3.0 patches

15 files changed, 1017 insertions, 0 deletions

diff --git a/queue-3.0/3w-9xxx-fix-iommu_iova-leak.patch b/queue-3.0/3w-9xxx-fix-iommu_iova-leak.patch
new file mode 100644
index 0000000000..cca5611459
--- /dev/null
+++ b/queue-3.0/3w-9xxx-fix-iommu_iova-leak.patch
@@ -0,0 +1,40 @@
+From 96067723e46b0dd24ae7b934085ab4eff4d26a1b Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Parallels.com>
+Date: Sun, 18 Sep 2011 18:56:20 +0400
+Subject: [SCSI] 3w-9xxx: fix iommu_iova leak
+
+From: James Bottomley <JBottomley@Parallels.com>
+
+commit 96067723e46b0dd24ae7b934085ab4eff4d26a1b upstream.
+
+Following reports on the list, it looks like the 3e-9xxx driver will leak dma
+mappings every time we get a transient queueing error back from the card.
+This is because it maps the sg list in the routine that sends the command, but
+doesn't unmap again in the transient failure path (even though the command is
+sent back to the block layer).  Fix by unmapping before returning the status.
+
+Reported-by: Chris Boot <bootc@bootc.net>
+Tested-by: Chris Boot <bootc@bootc.net>
+Acked-by: Adam Radford <aradford@gmail.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/3w-9xxx.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -1800,10 +1800,12 @@ static int twa_scsi_queue_lck(struct scs
+ 	switch (retval) {
+ 	case SCSI_MLQUEUE_HOST_BUSY:
+ 		twa_free_request_id(tw_dev, request_id);
++		twa_unmap_scsi_data(tw_dev, request_id);
+ 		break;
+ 	case 1:
+ 		tw_dev->state[request_id] = TW_S_COMPLETED;
+ 		twa_free_request_id(tw_dev, request_id);
++		twa_unmap_scsi_data(tw_dev, request_id);
+ 		SCpnt->result = (DID_ERROR << 16);
+ 		done(SCpnt);
+ 		retval = 0;
diff --git a/queue-3.0/aacraid-reset-should-disable-msi-interrupt.patch b/queue-3.0/aacraid-reset-should-disable-msi-interrupt.patch
new file mode 100644
index 0000000000..42ddb83e0c
--- /dev/null
+++ b/queue-3.0/aacraid-reset-should-disable-msi-interrupt.patch
@@ -0,0 +1,37 @@
+From d0efab26f89506387a1bde898556660e06d7eb15 Mon Sep 17 00:00:00 2001
+From: Vasily Averin <vvs@parallels.com>
+Date: Fri, 2 Sep 2011 19:31:46 +0400
+Subject: [SCSI] aacraid: reset should disable MSI interrupt
+
+From: Vasily Averin <vvs@parallels.com>
+
+commit d0efab26f89506387a1bde898556660e06d7eb15 upstream.
+
+scsi reset on hardware with enabled MSI interrupts generates WARNING message
+
+[11027.798722] aacraid: Host adapter abort request (0,0,0,0)
+[11027.798814] aacraid: Host adapter reset request. SCSI hang ?
+[11087.762237] aacraid: SCSI bus appears hung
+[11135.082543] ------------[ cut here ]------------
+[11135.082646] WARNING: at drivers/pci/msi.c:658 pci_enable_msi_block+0x251/0x290()
+
+Signed-off-by: Vasily Averin <vvs@sw.ru>
+Acked-by: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/aacraid/commsup.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -1283,6 +1283,8 @@ static int _aac_reset_adapter(struct aac
+ 	kfree(aac->queues);
+ 	aac->queues = NULL;
+ 	free_irq(aac->pdev->irq, aac);
++	if (aac->msi)
++		pci_disable_msi(aac->pdev);
+ 	kfree(aac->fsa_dev);
+ 	aac->fsa_dev = NULL;
+ 	quirks = aac_get_driver_ident(index)->quirks;
diff --git a/queue-3.0/ath9k_hw-fix-rx-dma-stuck-for-ar9003-chips.patch b/queue-3.0/ath9k_hw-fix-rx-dma-stuck-for-ar9003-chips.patch
new file mode 100644
index 0000000000..8cdbc9bae5
--- /dev/null
+++ b/queue-3.0/ath9k_hw-fix-rx-dma-stuck-for-ar9003-chips.patch
@@ -0,0 +1,33 @@
+From e9f9530bb697f53dd620df290102359a3325bb23 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Date: Tue, 20 Sep 2011 16:23:51 +0530
+Subject: ath9k_hw: Fix Rx DMA stuck for AR9003 chips
+
+From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+
+commit e9f9530bb697f53dd620df290102359a3325bb23 upstream.
+
+During the endurance testing, rx frames are not getting DMAd from
+MAC whereas pcu rx frame counters are getting updated properly.
+As per systems team input updated the initval to fix rx dma stuck
+issue.
+
+Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+@@ -1516,7 +1516,7 @@ static const u32 ar9300_2p2_mac_core[][2
+ 	{0x00008258, 0x00000000},
+ 	{0x0000825c, 0x40000000},
+ 	{0x00008260, 0x00080922},
+-	{0x00008264, 0x9bc00010},
++	{0x00008264, 0x9d400010},
+ 	{0x00008268, 0xffffffff},
+ 	{0x0000826c, 0x0000ffff},
+ 	{0x00008270, 0x00000000},
diff --git a/queue-3.0/block-free-queue-resources-at-blk_release_queue.patch b/queue-3.0/block-free-queue-resources-at-blk_release_queue.patch
new file mode 100644
index 0000000000..7fcd11a8ba
--- /dev/null
+++ b/queue-3.0/block-free-queue-resources-at-blk_release_queue.patch
@@ -0,0 +1,70 @@
+From 777eb1bf15b8532c396821774bf6451e563438f5 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Wed, 28 Sep 2011 08:07:01 -0600
+Subject: block: Free queue resources at blk_release_queue()
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit 777eb1bf15b8532c396821774bf6451e563438f5 upstream.
