.37 patches

13 files changed, 822 insertions, 0 deletions

diff --git a/queue-2.6.37/arm-oprofile-fix-backtraces-in-timer-mode.patch b/queue-2.6.37/arm-oprofile-fix-backtraces-in-timer-mode.patch
new file mode 100644
index 0000000000..28478b4600
--- /dev/null
+++ b/queue-2.6.37/arm-oprofile-fix-backtraces-in-timer-mode.patch
@@ -0,0 +1,94 @@
+From d14dd7e20d5e526557f5d3cfef4046a642f80924 Mon Sep 17 00:00:00 2001
+From: Ari Kauppi <kauppi@papupata.org>
+Date: Thu, 20 Jan 2011 13:57:19 -0500
+Subject: ARM: oprofile: Fix backtraces in timer mode
+
+From: Ari Kauppi <kauppi@papupata.org>
+
+commit d14dd7e20d5e526557f5d3cfef4046a642f80924 upstream.
+
+Always allow backtraces when using oprofile on ARM, even if a PMU
+isn't present. Restores functionality originally introduced in commit
+1b7b56982fdcd9d85effd76f3928cf5d6eb26155 ("oprofile: Always allow
+backtraces on ARM") by Richard Purdie.
+
+It is not that obvious, but there is now only one oprofile_arch_init()
+function. So the .backtrace callback is available also in timer mode.
+
+Implemented by removing code and using stubs for oprofile_perf_{init,
+exit} provided by <linux/oprofile.h>. This allows cleaning of other
+architecture specific implementations too.
+
+Signed-off-by: Ari Kauppi <kauppi@papupata.org>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
+index 8aa9744..2b66391 100644
+--- a/arch/arm/oprofile/common.c
++++ b/arch/arm/oprofile/common.c
+@@ -10,8 +10,6 @@
+  */
+ 
+ #include <linux/cpumask.h>
+-#include <linux/err.h>
+-#include <linux/errno.h>
+ #include <linux/init.h>
+ #include <linux/mutex.h>
+ #include <linux/oprofile.h>
+@@ -46,6 +44,7 @@ char *op_name_from_perf_id(void)
+ 		return NULL;
+ 	}
+ }
++#endif
+ 
+ static int report_trace(struct stackframe *frame, void *d)
+ {
+@@ -111,6 +110,7 @@ static void arm_backtrace(struct pt_regs * const regs, unsigned int depth)
+ 
+ int __init oprofile_arch_init(struct oprofile_operations *ops)
+ {
++	/* provide backtrace support also in timer mode: */
+ 	ops->backtrace		= arm_backtrace;
+ 
+ 	return oprofile_perf_init(ops);
+@@ -120,11 +120,3 @@ void __exit oprofile_arch_exit(void)
+ {
+ 	oprofile_perf_exit();
+ }
+-#else
+-int __init oprofile_arch_init(struct oprofile_operations *ops)
+-{
+-	pr_info("oprofile: hardware counters not available\n");
+-	return -ENODEV;
+-}
+-void __exit oprofile_arch_exit(void) {}
+-#endif /* CONFIG_HW_PERF_EVENTS */
+diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
+index 54c8382..1ca6411 100644
+--- a/include/linux/oprofile.h
++++ b/include/linux/oprofile.h
+@@ -16,6 +16,8 @@
+ #include <linux/types.h>
+ #include <linux/spinlock.h>
+ #include <linux/init.h>
++#include <linux/errno.h>
++#include <linux/printk.h>
+ #include <asm/atomic.h>
+  
+ /* Each escaped entry is prefixed by ESCAPE_CODE
+@@ -190,6 +192,13 @@ int oprofile_write_commit(struct op_entry *entry);
+ int __init oprofile_perf_init(struct oprofile_operations *ops);
+ void oprofile_perf_exit(void);
+ char *op_name_from_perf_id(void);
++#else
++static inline int __init oprofile_perf_init(struct oprofile_operations *ops)
++{
++	pr_info("oprofile: hardware counters not available\n");
++	return -ENODEV;
++}
++static inline void oprofile_perf_exit(void) { }
+ #endif /* CONFIG_HW_PERF_EVENTS */
+ 
+ #endif /* OPROFILE_H */
diff --git a/queue-2.6.37/dm-dont-take-i_mutex-to-change-device-size.patch b/queue-2.6.37/dm-dont-take-i_mutex-to-change-device-size.patch
new file mode 100644
index 0000000000..af633c1db2
--- /dev/null
+++ b/queue-2.6.37/dm-dont-take-i_mutex-to-change-device-size.patch
@@ -0,0 +1,49 @@
+From c217649bf2d60ac119afd71d938278cffd55962b Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Thu, 13 Jan 2011 19:53:46 +0000
+Subject: dm: dont take i_mutex to change device size
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit c217649bf2d60ac119afd71d938278cffd55962b upstream.
