONOTONIC, ts) which eventually
+calls ktime_get. As a result the returned ping travel time was zero.
+
+Signed-off-by: Hector Palacios <hector.palacios@digi.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/timekeeping.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -249,6 +249,8 @@ ktime_t ktime_get(void)
+ secs = xtime.tv_sec + wall_to_monotonic.tv_sec;
+ nsecs = xtime.tv_nsec + wall_to_monotonic.tv_nsec;
+ nsecs += timekeeping_get_ns();
++ /* If arch requires, add in gettimeoffset() */
++ nsecs += arch_gettimeoffset();
+
+ } while (read_seqretry(&xtime_lock, seq));
+ /*
+@@ -280,6 +282,8 @@ void ktime_get_ts(struct timespec *ts)
+ *ts = xtime;
+ tomono = wall_to_monotonic;
+ nsecs = timekeeping_get_ns();
++ /* If arch requires, add in gettimeoffset() */
++ nsecs += arch_gettimeoffset();
+
+ } while (read_seqretry(&xtime_lock, seq));
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
