.39 patches

22 files changed, 1137 insertions, 124 deletions

diff --git a/queue-2.6.39/asus-wmi-remove-__init-from-asus_wmi_platform_init.patch b/queue-2.6.39/asus-wmi-remove-__init-from-asus_wmi_platform_init.patch
new file mode 100644
index 0000000000..ddf95bdc34
--- /dev/null
+++ b/queue-2.6.39/asus-wmi-remove-__init-from-asus_wmi_platform_init.patch
@@ -0,0 +1,31 @@
+From 39ddf3bf6463bc86041e806b43e014d50a144aa4 Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe@perches.com>
+Date: Tue, 29 Mar 2011 15:21:32 -0700
+Subject: asus-wmi: Remove __init from asus_wmi_platform_init
+
+From: Joe Perches <joe@perches.com>
+
+commit 39ddf3bf6463bc86041e806b43e014d50a144aa4 upstream.
+
+It's used by a non-init function.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/asus-wmi.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -1223,7 +1223,7 @@ static int asus_wmi_sysfs_init(struct pl
+ /*
+  * Platform device
+  */
+-static int __init asus_wmi_platform_init(struct asus_wmi *asus)
++static int asus_wmi_platform_init(struct asus_wmi *asus)
+ {
+ 	int rv;
+ 
diff --git a/queue-2.6.39/ath9k-fix-two-more-bugs-in-tx-power.patch b/queue-2.6.39/ath9k-fix-two-more-bugs-in-tx-power.patch
new file mode 100644
index 0000000000..2144ce1f6c
--- /dev/null
+++ b/queue-2.6.39/ath9k-fix-two-more-bugs-in-tx-power.patch
@@ -0,0 +1,73 @@
+From 21fdc87248d1d28492c775e05fa92b3c8c7bc8db Mon Sep 17 00:00:00 2001
+From: Daniel Halperin <dhalperi@cs.washington.edu>
+Date: Tue, 31 May 2011 11:59:30 -0700
+Subject: ath9k: fix two more bugs in tx power
+
+From: Daniel Halperin <dhalperi@cs.washington.edu>
+
+commit 21fdc87248d1d28492c775e05fa92b3c8c7bc8db upstream.
+
+This is the same fix as
+
+   commit 841051602e3fa18ea468fe5a177aa92b6eb44b56
+   Author: Matteo Croce <technoboy85@gmail.com>
+   Date:   Fri Dec 3 02:25:08 2010 +0100
+
+   The ath9k driver subtracts 3 dBm to the txpower as with two radios the
+   signal power is doubled.
+   The resulting value is assigned in an u16 which overflows and makes
+   the card work at full power.
+
+in two more places. I grepped the ath tree and didn't find any others.
+
+Signed-off-by: Daniel Halperin <dhalperi@cs.washington.edu>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_eeprom.c |   10 ++++++++--
+ drivers/net/wireless/ath/ath9k/eeprom_9287.c   |   10 ++++++++--
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -4598,10 +4598,16 @@ static void ar9003_hw_set_power_per_rate
+ 	case 1:
+ 		break;
+ 	case 2:
+-		scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++		if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
++			scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++		else
++			scaledPower = 0;
+ 		break;
+ 	case 3:
+-		scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++		if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
++			scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++		else
++			scaledPower = 0;
+ 		break;
+ 	}
+ 
+--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+@@ -522,10 +522,16 @@ static void ath9k_hw_set_ar9287_power_pe
+ 	case 1:
+ 		break;
+ 	case 2:
+-		scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++		if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
++			scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++		else
++			scaledPower = 0;
+ 		break;
+ 	case 3:
+-		scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++		if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
++			scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++		else
++			scaledPower = 0;
+ 		break;
+ 	}
+ 	scaledPower = max((u16)0, scaledPower);
diff --git a/queue-2.6.39/ath9k-reset-chip-on-baseband-hang.patch b/queue-2.6.39/ath9k-reset-chip-on-baseband-hang.patch
new file mode 100644
index 0000000000..65300b71e0
--- /dev/null
+++ b/queue-2.6.39/ath9k-reset-chip-on-baseband-hang.patch
@@ -0,0 +1,40 @@
+From a4d86d953b8593791cb29cf2acffd48f9ee6c4f9 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+Date: Fri, 20 May 2011 17:52:10 +0530
+Subject: ath9k: Reset chip on baseband hang
+
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+
+commit a4d86d953b8593791cb29cf2acffd48f9ee6c4f9 upstream.
+
+Resetting hardware helps to recover from baseband
+hang/panic for AR9003 based chips.
+
+Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -633,7 +633,8 @@ void ath9k_tasklet(unsigned long data)
+ 	u32 status = sc->intrstatus;
+ 	u32 rxmask;
+ 
+-	if (status & ATH9K_INT_FATAL) {
++	if ((status & ATH9K_INT_FATAL) ||
++	    (status & ATH9K_INT_BB_WATCHDOG)) {
+ 		ath_reset(sc, true);
+ 		return;
+ 	}
+@@ -699,6 +700,7 @@ irqreturn_t ath_isr(int irq, void *dev)
+ {
+ #define SCHED_INTR (				\
+ 		ATH9K_INT_FATAL |		\
++		ATH9K_INT_BB_WATCHDOG |		\
+ 		ATH9K_INT_RXORN |		\
+ 		ATH9K_INT_RXEOL |		\
+ 		ATH9K_INT_RX |			\
diff --git a/queue-2.6.39/ath9k-set-40-mhz-rate-only-if-hw-is-configured-in-ht40.patch b/queue-2.6.39/ath9k-set-40-mhz-rate-only-if-hw-is-configured-in-ht40.patch
new file mode 100644
index 0000000000..4cbfb21cc3
--- /dev/null
+++ b/queue-2.6.39/ath9k-set-40-mhz-rate-only-if-hw-is-configured-in-ht40.patch
@@ -0,0 +1,45 @@
+From 41e2b05b9598d6bdf91fc20280bfc538d853f769 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+Date: Fri, 20 May 2011 17:52:14 +0530
+Subject: ath9k: set 40 Mhz rate only if hw is configured in ht40
+
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+
+commit 41e2b05b9598d6bdf91fc20280bfc538d853f769 upstream.
+
+Whenever there is a channel width change from 40 Mhz to 20 Mhz,
+the hardware is reconfigured to ht20. Meantime before doing
+the rate control updation, the packets are being transmitted are
+selected rate with IEEE80211_TX_RC_40_MHZ_WIDTH.
+
+While transmitting ht40 rate packets in ht20 mode is causing
+baseband panic with AR9003 based chips.
