3.0 patches

14 files changed, 763 insertions, 0 deletions

diff --git a/queue-3.0/ethtool-allow-zero-length-register-dumps-again.patch b/queue-3.0/ethtool-allow-zero-length-register-dumps-again.patch
new file mode 100644
index 0000000000..65c0911576
--- /dev/null
+++ b/queue-3.0/ethtool-allow-zero-length-register-dumps-again.patch
@@ -0,0 +1,46 @@
+From 67ae7cf1eeda777f79259c4c6cb17a0bd28dee71 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings@solarflare.com>
+Date: Thu, 21 Jul 2011 15:25:30 -0700
+Subject: ethtool: Allow zero-length register dumps again
+
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+commit 67ae7cf1eeda777f79259c4c6cb17a0bd28dee71 upstream.
+
+Some drivers (ab)use the ethtool_ops::get_regs operation to expose
+only a hardware revision ID.  Commit
+a77f5db361ed9953b5b749353ea2c7fed2bf8d93 ('ethtool: Allocate register
+dump buffer with vmalloc()') had the side-effect of breaking these, as
+vmalloc() returns a null pointer for size=0 whereas kmalloc() did not.
+
+For backward-compatibility, allow zero-length dumps again.
+
+Reported-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/ethtool.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1227,7 +1227,7 @@ static int ethtool_get_regs(struct net_d
+ 		regs.len = reglen;
+ 
+ 	regbuf = vzalloc(reglen);
+-	if (!regbuf)
++	if (reglen && !regbuf)
+ 		return -ENOMEM;
+ 
+ 	ops->get_regs(dev, &regs, regbuf);
+@@ -1236,7 +1236,7 @@ static int ethtool_get_regs(struct net_d
+ 	if (copy_to_user(useraddr, &regs, sizeof(regs)))
+ 		goto out;
+ 	useraddr += offsetof(struct ethtool_regs, data);
+-	if (copy_to_user(useraddr, regbuf, regs.len))
++	if (regbuf && copy_to_user(useraddr, regbuf, regs.len))
+ 		goto out;
+ 	ret = 0;
+ 
diff --git a/queue-3.0/firewire-cdev-prevent-race-between-first-get_info-ioctl-and-bus-reset-event-queuing.patch b/queue-3.0/firewire-cdev-prevent-race-between-first-get_info-ioctl-and-bus-reset-event-queuing.patch
new file mode 100644
index 0000000000..2be42e8cb5
--- /dev/null
+++ b/queue-3.0/firewire-cdev-prevent-race-between-first-get_info-ioctl-and-bus-reset-event-queuing.patch
@@ -0,0 +1,104 @@
+From 93b37905f70083d6143f5f4dba0a45cc64379a62 Mon Sep 17 00:00:00 2001
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Date: Sat, 9 Jul 2011 16:43:22 +0200
+Subject: firewire: cdev: prevent race between first get_info ioctl and bus reset event queuing
+
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+commit 93b37905f70083d6143f5f4dba0a45cc64379a62 upstream.
+
+Between open(2) of a /dev/fw* and the first FW_CDEV_IOC_GET_INFO
+ioctl(2) on it, the kernel already queues FW_CDEV_EVENT_BUS_RESET events
+to be read(2) by the client.  The get_info ioctl is practically always
+issued right away after open, hence this condition only occurs if the
+client opens during a bus reset, especially during a rapid series of bus
+resets.
+
+The problem with this condition is twofold:
+
+  - These bus reset events carry the (as yet undocumented) @closure
+    value of 0.  But it is not the kernel's place to choose closures;
+    they are privat to the client.  E.g., this 0 value forced from the
+    kernel makes it unsafe for clients to dereference it as a pointer to
+    a closure object without NULL pointer check.
+
+  - It is impossible for clients to determine the relative order of bus
+    reset events from get_info ioctl(2) versus those from read(2),
+    except in one way:  By comparison of closure values.  Again, such a
+    procedure imposes complexity on clients and reduces freedom in use
+    of the bus reset closure.
+
+So, change the ABI to suppress queuing of bus reset events before the
+first FW_CDEV_IOC_GET_INFO ioctl was issued by the client.
+
+Note, this ABI change cannot be version-controlled.  The kernel cannot
+distinguish old from new clients before the first FW_CDEV_IOC_GET_INFO
+ioctl.