+
+A kernel crash is observed when a mounted ext3/ext4 filesystem is
+physically removed. The problem is that blk_cleanup_queue() frees up
+some resources eg by calling elevator_exit(), which are not checked for
+in normal operation. So we should rather move these calls to the
+destructor function blk_release_queue() as at that point all remaining
+references are gone. However, in doing so we have to ensure that any
+externally supplied queue_lock is disconnected as the driver might free
+up the lock after the call of blk_cleanup_queue(),
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-core.c  |   13 ++++++-------
+ block/blk-sysfs.c |    5 +++++
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue
+ EXPORT_SYMBOL(blk_put_queue);
+ 
+ /*
+- * Note: If a driver supplied the queue lock, it should not zap that lock
+- * unexpectedly as some queue cleanup components like elevator_exit() and
+- * blk_throtl_exit() need queue lock.
++ * Note: If a driver supplied the queue lock, it is disconnected
++ * by this function. The actual state of the lock doesn't matter
++ * here as the request_queue isn't accessible after this point
++ * (QUEUE_FLAG_DEAD is set) and no other requests will be queued.
+  */
+ void blk_cleanup_queue(struct request_queue *q)
+ {
+@@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_qu
+ 	queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);
+ 	mutex_unlock(&q->sysfs_lock);
+ 
+-	if (q->elevator)
+-		elevator_exit(q->elevator);
+-
+-	blk_throtl_exit(q);
++	if (q->queue_lock != &q->__queue_lock)
++		q->queue_lock = &q->__queue_lock;
+ 
+ 	blk_put_queue(q);
+ }
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -472,6 +472,11 @@ static void blk_release_queue(struct kob
+ 
+ 	blk_sync_queue(q);
+ 
++	if (q->elevator)
++		elevator_exit(q->elevator);
++
++	blk_throtl_exit(q);
++
+ 	if (rl->rq_pool)
+ 		mempool_destroy(rl->rq_pool);
+ 
diff --git a/queue-3.0/bnx2x-add-missing-break-in-bnx2x_dcbnl_get_cap.patch b/queue-3.0/bnx2x-add-missing-break-in-bnx2x_dcbnl_get_cap.patch
new file mode 100644
index 0000000000..da64008f60
--- /dev/null
+++ b/queue-3.0/bnx2x-add-missing-break-in-bnx2x_dcbnl_get_cap.patch
@@ -0,0 +1,28 @@
+From a0babc80eb375aad69dab4687c3b44c47d42f241 Mon Sep 17 00:00:00 2001
+From: Shmulik Ravid <shmulikr@broadcom.com>
+Date: Thu, 22 Sep 2011 02:33:33 +0000
+Subject: bnx2x: add missing break in bnx2x_dcbnl_get_cap
+
+From: Shmulik Ravid <shmulikr@broadcom.com>
+
+commit a0babc80eb375aad69dab4687c3b44c47d42f241 upstream.
+
+Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
+Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bnx2x/bnx2x_dcb.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/bnx2x/bnx2x_dcb.c
++++ b/drivers/net/bnx2x/bnx2x_dcb.c
+@@ -1858,6 +1858,7 @@ static u8 bnx2x_dcbnl_get_cap(struct net
+ 			break;
+ 		case DCB_CAP_ATTR_DCBX:
+ 			*cap = BNX2X_DCBX_CAPS;
++			break;
+ 		default:
+ 			rval = -EINVAL;
+ 			break;
diff --git a/queue-3.0/bnx2x-fix-hw-attention-handling.patch b/queue-3.0/bnx2x-fix-hw-attention-handling.patch
new file mode 100644
index 0000000000..ba58efb4bd
--- /dev/null
+++ b/queue-3.0/bnx2x-fix-hw-attention-handling.patch
@@ -0,0 +1,71 @@
+From f2eaeb58bf6995a979c413ea0cc73289533feacb Mon Sep 17 00:00:00 2001
+From: Dmitry Kravkov <dmitry@broadcom.com>
+Date: Thu, 22 Sep 2011 02:33:31 +0000
+Subject: bnx2x: fix hw attention handling
+
+From: Dmitry Kravkov <dmitry@broadcom.com>
+
+commit f2eaeb58bf6995a979c413ea0cc73289533feacb upstream.
