3.0 patches

13 files changed, 541 insertions, 0 deletions

diff --git a/queue-3.0/apparmor-fix-masking-of-capabilities-in-complain-mode.patch b/queue-3.0/apparmor-fix-masking-of-capabilities-in-complain-mode.patch
new file mode 100644
index 0000000000..283e32cfae
--- /dev/null
+++ b/queue-3.0/apparmor-fix-masking-of-capabilities-in-complain-mode.patch
@@ -0,0 +1,41 @@
+From 25e75dff519bcce2cb35023105e7df51d7b9e691 Mon Sep 17 00:00:00 2001
+From: John Johansen <john.johansen@canonical.com>
+Date: Sat, 25 Jun 2011 16:57:07 +0100
+Subject: AppArmor: Fix masking of capabilities in complain mode
+
+From: John Johansen <john.johansen@canonical.com>
+
+commit 25e75dff519bcce2cb35023105e7df51d7b9e691 upstream.
+
+AppArmor is masking the capabilities returned by capget against the
+capabilities mask in the profile.  This is wrong, in complain mode the
+profile has effectively all capabilities, as the profile restrictions are
+not being enforced, merely tested against to determine if an access is
+known by the profile.
+
+This can result in the wrong behavior of security conscience applications
+like sshd which examine their capability set, and change their behavior
+accordingly.  In this case because of the masked capability set being
+returned sshd fails due to DAC checks, even when the profile is in complain
+mode.
+
+Kernels affected: 2.6.36 - 3.0.
+
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/apparmor/lsm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -127,7 +127,7 @@ static int apparmor_capget(struct task_s
+ 	*inheritable = cred->cap_inheritable;
+ 	*permitted = cred->cap_permitted;
+ 
+-	if (!unconfined(profile)) {
++	if (!unconfined(profile) && !COMPLAIN_MODE(profile)) {
+ 		*effective = cap_intersect(*effective, profile->caps.allow);
+ 		*permitted = cap_intersect(*permitted, profile->caps.allow);
+ 	}
diff --git a/queue-3.0/apparmor-fix-reference-to-rcu-protected-pointer-outside-of.patch b/queue-3.0/apparmor-fix-reference-to-rcu-protected-pointer-outside-of.patch
new file mode 100644
index 0000000000..9bc35f4f5c
--- /dev/null
+++ b/queue-3.0/apparmor-fix-reference-to-rcu-protected-pointer-outside-of.patch
@@ -0,0 +1,45 @@
+From 04fdc099f9c80c7775dbac388fc97e156d4d47e7 Mon Sep 17 00:00:00 2001
+From: John Johansen <john.johansen@canonical.com>
+Date: Tue, 28 Jun 2011 15:06:38 +0100
+Subject: AppArmor: Fix reference to rcu protected pointer outside of
+ rcu_read_lock
+
+From: John Johansen <john.johansen@canonical.com>
+
+commit 04fdc099f9c80c7775dbac388fc97e156d4d47e7 upstream.
+
+The pointer returned from tracehook_tracer_task() is only valid inside
+the rcu_read_lock.  However the tracer pointer obtained is being passed
+to aa_may_ptrace outside of the rcu_read_lock critical section.
+
+Mover the aa_may_ptrace test into the rcu_read_lock critical section, to
+fix this.
+
+Kernels affected: 2.6.36 - 3.0
+
+Reported-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/apparmor/domain.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -73,7 +73,6 @@ static int may_change_ptraced_domain(str
+ 		cred = get_task_cred(tracer);
+ 		tracerp = aa_cred_profile(cred);
+ 	}
+-	rcu_read_unlock();
+ 
+ 	/* not ptraced */
+ 	if (!tracer || unconfined(tracerp))
+@@ -82,6 +81,7 @@ static int may_change_ptraced_domain(str
+ 	error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
+ 
+ out:
++	rcu_read_unlock();
+ 	if (cred)
+ 		put_cred(cred);
+ 
diff --git a/queue-3.0/cfg80211-really-ignore-the-regulatory-request.patch b/queue-3.0/cfg80211-really-ignore-the-regulatory-request.patch
new file mode 100644
index 0000000000..ce432ffef3
--- /dev/null
+++ b/queue-3.0/cfg80211-really-ignore-the-regulatory-request.patch
@@ -0,0 +1,52 @@
+From a203c2aa4cefccb879c879b8e1cad1a09a679e55 Mon Sep 17 00:00:00 2001
+From: Sven Neumann <s.neumann@raumfeld.com>
+Date: Tue, 12 Jul 2011 15:52:07 +0200
+Subject: cfg80211: really ignore the regulatory request
+
+From: Sven Neumann <s.neumann@raumfeld.com>
+
+commit a203c2aa4cefccb879c879b8e1cad1a09a679e55 upstream.