+
+==== BB update: BB status=0x02001109 ====
+ath: ** BB state: wd=1 det=1 rdar=0 rOFDM=1 rCCK=1 tOFDM=0 tCCK=0 agc=2
+src=0 **
+ath: ** BB WD cntl: cntl1=0xffff0085 cntl2=0x00000004 **
+ath: ** BB mode: BB_gen_controls=0x000033c0 **
+ath: ** BB busy times: rx_clear=99%, rx_frame=0%, tx_frame=0% **
+ath: ==== BB update: done ====
+
+Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/rc.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/rc.c
++++ b/drivers/net/wireless/ath/ath9k/rc.c
+@@ -689,7 +689,8 @@ static void ath_rc_rate_set_series(const
+ 
+ 	if (WLAN_RC_PHY_HT(rate_table->info[rix].phy)) {
+ 		rate->flags |= IEEE80211_TX_RC_MCS;
+-		if (WLAN_RC_PHY_40(rate_table->info[rix].phy))
++		if (WLAN_RC_PHY_40(rate_table->info[rix].phy) &&
++		    conf_is_ht40(&txrc->hw->conf))
+ 			rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+ 		if (WLAN_RC_PHY_SGI(rate_table->info[rix].phy))
+ 			rate->flags |= IEEE80211_TX_RC_SHORT_GI;
diff --git a/queue-2.6.39/block-blkdev_get-should-access-bd_disk-only-after.patch b/queue-2.6.39/block-blkdev_get-should-access-bd_disk-only-after.patch
new file mode 100644
index 0000000000..956b04160c
--- /dev/null
+++ b/queue-2.6.39/block-blkdev_get-should-access-bd_disk-only-after.patch
@@ -0,0 +1,40 @@
+From 4c49ff3fe128ca68dabd07537415c419ad7f82f9 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 1 Jun 2011 08:27:41 +0200
+Subject: block: blkdev_get() should access ->bd_disk only after
+ success
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 4c49ff3fe128ca68dabd07537415c419ad7f82f9 upstream.
+
+d4dc210f69 (block: don't block events on excl write for non-optical
+devices) added dereferencing of bdev->bd_disk to test
+GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE; however, bdev->bd_disk can be
+%NULL if open failed which can lead to an oops.
+
+Test the flag after testing open was successful, not before.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: David Miller <davem@davemloft.net>
+Tested-by: David Miller <davem@davemloft.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1272,8 +1272,8 @@ int blkdev_get(struct block_device *bdev
+ 		 * individual writeable reference is too fragile given the
+ 		 * way @mode is used in blkdev_get/put().
+ 		 */
+-		if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) &&
+-		    !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) {
++		if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder &&
++		    (disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE)) {
+ 			bdev->bd_write_holder = true;
+ 			disk_block_events(disk);
+ 		}
diff --git a/queue-2.6.39/fix-oops-caused-by-queue-refcounting-failure.patch b/queue-2.6.39/fix-oops-caused-by-queue-refcounting-failure.patch
new file mode 100644
index 0000000000..29e71b3691
--- /dev/null
+++ b/queue-2.6.39/fix-oops-caused-by-queue-refcounting-failure.patch
@@ -0,0 +1,47 @@
+From e73e079bf128d68284efedeba1fbbc18d78610f9 Mon Sep 17 00:00:00 2001
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Wed, 25 May 2011 15:52:14 -0500
+Subject: [SCSI] Fix oops caused by queue refcounting failure
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit e73e079bf128d68284efedeba1fbbc18d78610f9 upstream.
+
+In certain circumstances, we can get an oops from a torn down device.
+Most notably this is from CD roms trying to call scsi_ioctl.  The root
+cause of the problem is the fact that after scsi_remove_device() has
+been called, the queue is fully torn down.  This is actually wrong
+since the queue can be used until the sdev release function is called.
+Therefore, we add an extra reference to the queue which is released in
+sdev->release, so the queue always exists.
+
+Reported-by: Parag Warudkar <parag.lkml@gmail.com>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_scan.c  |    2 +-
+ drivers/scsi/scsi_sysfs.c |    1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sd
+ 		kfree(sdev);
+ 		goto out;
+ 	}
+-
++	blk_get_queue(sdev->request_queue);
+ 	sdev->request_queue->queuedata = sdev;
+ 	scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
+ 
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -322,6 +322,7 @@ static void scsi_device_dev_release_user
+ 		kfree(evt);
+ 	}
+ 
++	blk_put_queue(sdev->request_queue);
+ 	/* NULL queue means the device can't be used */
+ 	sdev->request_queue = NULL;
+ 
diff --git a/queue-2.6.39/hwmon-coretemp-fix-tjmax-detection-for-older-cpus.patch b/queue-2.6.39/hwmon-coretemp-fix-tjmax-detection-for-older-cpus.patch
new file mode 100644
index 0000000000..d08672b34e
--- /dev/null
+++ b/queue-2.6.39/hwmon-coretemp-fix-tjmax-detection-for-older-cpus.patch
@@ -0,0 +1,66 @@
+From 4f5f71a7abe329bdad81ee6a8e4545054a7cc30a Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Tue, 31 May 2011 06:54:21 -0700
+Subject: hwmon: (coretemp) Fix TjMax detection for older CPUs
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit 4f5f71a7abe329bdad81ee6a8e4545054a7cc30a upstream.
+
+Commit a321cedb12904114e2ba5041a3673ca24deb09c9 excludes CPU models 0xe, 0xf,
+0x16, and 0x1a from TjMax temperature adjustment, even though several of those
+CPUs are known to have TiMax other than 100 degrees C, and even though the code
+in adjust_tjmax() explicitly handles those CPUs and points to a Web document
+listing several of the affected CPU IDs.
+
+Reinstate original TjMax adjustment if TjMax can not be determined using the
+IA32_TEMPERATURE_TARGET register.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=32582
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Cc: Huaxu Wan <huaxu.wan@linux.intel.com>
+Cc: Carsten Emde <C.Emde@osadl.org>
+Cc: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Cc: Yong Wang <yong.y.wang@linux.intel.com>
+Cc: Rudolf Marek <r.marek@assembler.cz>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Tested-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/coretemp.c |   19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -271,24 +271,9 @@ static int __devinit get_tjmax(struct cp
+ 
+ 	/*
+ 	 * An assumption is made for early CPUs and unreadable MSR.
+-	 * NOTE: the given value may not be correct.
++	 * NOTE: the calculated value may not be correct.