+
+Use register name to initialize attention mask
+
+Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
+Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bnx2x/bnx2x_main.c |    6 ++++--
+ drivers/net/bnx2x/bnx2x_reg.h  |   12 ++++++++++++
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bnx2x/bnx2x_main.c
++++ b/drivers/net/bnx2x/bnx2x_main.c
+@@ -4138,7 +4138,7 @@ static void bnx2x_init_def_sb(struct bnx
+ 	int igu_seg_id;
+ 	int port = BP_PORT(bp);
+ 	int func = BP_FUNC(bp);
+-	int reg_offset;
++	int reg_offset, reg_offset_en5;
+ 	u64 section;
+ 	int index;
+ 	struct hc_sp_status_block_data sp_sb_data;
+@@ -4161,6 +4161,8 @@ static void bnx2x_init_def_sb(struct bnx
+ 
+ 	reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
+ 			     MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
++	reg_offset_en5 = (port ? MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0 :
++				 MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0);
+ 	for (index = 0; index < MAX_DYNAMIC_ATTN_GRPS; index++) {
+ 		int sindex;
+ 		/* take care of sig[0]..sig[4] */
+@@ -4175,7 +4177,7 @@ static void bnx2x_init_def_sb(struct bnx
+ 			 * and not 16 between the different groups
+ 			 */
+ 			bp->attn_group[index].sig[4] = REG_RD(bp,
+-					reg_offset + 0x10 + 0x4*index);
++					reg_offset_en5 + 0x4*index);
+ 		else
+ 			bp->attn_group[index].sig[4] = 0;
+ 	}
+--- a/drivers/net/bnx2x/bnx2x_reg.h
++++ b/drivers/net/bnx2x/bnx2x_reg.h
+@@ -1325,6 +1325,18 @@
+    Latched ump_tx_parity; [31] MCP Latched scpad_parity; */
+ #define MISC_REG_AEU_ENABLE4_PXP_0				 0xa108
+ #define MISC_REG_AEU_ENABLE4_PXP_1				 0xa1a8
++/* [RW 32] fifth 32b for enabling the output for function 0 output0. Mapped
++ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
++ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
++ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
++ * parity; [31-10] Reserved; */
++#define MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0			 0xa688
++/* [RW 32] Fifth 32b for enabling the output for function 1 output0. Mapped
++ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
++ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
++ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
++ * parity; [31-10] Reserved; */
++#define MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0			 0xa6b0
+ /* [RW 1] set/clr general attention 0; this will set/clr bit 94 in the aeu
+    128 bit vector */
+ #define MISC_REG_AEU_GENERAL_ATTN_0				 0xa000
diff --git a/queue-3.0/cfg80211-fix-validation-of-akm-suites.patch b/queue-3.0/cfg80211-fix-validation-of-akm-suites.patch
new file mode 100644
index 0000000000..9a4ebe627f
--- /dev/null
+++ b/queue-3.0/cfg80211-fix-validation-of-akm-suites.patch
@@ -0,0 +1,43 @@
+From 1b9ca0272ffae212e726380f66777b30a56ed7a5 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Wed, 21 Sep 2011 16:13:07 +0300
+Subject: cfg80211: Fix validation of AKM suites
+
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+
+commit 1b9ca0272ffae212e726380f66777b30a56ed7a5 upstream.
+
+Incorrect variable was used in validating the akm_suites array from
+NL80211_ATTR_AKM_SUITES. In addition, there was no explicit
+validation of the array length (we only have room for
+NL80211_MAX_NR_AKM_SUITES).
+
+This can result in a buffer write overflow for stack variables with
+arbitrary data from user space. The nl80211 commands using the affected
+functionality require GENL_ADMIN_PERM, so this is only exposed to admin
+users.
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/nl80211.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4044,9 +4044,12 @@ static int nl80211_crypto_settings(struc
+ 		if (len % sizeof(u32))
+ 			return -EINVAL;
+ 
++		if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
++			return -EINVAL;
++
+ 		memcpy(settings->akm_suites, data, len);
+ 
+-		for (i = 0; i < settings->n_ciphers_pairwise; i++)
++		for (i = 0; i < settings->n_akm_suites; i++)
+ 			if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
+ 				return -EINVAL;
+ 	}
diff --git a/queue-3.0/cxgb3i-convert-cdev-l2opt-to-use-rcu-to-prevent-null-dereference.patch b/queue-3.0/cxgb3i-convert-cdev-l2opt-to-use-rcu-to-prevent-null-dereference.patch
new file mode 100644
index 0000000000..7c12722829
--- /dev/null
+++ b/queue-3.0/cxgb3i-convert-cdev-l2opt-to-use-rcu-to-prevent-null-dereference.patch
@@ -0,0 +1,247 @@
+From e48f129c2f200dde8899f6ea5c6e7173674fc482 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Tue, 6 Sep 2011 13:59:13 -0400
+Subject: [SCSI] cxgb3i: convert cdev->l2opt to use rcu to prevent NULL dereference
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+commit e48f129c2f200dde8899f6ea5c6e7173674fc482 upstream.
+
+This oops was reported recently:
+d:mon> e
+cpu 0xd: Vector: 300 (Data Access) at [c0000000fd4c7120]
+    pc: d00000000076f194: .t3_l2t_get+0x44/0x524 [cxgb3]
+    lr: d000000000b02108: .init_act_open+0x150/0x3d4 [cxgb3i]
+    sp: c0000000fd4c73a0
+   msr: 8000000000009032
+   dar: 0
+ dsisr: 40000000
+  current = 0xc0000000fd640d40
+  paca    = 0xc00000000054ff80
+    pid   = 5085, comm = iscsid
+d:mon> t
+[c0000000fd4c7450] d000000000b02108 .init_act_open+0x150/0x3d4 [cxgb3i]
+[c0000000fd4c7500] d000000000e45378 .cxgbi_ep_connect+0x784/0x8e8 [libcxgbi]
+[c0000000fd4c7650] d000000000db33f0 .iscsi_if_rx+0x71c/0xb18
+[scsi_transport_iscsi2]