+
+At the beginning of wiphy_update_regulatory() a check is performed
+whether the request is to be ignored. Then the request is sent to
+the driver nevertheless. This happens even if last_request points
+to NULL, leading to a crash in the driver:
+
+ [<bf01d864>] (lbs_set_11d_domain_info+0x28/0x1e4 [libertas]) from [<c03b714c>] (wiphy_update_regulatory+0x4d0/0x4f4)
+ [<c03b714c>] (wiphy_update_regulatory+0x4d0/0x4f4) from [<c03b4008>] (wiphy_register+0x354/0x420)
+ [<c03b4008>] (wiphy_register+0x354/0x420) from [<bf01b17c>] (lbs_cfg_register+0x80/0x164 [libertas])
+ [<bf01b17c>] (lbs_cfg_register+0x80/0x164 [libertas]) from [<bf020e64>] (lbs_start_card+0x20/0x88 [libertas])
+ [<bf020e64>] (lbs_start_card+0x20/0x88 [libertas]) from [<bf02cbd8>] (if_sdio_probe+0x898/0x9c0 [libertas_sdio])
+
+Fix this by returning early. Also remove the out: label as it is
+not any longer needed.
+
+Signed-off-by: Sven Neumann <s.neumann@raumfeld.com>
+Cc: linux-wireless@vger.kernel.org
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Cc: Daniel Mack <daniel@zonque.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/reg.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1125,12 +1125,13 @@ void wiphy_update_regulatory(struct wiph
+ 	enum ieee80211_band band;
+ 
+ 	if (ignore_reg_update(wiphy, initiator))
+-		goto out;
++		return;
++
+ 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+ 		if (wiphy->bands[band])
+ 			handle_band(wiphy, band, initiator);
+ 	}
+-out:
++
+ 	reg_process_beacons(wiphy);
+ 	reg_process_ht_flags(wiphy);
+ 	if (wiphy->reg_notifier)
diff --git a/queue-3.0/gfs2-fix-mount-hang-caused-by-certain-access-pattern-to-sysfs-files.patch b/queue-3.0/gfs2-fix-mount-hang-caused-by-certain-access-pattern-to-sysfs-files.patch
new file mode 100644
index 0000000000..96435b9f97
--- /dev/null
+++ b/queue-3.0/gfs2-fix-mount-hang-caused-by-certain-access-pattern-to-sysfs-files.patch
@@ -0,0 +1,38 @@
+From 19237039919088781b4191a00bdc1284d8fea1dd Mon Sep 17 00:00:00 2001
+From: Steven Whitehouse <swhiteho@redhat.com>
+Date: Tue, 26 Jul 2011 09:15:45 +0100
+Subject: GFS2: Fix mount hang caused by certain access pattern to sysfs files
+
+From: Steven Whitehouse <swhiteho@redhat.com>
+
+commit 19237039919088781b4191a00bdc1284d8fea1dd upstream.
+
+Depending upon the order of userspace/kernel during the
+mount process, this can result in a hang without the
+_all version of the completion.
+
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/gfs2/ops_fstype.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1018,13 +1018,13 @@ hostdata_error:
+ 		fsname++;
+ 	if (lm->lm_mount == NULL) {
+ 		fs_info(sdp, "Now mounting FS...\n");
+-		complete(&sdp->sd_locking_init);
++		complete_all(&sdp->sd_locking_init);
+ 		return 0;
+ 	}
+ 	ret = lm->lm_mount(sdp, fsname);
+ 	if (ret == 0)
+ 		fs_info(sdp, "Joined cluster. Now mounting FS...\n");
+-	complete(&sdp->sd_locking_init);
++	complete_all(&sdp->sd_locking_init);
+ 	return ret;
+ }
+ 
diff --git a/queue-3.0/hvc_console-improve-tty-console-put_chars-handling.patch b/queue-3.0/hvc_console-improve-tty-console-put_chars-handling.patch
new file mode 100644
index 0000000000..a2896d1540
--- /dev/null
+++ b/queue-3.0/hvc_console-improve-tty-console-put_chars-handling.patch
@@ -0,0 +1,57 @@
+From 8c2381af0d3ef62a681dac5a141b6dabb27bf2e1 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Date: Tue, 5 Jul 2011 21:50:18 +0000
+Subject: hvc_console: Improve tty/console put_chars handling
+
+From: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+
+commit 8c2381af0d3ef62a681dac5a141b6dabb27bf2e1 upstream.