+
+No longer needlessly hold md->bdev->bd_inode->i_mutex when changing the
+size of a DM device.  This additional locking is unnecessary because
+i_size_write() is already protected by the existing critical section in
+dm_swap_table().  DM already has a reference on md->bdev so the
+associated bd_inode may be changed without lifetime concerns.
+
+A negative side-effect of having held md->bdev->bd_inode->i_mutex was
+that a concurrent DM device resize and flush (via fsync) would deadlock.
+Dropping md->bdev->bd_inode->i_mutex eliminates this potential for
+deadlock.  The following reproducer no longer deadlocks:
+  https://www.redhat.com/archives/dm-devel/2009-July/msg00284.html
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1992,13 +1992,14 @@ static void event_callback(void *context
+ 	wake_up(&md->eventq);
+ }
+ 
++/*
++ * Protected by md->suspend_lock obtained by dm_swap_table().
++ */
+ static void __set_size(struct mapped_device *md, sector_t size)
+ {
+ 	set_capacity(md->disk, size);
+ 
+-	mutex_lock(&md->bdev->bd_inode->i_mutex);
+ 	i_size_write(md->bdev->bd_inode, (loff_t)size << SECTOR_SHIFT);
+-	mutex_unlock(&md->bdev->bd_inode->i_mutex);
+ }
+ 
+ /*
diff --git a/queue-2.6.37/dm-mpath-disable-blk_abort_queue.patch b/queue-2.6.37/dm-mpath-disable-blk_abort_queue.patch
new file mode 100644
index 0000000000..182c7b0d53
--- /dev/null
+++ b/queue-2.6.37/dm-mpath-disable-blk_abort_queue.patch
@@ -0,0 +1,81 @@
+From 09c9d4c9b6a2b5909ae3c6265e4cd3820b636863 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Thu, 13 Jan 2011 19:59:46 +0000
+Subject: dm mpath: disable blk_abort_queue
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 09c9d4c9b6a2b5909ae3c6265e4cd3820b636863 upstream.
+
+Revert commit 224cb3e981f1b2f9f93dbd49eaef505d17d894c2
+  dm: Call blk_abort_queue on failed paths
+
+Multipath began to use blk_abort_queue() to allow for
+lower latency path deactivation.  This was found to
+cause list corruption:
+
+   the cmd gets blk_abort_queued/timedout run on it and the scsi eh
+   somehow is able to complete and run scsi_queue_insert while
+   scsi_request_fn is still trying to process the request.
+
+   https://www.redhat.com/archives/dm-devel/2010-November/msg00085.html
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Cc: Mike Anderson <andmike@linux.vnet.ibm.com>
+Cc: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |   12 ------------
+ 1 file changed, 12 deletions(-)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -33,7 +33,6 @@ struct pgpath {
+ 	unsigned fail_count;		/* Cumulative failure count */
+ 
+ 	struct dm_path path;
+-	struct work_struct deactivate_path;
+ 	struct work_struct activate_path;
+ };
+ 
+@@ -116,7 +115,6 @@ static struct workqueue_struct *kmultipa
+ static void process_queued_ios(struct work_struct *work);
+ static void trigger_event(struct work_struct *work);
+ static void activate_path(struct work_struct *work);
+-static void deactivate_path(struct work_struct *work);
+ 
+ 
+ /*-----------------------------------------------
+@@ -129,7 +127,6 @@ static struct pgpath *alloc_pgpath(void)
+ 
+ 	if (pgpath) {
+ 		pgpath->is_active = 1;
+-		INIT_WORK(&pgpath->deactivate_path, deactivate_path);
+ 		INIT_WORK(&pgpath->activate_path, activate_path);
+ 	}
+ 
+@@ -141,14 +138,6 @@ static void free_pgpath(struct pgpath *p
+ 	kfree(pgpath);
+ }
+ 
+-static void deactivate_path(struct work_struct *work)
+-{
+-	struct pgpath *pgpath =
+-		container_of(work, struct pgpath, deactivate_path);
+-
+-	blk_abort_queue(pgpath->path.dev->bdev->bd_disk->queue);
+-}
+-
+ static struct priority_group *alloc_priority_group(void)
+ {
+ 	struct priority_group *pg;
+@@ -995,7 +984,6 @@ static int fail_path(struct pgpath *pgpa
+ 		      pgpath->path.dev->name, m->nr_valid_paths);
+ 
+ 	schedule_work(&m->trigger_event);
+-	queue_work(kmultipathd, &pgpath->deactivate_path);
+ 
+ out:
+ 	spin_unlock_irqrestore(&m->lock, flags);
diff --git a/queue-2.6.37/ieee80211-correct-ieee80211_addba_param_buf_size_mask-macro.patch b/queue-2.6.37/ieee80211-correct-ieee80211_addba_param_buf_size_mask-macro.patch
new file mode 100644
index 0000000000..463732c455
--- /dev/null
+++ b/queue-2.6.37/ieee80211-correct-ieee80211_addba_param_buf_size_mask-macro.patch
@@ -0,0 +1,34 @@
+From 8d661f1e462d50bd83de87ee628aaf820ce3c66c Mon Sep 17 00:00:00 2001
+From: Amitkumar Karwar <akarwar@marvell.com>
+Date: Tue, 11 Jan 2011 16:14:24 -0800
+Subject: ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro
+
+From: Amitkumar Karwar <akarwar@marvell.com>
+
+commit 8d661f1e462d50bd83de87ee628aaf820ce3c66c upstream.