+ 	 */
+-
+-	switch (c->x86_model) {
+-	case 0xe:
+-	case 0xf:
+-	case 0x16:
+-	case 0x1a:
+-		dev_warn(dev, "TjMax is assumed as 100 C!\n");
+-		return 100000;
+-	case 0x17:
+-	case 0x1c:		/* Atom CPUs */
+-		return adjust_tjmax(c, id, dev);
+-	default:
+-		dev_warn(dev, "CPU (model=0x%x) is not supported yet,"
+-			" using default TjMax of 100C.\n", c->x86_model);
+-		return 100000;
+-	}
++	return adjust_tjmax(c, id, dev);
+ }
+ 
+ static void __devinit get_ucode_rev_on_cpu(void *edx)
diff --git a/queue-2.6.39/hwmon-coretemp-relax-target-temperature-range-check.patch b/queue-2.6.39/hwmon-coretemp-relax-target-temperature-range-check.patch
new file mode 100644
index 0000000000..f98a7ae6f0
--- /dev/null
+++ b/queue-2.6.39/hwmon-coretemp-relax-target-temperature-range-check.patch
@@ -0,0 +1,36 @@
+From 4c6e0f8101e62d8b2d01dc94b835a98b191a1454 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Tue, 31 May 2011 15:50:51 -0400
+Subject: hwmon: (coretemp) Relax target temperature range check
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 4c6e0f8101e62d8b2d01dc94b835a98b191a1454 upstream.
+
+The current temperature range check of MSR_IA32_TEMPERATURE_TARGET
+seems too strict to me, some TjMax values documented in
+Documentation/hwmon/coretemp wouldn't pass. Relax the check so that
+all the documented values pass.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Cc: Carsten Emde <C.Emde@osadl.org>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/hwmon/coretemp.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -263,7 +263,7 @@ static int __devinit get_tjmax(struct cp
+ 		 * If the TjMax is not plausible, an assumption
+ 		 * will be used
+ 		 */
+-		if ((val > 80) && (val < 120)) {
++		if (val >= 70 && val <= 125) {
+ 			dev_info(dev, "TjMax is %d C.\n", val);
+ 			return val * 1000;
+ 		}
diff --git a/queue-2.6.39/iwl4965-correctly-validate-temperature-value.patch b/queue-2.6.39/iwl4965-correctly-validate-temperature-value.patch
new file mode 100644
index 0000000000..85fe30d1ae
--- /dev/null
+++ b/queue-2.6.39/iwl4965-correctly-validate-temperature-value.patch
@@ -0,0 +1,35 @@
+From dfe21582ac5ebc460dda98c67e8589dd506d02cd Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 1 Jun 2011 17:17:57 +0200
+Subject: iwl4965: correctly validate temperature value
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit dfe21582ac5ebc460dda98c67e8589dd506d02cd upstream.
+
+In some cases we can read wrong temperature value. If after that
+temperature value will not be updated to good one, we badly configure
+tx power parameters and device is unable to send a data.
+
+Resolves:
+https://bugzilla.kernel.org/show_bug.cgi?id=35932
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlegacy/iwl-4965.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlegacy/iwl-4965.c
++++ b/drivers/net/wireless/iwlegacy/iwl-4965.c
+@@ -1543,7 +1543,7 @@ static void iwl4965_temperature_calib(st
+ 	s32 temp;
+ 
+ 	temp = iwl4965_hw_get_temperature(priv);
+-	if (temp < 0)
++	if (IWL_TX_POWER_TEMPERATURE_OUT_OF_RANGE(temp))
+ 		return;
+ 
+ 	if (priv->temperature != temp) {
diff --git a/queue-2.6.39/iwl4965-fix-5ghz-operation.patch b/queue-2.6.39/iwl4965-fix-5ghz-operation.patch
new file mode 100644
index 0000000000..8acc214086
--- /dev/null
+++ b/queue-2.6.39/iwl4965-fix-5ghz-operation.patch
@@ -0,0 +1,35 @@
+From aac11c1b351413aa3412e258e2b2dcba31777209 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 24 May 2011 16:28:55 +0200
+Subject: iwl4965: fix 5GHz operation
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit aac11c1b351413aa3412e258e2b2dcba31777209 upstream.
+
+rx_status.band is used uninitialized, what disallow to work on 5GHz .
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlegacy/iwl-4965-lib.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
++++ b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
+@@ -628,11 +628,11 @@ void iwl4965_rx_reply_rx(struct iwl_priv
+ 
+ 	/* rx_status carries information about the packet to mac80211 */
+ 	rx_status.mactime = le64_to_cpu(phy_res->timestamp);
++	rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
++				IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+ 	rx_status.freq =
+ 		ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel),
+ 							rx_status.band);
+-	rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+-				IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+ 	rx_status.rate_idx =
+ 		iwl4965_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
+ 	rx_status.flag = 0;
diff --git a/queue-2.6.39/mm-fix-enospc-returned-by-handle_mm_fault.patch b/queue-2.6.39/mm-fix-enospc-returned-by-handle_mm_fault.patch
new file mode 100644
index 0000000000..606cae9b0b
--- /dev/null
+++ b/queue-2.6.39/mm-fix-enospc-returned-by-handle_mm_fault.patch
@@ -0,0 +1,37 @@
+From e0dcd8a05be438b3d2e49ef61441ea3a463663f8 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Sun, 5 Jun 2011 22:03:13 -0700
+Subject: mm: fix ENOSPC returned by handle_mm_fault()
+
+From: Hugh Dickins <hughd@google.com>
+
+commit e0dcd8a05be438b3d2e49ef61441ea3a463663f8 upstream.
+
+Al Viro observes that in the hugetlb case, handle_mm_fault() may return
+a value of the kind ENOSPC when its caller is expecting a value of the
+kind VM_FAULT_SIGBUS: fix alloc_huge_page()'s failure returns.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Acked-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1033,10 +1033,10 @@ static struct page *alloc_huge_page(stru
+ 	 */
+ 	chg = vma_needs_reservation(h, vma, addr);
+ 	if (chg < 0)
+-		return ERR_PTR(chg);
++		return ERR_PTR(-VM_FAULT_OOM);
+ 	if (chg)
+ 		if (hugetlb_get_quota(inode->i_mapping, chg))
+-			return ERR_PTR(-ENOSPC);
++			return ERR_PTR(-VM_FAULT_SIGBUS);
+ 
+ 	spin_lock(&hugetlb_lock);
+ 	page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve);
diff --git a/queue-2.6.39/nbd-limit-module-parameters-to-a-sane-value.patch b/queue-2.6.39/nbd-limit-module-parameters-to-a-sane-value.patch
new file mode 100644
index 0000000000..7f63c34651
--- /dev/null
+++ b/queue-2.6.39/nbd-limit-module-parameters-to-a-sane-value.patch
@@ -0,0 +1,88 @@
+From 3b2710824e00d238554c13b5add347e6c701ab1a Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Sat, 28 May 2011 14:44:46 +0200
+Subject: nbd: limit module parameters to a sane value
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 3b2710824e00d238554c13b5add347e6c701ab1a upstream.
+
+The 'max_part' parameter controls the number of maximum partition
+a nbd device can have. However if a user specifies very large
+value it would exceed the limitation of device minor number and
+can cause a kernel oops (or, at least, produce invalid device
+nodes in some cases).
+
+In addition, specifying large 'nbds_max' value causes same
+problem for the same reason.
+
+On my desktop, following command results to the kernel bug:
+
+$ sudo modprobe nbd max_part=100000
+ kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65!