+[c0000000fd4c7740] c000000000370c9c .netlink_data_ready+0x40/0xa4
+[c0000000fd4c77c0] c00000000036f010 .netlink_sendskb+0x4c/0x9c
+[c0000000fd4c7850] c000000000370c18 .netlink_sendmsg+0x358/0x39c
+[c0000000fd4c7950] c00000000033be24 .sock_sendmsg+0x114/0x1b8
+[c0000000fd4c7b50] c00000000033d208 .sys_sendmsg+0x218/0x2ac
+[c0000000fd4c7d70] c00000000033f55c .sys_socketcall+0x228/0x27c
+[c0000000fd4c7e30] c0000000000086a4 syscall_exit+0x0/0x40
+---
+ drivers/infiniband/hw/cxgb3/iwch_cm.c |   10 +++++-----
+ drivers/net/cxgb3/cxgb3_offload.c     |   23 ++++++++++++++++++-----
+ drivers/net/cxgb3/l2t.c               |   15 ++++++++++++---
+ drivers/net/cxgb3/l2t.h               |   16 ++++++++++++----
+ drivers/scsi/cxgbi/cxgb3i/cxgb3i.c    |    2 +-
+ 5 files changed, 48 insertions(+), 18 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
+@@ -287,7 +287,7 @@ void __free_ep(struct kref *kref)
+ 	if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
+ 		cxgb3_remove_tid(ep->com.tdev, (void *)ep, ep->hwtid);
+ 		dst_release(ep->dst);
+-		l2t_release(L2DATA(ep->com.tdev), ep->l2t);
++		l2t_release(ep->com.tdev, ep->l2t);
+ 	}
+ 	kfree(ep);
+ }
+@@ -1178,7 +1178,7 @@ static int act_open_rpl(struct t3cdev *t
+ 		release_tid(ep->com.tdev, GET_TID(rpl), NULL);
+ 	cxgb3_free_atid(ep->com.tdev, ep->atid);
+ 	dst_release(ep->dst);
+-	l2t_release(L2DATA(ep->com.tdev), ep->l2t);
++	l2t_release(ep->com.tdev, ep->l2t);
+ 	put_ep(&ep->com);
+ 	return CPL_RET_BUF_DONE;
+ }
+@@ -1375,7 +1375,7 @@ static int pass_accept_req(struct t3cdev
+ 	if (!child_ep) {
+ 		printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n",
+ 		       __func__);
+-		l2t_release(L2DATA(tdev), l2t);
++		l2t_release(tdev, l2t);
+ 		dst_release(dst);
+ 		goto reject;
+ 	}
+@@ -1952,7 +1952,7 @@ int iwch_connect(struct iw_cm_id *cm_id,
+ 	if (!err)
+ 		goto out;
+ 
+-	l2t_release(L2DATA(h->rdev.t3cdev_p), ep->l2t);
++	l2t_release(h->rdev.t3cdev_p, ep->l2t);
+ fail4:
+ 	dst_release(ep->dst);
+ fail3:
+@@ -2123,7 +2123,7 @@ int iwch_ep_redirect(void *ctx, struct d
+ 	PDBG("%s ep %p redirect to dst %p l2t %p\n", __func__, ep, new,
+ 	     l2t);
+ 	dst_hold(new);
+-	l2t_release(L2DATA(ep->com.tdev), ep->l2t);
++	l2t_release(ep->com.tdev, ep->l2t);
+ 	ep->l2t = l2t;
+ 	dst_release(old);
+ 	ep->dst = new;
+--- a/drivers/net/cxgb3/cxgb3_offload.c
++++ b/drivers/net/cxgb3/cxgb3_offload.c
+@@ -1149,12 +1149,14 @@ static void cxgb_redirect(struct dst_ent
+ 		if (te && te->ctx && te->client && te->client->redirect) {
+ 			update_tcb = te->client->redirect(te->ctx, old, new, e);
+ 			if (update_tcb) {
++				rcu_read_lock();
+ 				l2t_hold(L2DATA(tdev), e);
++				rcu_read_unlock();
+ 				set_l2t_ix(tdev, tid, e);
+ 			}
+ 		}
+ 	}
+-	l2t_release(L2DATA(tdev), e);
++	l2t_release(tdev, e);
+ }
+ 
+ /*
+@@ -1267,7 +1269,7 @@ int cxgb3_offload_activate(struct adapte
+ 		goto out_free;
+ 
+ 	err = -ENOMEM;
+-	L2DATA(dev) = t3_init_l2t(l2t_capacity);
++	RCU_INIT_POINTER(dev->l2opt, t3_init_l2t(l2t_capacity));
+ 	if (!L2DATA(dev))
+ 		goto out_free;
+ 
+@@ -1301,16 +1303,24 @@ int cxgb3_offload_activate(struct adapte
+ 
+ out_free_l2t:
+ 	t3_free_l2t(L2DATA(dev));
+-	L2DATA(dev) = NULL;
++	rcu_assign_pointer(dev->l2opt, NULL);
+ out_free:
+ 	kfree(t);
+ 	return err;
+ }
+ 
++static void clean_l2_data(struct rcu_head *head)
++{
++	struct l2t_data *d = container_of(head, struct l2t_data, rcu_head);
++	t3_free_l2t(d);
++}
++
++
+ void cxgb3_offload_deactivate(struct adapter *adapter)
+ {
+ 	struct t3cdev *tdev = &adapter->tdev;
+ 	struct t3c_data *t = T3C_DATA(tdev);
++	struct l2t_data *d;
+ 
+ 	remove_adapter(adapter);
+ 	if (list_empty(&adapter_list))
+@@ -1318,8 +1328,11 @@ void cxgb3_offload_deactivate(struct ada
+ 
+ 	free_tid_maps(&t->tid_maps);
+ 	T3C_DATA(tdev) = NULL;
+-	t3_free_l2t(L2DATA(tdev));
+-	L2DATA(tdev) = NULL;
++	rcu_read_lock();
++	d = L2DATA(tdev);
++	rcu_read_unlock();
++	rcu_assign_pointer(tdev->l2opt, NULL);
++	call_rcu(&d->rcu_head, clean_l2_data);
+ 	if (t->nofail_skb)
+ 		kfree_skb(t->nofail_skb);
+ 	kfree(t);
+--- a/drivers/net/cxgb3/l2t.c
++++ b/drivers/net/cxgb3/l2t.c
+@@ -300,14 +300,21 @@ static inline void reuse_entry(struct l2
+ struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
+ 			     struct net_device *dev)
+ {
+-	struct l2t_entry *e;
+-	struct l2t_data *d = L2DATA(cdev);
++	struct l2t_entry *e = NULL;
++	struct l2t_data *d;
++	int hash;
+ 	u32 addr = *(u32 *) neigh->primary_key;
+ 	int ifidx = neigh->dev->ifindex;
+-	int hash = arp_hash(addr, ifidx, d);
+ 	struct port_info *p = netdev_priv(dev);
+ 	int smt_idx = p->port_id;
+ 
++	rcu_read_lock();
++	d = L2DATA(cdev);
++	if (!d)
++		goto done_rcu;
++
++	hash = arp_hash(addr, ifidx, d);
++
+ 	write_lock_bh(&d->lock);
+ 	for (e = d->l2tab[hash].first; e; e = e->next)
+ 		if (e->addr == addr && e->ifindex == ifidx &&
+@@ -338,6 +345,8 @@ struct l2t_entry *t3_l2t_get(struct t3cd
+ 	}
+ done:
+ 	write_unlock_bh(&d->lock);
++done_rcu:
++	rcu_read_unlock();
+ 	return e;
+ }
+ 
+--- a/drivers/net/cxgb3/l2t.h
++++ b/drivers/net/cxgb3/l2t.h
+@@ -76,6 +76,7 @@ struct l2t_data {
+ 	atomic_t nfree;		/* number of free entries */
+ 	rwlock_t lock;
+ 	struct l2t_entry l2tab[0];
++	struct rcu_head rcu_head;	/* to handle rcu cleanup */
+ };
+ 
+ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
+@@ -99,7 +100,7 @@ static inline void set_arp_failure_handl
+ /*
+  * Getting to the L2 data from an offload device.