+
+We will try to back-merge this change into currently maintained stable/
+longterm series, and we only document the new behaviour.  The old
+behavior is now considered a kernel bug, which it basically is.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Cc: <stable@kernel.org>
+
+---
+ drivers/firewire/core-cdev.c  |   18 ++++++++++--------
+ include/linux/firewire-cdev.h |    3 +++
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -253,14 +253,11 @@ static int fw_device_op_open(struct inod
+ 	init_waitqueue_head(&client->wait);
+ 	init_waitqueue_head(&client->tx_flush_wait);
+ 	INIT_LIST_HEAD(&client->phy_receiver_link);
++	INIT_LIST_HEAD(&client->link);
+ 	kref_init(&client->kref);
+ 
+ 	file->private_data = client;
+ 
+-	mutex_lock(&device->client_list_mutex);
+-	list_add_tail(&client->link, &device->client_list);
+-	mutex_unlock(&device->client_list_mutex);
+-
+ 	return nonseekable_open(inode, file);
+ }
+ 
+@@ -451,15 +448,20 @@ static int ioctl_get_info(struct client
+ 	if (ret != 0)
+ 		return -EFAULT;
+ 
++	mutex_lock(&client->device->client_list_mutex);
++
+ 	client->bus_reset_closure = a->bus_reset_closure;
+ 	if (a->bus_reset != 0) {
+ 		fill_bus_reset_event(&bus_reset, client);
+-		if (copy_to_user(u64_to_uptr(a->bus_reset),
+-				 &bus_reset, sizeof(bus_reset)))
+-			return -EFAULT;
++		ret = copy_to_user(u64_to_uptr(a->bus_reset),
++				   &bus_reset, sizeof(bus_reset));
+ 	}
++	if (ret == 0 && list_empty(&client->link))
++		list_add_tail(&client->link, &client->device->client_list);
+ 
+-	return 0;
++	mutex_unlock(&client->device->client_list_mutex);
++
++	return ret ? -EFAULT : 0;
+ }
+ 
+ static int add_client_resource(struct client *client,
+--- a/include/linux/firewire-cdev.h
++++ b/include/linux/firewire-cdev.h
+@@ -475,6 +475,9 @@ union fw_cdev_event {
+  *		of the bus.  This does not cause a bus reset to happen.
+  * @bus_reset_closure: Value of &closure in this and subsequent bus reset events
+  * @card:	The index of the card this device belongs to
++ *
++ * As a side effect, reception of %FW_CDEV_EVENT_BUS_RESET events to be read(2)
++ * is started by this ioctl.
+  */
+ struct fw_cdev_get_info {
+ 	__u32 version;
diff --git a/queue-3.0/firewire-cdev-return-enotty-for-unimplemented-ioctls-not.patch b/queue-3.0/firewire-cdev-return-enotty-for-unimplemented-ioctls-not.patch
new file mode 100644
index 0000000000..b9afd2deb9
--- /dev/null
+++ b/queue-3.0/firewire-cdev-return-enotty-for-unimplemented-ioctls-not.patch
@@ -0,0 +1,59 @@
+From d873d794235efa590ab3c94d5ee22bb1fab19ac4 Mon Sep 17 00:00:00 2001
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Date: Sat, 9 Jul 2011 16:42:26 +0200
+Subject: firewire: cdev: return -ENOTTY for unimplemented ioctls, not -EINVAL
+
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+commit d873d794235efa590ab3c94d5ee22bb1fab19ac4 upstream.
+
+On Jun 27 Linus Torvalds wrote:
+> The correct error code for "I don't understand this ioctl" is ENOTTY.
+> The naming may be odd, but you should think of that error value as a
+> "unrecognized ioctl number, you're feeding me random numbers that I
+> don't understand and I assume for historical reasons that you tried to
+> do some tty operation on me".
+[...]
+> The EINVAL thing goes way back, and is a disaster. It predates Linux
+> itself, as far as I can tell. You'll find lots of man-pages that have
+> this line in it:
+>
+>   EINVAL Request or argp is not valid.
+>
+> and it shows up in POSIX etc. And sadly, it generally shows up
+> _before_ the line that says
+>
+>   ENOTTY The specified request does not apply to the kind of object
+> that the descriptor d references.
+>
+> so a lot of people get to the EINVAL, and never even notice the ENOTTY.
+[...]
+> At least glibc (and hopefully other C libraries) use a _string_ that
+> makes much more sense: strerror(ENOTTY) is "Inappropriate ioctl for
+> device"
+
+So let's correct this in the <linux/firewire-cdev.h> ABI while it is
+still young, relative to distributor adoption.