+ invalid opcode: 0000 [#1] SMP
+ last sysfs file: /sys/devices/virtual/block/nbd4/range
+ CPU 1
+ Modules linked in: nbd(+) bridge stp llc kvm_intel kvm asus_atk0110 sg sr_mod cdrom
+
+ Pid: 2522, comm: modprobe Tainted: G        W   2.6.39-leonard+ #159 System manufacturer System Product Name/P5G41TD-M PRO
+ RIP: 0010:[<ffffffff8115aa08>]  [<ffffffff8115aa08>] internal_create_group+0x2f/0x166
+ RSP: 0018:ffff8801009f1de8  EFLAGS: 00010246
+ RAX: 00000000ffffffef RBX: ffff880103920478 RCX: 00000000000a7bd3
+ RDX: ffffffff81a2dbe0 RSI: 0000000000000000 RDI: ffff880103920478
+ RBP: ffff8801009f1e38 R08: ffff880103920468 R09: ffff880103920478
+ R10: ffff8801009f1de8 R11: ffff88011eccbb68 R12: ffffffff81a2dbe0
+ R13: ffff880103920468 R14: 0000000000000000 R15: ffff880103920400
+ FS:  00007f3c49de9700(0000) GS:ffff88011f800000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: 00007f3b7fe7c000 CR3: 00000000cd58d000 CR4: 00000000000406e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Process modprobe (pid: 2522, threadinfo ffff8801009f0000, task ffff8801009a93a0)
+ Stack:
+  ffff8801009f1e58 ffffffff812e8f6e ffff8801009f1e58 ffffffff812e7a80
+  ffff880000000010 ffff880103920400 ffff8801002fd0c0 ffff880103920468
+  0000000000000011 ffff880103920400 ffff8801009f1e48 ffffffff8115ab6a
+ Call Trace:
+  [<ffffffff812e8f6e>] ? device_add+0x4f1/0x5e4
+  [<ffffffff812e7a80>] ? dev_set_name+0x41/0x43
+  [<ffffffff8115ab6a>] sysfs_create_group+0x13/0x15
+  [<ffffffff810b857e>] blk_trace_init_sysfs+0x14/0x16
+  [<ffffffff811ee58b>] blk_register_queue+0x4c/0xfd
+  [<ffffffff811f3bdf>] add_disk+0xe4/0x29c
+  [<ffffffffa007e2ab>] nbd_init+0x2ab/0x30d [nbd]
+  [<ffffffffa007e000>] ? 0xffffffffa007dfff
+  [<ffffffff8100020f>] do_one_initcall+0x7f/0x13e
+  [<ffffffff8107ab0a>] sys_init_module+0xa1/0x1e3
+  [<ffffffff814f3542>] system_call_fastpath+0x16/0x1b
+ Code: 41 57 41 56 41 55 41 54 53 48 83 ec 28 0f 1f 44 00 00 48 89 fb 41 89 f6 49 89 d4 48 85 ff 74 0b 85 f6 75 0b 48 83
+  7f 30 00 75 14 <0f> 0b eb fe b9 ea ff ff ff 48 83 7f 30 00 0f 84 09 01 00 00 49
+ RIP  [<ffffffff8115aa08>] internal_create_group+0x2f/0x166
+  RSP <ffff8801009f1de8>
+ ---[ end trace 753285ffbf72c57c ]---
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Cc: Paul Clements <Paul.Clements@steeleye.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/nbd.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -756,6 +756,12 @@ static int __init nbd_init(void)
+ 	if (max_part > 0)
+ 		part_shift = fls(max_part);
+ 
++	if ((1UL << part_shift) > DISK_MAX_PARTS)
++		return -EINVAL;
++
++	if (nbds_max > 1UL << (MINORBITS - part_shift))
++		return -EINVAL;
++
+ 	for (i = 0; i < nbds_max; i++) {
+ 		struct gendisk *disk = alloc_disk(1 << part_shift);
+ 		if (!disk)
diff --git a/queue-2.6.39/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch b/queue-2.6.39/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch
new file mode 100644
index 0000000000..9894977c27
--- /dev/null
+++ b/queue-2.6.39/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch
@@ -0,0 +1,85 @@
+From e522a7126c7c144a1dd14c6f217ac31e71082b1d Mon Sep 17 00:00:00 2001
+From: "Jordan_Hargrave@Dell.com" <Jordan_Hargrave@Dell.com>
+Date: Mon, 9 May 2011 15:24:55 -0500
+Subject: PCI: Set PCIE maxpayload for card during hotplug insertion
+
+From: "Jordan_Hargrave@Dell.com" <Jordan_Hargrave@Dell.com>
+
+commit e522a7126c7c144a1dd14c6f217ac31e71082b1d upstream.
+
+The following patch sets the MaxPayload setting to match the parent
+reading when inserting a PCIE card into a hotplug slot.  On our system,
+the upstream bridge is set to 256, but when inserting a card, the card
+setting defaults to 128.  As soon as I/O is performed to the card it
+starts receiving errors since the payload size is too small.
+
+Reviewed-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+Signed-off-by: Jordan Hargrave <jordan_hargrave@dell.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/hotplug/pcihp_slot.c |   45 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+--- a/drivers/pci/hotplug/pcihp_slot.c
++++ b/drivers/pci/hotplug/pcihp_slot.c
+@@ -158,6 +158,47 @@ static void program_hpp_type2(struct pci
+ 	 */
+ }
+ 
++/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */
++static int pci_set_payload(struct pci_dev *dev)
++{
++       int pos, ppos;
++       u16 pctl, psz;
++       u16 dctl, dsz, dcap, dmax;
++       struct pci_dev *parent;
++
++       parent = dev->bus->self;
++       pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
++       if (!pos)
++               return 0;
++
++       /* Read Device MaxPayload capability and setting */
++       pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl);
++       pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap);
++       dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5;
++       dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD);
++
++       /* Read Parent MaxPayload setting */
++       ppos = pci_find_capability(parent, PCI_CAP_ID_EXP);
++       if (!ppos)
++               return 0;
++       pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl);
++       psz = (pctl &  PCI_EXP_DEVCTL_PAYLOAD) >> 5;
++
++       /* If parent payload > device max payload -> error
++        * If parent payload > device payload -> set speed
++        * If parent payload <= device payload -> do nothing
++        */
++       if (psz > dmax)
++               return -1;
++       else if (psz > dsz) {
++               dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz);
++               pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
++                                     (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) +
++                                     (psz << 5));
++       }
++       return 0;
++}
++
+ void pci_configure_slot(struct pci_dev *dev)
+ {
+ 	struct pci_dev *cdev;
+@@ -169,6 +210,10 @@ void pci_configure_slot(struct pci_dev *
+ 			(dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
+ 		return;
+ 
++       ret = pci_set_payload(dev);
++       if (ret)
++               dev_warn(&dev->dev, "could not set device max payload\n");
++
+ 	memset(&hpp, 0, sizeof(hpp));
+ 	ret = pci_get_hp_params(dev, &hpp);
+ 	if (ret)
diff --git a/queue-2.6.39/powerpc-fix-32-bit-smp-build.patch b/queue-2.6.39/powerpc-fix-32-bit-smp-build.patch
new file mode 100644
index 0000000000..9f2d15dd9e
--- /dev/null
+++ b/queue-2.6.39/powerpc-fix-32-bit-smp-build.patch
@@ -0,0 +1,36 @@
+From 6de06f313a65d0ecabf055e708d082002b568866 Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@linux.vnet.ibm.com>
+Date: Fri, 20 May 2011 16:22:25 -0400
+Subject: powerpc: Fix 32-bit SMP build
+
+From: Josh Boyer <jwboyer@linux.vnet.ibm.com>
+
+commit 6de06f313a65d0ecabf055e708d082002b568866 upstream.