+
+It is defined in include/linux/ieee80211.h. As per IEEE spec.
+bit6 to bit15 in block ack parameter represents buffer size.
+So the bitmask should be 0xFFC0.
+
+Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/ieee80211.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -959,7 +959,7 @@ struct ieee80211_ht_info {
+ /* block-ack parameters */
+ #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
+ #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
+-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
++#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
+ #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
+ #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
+ 
diff --git a/queue-2.6.37/input-sysrq-ensure-sysrq_enabled-and-__sysrq_enabled-are-consistent.patch b/queue-2.6.37/input-sysrq-ensure-sysrq_enabled-and-__sysrq_enabled-are-consistent.patch
new file mode 100644
index 0000000000..1210f8956b
--- /dev/null
+++ b/queue-2.6.37/input-sysrq-ensure-sysrq_enabled-and-__sysrq_enabled-are-consistent.patch
@@ -0,0 +1,66 @@
+From 8c6a98b22b750c9eb52653ba643faa17db8d3881 Mon Sep 17 00:00:00 2001
+From: Andy Whitcroft <apw@canonical.com>
+Date: Mon, 24 Jan 2011 09:31:38 -0800
+Subject: Input: sysrq - ensure sysrq_enabled and __sysrq_enabled are consistent
+
+From: Andy Whitcroft <apw@canonical.com>
+
+commit 8c6a98b22b750c9eb52653ba643faa17db8d3881 upstream.
+
+Currently sysrq_enabled and __sysrq_enabled are initialised separately
+and inconsistently, leading to sysrq being actually enabled by reported
+as not enabled in sysfs.  The first change to the sysfs configurable
+synchronises these two:
+
+    static int __read_mostly sysrq_enabled = 1;
+    static int __sysrq_enabled;
+
+Add a common define to carry the default for these preventing them becoming
+out of sync again.  Default this to 1 to mirror previous behaviour.
+
+Signed-off-by: Andy Whitcroft <apw@canonical.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/tty/sysrq.c   |    2 +-
+ include/linux/sysrq.h |    3 +++
+ kernel/sysctl.c       |    3 ++-
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/sysrq.c
++++ b/drivers/tty/sysrq.c
+@@ -46,7 +46,7 @@
+ #include <asm/irq_regs.h>
+ 
+ /* Whether we react on sysrq keys or just ignore them */
+-static int __read_mostly sysrq_enabled = 1;
++static int __read_mostly sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
+ static bool __read_mostly sysrq_always_enabled;
+ 
+ static bool sysrq_on(void)
+--- a/include/linux/sysrq.h
++++ b/include/linux/sysrq.h
+@@ -17,6 +17,9 @@
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ 
++/* Enable/disable SYSRQ support by default (0==no, 1==yes). */
++#define SYSRQ_DEFAULT_ENABLE	1
++
+ /* Possible values of bitmask for enabling sysrq functions */
+ /* 0x0001 is reserved for enable everything */
+ #define SYSRQ_ENABLE_LOG	0x0002
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -169,7 +169,8 @@ static int proc_taint(struct ctl_table *
+ #endif
+ 
+ #ifdef CONFIG_MAGIC_SYSRQ
+-static int __sysrq_enabled; /* Note: sysrq code ises it's own private copy */
++/* Note: sysrq code uses it's own private copy */
++static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
+ 
+ static int sysrq_sysctl_handler(ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp,
diff --git a/queue-2.6.37/input-sysrq-rework-re-inject-logic.patch b/queue-2.6.37/input-sysrq-rework-re-inject-logic.patch
new file mode 100644
index 0000000000..1db7f799c0
--- /dev/null
+++ b/queue-2.6.37/input-sysrq-rework-re-inject-logic.patch
@@ -0,0 +1,79 @@
+From 7ab7b5adfb923978a2cab7bd3fac9ccf7d21cc3f Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Wed, 2 Feb 2011 22:59:54 -0800
+Subject: Input: sysrq - rework re-inject logic
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 7ab7b5adfb923978a2cab7bd3fac9ccf7d21cc3f upstream.