+
+Side note:  We return -ENOTTY not only on _IOC_TYPE or _IOC_NR mismatch,
+but also on _IOC_SIZE mismatch.  An ioctl with an unsupported size of
+argument structure can be seen as an unsupported version of that ioctl.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/core-cdev.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -1583,7 +1583,7 @@ static int dispatch_ioctl(struct client
+ 	if (_IOC_TYPE(cmd) != '#' ||
+ 	    _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers) ||
+ 	    _IOC_SIZE(cmd) > sizeof(buffer))
+-		return -EINVAL;
++		return -ENOTTY;
+ 
+ 	if (_IOC_DIR(cmd) == _IOC_READ)
+ 		memset(&buffer, 0, _IOC_SIZE(cmd));
diff --git a/queue-3.0/ib-srp-avoid-duplicate-devices-from-lun-scan.patch b/queue-3.0/ib-srp-avoid-duplicate-devices-from-lun-scan.patch
new file mode 100644
index 0000000000..b550c81d02
--- /dev/null
+++ b/queue-3.0/ib-srp-avoid-duplicate-devices-from-lun-scan.patch
@@ -0,0 +1,50 @@
+From fd1b6c4a693c9cac59375ffb36ffe5d7c079037c Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 13 Jul 2011 09:19:16 -0700
+Subject: IB/srp: Avoid duplicate devices from LUN scan
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit fd1b6c4a693c9cac59375ffb36ffe5d7c079037c upstream.
+
+SCSI scanning of a channel:id:lun triplet in Linux works as follows
+(function scsi_scan_target() in drivers/scsi/scsi_scan.c):
+
+- If lun == SCAN_WILD_CARD, send a REPORT LUNS command to the target
+  and process the result.
+
+- If lun != SCAN_WILD_CARD, send an INQUIRY command to the LUN
+  corresponding to the specified channel:id:lun triplet to verify
+  whether the LUN exists.
+
+So a SCSI driver must either take the channel and target id values in
+account in its quecommand() function or it should declare that it only
+supports one channel and one target id.
+
+Currently the ib_srp driver does neither.  As a result scanning the
+SCSI bus via e.g. rescan-scsi-bus.sh causes many duplicate SCSI
+devices to be created. For each 0:0:L device, several duplicates are
+created with the same LUN number and with (C:I) != (0:0). Fix this by
+declaring that the ib_srp driver only supports one channel and one
+target id.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: David Dillow <dillowda@ornl.gov>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2127,6 +2127,8 @@ static ssize_t srp_create_target(struct
+ 		return -ENOMEM;
+ 
+ 	target_host->transportt  = ib_srp_transport_template;
++	target_host->max_channel = 0;
++	target_host->max_id      = 1;
+ 	target_host->max_lun     = SRP_MAX_LUN;
+ 	target_host->max_cmd_len = sizeof ((struct srp_cmd *) (void *) 0L)->cdb;
+ 
diff --git a/queue-3.0/irq_work-ppc-fix-up-arch-hooks.patch b/queue-3.0/irq_work-ppc-fix-up-arch-hooks.patch
new file mode 100644
index 0000000000..7dfe90b24c
--- /dev/null
+++ b/queue-3.0/irq_work-ppc-fix-up-arch-hooks.patch
@@ -0,0 +1,37 @@
+From 4f8b50bbbe63ae4ec6bea28a90a9a603c745ea71 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Mon, 27 Jun 2011 17:22:43 +0200
+Subject: irq_work, ppc: Fix up arch hooks
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 4f8b50bbbe63ae4ec6bea28a90a9a603c745ea71 upstream.
+
+Commit e360adbe29 ("irq_work: Add generic hardirq context
+callbacks") fouled up the ppc bit, not properly naming the
+arch specific function that raises the 'self-IPI'.
+
+Cc: Huang Ying <ying.huang@intel.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Anton Blanchard <anton@samba.org>
+Cc: Eric B Munson <emunson@mgebm.net>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/n/tip-eg0aqien8p1aqvzu9dft6dtv@git.kernel.org
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/time.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -544,7 +544,7 @@ DEFINE_PER_CPU(u8, irq_work_pending);
+ 
+ #endif /* 32 vs 64 bit */
+ 
+-void set_irq_work_pending(void)
++void arch_irq_work_raise(void)
+ {
+ 	preempt_disable();
+ 	set_irq_work_pending_flag();
diff --git a/queue-3.0/jme-fix-unmap-error-causing-system-freeze.patch b/queue-3.0/jme-fix-unmap-error-causing-system-freeze.patch
new file mode 100644
index 0000000000..d0a3be3498
--- /dev/null
+++ b/queue-3.0/jme-fix-unmap-error-causing-system-freeze.patch
@@ -0,0 +1,68 @@
+From 94c5b41b327e08de0ddf563237855f55080652a1 Mon Sep 17 00:00:00 2001
+From: Guo-Fu Tseng <cooldavid@cooldavid.org>
+Date: Wed, 20 Jul 2011 16:57:36 +0000
+Subject: jme: Fix unmap error (Causing system freeze)
+
+From: Guo-Fu Tseng <cooldavid@cooldavid.org>
+
+commit 94c5b41b327e08de0ddf563237855f55080652a1 upstream.