+
+Commit 69e3cea8d5fd526 ("powerpc/smp: Make start_secondary_resume
+available to all CPU variants") introduced start_secondary_resume to
+misc_32.S, however it uses a 64-bit instruction which is not valid on
+32-bit platforms.  Use 'stw' instead.
+
+Reported-by: Richard Cochran <richardcochran@gmail.com>
+Tested-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Josh Boyer <jwboyer@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/head_32.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/head_32.S
++++ b/arch/powerpc/kernel/head_32.S
+@@ -896,7 +896,7 @@ _GLOBAL(start_secondary_resume)
+ 	rlwinm	r1,r1,0,0,(31-THREAD_SHIFT)	/* current_thread_info() */
+ 	addi	r1,r1,THREAD_SIZE-STACK_FRAME_OVERHEAD
+ 	li	r3,0
+-	std	r3,0(r1)		/* Zero the stack frame pointer	*/
++	stw	r3,0(r1)		/* Zero the stack frame pointer	*/
+ 	bl	start_secondary
+ 	b	.
+ #endif /* CONFIG_SMP */
diff --git a/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch b/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch
deleted file mode 100644
index 8a5ef567bb..0000000000
--- a/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From 099fb8ab1e57e5d609ac686cc0ab6d1835a79155 Mon Sep 17 00:00:00 2001
-From: Larry Finger <Larry.Finger@lwfinger.net>
-Date: Sat, 14 May 2011 10:15:17 -0500
-Subject: rtlwifi: rtl8192c-common: rtl8192ce: Fix for HT40 regression
-
-From: Larry Finger <Larry.Finger@lwfinger.net>
-
-commit 099fb8ab1e57e5d609ac686cc0ab6d1835a79155 upstream.
-
-The changes that were made to rtl8192ce when rtl8192cu was added broke
-HT40. The errors included a typo in rtlwifi, a missing routine in
-rtl8192ce and a missing callback of that routine in rtl8192c-common.
-
-This patch fixes the regression reported in Bug #35082.
-
-Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
-Signed-off-by: John W. Linville <linville@tuxdriver.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/net/wireless/rtlwifi/ps.c            |    2 
- drivers/net/wireless/rtlwifi/rtl8192ce/phy.c |   69 +++++++++++++++++++++++++++
- drivers/net/wireless/rtlwifi/rtl8192ce/phy.h |    1 
- 3 files changed, 71 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/rtlwifi/ps.c
-+++ b/drivers/net/wireless/rtlwifi/ps.c
-@@ -205,7 +205,7 @@ static void _rtl_ps_inactive_ps(struct i
- 	rtl_ps_set_rf_state(hw, ppsc->inactive_pwrstate,
- 			    RF_CHANGE_BY_IPS, false);
- 
--	if (ppsc->inactive_pwrstate == ERFOFF &&
-+	if (ppsc->inactive_pwrstate == ERFON &&
- 	    rtlhal->interface == INTF_PCI) {
- 		if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM) {
- 			rtlpriv->intf_ops->enable_aspm(hw);
---- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
-@@ -432,6 +432,75 @@ void rtl92ce_phy_set_bw_mode_callback(st
- 	RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, ("<==\n"));
- }
- 
-+void rtl92ce_phy_set_bw_mode_callback(struct ieee80211_hw *hw)
-+{
-+	struct rtl_priv *rtlpriv = rtl_priv(hw);
-+	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-+	struct rtl_phy *rtlphy = &(rtlpriv->phy);
-+	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-+	u8 reg_bw_opmode;
-+	u8 reg_prsr_rsc;
-+
-+	RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE,
-+		 ("Switch to %s bandwidth\n",
-+		  rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20 ?
-+		  "20MHz" : "40MHz"))
-+
-+	if (is_hal_stop(rtlhal)) {
-+		rtlphy->set_bwmode_inprogress = false;
-+		return;
-+	}
-+
-+	reg_bw_opmode = rtl_read_byte(rtlpriv, REG_BWOPMODE);
-+	reg_prsr_rsc = rtl_read_byte(rtlpriv, REG_RRSR + 2);
-+
-+	switch (rtlphy->current_chan_bw) {
-+	case HT_CHANNEL_WIDTH_20:
-+		reg_bw_opmode |= BW_OPMODE_20MHZ;
-+		rtl_write_byte(rtlpriv, REG_BWOPMODE, reg_bw_opmode);
-+		break;
-+	case HT_CHANNEL_WIDTH_20_40:
-+		reg_bw_opmode &= ~BW_OPMODE_20MHZ;
-+		rtl_write_byte(rtlpriv, REG_BWOPMODE, reg_bw_opmode);
-+		reg_prsr_rsc =
-+		    (reg_prsr_rsc & 0x90) | (mac->cur_40_prime_sc << 5);
-+		rtl_write_byte(rtlpriv, REG_RRSR + 2, reg_prsr_rsc);
-+		break;
-+	default:
-+		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-+			 ("unknown bandwidth: %#X\n", rtlphy->current_chan_bw));
-+		break;
-+	}
-+
-+	switch (rtlphy->current_chan_bw) {
-+	case HT_CHANNEL_WIDTH_20:
-+		rtl_set_bbreg(hw, RFPGA0_RFMOD, BRFMOD, 0x0);
-+		rtl_set_bbreg(hw, RFPGA1_RFMOD, BRFMOD, 0x0);
-+		rtl_set_bbreg(hw, RFPGA0_ANALOGPARAMETER2, BIT(10), 1);
-+		break;
-+	case HT_CHANNEL_WIDTH_20_40:
-+		rtl_set_bbreg(hw, RFPGA0_RFMOD, BRFMOD, 0x1);
-+		rtl_set_bbreg(hw, RFPGA1_RFMOD, BRFMOD, 0x1);
-+
-+		rtl_set_bbreg(hw, RCCK0_SYSTEM, BCCK_SIDEBAND,
-+			      (mac->cur_40_prime_sc >> 1));
-+		rtl_set_bbreg(hw, ROFDM1_LSTF, 0xC00, mac->cur_40_prime_sc);
-+		rtl_set_bbreg(hw, RFPGA0_ANALOGPARAMETER2, BIT(10), 0);
-+
-+		rtl_set_bbreg(hw, 0x818, (BIT(26) | BIT(27)),
-+			      (mac->cur_40_prime_sc ==
-+			       HAL_PRIME_CHNL_OFFSET_LOWER) ? 2 : 1);
-+		break;
-+	default:
-+		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-+			 ("unknown bandwidth: %#X\n", rtlphy->current_chan_bw));
-+		break;
-+	}
-+	rtl92ce_phy_rf6052_set_bandwidth(hw, rtlphy->current_chan_bw);
-+	rtlphy->set_bwmode_inprogress = false;
-+	RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, ("<==\n"));