+
+Internally 'disable' the filter when re-injecting Alt-SysRq instead
+of relying on input core to suppress delivery of injected events
+to the originating handler.
+
+This allows to revert commit 5fdbe44d033d059cc56c2803e6b4dbd8cb4e5e39
+which causes problems with existing userspace programs trying to
+loopback the events via evdev.
+
+Reported-by: Kristen Carlson Accardi <kristen@linux.intel.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/sysrq.c |   17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/sysrq.c
++++ b/drivers/tty/sysrq.c
+@@ -571,6 +571,7 @@ struct sysrq_state {
+ 	unsigned int alt_use;
+ 	bool active;
+ 	bool need_reinject;
++	bool reinjecting;
+ };
+ 
+ static void sysrq_reinject_alt_sysrq(struct work_struct *work)
+@@ -581,6 +582,10 @@ static void sysrq_reinject_alt_sysrq(str
+ 	unsigned int alt_code = sysrq->alt_use;
+ 
+ 	if (sysrq->need_reinject) {
++		/* we do not want the assignment to be reordered */
++		sysrq->reinjecting = true;
++		mb();
++
+ 		/* Simulate press and release of Alt + SysRq */
+ 		input_inject_event(handle, EV_KEY, alt_code, 1);
+ 		input_inject_event(handle, EV_KEY, KEY_SYSRQ, 1);
+@@ -589,6 +594,9 @@ static void sysrq_reinject_alt_sysrq(str
+ 		input_inject_event(handle, EV_KEY, KEY_SYSRQ, 0);
+ 		input_inject_event(handle, EV_KEY, alt_code, 0);
+ 		input_inject_event(handle, EV_SYN, SYN_REPORT, 1);
++
++		mb();
++		sysrq->reinjecting = false;
+ 	}
+ }
+ 
+@@ -599,6 +607,13 @@ static bool sysrq_filter(struct input_ha
+ 	bool was_active = sysrq->active;
+ 	bool suppress;
+ 
++	/*
++	 * Do not filter anything if we are in the process of re-injecting
++	 * Alt+SysRq combination.
++	 */
++	if (sysrq->reinjecting)
++		return false;
++
+ 	switch (type) {
+ 
+ 	case EV_SYN:
+@@ -629,7 +644,7 @@ static bool sysrq_filter(struct input_ha
+ 				sysrq->alt_use = sysrq->alt;
+ 				/*
+ 				 * If nothing else will be pressed we'll need
+-				 * to * re-inject Alt-SysRq keysroke.
++				 * to re-inject Alt-SysRq keysroke.
+ 				 */
+ 				sysrq->need_reinject = true;
+ 			}
diff --git a/queue-2.6.37/mtd-pxa3xx_nand-null-dereference-in-pxa3xx_nand_probe.patch b/queue-2.6.37/mtd-pxa3xx_nand-null-dereference-in-pxa3xx_nand_probe.patch
new file mode 100644
index 0000000000..7c70286cc5
--- /dev/null
+++ b/queue-2.6.37/mtd-pxa3xx_nand-null-dereference-in-pxa3xx_nand_probe.patch
@@ -0,0 +1,41 @@
+From 52d039fdaa78c5a9f9bc2940ad58d7ed76b8336d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Thu, 6 Jan 2011 17:05:36 +0300
+Subject: mtd: pxa3xx_nand: NULL dereference in pxa3xx_nand_probe
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit 52d039fdaa78c5a9f9bc2940ad58d7ed76b8336d upstream.
+
+"info->cmdset" gets dereferenced in __readid() so it needs to be
+initialized earlier in the function.  This bug was introduced in
+18c81b1828f8 "mtd: pxa3xx_nand: remove the flash info in driver
+structure".