+  */
+-#define L2DATA(dev) ((dev)->l2opt)
++#define L2DATA(cdev) (rcu_dereference((cdev)->l2opt))
+ 
+ #define W_TCB_L2T_IX    0
+ #define S_TCB_L2T_IX    7
+@@ -126,15 +127,22 @@ static inline int l2t_send(struct t3cdev
+ 	return t3_l2t_send_slow(dev, skb, e);
+ }
+ 
+-static inline void l2t_release(struct l2t_data *d, struct l2t_entry *e)
++static inline void l2t_release(struct t3cdev *t, struct l2t_entry *e)
+ {
+-	if (atomic_dec_and_test(&e->refcnt))
++	struct l2t_data *d;
++
++	rcu_read_lock();
++	d = L2DATA(t);
++
++	if (atomic_dec_and_test(&e->refcnt) && d)
+ 		t3_l2e_free(d, e);
++
++	rcu_read_unlock();
+ }
+ 
+ static inline void l2t_hold(struct l2t_data *d, struct l2t_entry *e)
+ {
+-	if (atomic_add_return(1, &e->refcnt) == 1)	/* 0 -> 1 transition */
++	if (d && atomic_add_return(1, &e->refcnt) == 1)	/* 0 -> 1 transition */
+ 		atomic_dec(&d->nfree);
+ }
+ 
+--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
++++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+@@ -913,7 +913,7 @@ static void l2t_put(struct cxgbi_sock *c
+ 	struct t3cdev *t3dev = (struct t3cdev *)csk->cdev->lldev;
+ 
+ 	if (csk->l2t) {
+-		l2t_release(L2DATA(t3dev), csk->l2t);
++		l2t_release(t3dev, csk->l2t);
+ 		csk->l2t = NULL;
+ 		cxgbi_sock_put(csk);
+ 	}
diff --git a/queue-3.0/iwlagn-fix-dangling-scan-request.patch b/queue-3.0/iwlagn-fix-dangling-scan-request.patch
new file mode 100644
index 0000000000..e224001e15
--- /dev/null
+++ b/queue-3.0/iwlagn-fix-dangling-scan-request.patch
@@ -0,0 +1,85 @@
+From 6c80c39d9a6986a566c30d797aae37bfb697eea3 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 22 Sep 2011 14:59:04 -0700
+Subject: iwlagn: fix dangling scan request
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 6c80c39d9a6986a566c30d797aae37bfb697eea3 upstream.
+
+If iwl_scan_initiate() fails for any reason,
+priv->scan_request and priv->scan_vif are left
+dangling. This can lead to a crash later when
+iwl_bg_scan_completed() tries to run a pending
+scan request.
+
+In practice, this seems to be very rare due to
+the STATUS_SCANNING check earlier. That check,
+however, is wrong -- it should allow a scan to
+be queued when a reset/roc scan is going on.
+When a normal scan is already going on, a new
+one can't be issued by mac80211, so that code
+can be removed completely. I introduced this
+bug when adding off-channel support in commit
+266af4c745952e9bebf687dd68af58df553cb59d.
+
+Reported-by: Peng Yan <peng.yan@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-scan.c |   30 ++++++++++++++++--------------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
+@@ -406,31 +406,33 @@ int iwl_mac_hw_scan(struct ieee80211_hw
+ 
+ 	mutex_lock(&priv->mutex);
+ 
+-	if (test_bit(STATUS_SCANNING, &priv->status) &&
+-	    priv->scan_type != IWL_SCAN_NORMAL) {
+-		IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
+-		ret = -EAGAIN;
+-		goto out_unlock;
+-	}
+-
+-	/* mac80211 will only ask for one band at a time */
+-	priv->scan_request = req;
+-	priv->scan_vif = vif;
+-
+ 	/*
+ 	 * If an internal scan is in progress, just set
+ 	 * up the scan_request as per above.