+
+This patch add the missing dma_unmap().
+Which solved the critical issue of system freeze on heavy load.
+
+Michal Miroslaw's rejected patch:
+[PATCH v2 10/46] net: jme: convert to generic DMA API
+Pointed out the issue also, thank you Michal.
+But the fix was incorrect. It would unmap needed address
+when low memory.
+
+Got lots of feedback from End user and Gentoo Bugzilla.
+https://bugs.gentoo.org/show_bug.cgi?id=373109
+Thank you all. :)
+
+Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
+Acked-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/jme.c |   20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/jme.c
++++ b/drivers/net/jme.c
+@@ -753,20 +753,28 @@ jme_make_new_rx_buf(struct jme_adapter *
+ 	struct jme_ring *rxring = &(jme->rxring[0]);
+ 	struct jme_buffer_info *rxbi = rxring->bufinf + i;
+ 	struct sk_buff *skb;
++	dma_addr_t mapping;
+ 
+ 	skb = netdev_alloc_skb(jme->dev,
+ 		jme->dev->mtu + RX_EXTRA_LEN);
+ 	if (unlikely(!skb))
+ 		return -ENOMEM;
+ 
++	mapping = pci_map_page(jme->pdev, virt_to_page(skb->data),
++			       offset_in_page(skb->data), skb_tailroom(skb),
++			       PCI_DMA_FROMDEVICE);
++	if (unlikely(pci_dma_mapping_error(jme->pdev, mapping))) {
++		dev_kfree_skb(skb);
++		return -ENOMEM;
++	}
++
++	if (likely(rxbi->mapping))
++		pci_unmap_page(jme->pdev, rxbi->mapping,
++			       rxbi->len, PCI_DMA_FROMDEVICE);
++
+ 	rxbi->skb = skb;
+ 	rxbi->len = skb_tailroom(skb);
+-	rxbi->mapping = pci_map_page(jme->pdev,
+-					virt_to_page(skb->data),
+-					offset_in_page(skb->data),
+-					rxbi->len,
+-					PCI_DMA_FROMDEVICE);
+-
++	rxbi->mapping = mapping;
+ 	return 0;
+ }
+ 
diff --git a/queue-3.0/libsas-remove-expander-from-dev-list-on-error.patch b/queue-3.0/libsas-remove-expander-from-dev-list-on-error.patch
new file mode 100644
index 0000000000..6428040233
--- /dev/null
+++ b/queue-3.0/libsas-remove-expander-from-dev-list-on-error.patch
@@ -0,0 +1,35 @@
+From 5911e963d3718e306bcac387b83e259aa4228896 Mon Sep 17 00:00:00 2001
+From: Luben Tuikov <ltuikov@yahoo.com>
+Date: Tue, 26 Jul 2011 23:10:48 -0700
+Subject: [SCSI] libsas: remove expander from dev list on error
+
+From: Luben Tuikov <ltuikov@yahoo.com>
+
+commit 5911e963d3718e306bcac387b83e259aa4228896 upstream.
+
+If expander discovery fails (sas_discover_expander()), remove the
+expander from the port device list (sas_ex_discover_expander()),
+before freeing it. Else the list is corrupted and, e.g., when we
+attempt to send SMP commands to other devices, the kernel oopses.