+
+Reported-and-tested-by: Sven Neumann <s.neumann@raumfeld.com>
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/nand/pxa3xx_nand.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/pxa3xx_nand.c
++++ b/drivers/mtd/nand/pxa3xx_nand.c
+@@ -885,6 +885,7 @@ static int pxa3xx_nand_detect_config(str
+ 	/* set info fields needed to __readid */
+ 	info->read_id_bytes = (info->page_size == 2048) ? 4 : 2;
+ 	info->reg_ndcr = ndcr;
++	info->cmdset = &default_cmdset;
+ 
+ 	if (__readid(info, &id))
+ 		return -ENODEV;
+@@ -915,7 +916,6 @@ static int pxa3xx_nand_detect_config(str
+ 
+ 	info->ndtr0cs0 = nand_readl(info, NDTR0CS0);
+ 	info->ndtr1cs0 = nand_readl(info, NDTR1CS0);
+-	info->cmdset = &default_cmdset;
+ 
+ 	return 0;
+ }
diff --git a/queue-2.6.37/net-fec-fix-mmfr_op-type-in-fec_enet_mdio_write.patch b/queue-2.6.37/net-fec-fix-mmfr_op-type-in-fec_enet_mdio_write.patch
new file mode 100644
index 0000000000..6ff28a82f5
--- /dev/null
+++ b/queue-2.6.37/net-fec-fix-mmfr_op-type-in-fec_enet_mdio_write.patch
@@ -0,0 +1,38 @@
+From 862f0982eadcea0e114576c57ea426d3d51a69a6 Mon Sep 17 00:00:00 2001
+From: Shawn Guo <shawn.guo@freescale.com>
+Date: Wed, 5 Jan 2011 21:13:09 +0000
+Subject: net/fec: fix MMFR_OP type in fec_enet_mdio_write
+
+From: Shawn Guo <shawn.guo@freescale.com>
+
+commit 862f0982eadcea0e114576c57ea426d3d51a69a6 upstream.
+
+FEC_MMFR_OP_WRITE should be used than FEC_MMFR_OP_READ in
+a mdio write operation.
+
+It's probably a typo introduced by commit:
+
+e6b043d512fa8d9a3801bf5d72bfa3b8fc3b3cc8
+netdev/fec.c: add phylib supporting to enable carrier detection (v2)
+
+Signed-off-by: Shawn Guo <shawn.guo@freescale.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/fec.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/fec.c
++++ b/drivers/net/fec.c
+@@ -651,8 +651,8 @@ static int fec_enet_mdio_write(struct mi
+ 	fep->mii_timeout = 0;
+ 	init_completion(&fep->mdio_done);
+ 
+-	/* start a read op */
+-	writel(FEC_MMFR_ST | FEC_MMFR_OP_READ |
++	/* start a write op */
++	writel(FEC_MMFR_ST | FEC_MMFR_OP_WRITE |
+ 		FEC_MMFR_PA(mii_id) | FEC_MMFR_RA(regnum) |
+ 		FEC_MMFR_TA | FEC_MMFR_DATA(value),
+ 		fep->hwp + FEC_MII_DATA);
diff --git a/queue-2.6.37/oprofile-fix-usage-of-config_hw_perf_events-for-oprofile_perf_init-and-friends.patch b/queue-2.6.37/oprofile-fix-usage-of-config_hw_perf_events-for-oprofile_perf_init-and-friends.patch
new file mode 100644
index 0000000000..34148e31d0
--- /dev/null
+++ b/queue-2.6.37/oprofile-fix-usage-of-config_hw_perf_events-for-oprofile_perf_init-and-friends.patch
@@ -0,0 +1,35 @@
+From 1ea1bdf7faa4d0b5293e605f2e1ef1c2c59f6b53 Mon Sep 17 00:00:00 2001
+From: Ari Kauppi <kauppi@papupata.org>
+Date: Thu, 20 Jan 2011 13:57:18 -0500
+Subject: oprofile: Fix usage of CONFIG_HW_PERF_EVENTS for oprofile_perf_init and friends
+
+From: Ari Kauppi <kauppi@papupata.org>
+
+commit 1ea1bdf7faa4d0b5293e605f2e1ef1c2c59f6b53 upstream.
+
+The implementations are flagged in Makefile with CONFIG_HW_PERF_EVENTS
+instead of CONFIG_PERF_EVENTS.
+
+Signed-off-by: Ari Kauppi <kauppi@papupata.org>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/oprofile.h |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/oprofile.h
++++ b/include/linux/oprofile.h
+@@ -186,10 +186,10 @@ int oprofile_add_data(struct op_entry *e
+ int oprofile_add_data64(struct op_entry *entry, u64 val);
+ int oprofile_write_commit(struct op_entry *entry);
+ 
+-#ifdef CONFIG_PERF_EVENTS
++#ifdef CONFIG_HW_PERF_EVENTS
+ int __init oprofile_perf_init(struct oprofile_operations *ops);
+ void oprofile_perf_exit(void);
+ char *op_name_from_perf_id(void);
+-#endif /* CONFIG_PERF_EVENTS */
++#endif /* CONFIG_HW_PERF_EVENTS */
+ 
+ #endif /* OPROFILE_H */
diff --git a/queue-2.6.37/revert-input-do-not-pass-injected-events-back-to-the-originating-handler.patch b/queue-2.6.37/revert-input-do-not-pass-injected-events-back-to-the-originating-handler.patch
new file mode 100644
index 0000000000..c7f882df16
--- /dev/null
+++ b/queue-2.6.37/revert-input-do-not-pass-injected-events-back-to-the-originating-handler.patch
@@ -0,0 +1,157 @@
+From 9ae4345a46bdb148e32a547e89ff29563a11e127 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Wed, 2 Feb 2011 23:04:27 -0800
+Subject: Revert "Input: do not pass injected events back to the originating handler"
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 9ae4345a46bdb148e32a547e89ff29563a11e127 upstream.