+ 	 */
+ 	if (priv->scan_type != IWL_SCAN_NORMAL) {
+-		IWL_DEBUG_SCAN(priv, "SCAN request during internal scan\n");
++		IWL_DEBUG_SCAN(priv,
++			       "SCAN request during internal scan - defer\n");
++		priv->scan_request = req;
++		priv->scan_vif = vif;
+ 		ret = 0;
+-	} else
++	} else {
++		priv->scan_request = req;
++		priv->scan_vif = vif;
++		/*
++		 * mac80211 will only ask for one band at a time
++		 * so using channels[0] here is ok
++		 */
+ 		ret = iwl_scan_initiate(priv, vif, IWL_SCAN_NORMAL,
+ 					req->channels[0]->band);
++		if (ret) {
++			priv->scan_request = NULL;
++			priv->scan_vif = NULL;
++		}
++	}
+ 
+ 	IWL_DEBUG_MAC80211(priv, "leave\n");
+ 
+-out_unlock:
+ 	mutex_unlock(&priv->mutex);
+ 
+ 	return ret;
diff --git a/queue-3.0/iwlegacy-do-not-use-interruptible-waits.patch b/queue-3.0/iwlegacy-do-not-use-interruptible-waits.patch
new file mode 100644
index 0000000000..40bdc2a841
--- /dev/null
+++ b/queue-3.0/iwlegacy-do-not-use-interruptible-waits.patch
@@ -0,0 +1,178 @@
+From 65d0f19e583e80e42b1c67c166bfc4dfdf6ab693 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 20 Sep 2011 16:49:03 +0200
+Subject: iwlegacy: do not use interruptible waits
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 65d0f19e583e80e42b1c67c166bfc4dfdf6ab693 upstream.
+
+iwlegacy version of fix:
+
+commit effd4d9aece9184f526e6556786a94d335e38b71
+Author: Johannes Berg <johannes.berg@intel.com>
+Date:   Thu Sep 15 11:46:52 2011 -0700
+
+    iwlagn: do not use interruptible waits
+
+    Since the dawn of its time, iwlwifi has used
+    interruptible waits to wait for synchronous
+    commands and firmware loading.
+
+    This leads to "interesting" bugs, because it
+    can't actually handle the interruptions; for
+    example when a command sending is interrupted
+    it will assume the command completed fully,
+    and then leave it pending, which leads to all
+    kinds of trouble when the command finishes
+    later.
+
+    Since there's no easy way to gracefully deal
+    with interruptions, fix the driver to not use
+    interruptible waits.
+
+    This at least fixes the error
+    iwlagn 0000:02:00.0: Error: Response NULL in  'REPLY_SCAN_ABORT_CMD'
+
+    I have seen in P2P testing, but it is likely
+    that there are other errors caused by this.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlegacy/iwl-core.c     |    4 ++--
+ drivers/net/wireless/iwlegacy/iwl-hcmd.c     |    2 +-
+ drivers/net/wireless/iwlegacy/iwl-tx.c       |    2 +-
+ drivers/net/wireless/iwlegacy/iwl3945-base.c |    8 ++++----
+ drivers/net/wireless/iwlegacy/iwl4965-base.c |   10 +++++-----
+ 5 files changed, 13 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/iwlegacy/iwl-core.c
++++ b/drivers/net/wireless/iwlegacy/iwl-core.c
+@@ -938,7 +938,7 @@ void iwl_legacy_irq_handle_error(struct
+ 					&priv->contexts[IWL_RXON_CTX_BSS]);
+ #endif
+ 
+-	wake_up_interruptible(&priv->wait_command_queue);
++	wake_up(&priv->wait_command_queue);
+ 
+ 	/* Keep the restart process from trying to send host
+ 	 * commands by clearing the INIT status bit */
+@@ -1776,7 +1776,7 @@ int iwl_legacy_force_reset(struct iwl_pr
+ 		IWL_ERR(priv, "On demand firmware reload\n");
+ 		/* Set the FW error flag -- cleared on iwl_down */
+ 		set_bit(STATUS_FW_ERROR, &priv->status);
+-		wake_up_interruptible(&priv->wait_command_queue);
++		wake_up(&priv->wait_command_queue);
+ 		/*
+ 		 * Keep the restart process from trying to send host
+ 		 * commands by clearing the INIT status bit
+--- a/drivers/net/wireless/iwlegacy/iwl-hcmd.c
++++ b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
+@@ -167,7 +167,7 @@ int iwl_legacy_send_cmd_sync(struct iwl_
+ 		goto out;
+ 	}
+ 
+-	ret = wait_event_interruptible_timeout(priv->wait_command_queue,
++	ret = wait_event_timeout(priv->wait_command_queue,
+ 			!test_bit(STATUS_HCMD_ACTIVE, &priv->status),
+ 			HOST_COMPLETE_TIMEOUT);
+ 	if (!ret) {
+--- a/drivers/net/wireless/iwlegacy/iwl-tx.c
++++ b/drivers/net/wireless/iwlegacy/iwl-tx.c
+@@ -647,7 +647,7 @@ iwl_legacy_tx_cmd_complete(struct iwl_pr
+ 		clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
+ 		IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
+ 			       iwl_legacy_get_cmd_string(cmd->hdr.cmd));
+-		wake_up_interruptible(&priv->wait_command_queue);
++		wake_up(&priv->wait_command_queue);
+ 	}
+ 
+ 	/* Mark as unmapped */
+--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
++++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
+@@ -841,7 +841,7 @@ static void iwl3945_rx_card_state_notif(
+ 		wiphy_rfkill_set_hw_state(priv->hw->wiphy,
+ 				test_bit(STATUS_RF_KILL_HW, &priv->status));
+ 	else
+-		wake_up_interruptible(&priv->wait_command_queue);
++		wake_up(&priv->wait_command_queue);
+ }
+ 
+ /**
+@@ -2518,7 +2518,7 @@ static void iwl3945_alive_start(struct i
+ 	iwl3945_reg_txpower_periodic(priv);
+ 
+ 	IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
+-	wake_up_interruptible(&priv->wait_command_queue);
++	wake_up(&priv->wait_command_queue);
+ 
+ 	return;
+ 
+@@ -2549,7 +2549,7 @@ static void __iwl3945_down(struct iwl_pr