+
+Signed-off-by: Luben Tuikov <ltuikov@yahoo.com>
+Reviewed-by: Jack Wang <jack_wang@usish.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libsas/sas_expander.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -849,6 +849,9 @@ static struct domain_device *sas_ex_disc
+ 
+ 	res = sas_discover_expander(child);
+ 	if (res) {
++		spin_lock_irq(&parent->port->dev_list_lock);
++		list_del(&child->dev_list_node);
++		spin_unlock_irq(&parent->port->dev_list_lock);
+ 		kfree(child);
+ 		return NULL;
+ 	}
diff --git a/queue-3.0/mac80211-restart-sta-timers-only-on-associated-state.patch b/queue-3.0/mac80211-restart-sta-timers-only-on-associated-state.patch
new file mode 100644
index 0000000000..fe98392a47
--- /dev/null
+++ b/queue-3.0/mac80211-restart-sta-timers-only-on-associated-state.patch
@@ -0,0 +1,33 @@
+From 676b58c27475a9defccc025fea1cbd2b141ee539 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Date: Thu, 7 Jul 2011 23:33:39 +0530
+Subject: mac80211: Restart STA timers only on associated state
+
+From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+
+commit 676b58c27475a9defccc025fea1cbd2b141ee539 upstream.
+
+A panic was observed when the device is failed to resume properly,
+and there are no running interfaces. ieee80211_reconfig tries
+to restart STA timers on unassociated state.
+
+Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/mlme.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2200,6 +2200,9 @@ void ieee80211_sta_restart(struct ieee80
+ {
+ 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+ 
++	if (!ifmgd->associated)
++		return;
++
+ 	if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
+ 		add_timer(&ifmgd->timer);
+ 	if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
diff --git a/queue-3.0/perf-fix-software-event-overflow.patch b/queue-3.0/perf-fix-software-event-overflow.patch
new file mode 100644
index 0000000000..fb7a41e034
--- /dev/null
+++ b/queue-3.0/perf-fix-software-event-overflow.patch
@@ -0,0 +1,41 @@
+From a.p.zijlstra@chello.nl  Tue Aug  2 09:32:36 2011
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Thu, 28 Jul 2011 20:47:10 +0200
+Subject: perf: Fix software event overflow
+To: Vince Weaver <vweaver1@eecs.utk.edu>
+Cc: Ingo Molnar <mingo@elte.hu>, Paul Mackerras <paulus@samba.org>, linux-kernel@vger.kernel.org, Arnaldo Carvalho de Melo <acme@ghostprotocols.net>, stable <stable@kernel.org>
+Message-ID: <1311878830.2617.373.camel@laptop>
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+The below patch is for -stable only, upstream has a much larger patch
+that contains the below hunk in commit a8b0ca17b80e92faab46ee7179ba9e99ccb61233
+
+Vince found that under certain circumstances software event overflows
+go wrong and deadlock. Avoid trying to delete a timer from the timer
+callback.
+
+Reported-by: Vince Weaver <vweaver1@eecs.utk.edu>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/events/core.c |    7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5016,11 +5016,8 @@ static int __perf_event_overflow(struct
+ 	if (events && atomic_dec_and_test(&event->event_limit)) {
+ 		ret = 1;
+ 		event->pending_kill = POLL_HUP;
+-		if (nmi) {
+-			event->pending_disable = 1;
+-			irq_work_queue(&event->pending);
+-		} else
+-			perf_event_disable(event);
++		event->pending_disable = 1;
++		irq_work_queue(&event->pending);
+ 	}
+ 
+ 	if (event->overflow_handler)
diff --git a/queue-3.0/perf-tools-fix-endian-conversion-reading-event-attr-from.patch b/queue-3.0/perf-tools-fix-endian-conversion-reading-event-attr-from.patch
new file mode 100644
index 0000000000..bbf1c3d73b
--- /dev/null
+++ b/queue-3.0/perf-tools-fix-endian-conversion-reading-event-attr-from.patch
@@ -0,0 +1,114 @@
+From eda3913bb70ecebac13adccffe1e7f96e93cee02 Mon Sep 17 00:00:00 2001
+From: David Ahern <dsahern@gmail.com>
+Date: Fri, 15 Jul 2011 12:34:09 -0600
+Subject: perf tools: Fix endian conversion reading event attr from
+ file header
+
+From: David Ahern <dsahern@gmail.com>
+
+commit eda3913bb70ecebac13adccffe1e7f96e93cee02 upstream.
+
+The perf_event_attr struct has two __u32's at the top and
+they need to be swapped individually.
+
+With this change I was able to analyze a perf.data collected in a
+32-bit PPC VM on an x86 system. I tested both 32-bit and 64-bit
+binaries for the Intel analysis side; both read the PPC perf.data
+file correctly.