+
+This reverts commit 5fdbe44d033d059cc56c2803e6b4dbd8cb4e5e39.
+
+Apparently there exist userspace programs that expect to be able to
+"loop back" and distribute to readers events written into
+/dev/input/eventX and this change made for the benefit of SysRq
+handler broke them. Now that SysRq uses alternative method to suppress
+filtering of the events it re-injects we can safely revert this change.
+
+Reported-by: Kristen Carlson Accardi <kristen@linux.intel.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/input.c |   37 +++++++++++--------------------------
+ 1 file changed, 11 insertions(+), 26 deletions(-)
+
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -73,7 +73,6 @@ static int input_defuzz_abs_event(int va
+  * dev->event_lock held and interrupts disabled.
+  */
+ static void input_pass_event(struct input_dev *dev,
+-			     struct input_handler *src_handler,
+ 			     unsigned int type, unsigned int code, int value)
+ {
+ 	struct input_handler *handler;
+@@ -92,15 +91,6 @@ static void input_pass_event(struct inpu
+ 				continue;
+ 
+ 			handler = handle->handler;
+-
+-			/*
+-			 * If this is the handler that injected this
+-			 * particular event we want to skip it to avoid
+-			 * filters firing again and again.
+-			 */
+-			if (handler == src_handler)
+-				continue;
+-
+ 			if (!handler->filter) {
+ 				if (filtered)
+ 					break;
+@@ -130,7 +120,7 @@ static void input_repeat_key(unsigned lo
+ 	if (test_bit(dev->repeat_key, dev->key) &&
+ 	    is_event_supported(dev->repeat_key, dev->keybit, KEY_MAX)) {
+ 
+-		input_pass_event(dev, NULL, EV_KEY, dev->repeat_key, 2);
++		input_pass_event(dev, EV_KEY, dev->repeat_key, 2);
+ 
+ 		if (dev->sync) {
+ 			/*
+@@ -139,7 +129,7 @@ static void input_repeat_key(unsigned lo
+ 			 * Otherwise assume that the driver will send
+ 			 * SYN_REPORT once it's done.
+ 			 */
+-			input_pass_event(dev, NULL, EV_SYN, SYN_REPORT, 1);
++			input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+ 		}
+ 
+ 		if (dev->rep[REP_PERIOD])
+@@ -172,7 +162,6 @@ static void input_stop_autorepeat(struct
+ #define INPUT_PASS_TO_ALL	(INPUT_PASS_TO_HANDLERS | INPUT_PASS_TO_DEVICE)
+ 
+ static int input_handle_abs_event(struct input_dev *dev,
+-				  struct input_handler *src_handler,
+ 				  unsigned int code, int *pval)
+ {
+ 	bool is_mt_event;
+@@ -216,15 +205,13 @@ static int input_handle_abs_event(struct
+ 	/* Flush pending "slot" event */
+ 	if (is_mt_event && dev->slot != input_abs_get_val(dev, ABS_MT_SLOT)) {
+ 		input_abs_set_val(dev, ABS_MT_SLOT, dev->slot);
+-		input_pass_event(dev, src_handler,
+-				 EV_ABS, ABS_MT_SLOT, dev->slot);
++		input_pass_event(dev, EV_ABS, ABS_MT_SLOT, dev->slot);
+ 	}
+ 
+ 	return INPUT_PASS_TO_HANDLERS;
+ }
+ 
+ static void input_handle_event(struct input_dev *dev,
+-			       struct input_handler *src_handler,
+ 			       unsigned int type, unsigned int code, int value)
+ {
+ 	int disposition = INPUT_IGNORE_EVENT;
+@@ -277,8 +264,7 @@ static void input_handle_event(struct in
+ 
+ 	case EV_ABS:
+ 		if (is_event_supported(code, dev->absbit, ABS_MAX))
+-			disposition = input_handle_abs_event(dev, src_handler,
+-							     code, &value);
++			disposition = input_handle_abs_event(dev, code, &value);
+ 
+ 		break;
+ 
+@@ -336,7 +322,7 @@ static void input_handle_event(struct in
+ 		dev->event(dev, type, code, value);
+ 
+ 	if (disposition & INPUT_PASS_TO_HANDLERS)
+-		input_pass_event(dev, src_handler, type, code, value);
++		input_pass_event(dev, type, code, value);
+ }
+ 
+ /**
+@@ -365,7 +351,7 @@ void input_event(struct input_dev *dev,
+ 
+ 		spin_lock_irqsave(&dev->event_lock, flags);