-+}
-+
- void _rtl92ce_phy_lc_calibrate(struct ieee80211_hw *hw, bool is2t)
- {
- 	u8 tmpreg;
---- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
-+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
-@@ -250,5 +250,6 @@ bool _rtl92ce_phy_config_mac_with_header
- void _rtl92c_phy_init_bb_rf_register_definition(struct ieee80211_hw *hw);
- bool _rtl92c_phy_bb8192c_config_parafile(struct ieee80211_hw *hw);
- void _rtl92c_phy_set_rf_sleep(struct ieee80211_hw *hw);
-+void rtl92ce_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
- 
- #endif
diff --git a/queue-2.6.39/serial-core-do-not-set-dtr-rts-twice-on-startup.patch b/queue-2.6.39/serial-core-do-not-set-dtr-rts-twice-on-startup.patch
new file mode 100644
index 0000000000..25f31f88d4
--- /dev/null
+++ b/queue-2.6.39/serial-core-do-not-set-dtr-rts-twice-on-startup.patch
@@ -0,0 +1,48 @@
+From 303a7a1199c20f7c9452f024a6e17bf348b6b398 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Wed, 30 Mar 2011 00:10:56 +0200
+Subject: serial: core, do not set DTR/RTS twice on startup
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 303a7a1199c20f7c9452f024a6e17bf348b6b398 upstream.
+
+In .dtr_rts we do:
+  uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS)
+and call uart_update_termios. It does:
+  uart_set_mctrl(port, TIOCM_DTR | TIOCM_RTS)
+once again. As the only callsite of uart_update_termios is .dtr_rts,
+remove the uart_set_mctrl from uart_update_termios to not set it twice.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/serial/serial_core.c |   14 --------------
+ 1 file changed, 14 deletions(-)
+
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1483,20 +1483,6 @@ static void uart_hangup(struct tty_struc
+ static void uart_update_termios(struct tty_struct *tty,
+ 						struct uart_state *state)
+ {
+-	struct uart_port *port = state->uart_port;
+-
+-	/*
+-	 * If the device failed to grab its irq resources,
+-	 * or some other error occurred, don't try to talk
+-	 * to the port hardware.
+-	 */
+-	if (!(tty->flags & (1 << TTY_IO_ERROR))) {
+-		/*
+-		 * And finally enable the RTS and DTR signals.
+-		 */
+-		if (tty->termios->c_cflag & CBAUD)
+-			uart_set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
+-	}
+ }
+ 
+ static int uart_carrier_raised(struct tty_port *port)
diff --git a/queue-2.6.39/serial-core-move-termios-handling-to-uart_startup.patch b/queue-2.6.39/serial-core-move-termios-handling-to-uart_startup.patch
new file mode 100644
index 0000000000..cfa55bdb3b
--- /dev/null
+++ b/queue-2.6.39/serial-core-move-termios-handling-to-uart_startup.patch
@@ -0,0 +1,84 @@
+From c7d7abff40c27f82fe78b1091ab3fad69b2546f9 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Wed, 30 Mar 2011 00:10:55 +0200
+Subject: serial: core, move termios handling to uart_startup
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit c7d7abff40c27f82fe78b1091ab3fad69b2546f9 upstream.
+
+We should not fiddle with speed and cflags in .dtr_rts hook. Actually
+we might not have tty at that moment already.
+
+So move the console cflag copy and speed setup into uart_startup.
+Actually the speed setup is already there, but we need to call it
+unconditionally (uart_startup is called from uart_open with hw_init =
+0).
+
+This means we move uart_change_speed before dtr/rts setup in .dtr_rts.
+But this should not matter as the setup should be called after
+uart_change_speed anyway.
+Before:                             After:
+dtr/rts setup (dtr_rts)             uart_change_speed (startup)
+uart_change_speed (update_termios)  dtr/rts setup (dtr_rts)
+dtr/rts setup (update_termios)      dtr/rts setup (update_termios)
+
+The second setup will dismiss with the next patch.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/serial/serial_core.c |   24 +++++++++---------------
+ 1 file changed, 9 insertions(+), 15 deletions(-)
+
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -172,12 +172,16 @@ static int uart_startup(struct tty_struc
+ 
+ 	retval = uport->ops->startup(uport);
+ 	if (retval == 0) {
+-		if (init_hw) {
+-			/*
+-			 * Initialise the hardware port settings.
+-			 */
+-			uart_change_speed(tty, state, NULL);
++		if (uart_console(uport) && uport->cons->cflag) {
++			tty->termios->c_cflag = uport->cons->cflag;
++			uport->cons->cflag = 0;
++		}
++		/*
++		 * Initialise the hardware port settings.
++		 */
++		uart_change_speed(tty, state, NULL);
+ 
++		if (init_hw) {
+ 			/*
+ 			 * Setup the RTS and DTR signals once the
+ 			 * port is open and ready to respond.
+@@ -1481,11 +1485,6 @@ static void uart_update_termios(struct t
+ {
+ 	struct uart_port *port = state->uart_port;
+ 
+-	if (uart_console(port) && port->cons->cflag) {
+-		tty->termios->c_cflag = port->cons->cflag;
+-		port->cons->cflag = 0;
+-	}
+-
+ 	/*
+ 	 * If the device failed to grab its irq resources,
+ 	 * or some other error occurred, don't try to talk
+@@ -1493,11 +1492,6 @@ static void uart_update_termios(struct t
+ 	 */
+ 	if (!(tty->flags & (1 << TTY_IO_ERROR))) {
+ 		/*
+-		 * Make termios settings take effect.
+-		 */
+-		uart_change_speed(tty, state, NULL);
+-
+-		/*
+ 		 * And finally enable the RTS and DTR signals.