+
+-v2:
+ - changed the existing perf_event__attr_swap() to swap only elements
+   of perf_event_attr and exported it for use in swapping the
+   attributes in the file header
+ - updated swap_ops used for processing events
+
+Signed-off-by: David Ahern <dsahern@gmail.com>
+Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: acme@ghostprotocols.net
+Cc: peterz@infradead.org
+Cc: paulus@samba.org
+Link: http://lkml.kernel.org/r/1310754849-12474-1-git-send-email-dsahern@gmail.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/util/header.c  |    5 ++++-
+ tools/perf/util/session.c |   30 ++++++++++++++++++------------
+ tools/perf/util/session.h |    1 +
+ 3 files changed, 23 insertions(+), 13 deletions(-)
+
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -877,9 +877,12 @@ int perf_session__read_header(struct per
+ 		struct perf_evsel *evsel;
+ 		off_t tmp;
+ 
+-		if (perf_header__getbuffer64(header, fd, &f_attr, sizeof(f_attr)))
++		if (readn(fd, &f_attr, sizeof(f_attr)) <= 0)
+ 			goto out_errno;
+ 
++		if (header->needs_swap)
++			perf_event__attr_swap(&f_attr.attr);
++
+ 		tmp = lseek(fd, 0, SEEK_CUR);
+ 		evsel = perf_evsel__new(&f_attr.attr, i);
+ 
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -407,20 +407,26 @@ static void perf_event__read_swap(union
+ 	event->read.id		 = bswap_64(event->read.id);
+ }
+ 
+-static void perf_event__attr_swap(union perf_event *event)
++/* exported for swapping attributes in file header */
++void perf_event__attr_swap(struct perf_event_attr *attr)
++{
++	attr->type		= bswap_32(attr->type);
++	attr->size		= bswap_32(attr->size);
++	attr->config		= bswap_64(attr->config);
++	attr->sample_period	= bswap_64(attr->sample_period);
++	attr->sample_type	= bswap_64(attr->sample_type);
++	attr->read_format	= bswap_64(attr->read_format);
++	attr->wakeup_events	= bswap_32(attr->wakeup_events);
++	attr->bp_type		= bswap_32(attr->bp_type);
++	attr->bp_addr		= bswap_64(attr->bp_addr);
++	attr->bp_len		= bswap_64(attr->bp_len);
++}
++
++static void perf_event__hdr_attr_swap(union perf_event *event)
+ {
+ 	size_t size;
+ 
+-	event->attr.attr.type		= bswap_32(event->attr.attr.type);
+-	event->attr.attr.size		= bswap_32(event->attr.attr.size);
+-	event->attr.attr.config		= bswap_64(event->attr.attr.config);
+-	event->attr.attr.sample_period	= bswap_64(event->attr.attr.sample_period);
+-	event->attr.attr.sample_type	= bswap_64(event->attr.attr.sample_type);
+-	event->attr.attr.read_format	= bswap_64(event->attr.attr.read_format);
+-	event->attr.attr.wakeup_events	= bswap_32(event->attr.attr.wakeup_events);
+-	event->attr.attr.bp_type	= bswap_32(event->attr.attr.bp_type);
+-	event->attr.attr.bp_addr	= bswap_64(event->attr.attr.bp_addr);
+-	event->attr.attr.bp_len		= bswap_64(event->attr.attr.bp_len);
++	perf_event__attr_swap(&event->attr.attr);
+ 
+ 	size = event->header.size;
+ 	size -= (void *)&event->attr.id - (void *)event;
+@@ -448,7 +454,7 @@ static perf_event__swap_op perf_event__s
+ 	[PERF_RECORD_LOST]		  = perf_event__all64_swap,
+ 	[PERF_RECORD_READ]		  = perf_event__read_swap,
+ 	[PERF_RECORD_SAMPLE]		  = perf_event__all64_swap,
+-	[PERF_RECORD_HEADER_ATTR]	  = perf_event__attr_swap,
++	[PERF_RECORD_HEADER_ATTR]	  = perf_event__hdr_attr_swap,
+ 	[PERF_RECORD_HEADER_EVENT_TYPE]	  = perf_event__event_type_swap,
+ 	[PERF_RECORD_HEADER_TRACING_DATA] = perf_event__tracing_data_swap,
+ 	[PERF_RECORD_HEADER_BUILD_ID]	  = NULL,
+--- a/tools/perf/util/session.h
++++ b/tools/perf/util/session.h
+@@ -112,6 +112,7 @@ int perf_session__set_kallsyms_ref_reloc
+ 					     u64 addr);
+ 
+ void mem_bswap_64(void *src, int byte_size);
++void perf_event__attr_swap(struct perf_event_attr *attr);
+ 
+ int perf_session__create_kernel_maps(struct perf_session *self);
+ 
diff --git a/queue-3.0/perf-tools-x86-fix-32-bit-compile-on-64-bit-system.patch b/queue-3.0/perf-tools-x86-fix-32-bit-compile-on-64-bit-system.patch
new file mode 100644
index 0000000000..e7f2e807ce
--- /dev/null
+++ b/queue-3.0/perf-tools-x86-fix-32-bit-compile-on-64-bit-system.patch
@@ -0,0 +1,52 @@
+From 08a4a43fc407d780bdde36d98f89c0dbb2a6be6b Mon Sep 17 00:00:00 2001
+From: David Ahern <dsahern@gmail.com>
+Date: Mon, 11 Jul 2011 15:38:24 -0600
+Subject: perf tools, x86: Fix 32-bit compile on 64-bit system
+
+From: David Ahern <dsahern@gmail.com>
+
+commit 08a4a43fc407d780bdde36d98f89c0dbb2a6be6b upstream.