+ 		add_input_randomness(type, code, value);
+-		input_handle_event(dev, NULL, type, code, value);
++		input_handle_event(dev, type, code, value);
+ 		spin_unlock_irqrestore(&dev->event_lock, flags);
+ 	}
+ }
+@@ -395,8 +381,7 @@ void input_inject_event(struct input_han
+ 		rcu_read_lock();
+ 		grab = rcu_dereference(dev->grab);
+ 		if (!grab || grab == handle)
+-			input_handle_event(dev, handle->handler,
+-					   type, code, value);
++			input_handle_event(dev, type, code, value);
+ 		rcu_read_unlock();
+ 
+ 		spin_unlock_irqrestore(&dev->event_lock, flags);
+@@ -609,10 +594,10 @@ static void input_dev_release_keys(struc
+ 		for (code = 0; code <= KEY_MAX; code++) {
+ 			if (is_event_supported(code, dev->keybit, KEY_MAX) &&
+ 			    __test_and_clear_bit(code, dev->key)) {
+-				input_pass_event(dev, NULL, EV_KEY, code, 0);
++				input_pass_event(dev, EV_KEY, code, 0);
+ 			}
+ 		}
+-		input_pass_event(dev, NULL, EV_SYN, SYN_REPORT, 1);
++		input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+ 	}
+ }
+ 
+@@ -887,9 +872,9 @@ int input_set_keycode(struct input_dev *
+ 	    !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
+ 	    __test_and_clear_bit(old_keycode, dev->key)) {
+ 
+-		input_pass_event(dev, NULL, EV_KEY, old_keycode, 0);
++		input_pass_event(dev, EV_KEY, old_keycode, 0);
+ 		if (dev->sync)
+-			input_pass_event(dev, NULL, EV_SYN, SYN_REPORT, 1);
++			input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+ 	}
+ 
+  out:
diff --git a/queue-2.6.37/series b/queue-2.6.37/series
index 654529803c..f1c1c0c377 100644
--- a/queue-2.6.37/series
+++ b/queue-2.6.37/series
@@ -227,3 +227,15 @@ tpm_tis-use-timeouts-returned-from-tpm.patch
 selinux-define-permissions-for-dcb-netlink-messages.patch
 selinux-do-not-compute-transition-labels-on-mountpoint-labeled-filesystems.patch
 watchdog-fix-broken-nowatchdog-logic.patch
+input-sysrq-rework-re-inject-logic.patch
+revert-input-do-not-pass-injected-events-back-to-the-originating-handler.patch
+input-sysrq-ensure-sysrq_enabled-and-__sysrq_enabled-are-consistent.patch
+oprofile-fix-usage-of-config_hw_perf_events-for-oprofile_perf_init-and-friends.patch
+x86-dmi-debug-log-board-name-when-present-in-dmesg-oops-output.patch
+x86-readd-missing-irq_to_desc-in-fixup_irq.patch
+mtd-pxa3xx_nand-null-dereference-in-pxa3xx_nand_probe.patch
+ieee80211-correct-ieee80211_addba_param_buf_size_mask-macro.patch
+dm-dont-take-i_mutex-to-change-device-size.patch
+dm-mpath-disable-blk_abort_queue.patch
+arm-oprofile-fix-backtraces-in-timer-mode.patch
+net-fec-fix-mmfr_op-type-in-fec_enet_mdio_write.patch
diff --git a/queue-2.6.37/x86-dmi-debug-log-board-name-when-present-in-dmesg-oops-output.patch b/queue-2.6.37/x86-dmi-debug-log-board-name-when-present-in-dmesg-oops-output.patch
new file mode 100644
index 0000000000..cf5ecdd703
--- /dev/null
+++ b/queue-2.6.37/x86-dmi-debug-log-board-name-when-present-in-dmesg-oops-output.patch
@@ -0,0 +1,102 @@
+From 84e383b322e5348db03be54ff64cc6da87003717 Mon Sep 17 00:00:00 2001
+From: Naga Chumbalkar <nagananda.chumbalkar@hp.com>
+Date: Mon, 14 Feb 2011 22:47:17 +0000
+Subject: x86, dmi, debug: Log board name (when present) in dmesg/oops output
+
+From: Naga Chumbalkar <nagananda.chumbalkar@hp.com>
+
+commit 84e383b322e5348db03be54ff64cc6da87003717 upstream.
+
+The "Type 2" SMBIOS record that contains Board Name is not
+strictly required and may be absent in the SMBIOS on some
+platforms.
+
+( Please note that Type 2 is not listed in Table 3 in Sec 6.2
+  ("Required Structures and Data") of the SMBIOS v2.7
+  Specification. )
+
+Use the Manufacturer Name (aka System Vendor) name.
+Print Board Name only when it is present.