+ 		 */
+ 		if (tty->termios->c_cflag & CBAUD)
diff --git a/queue-2.6.39/serial-core-remove-uart_update_termios.patch b/queue-2.6.39/serial-core-remove-uart_update_termios.patch
new file mode 100644
index 0000000000..c2c9655608
--- /dev/null
+++ b/queue-2.6.39/serial-core-remove-uart_update_termios.patch
@@ -0,0 +1,67 @@
+From 6f5c24ad0f7619502199185a026a228174a27e68 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Wed, 30 Mar 2011 00:10:57 +0200
+Subject: serial: core, remove uart_update_termios
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 6f5c24ad0f7619502199185a026a228174a27e68 upstream.
+
+Now, uart_update_termios is empty, so it's time to remove it. We no
+longer need a live tty in .dtr_rts. So this should prune all the bugs
+where tty is zeroed in port->tty during tty_port_block_til_ready.
+
+There is one thing to note. We don't set ASYNC_NORMAL_ACTIVE now. It's
+because this is done already in tty_port_block_til_ready.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/serial/serial_core.c |   25 +------------------------
+ 1 file changed, 1 insertion(+), 24 deletions(-)
+
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1470,21 +1470,6 @@ static void uart_hangup(struct tty_struc
+ 	mutex_unlock(&port->mutex);
+ }
+ 
+-/**
+- *	uart_update_termios	-	update the terminal hw settings
+- *	@tty: tty associated with UART
+- *	@state: UART to update
+- *
+- *	Copy across the serial console cflag setting into the termios settings
+- *	for the initial open of the port.  This allows continuity between the
+- *	kernel settings, and the settings init adopts when it opens the port
+- *	for the first time.
+- */
+-static void uart_update_termios(struct tty_struct *tty,
+-						struct uart_state *state)
+-{
+-}
+-
+ static int uart_carrier_raised(struct tty_port *port)
+ {
+ 	struct uart_state *state = container_of(port, struct uart_state, port);
+@@ -1504,16 +1489,8 @@ static void uart_dtr_rts(struct tty_port
+ 	struct uart_state *state = container_of(port, struct uart_state, port);
+ 	struct uart_port *uport = state->uart_port;
+ 
+-	if (onoff) {
++	if (onoff)
+ 		uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+-
+-		/*
+-		 * If this is the first open to succeed,
+-		 * adjust things to suit.
+-		 */
+-		if (!test_and_set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags))
+-			uart_update_termios(port->tty, state);
+-	}
+ 	else
+ 		uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+ }
diff --git a/queue-2.6.39/series b/queue-2.6.39/series
index ffe62ad8a4..ed15c6b3bf 100644
--- a/queue-2.6.39/series
+++ b/queue-2.6.39/series
@@ -8,5 +8,24 @@ intel-iommu-use-coherent-dma-mask-when-requested.patch
 intel-iommu-remove-host-bridge-devices-from-identity.patch
 intel-iommu-add-domain-check-in-domain_remove_one_dev_info.patch
 powerpc-4xx-fix-regression-in-smp-on-476.patch
-rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch
 arch-tile-allocate-pci-irqs-later-in-boot.patch
+ubifs-fix-shrinker-object-count-reports.patch
+ubifs-fix-memory-leak-on-error-path.patch
+block-blkdev_get-should-access-bd_disk-only-after.patch
+nbd-limit-module-parameters-to-a-sane-value.patch
+fix-oops-caused-by-queue-refcounting-failure.patch
+ath9k-reset-chip-on-baseband-hang.patch
+ath9k-set-40-mhz-rate-only-if-hw-is-configured-in-ht40.patch
+ath9k-fix-two-more-bugs-in-tx-power.patch
+hwmon-coretemp-fix-tjmax-detection-for-older-cpus.patch
+hwmon-coretemp-relax-target-temperature-range-check.patch
+iwl4965-fix-5ghz-operation.patch
+iwl4965-correctly-validate-temperature-value.patch
+zd1211rw-fix-to-work-on-ohci.patch
+mm-fix-enospc-returned-by-handle_mm_fault.patch
+serial-core-move-termios-handling-to-uart_startup.patch
+serial-core-do-not-set-dtr-rts-twice-on-startup.patch
+serial-core-remove-uart_update_termios.patch
+pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch
+powerpc-fix-32-bit-smp-build.patch
+asus-wmi-remove-__init-from-asus_wmi_platform_init.patch
diff --git a/queue-2.6.39/ubifs-fix-memory-leak-on-error-path.patch b/queue-2.6.39/ubifs-fix-memory-leak-on-error-path.patch
new file mode 100644
index 0000000000..63b3aa8178
--- /dev/null
+++ b/queue-2.6.39/ubifs-fix-memory-leak-on-error-path.patch
@@ -0,0 +1,31 @@
+From 812eb258311f89bcd664a34a620f249d54a2cd83 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Date: Tue, 31 May 2011 08:40:40 +0300
+Subject: UBIFS: fix memory leak on error path
+
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+
+commit 812eb258311f89bcd664a34a620f249d54a2cd83 upstream.
+
+UBIFS leaks memory on error path in 'ubifs_jnl_update()' in case of write
+failure because it forgets to free the 'struct ubifs_dent_node *dent' object.
+Although the object is small, the alignment can make it large - e.g., 2KiB
+if the min. I/O unit is 2KiB.
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/journal.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -666,6 +666,7 @@ out_free:
+ 
+ out_release:
+ 	release_head(c, BASEHD);
++	kfree(dent);
+ out_ro:
+ 	ubifs_ro_mode(c, err);
+ 	if (last_reference)
diff --git a/queue-2.6.39/ubifs-fix-shrinker-object-count-reports.patch b/queue-2.6.39/ubifs-fix-shrinker-object-count-reports.patch
new file mode 100644
index 0000000000..624e08534d
--- /dev/null
+++ b/queue-2.6.39/ubifs-fix-shrinker-object-count-reports.patch
@@ -0,0 +1,40 @@
+From cf610bf4199770420629d3bc273494bd27ad6c1d Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Date: Tue, 31 May 2011 07:03:21 +0300
+Subject: UBIFS: fix shrinker object count reports
+
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+
+commit cf610bf4199770420629d3bc273494bd27ad6c1d upstream.
+
+Sometimes VM asks the shrinker to return amount of objects it can shrink,
+and we return the ubifs_clean_zn_cnt in that case. However, it is possible
+that this counter is negative for a short period of time, due to the way
+UBIFS TNC code updates it. And I can observe the following warnings sometimes:
+
+shrink_slab: ubifs_shrinker+0x0/0x2b7 [ubifs] negative objects to delete nr=-8541616642706119788
+
+This patch makes sure UBIFS never returns negative count of objects.
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/shrinker.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/ubifs/shrinker.c
++++ b/fs/ubifs/shrinker.c
+@@ -283,7 +283,11 @@ int ubifs_shrinker(struct shrinker *shri
+ 	long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt);
+ 
+ 	if (nr == 0)
+-		return clean_zn_cnt;
++		/*
++		 * Due to the way UBIFS updates the clean znode counter it may
++		 * temporarily be negative.