+
+Builds for 32-bit perf binaries on a 64-bit host currently fail
+with this error:
+
+ [...]
+ bench/../../../arch/x86/lib/memcpy_64.S: Assembler messages:
+ bench/../../../arch/x86/lib/memcpy_64.S:29: Error: bad register name `%rdi'
+ bench/../../../arch/x86/lib/memcpy_64.S:34: Error: invalid instruction suffix for `movs'
+ bench/../../../arch/x86/lib/memcpy_64.S:50: Error: bad register name `%rdi'
+ bench/../../../arch/x86/lib/memcpy_64.S:61: Error: bad register name `%rdi'
+ ...
+
+The problem is the detection of the host arch without considering passed in
+flags. This change fixes 32-bit builds via:
+
+make EXTRA_CFLAGS=-m32
+
+and 64-bit builds still reference the memcpy_64.S.
+
+Signed-off-by: David Ahern <dsahern@gmail.com>
+Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/1310420304-21452-1-git-send-email-dsahern@gmail.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/Makefile |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -52,7 +52,10 @@ ifeq ($(ARCH),i386)
+ endif
+ ifeq ($(ARCH),x86_64)
+ 	ARCH := x86
+-	IS_X86_64 := $(shell echo __x86_64__ | ${CC} -E -xc - | tail -n 1)
++	IS_X86_64 := 0
++	ifeq (, $(findstring m32,$(EXTRA_CFLAGS)))
++		IS_X86_64 := $(shell echo __x86_64__ | ${CC} -E -xc - | tail -n 1)
++	endif
+ 	ifeq (${IS_X86_64}, 1)
+ 		RAW_ARCH := x86_64
+ 		ARCH_CFLAGS := -DARCH_X86_64
diff --git a/queue-3.0/rtlwifi-rtl8192cu-fix-duplicate-if-test.patch b/queue-3.0/rtlwifi-rtl8192cu-fix-duplicate-if-test.patch
new file mode 100644
index 0000000000..b3f6eab4ff
--- /dev/null
+++ b/queue-3.0/rtlwifi-rtl8192cu-fix-duplicate-if-test.patch
@@ -0,0 +1,33 @@
+From 1288aa4e80145d9f4196df32f717b4c1cf6aab61 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 9 Jul 2011 13:15:58 -0500
+Subject: rtlwifi: rtl8192cu: Fix duplicate if test
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 1288aa4e80145d9f4196df32f717b4c1cf6aab61 upstream.
+
+A typo causes routine rtl92cu_phy_rf6052_set_cck_txpower() to test the
+same condition twice. The problem was found using cppcheck-1.49, and the
+proper fix was verified against the pre-mac80211 version of the code.