+
+Before the fix:
+  (i) dmesg output: DMI: /ProLiant DL380 G6, BIOS P62 01/29/2011
+ (ii) oops output:  Pid: 2170, comm: bash Not tainted 2.6.38-rc4+ #3 /ProLiant DL380 G6
+
+After the fix:
+  (i) dmesg output: DMI: HP ProLiant DL380 G6, BIOS P62 01/29/2011
+ (ii) oops output:  Pid: 2278, comm: bash Not tainted 2.6.38-rc4+ #4 HP ProLiant DL380 G6
+
+Signed-off-by: Naga Chumbalkar <nagananda.chumbalkar@hp.com>
+Reviewed-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Cc: <stable@kernel.org> # .3x - good for debugging, please apply as far back as it applies cleanly
+LKML-Reference: <20110214224423.2182.13929.sendpatchset@nchumbalkar.americas.hpqcorp.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/process.c   |   22 ++++++++++++++++------
+ drivers/firmware/dmi_scan.c |   11 +++++++++--
+ 2 files changed, 25 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -97,21 +97,31 @@ void show_regs(struct pt_regs *regs)
+ 
+ void show_regs_common(void)
+ {
+-	const char *board, *product;
++	const char *vendor, *product, *board;
+ 
+-	board = dmi_get_system_info(DMI_BOARD_NAME);
+-	if (!board)
+-		board = "";
++	vendor = dmi_get_system_info(DMI_SYS_VENDOR);
++	if (!vendor)
++		vendor = "";
+ 	product = dmi_get_system_info(DMI_PRODUCT_NAME);
+ 	if (!product)
+ 		product = "";
+ 
++	/* Board Name is optional */
++	board = dmi_get_system_info(DMI_BOARD_NAME);
++
+ 	printk(KERN_CONT "\n");
+-	printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s %s/%s\n",
++	printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
+ 		current->pid, current->comm, print_tainted(),
+ 		init_utsname()->release,
+ 		(int)strcspn(init_utsname()->version, " "),
+-		init_utsname()->version, board, product);
++		init_utsname()->version);
++	printk(KERN_CONT " ");
++	printk(KERN_CONT "%s %s", vendor, product);
++	if (board) {
++		printk(KERN_CONT "/");
++		printk(KERN_CONT "%s", board);
++	}
++	printk(KERN_CONT "\n");
+ }
+ 
+ void flush_thread(void)
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -378,10 +378,17 @@ static void __init print_filtered(const
+ 
+ static void __init dmi_dump_ids(void)
+ {
++	const char *board;	/* Board Name is optional */
++
+ 	printk(KERN_DEBUG "DMI: ");
+-	print_filtered(dmi_get_system_info(DMI_BOARD_NAME));
+-	printk(KERN_CONT "/");
++	print_filtered(dmi_get_system_info(DMI_SYS_VENDOR));
++	printk(KERN_CONT " ");
+ 	print_filtered(dmi_get_system_info(DMI_PRODUCT_NAME));
++	board = dmi_get_system_info(DMI_BOARD_NAME);
++	if (board) {
++		printk(KERN_CONT "/");
++		print_filtered(board);
++	}
+ 	printk(KERN_CONT ", BIOS ");
+ 	print_filtered(dmi_get_system_info(DMI_BIOS_VERSION));
+ 	printk(KERN_CONT " ");
diff --git a/queue-2.6.37/x86-readd-missing-irq_to_desc-in-fixup_irq.patch b/queue-2.6.37/x86-readd-missing-irq_to_desc-in-fixup_irq.patch
new file mode 100644
index 0000000000..8ec681ea42
--- /dev/null
+++ b/queue-2.6.37/x86-readd-missing-irq_to_desc-in-fixup_irq.patch
@@ -0,0 +1,34 @@
+From 5117348dea5e3ecbb785cfa1271386fb49332b41 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sat, 12 Feb 2011 11:51:03 +0100
+Subject: x86: Readd missing irq_to_desc() in fixup_irq()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 5117348dea5e3ecbb785cfa1271386fb49332b41 upstream.
+
+commit a3c08e5d(x86: Convert irq_chip access to new functions)
+accidentally zapped desc = irq_to_desc(irq); in the vector loop.
+So we lock some random irq descriptor.
+
+Add it back.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/irq.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -357,7 +357,8 @@ void fixup_irqs(void)
+ 		if (irr  & (1 << (vector % 32))) {
+ 			irq = __get_cpu_var(vector_irq)[vector];
+ 
+-			data = irq_get_irq_data(irq);
++			desc = irq_to_desc(irq);
++			data = &desc->irq_data;
+ 			raw_spin_lock(&desc->lock);
+ 			if (data->chip->irq_retrigger)
+ 				data->chip->irq_retrigger(data);