++		 */
++		return clean_zn_cnt >= 0 ? clean_zn_cnt : 1;
+ 
+ 	if (!clean_zn_cnt) {
+ 		/*
diff --git a/queue-2.6.39/zd1211rw-fix-to-work-on-ohci.patch b/queue-2.6.39/zd1211rw-fix-to-work-on-ohci.patch
new file mode 100644
index 0000000000..57981887ee
--- /dev/null
+++ b/queue-2.6.39/zd1211rw-fix-to-work-on-ohci.patch
@@ -0,0 +1,153 @@
+From 59342f6a6bc35df623fb44784daa5e1077063b8f Mon Sep 17 00:00:00 2001
+From: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Date: Mon, 30 May 2011 10:15:47 +0300
+Subject: zd1211rw: fix to work on OHCI
+
+From: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+
+commit 59342f6a6bc35df623fb44784daa5e1077063b8f upstream.
+
+zd1211 devices register 'EP 4 OUT' endpoint as Interrupt type on USB 2.0:
+
+      Endpoint Descriptor:
+        bLength                 7
+        bDescriptorType         5
+        bEndpointAddress     0x04  EP 4 OUT
+        bmAttributes            3
+          Transfer Type            Interrupt
+          Synch Type               None
+          Usage Type               Data
+        wMaxPacketSize     0x0040  1x 64 bytes
+        bInterval               1
+
+However on USB 1.1 endpoint becomes Bulk:
+
+      Endpoint Descriptor:
+        bLength                 7
+        bDescriptorType         5
+        bEndpointAddress     0x04  EP 4 OUT
+        bmAttributes            2
+          Transfer Type            Bulk
+          Synch Type               None
+          Usage Type               Data
+        wMaxPacketSize     0x0040  1x 64 bytes
+        bInterval               0
+
+Commit 37939810b937aba830dd751291fcdc51cae1a6cb assumed that endpoint is
+always interrupt type and changed usb_bulk_msg() calls to usb_interrupt_msg().
+
+Problem here is that usb_bulk_msg() on interrupt endpoint selfcorrects the
+call and changes requested pipe to interrupt type (see usb_bulk_msg).
+However with usb_interrupt_msg() on bulk endpoint does not correct the
+pipe type to bulk, but instead URB is submitted with interrupt type pipe.
+
+So pre-2.6.39 used usb_bulk_msg() and therefore worked with both endpoint
+types, however in 2.6.39 usb_interrupt_msg() with bulk endpoint causes
+ohci_hcd to fail submitted URB instantly with -ENOSPC and preventing zd1211rw
+from working with OHCI.
+
+Fix this by detecting endpoint type and using correct endpoint/pipe types
+for URB. Also fix asynchronous zd_usb_iowrite16v_async() to use right
+URB type on 'EP 4 OUT'.
+
+Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/zd1211rw/zd_usb.c |   53 ++++++++++++++++++++++++++-------
+ 1 file changed, 42 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zd1211rw/zd_usb.c
+@@ -1533,6 +1533,31 @@ static void __exit usb_exit(void)
+ module_init(usb_init);
+ module_exit(usb_exit);
+ 
++static int zd_ep_regs_out_msg(struct usb_device *udev, void *data, int len,
++			      int *actual_length, int timeout)
++{
++	/* In USB 2.0 mode EP_REGS_OUT endpoint is interrupt type. However in
++	 * USB 1.1 mode endpoint is bulk. Select correct type URB by endpoint
++	 * descriptor.
++	 */
++	struct usb_host_endpoint *ep;
++	unsigned int pipe;
++
++	pipe = usb_sndintpipe(udev, EP_REGS_OUT);
++	ep = usb_pipe_endpoint(udev, pipe);
++	if (!ep)
++		return -EINVAL;
++
++	if (usb_endpoint_xfer_int(&ep->desc)) {
++		return usb_interrupt_msg(udev, pipe, data, len,
++					 actual_length, timeout);
++	} else {
++		pipe = usb_sndbulkpipe(udev, EP_REGS_OUT);
++		return usb_bulk_msg(udev, pipe, data, len, actual_length,
++				    timeout);
++	}
++}
++
+ static int usb_int_regs_length(unsigned int count)
+ {
+ 	return sizeof(struct usb_int_regs) + count * sizeof(struct reg_data);
+@@ -1648,15 +1673,14 @@ int zd_usb_ioread16v(struct zd_usb *usb,
+ 
+ 	udev = zd_usb_to_usbdev(usb);
+ 	prepare_read_regs_int(usb);
+-	r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT),
+-			      req, req_len, &actual_req_len, 50 /* ms */);
++	r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/);
+ 	if (r) {
+ 		dev_dbg_f(zd_usb_dev(usb),
+-			"error in usb_interrupt_msg(). Error number %d\n", r);
++			"error in zd_ep_regs_out_msg(). Error number %d\n", r);
+ 		goto error;
+ 	}
+ 	if (req_len != actual_req_len) {
+-		dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()\n"
++		dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()\n"
+ 			" req_len %d != actual_req_len %d\n",
+ 			req_len, actual_req_len);
+ 		r = -EIO;
+@@ -1818,9 +1842,17 @@ int zd_usb_iowrite16v_async(struct zd_us
+ 		rw->value = cpu_to_le16(ioreqs[i].value);
+ 	}
+ 
+-	usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
+-			 req, req_len, iowrite16v_urb_complete, usb,
+-			 ep->desc.bInterval);
++	/* In USB 2.0 mode endpoint is interrupt type. However in USB 1.1 mode
++	 * endpoint is bulk. Select correct type URB by endpoint descriptor.
++	 */
++	if (usb_endpoint_xfer_int(&ep->desc))
++		usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
++				 req, req_len, iowrite16v_urb_complete, usb,
++				 ep->desc.bInterval);
++	else
++		usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_REGS_OUT),
++				  req, req_len, iowrite16v_urb_complete, usb);
++
+ 	urb->transfer_flags |= URB_FREE_BUFFER;
+ 
+ 	/* Submit previous URB */
+@@ -1924,15 +1956,14 @@ int zd_usb_rfwrite(struct zd_usb *usb, u
+ 	}
+ 
+ 	udev = zd_usb_to_usbdev(usb);
+-	r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT),
+-			      req, req_len, &actual_req_len, 50 /* ms */);
++	r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/);
+ 	if (r) {
+ 		dev_dbg_f(zd_usb_dev(usb),
+-			"error in usb_interrupt_msg(). Error number %d\n", r);
++			"error in zd_ep_regs_out_msg(). Error number %d\n", r);
+ 		goto out;
+ 	}
+ 	if (req_len != actual_req_len) {
+-		dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()"
++		dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()"
+ 			" req_len %d != actual_req_len %d\n",
+ 			req_len, actual_req_len);
+ 		r = -EIO;