+
+Currently, the hvc_console_print() function drops console output if the
+hvc backend's put_chars() returns 0.  This patch changes this behavior
+to allow a retry through returning -EAGAIN.
+
+This change also affects the hvc_push() function.  Both functions are
+changed to handle -EAGAIN and to retry the put_chars() operation.
+
+If a hvc backend returns -EAGAIN, the retry handling differs:
+
+  - hvc_console_print() spins to write the complete console output.
+  - hvc_push() behaves the same way as for returning 0.
+
+Now hvc backends can indirectly control the way how console output is
+handled through the hvc console layer.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Acked-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/hvc/hvc_console.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/hvc/hvc_console.c
++++ b/drivers/tty/hvc/hvc_console.c
+@@ -163,8 +163,10 @@ static void hvc_console_print(struct con
+ 		} else {
+ 			r = cons_ops[index]->put_chars(vtermnos[index], c, i);
+ 			if (r <= 0) {
+-				/* throw away chars on error */
+-				i = 0;
++				/* throw away characters on error
++				 * but spin in case of -EAGAIN */
++				if (r != -EAGAIN)
++					i = 0;
+ 			} else if (r > 0) {
+ 				i -= r;
+ 				if (i > 0)
+@@ -448,7 +450,7 @@ static int hvc_push(struct hvc_struct *h
+ 
+ 	n = hp->ops->put_chars(hp->vtermno, hp->outbuf, hp->n_outbuf);
+ 	if (n <= 0) {
+-		if (n == 0) {
++		if (n == 0 || n == -EAGAIN) {
+ 			hp->do_wakeup = 1;
+ 			return 0;
+ 		}
diff --git a/queue-3.0/ipc-sem.c-fix-race-with-concurrent-semtimedop-timeouts.patch b/queue-3.0/ipc-sem.c-fix-race-with-concurrent-semtimedop-timeouts.patch
new file mode 100644
index 0000000000..dcc418614d
--- /dev/null
+++ b/queue-3.0/ipc-sem.c-fix-race-with-concurrent-semtimedop-timeouts.patch
@@ -0,0 +1,61 @@
+From d694ad62bf539dbb20a0899ac2a954555f9e4a83 Mon Sep 17 00:00:00 2001
+From: Manfred Spraul <manfred@colorfullife.com>
+Date: Mon, 25 Jul 2011 17:11:47 -0700
+Subject: ipc/sem.c: fix race with concurrent semtimedop() timeouts
+ and IPC_RMID
+
+From: Manfred Spraul <manfred@colorfullife.com>
+
+commit d694ad62bf539dbb20a0899ac2a954555f9e4a83 upstream.
+
+If a semaphore array is removed and in parallel a sleeping task is woken
+up (signal or timeout, does not matter), then the woken up task does not
+wait until wake_up_sem_queue_do() is completed.  This will cause crashes,
+because wake_up_sem_queue_do() will read from a stale pointer.
+
+The fix is simple: Regardless of anything, always call get_queue_result().
+This function waits until wake_up_sem_queue_do() has finished it's task.
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=27142
+
+Reported-by: Yuriy Yevtukhov <yuriy@ucoz.com>
+Reported-by: Harald Laabs <kernel@dasr.de>
+Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ ipc/sem.c |   13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -1456,15 +1456,24 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
+ 	}
+ 
+ 	sma = sem_lock(ns, semid);
++
++	/*
++	 * Wait until it's guaranteed that no wakeup_sem_queue_do() is ongoing.
++	 */
++	error = get_queue_result(&queue);
++
++	/*
++	 * Array removed? If yes, leave without sem_unlock().