+
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/rf.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -104,7 +104,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(
+ 			tx_agc[RF90_PATH_A] = 0x10101010;
+ 			tx_agc[RF90_PATH_B] = 0x10101010;
+ 		} else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+-			   TXHIGHPWRLEVEL_LEVEL1) {
++			   TXHIGHPWRLEVEL_LEVEL2) {
+ 			tx_agc[RF90_PATH_A] = 0x00000000;
+ 			tx_agc[RF90_PATH_B] = 0x00000000;
+ 		} else{
diff --git a/queue-3.0/series b/queue-3.0/series
index 5e0aba5557..6816640230 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -25,3 +25,16 @@ ath6kl-fix-crash-when-interface-is-closed-but-scan-is.patch
 ath9k_hw-fix-incorrect-key_miss-handling.patch
 cifs-fix-oops-while-mounting-with-prefixpath.patch
 staging-brcm80211-fix-for-reported-log-spam-problem.patch
+jme-fix-unmap-error-causing-system-freeze.patch
+ethtool-allow-zero-length-register-dumps-again.patch
+firewire-cdev-return-enotty-for-unimplemented-ioctls-not.patch
+firewire-cdev-prevent-race-between-first-get_info-ioctl-and-bus-reset-event-queuing.patch
+ib-srp-avoid-duplicate-devices-from-lun-scan.patch
+libsas-remove-expander-from-dev-list-on-error.patch
+rtlwifi-rtl8192cu-fix-duplicate-if-test.patch
+mac80211-restart-sta-timers-only-on-associated-state.patch
+irq_work-ppc-fix-up-arch-hooks.patch
+perf-tools-x86-fix-32-bit-compile-on-64-bit-system.patch
+perf-tools-fix-endian-conversion-reading-event-attr-from.patch
+x86-intel-power-initialize-msr_ia32_energy_perf_bias.patch
+perf-fix-software-event-overflow.patch
diff --git a/queue-3.0/x86-intel-power-initialize-msr_ia32_energy_perf_bias.patch b/queue-3.0/x86-intel-power-initialize-msr_ia32_energy_perf_bias.patch
new file mode 100644
index 0000000000..8d3ef87a12
--- /dev/null
+++ b/queue-3.0/x86-intel-power-initialize-msr_ia32_energy_perf_bias.patch
@@ -0,0 +1,78 @@
+From abe48b108247e9b90b4c6739662a2e5c765ed114 Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Thu, 14 Jul 2011 00:53:24 -0400
+Subject: x86, intel, power: Initialize MSR_IA32_ENERGY_PERF_BIAS
+
+From: Len Brown <len.brown@intel.com>
+
+commit abe48b108247e9b90b4c6739662a2e5c765ed114 upstream.
+
+Since 2.6.36 (23016bf0d25), Linux prints the existence of "epb" in /proc/cpuinfo,
+Since 2.6.38 (d5532ee7b40), the x86_energy_perf_policy(8) utility has
+been available in-tree to update MSR_IA32_ENERGY_PERF_BIAS.
+
+However, the typical BIOS fails to initialize the MSR, presumably
+because this is handled by high-volume shrink-wrap operating systems...
+
+Linux distros, on the other hand, do not yet invoke x86_energy_perf_policy(8).
+As a result, WSM-EP, SNB, and later hardware from Intel will run in its
+default hardware power-on state (performance), which assumes that users
+care for performance at all costs and not for energy efficiency.
+While that is fine for performance benchmarks, the hardware's intended default
+operating point is "normal" mode...
+
+Initialize the MSR to the "normal" by default during kernel boot.
+
+x86_energy_perf_policy(8) is available to change the default after boot,
+should the user have a different preference.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1107140051020.18606@x980
+Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/msr-index.h |    3 +++
+ arch/x86/kernel/cpu/intel.c      |   18 ++++++++++++++++++
+ 2 files changed, 21 insertions(+)
+
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -259,6 +259,9 @@
+ #define MSR_IA32_TEMPERATURE_TARGET	0x000001a2
+ 
+ #define MSR_IA32_ENERGY_PERF_BIAS	0x000001b0
++#define ENERGY_PERF_BIAS_PERFORMANCE	0
++#define ENERGY_PERF_BIAS_NORMAL		6
++#define ENERGY_PERF_BIAS_POWERSWAVE	15
+ 
+ #define MSR_IA32_PACKAGE_THERM_STATUS		0x000001b1
+ 
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -456,6 +456,24 @@ static void __cpuinit init_intel(struct
+ 
+ 	if (cpu_has(c, X86_FEATURE_VMX))
+ 		detect_vmx_virtcap(c);
++
++	/*
++	 * Initialize MSR_IA32_ENERGY_PERF_BIAS if BIOS did not.
++	 * x86_energy_perf_policy(8) is available to change it at run-time
++	 */
++	if (cpu_has(c, X86_FEATURE_EPB)) {
++		u64 epb;
++
++		rdmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
++		if ((epb & 0xF) == 0) {
++			printk_once(KERN_WARNING, "x86: updated energy_perf_bias"
++				" to 'normal' from 'performance'\n"
++				"You can view and update epb via utility,"
++				" such as x86_energy_perf_policy(8)\n");
++			epb = (epb & ~0xF) | ENERGY_PERF_BIAS_NORMAL;
++			wrmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
++		}
++	}
+ }
+ 
+ #ifdef CONFIG_X86_32