+ 	iwl_legacy_clear_driver_stations(priv);
+ 
+ 	/* Unblock any waiting calls */
+-	wake_up_interruptible_all(&priv->wait_command_queue);
++	wake_up_all(&priv->wait_command_queue);
+ 
+ 	/* Wipe out the EXIT_PENDING status bit if we are not actually
+ 	 * exiting the module */
+@@ -3125,7 +3125,7 @@ static int iwl3945_mac_start(struct ieee
+ 
+ 	/* Wait for START_ALIVE from ucode. Otherwise callbacks from
+ 	 * mac80211 will not be run successfully. */
+-	ret = wait_event_interruptible_timeout(priv->wait_command_queue,
++	ret = wait_event_timeout(priv->wait_command_queue,
+ 			test_bit(STATUS_READY, &priv->status),
+ 			UCODE_READY_TIMEOUT);
+ 	if (!ret) {
+--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
++++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
+@@ -704,7 +704,7 @@ static void iwl4965_rx_card_state_notif(
+ 		wiphy_rfkill_set_hw_state(priv->hw->wiphy,
+ 			test_bit(STATUS_RF_KILL_HW, &priv->status));
+ 	else
+-		wake_up_interruptible(&priv->wait_command_queue);
++		wake_up(&priv->wait_command_queue);
+ }
+ 
+ /**
+@@ -1054,7 +1054,7 @@ static void iwl4965_irq_tasklet(struct i
+ 		handled |= CSR_INT_BIT_FH_TX;
+ 		/* Wake up uCode load routine, now that load is complete */
+ 		priv->ucode_write_complete = 1;
+-		wake_up_interruptible(&priv->wait_command_queue);
++		wake_up(&priv->wait_command_queue);
+ 	}
+ 
+ 	if (inta & ~handled) {
+@@ -2126,7 +2126,7 @@ static void iwl4965_alive_start(struct i
+ 	iwl4965_rf_kill_ct_config(priv);
+ 
+ 	IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
+-	wake_up_interruptible(&priv->wait_command_queue);
++	wake_up(&priv->wait_command_queue);
+ 
+ 	iwl_legacy_power_update_mode(priv, true);
+ 	IWL_DEBUG_INFO(priv, "Updated power mode\n");
+@@ -2159,7 +2159,7 @@ static void __iwl4965_down(struct iwl_pr
+ 	iwl_legacy_clear_driver_stations(priv);
+ 
+ 	/* Unblock any waiting calls */
+-	wake_up_interruptible_all(&priv->wait_command_queue);
++	wake_up_all(&priv->wait_command_queue);
+ 
+ 	/* Wipe out the EXIT_PENDING status bit if we are not actually
+ 	 * exiting the module */
+@@ -2597,7 +2597,7 @@ int iwl4965_mac_start(struct ieee80211_h
+ 
+ 	/* Wait for START_ALIVE from Run Time ucode. Otherwise callbacks from
+ 	 * mac80211 will not be run successfully. */
+-	ret = wait_event_interruptible_timeout(priv->wait_command_queue,
++	ret = wait_event_timeout(priv->wait_command_queue,
+ 			test_bit(STATUS_READY, &priv->status),
+ 			UCODE_READY_TIMEOUT);
+ 	if (!ret) {
diff --git a/queue-3.0/iwlegacy-fix-command-queue-timeout.patch b/queue-3.0/iwlegacy-fix-command-queue-timeout.patch
new file mode 100644
index 0000000000..06438c13c0
--- /dev/null
+++ b/queue-3.0/iwlegacy-fix-command-queue-timeout.patch
@@ -0,0 +1,49 @@
+From 2e2a41d6ca07d1b2aa67015c35fd80701c98e867 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 20 Sep 2011 16:46:36 +0200
+Subject: iwlegacy: fix command queue timeout
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 2e2a41d6ca07d1b2aa67015c35fd80701c98e867 upstream.
+
+iwlegacy version of fix:
+
+commit 282cdb325aea4ebbc42ce753b47cc96145eb54bc
+Author: Johannes Berg <johannes.berg@intel.com>
+Date:   Mon Sep 12 12:09:10 2011 -0700
+
+    iwlagn: fix command queue timeout
+
+    If the command queue is constantly busy,
+    which can happen in P2P, the hangcheck
+    timer will frequently find a command in
+    it and will eventually reset the device
+    because nothing sets the timestamp for
+    this queue when commands are processed.
+
+    Fix this by setting the timestamp when
+    a command completes.
+
+iwlegacy does not support P2P, but this patch fix possible
+unneeded hardware resets, hence is needed.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlegacy/iwl-tx.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/iwlegacy/iwl-tx.c
++++ b/drivers/net/wireless/iwlegacy/iwl-tx.c
+@@ -625,6 +625,8 @@ iwl_legacy_tx_cmd_complete(struct iwl_pr
+ 	cmd = txq->cmd[cmd_index];
+ 	meta = &txq->meta[cmd_index];
+ 
++	txq->time_stamp = jiffies;
++
+ 	pci_unmap_single(priv->pci_dev,
+ 			 dma_unmap_addr(meta, mapping),
+ 			 dma_unmap_len(meta, len),
diff --git a/queue-3.0/libsas-fix-failure-to-revalidate-domain-for-anything-but-the-first-expander-child.patch b/queue-3.0/libsas-fix-failure-to-revalidate-domain-for-anything-but-the-first-expander-child.patch
new file mode 100644
index 0000000000..78f665f240
--- /dev/null
+++ b/queue-3.0/libsas-fix-failure-to-revalidate-domain-for-anything-but-the-first-expander-child.patch
@@ -0,0 +1,43 @@
+From 24926dadc41cc566e974022b0e66231b82c6375f Mon Sep 17 00:00:00 2001
+From: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+Date: Thu, 1 Sep 2011 06:11:17 -0700
+Subject: [SCSI] libsas: fix failure to revalidate domain for anything but the first expander child.
+
+From: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+
+commit 24926dadc41cc566e974022b0e66231b82c6375f upstream.
+
+In an enclosure model where there are chaining expanders to a large body
+of storage, it was discovered that libsas, responding to a broadcast
+event change, would only revalidate the domain of first child expander
+in the list.