++	 */
+ 	if (IS_ERR(sma)) {
+ 		error = -EIDRM;
+ 		goto out_free;
+ 	}
+ 
+-	error = get_queue_result(&queue);
+ 
+ 	/*
+-	 * If queue.status != -EINTR we are woken up by another process
++	 * If queue.status != -EINTR we are woken up by another process.
++	 * Leave without unlink_queue(), but with sem_unlock().
+ 	 */
+ 
+ 	if (error != -EINTR) {
diff --git a/queue-3.0/memcg-fix-behavior-of-mem_cgroup_resize_limit.patch b/queue-3.0/memcg-fix-behavior-of-mem_cgroup_resize_limit.patch
new file mode 100644
index 0000000000..61d7078505
--- /dev/null
+++ b/queue-3.0/memcg-fix-behavior-of-mem_cgroup_resize_limit.patch
@@ -0,0 +1,47 @@
+From 108b6a78463bb8c7163e4f9779f36ad8bbade334 Mon Sep 17 00:00:00 2001
+From: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Date: Tue, 26 Jul 2011 16:08:25 -0700
+Subject: memcg: fix behavior of mem_cgroup_resize_limit()
+
+From: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+
+commit 108b6a78463bb8c7163e4f9779f36ad8bbade334 upstream.
+
+Commit 22a668d7c3ef ("memcg: fix behavior under memory.limit equals to
+memsw.limit") introduced "memsw_is_minimum" flag, which becomes true
+when mem_limit == memsw_limit.  The flag is checked at the beginning of
+reclaim, and "noswap" is set if the flag is true, because using swap is
+meaningless in this case.
+
+This works well in most cases, but when we try to shrink mem_limit,
+which is the same as memsw_limit now, we might fail to shrink mem_limit
+because swap doesn't used.
+
+This patch fixes this behavior by:
+ - check MEM_CGROUP_RECLAIM_SHRINK at the begining of reclaim
+ - If it is set, don't set "noswap" flag even if memsw_is_minimum is true.
+
+Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Michal Hocko <mhocko@suse.cz>
+Cc: Ying Han <yinghan@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memcontrol.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1730,7 +1730,7 @@ static int mem_cgroup_hierarchical_recla
+ 	excess = res_counter_soft_limit_excess(&root_mem->res) >> PAGE_SHIFT;
+ 
+ 	/* If memsw_is_minimum==1, swap-out is of-no-use. */
+-	if (!check_soft && root_mem->memsw_is_minimum)
++	if (!check_soft && !shrink && root_mem->memsw_is_minimum)
+ 		noswap = true;
+ 
+ 	while (1) {
diff --git a/queue-3.0/oom-task-mm-null-doesn-t-mean-the-memory-was-freed.patch b/queue-3.0/oom-task-mm-null-doesn-t-mean-the-memory-was-freed.patch
new file mode 100644
index 0000000000..8fced3ae08
--- /dev/null
+++ b/queue-3.0/oom-task-mm-null-doesn-t-mean-the-memory-was-freed.patch
@@ -0,0 +1,50 @@
+From c027a474a68065391c8773f6e83ed5412657e369 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Sat, 30 Jul 2011 16:35:02 +0200
+Subject: oom: task->mm == NULL doesn't mean the memory was freed
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit c027a474a68065391c8773f6e83ed5412657e369 upstream.
+
+exit_mm() sets ->mm == NULL then it does mmput()->exit_mmap() which
+frees the memory.
+
+However select_bad_process() checks ->mm != NULL before TIF_MEMDIE,
+so it continues to kill other tasks even if we have the oom-killed
+task freeing its memory.
+
+Change select_bad_process() to check ->mm after TIF_MEMDIE, but skip
+the tasks which have already passed exit_notify() to ensure a zombie
+with TIF_MEMDIE set can't block oom-killer. Alternatively we could
+probably clear TIF_MEMDIE after exit_mmap().