+
+The issue is that the pointer value to the discovered source device was
+used to break out of the loop, rather than the content of the pointer.
+
+This still remains non-compliant as the revalidate domain code is
+supposed to loop through all child expanders, and not stop at the first
+one it finds that reports a change count. However, the design of this
+routine does not allow multiple device discoveries and that would be a
+more complicated set of patches reserved for another day. We are fixing
+the glaring bug rather than refactoring the code.
+
+Signed-off-by: Mark Salyzyn <msalyzyn@us.xyratex.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libsas/sas_expander.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -1721,7 +1721,7 @@ static int sas_find_bcast_dev(struct dom
+ 	list_for_each_entry(ch, &ex->children, siblings) {
+ 		if (ch->dev_type == EDGE_DEV || ch->dev_type == FANOUT_DEV) {
+ 			res = sas_find_bcast_dev(ch, src_dev);
+-			if (src_dev)
++			if (*src_dev)
+ 				return res;
+ 		}
+ 	}
diff --git a/queue-3.0/rtlwifi-rtl8192cu-fix-unitialized-struct.patch b/queue-3.0/rtlwifi-rtl8192cu-fix-unitialized-struct.patch
new file mode 100644
index 0000000000..63585652bb
--- /dev/null
+++ b/queue-3.0/rtlwifi-rtl8192cu-fix-unitialized-struct.patch
@@ -0,0 +1,30 @@
+From 831d85471e761e190c3c8979b37540d699ae5812 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Thu, 22 Sep 2011 22:59:02 -0500
+Subject: rtlwifi: rtl8192cu: Fix unitialized struct
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 831d85471e761e190c3c8979b37540d699ae5812 upstream.
+
+Driver rtl8192cu assigns a new struct rtl_tcb_desc object, but fails to
+clear it.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -861,6 +861,7 @@ static void _rtl_usb_tx_preprocess(struc
+ 	u8 tid = 0;
+ 	u16 seq_number = 0;
+ 
++	memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
+ 	if (ieee80211_is_auth(fc)) {
+ 		RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, ("MAC80211_LINKING\n"));
+ 		rtl_ips_nic_on(hw);
diff --git a/queue-3.0/scsi-qla4xxx-needs-libiscsi.o.patch b/queue-3.0/scsi-qla4xxx-needs-libiscsi.o.patch
new file mode 100644
index 0000000000..a92664c869
--- /dev/null
+++ b/queue-3.0/scsi-qla4xxx-needs-libiscsi.o.patch
@@ -0,0 +1,49 @@
+From 3538a001ea7db13fa1be2966b71f69d808acff01 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@xenotime.net>
+Date: Wed, 31 Aug 2011 15:02:00 -0700
+Subject: [SCSI] scsi: qla4xxx needs libiscsi.o
+
+From: Randy Dunlap <rdunlap@xenotime.net>
+
+commit 3538a001ea7db13fa1be2966b71f69d808acff01 upstream.
+
+qla4xxx driver needs to be linked with libiscsi.o to fix
+build errors.  This happens when no other drivers that use
+libiscsi.o are enabled.
+
+ERROR: "iscsi_conn_stop" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_conn_get_addr_param" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_session_teardown" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_host_alloc" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_conn_start" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_conn_send_pdu" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_session_get_param" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_conn_get_param" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_set_param" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_session_failure" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_complete_pdu" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_session_setup" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_conn_bind" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_conn_setup" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+ERROR: "iscsi_itt_to_task" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined!
+
+Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/Makefile |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/Makefile
++++ b/drivers/scsi/Makefile
+@@ -88,7 +88,7 @@ obj-$(CONFIG_SCSI_QLOGIC_FAS)	+= qlogicf
+ obj-$(CONFIG_PCMCIA_QLOGIC)	+= qlogicfas408.o
+ obj-$(CONFIG_SCSI_QLOGIC_1280)	+= qla1280.o 
+ obj-$(CONFIG_SCSI_QLA_FC)	+= qla2xxx/
+-obj-$(CONFIG_SCSI_QLA_ISCSI)	+= qla4xxx/
++obj-$(CONFIG_SCSI_QLA_ISCSI)	+= libiscsi.o qla4xxx/
+ obj-$(CONFIG_SCSI_LPFC)		+= lpfc/
+ obj-$(CONFIG_SCSI_BFA_FC)	+= bfa/
+ obj-$(CONFIG_SCSI_PAS16)	+= pas16.o
diff --git a/queue-3.0/series b/queue-3.0/series
index d7e3cde1d4..aadf6f9d24 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -228,3 +228,17 @@ alsa-hda-realtek-avoid-bogus-hp-pin-assignment.patch
 alsa-hda-no-power-nids-on-92hd93.patch
 alsa-usb-audio-check-for-possible-chip-null-pointer-before-clearing-probing-flag.patch
 memcg-fix-vmscan-count-in-small-memcgs.patch
+cxgb3i-convert-cdev-l2opt-to-use-rcu-to-prevent-null-dereference.patch
+3w-9xxx-fix-iommu_iova-leak.patch
+aacraid-reset-should-disable-msi-interrupt.patch
+libsas-fix-failure-to-revalidate-domain-for-anything-but-the-first-expander-child.patch
+scsi-qla4xxx-needs-libiscsi.o.patch
+cfg80211-fix-validation-of-akm-suites.patch
+ath9k_hw-fix-rx-dma-stuck-for-ar9003-chips.patch
+iwlegacy-fix-command-queue-timeout.patch
+rtlwifi-rtl8192cu-fix-unitialized-struct.patch
+iwlegacy-do-not-use-interruptible-waits.patch
+iwlagn-fix-dangling-scan-request.patch
+bnx2x-fix-hw-attention-handling.patch
+bnx2x-add-missing-break-in-bnx2x_dcbnl_get_cap.patch
+block-free-queue-resources-at-blk_release_queue.patch