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/oom_kill.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -303,7 +303,7 @@ static struct task_struct *select_bad_pr
+ 	do_each_thread(g, p) {
+ 		unsigned int points;
+ 
+-		if (!p->mm)
++		if (p->exit_state)
+ 			continue;
+ 		if (oom_unkillable_task(p, mem, nodemask))
+ 			continue;
+@@ -319,6 +319,8 @@ static struct task_struct *select_bad_pr
+ 		 */
+ 		if (test_tsk_thread_flag(p, TIF_MEMDIE))
+ 			return ERR_PTR(-1UL);
++		if (!p->mm)
++			continue;
+ 
+ 		if (p->flags & PF_EXITING) {
+ 			/*
diff --git a/queue-3.0/powerpc-pseries-hvconsole-fix-dropped-console-output.patch b/queue-3.0/powerpc-pseries-hvconsole-fix-dropped-console-output.patch
new file mode 100644
index 0000000000..07776a9622
--- /dev/null
+++ b/queue-3.0/powerpc-pseries-hvconsole-fix-dropped-console-output.patch
@@ -0,0 +1,31 @@
+From 51d33021425e1f905beb4208823146f2fb6517da Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Tue, 5 Jul 2011 21:51:36 +0000
+Subject: powerpc/pseries/hvconsole: Fix dropped console output
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 51d33021425e1f905beb4208823146f2fb6517da upstream.
+
+Return -EAGAIN when we get H_BUSY back from the hypervisor. This
+makes the hvc console driver retry, avoiding dropped printks.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/platforms/pseries/hvconsole.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/pseries/hvconsole.c
++++ b/arch/powerpc/platforms/pseries/hvconsole.c
+@@ -73,7 +73,7 @@ int hvc_put_chars(uint32_t vtermno, cons
+ 	if (ret == H_SUCCESS)
+ 		return count;
+ 	if (ret == H_BUSY)
+-		return 0;
++		return -EAGAIN;
+ 	return -EIO;
+ }
+ 
diff --git a/queue-3.0/rt2x00-add-device-id-for-rt539f-device.patch b/queue-3.0/rt2x00-add-device-id-for-rt539f-device.patch
new file mode 100644
index 0000000000..b567af9ec9
--- /dev/null
+++ b/queue-3.0/rt2x00-add-device-id-for-rt539f-device.patch
@@ -0,0 +1,29 @@
+From 71e0b38c2914018b01f3f08b43ee9e3328197699 Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Wed, 6 Jul 2011 22:58:55 +0200
+Subject: rt2x00: Add device ID for RT539F device.
+
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+
+commit 71e0b38c2914018b01f3f08b43ee9e3328197699 upstream.
+
+Reported-by: Wim Vander Schelden <wim@fixnum.org>
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2800pci.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -1158,6 +1158,7 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci
+ #endif
+ #ifdef CONFIG_RT2800PCI_RT53XX
+ 	{ PCI_DEVICE(0x1814, 0x5390) },
++	{ PCI_DEVICE(0x1814, 0x539f) },
+ #endif
+ 	{ 0, }
+ };
diff --git a/queue-3.0/serial-sc26xx-fix-link-error.patch b/queue-3.0/serial-sc26xx-fix-link-error.patch
new file mode 100644
index 0000000000..b66769698a
--- /dev/null
+++ b/queue-3.0/serial-sc26xx-fix-link-error.patch
@@ -0,0 +1,41 @@
+From f2eb3cdf14457fccb14ae8c4d7d7cee088cd3957 Mon Sep 17 00:00:00 2001
+From: Ralf Baechle <ralf@linux-mips.org>
+Date: Mon, 27 Jun 2011 14:26:56 +0100
+Subject: SERIAL: SC26xx: Fix link error.
+
+From: Ralf Baechle <ralf@linux-mips.org>
+
+commit f2eb3cdf14457fccb14ae8c4d7d7cee088cd3957 upstream.
+
+Kconfig allows enabling console support for the SC26xx driver even when
+it's configured as a module resulting in a:
+
+ERROR: "uart_console_device" [drivers/tty/serial/sc26xx.ko] undefined!
+
+modpost error since the driver was merged in
+eea63e0e8a60d00485b47fb6e75d9aa2566b989b [SC26XX: New serial driver for
+SC2681 uarts] in 2.6.25.  Fixed by only allowing console support to be
+enabled if the driver is builtin.
+
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-serial@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Acked-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/serial/Kconfig |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/Kconfig
++++ b/drivers/tty/serial/Kconfig
+@@ -1419,7 +1419,7 @@ config SERIAL_SC26XX
+ 
+ config SERIAL_SC26XX_CONSOLE
+ 	bool "Console on SC2681/SC2692 serial port"
+-	depends on SERIAL_SC26XX
++	depends on SERIAL_SC26XX=y
+ 	select SERIAL_CORE_CONSOLE
+ 	help
+ 	  Support for Console on SC2681/SC2692 serial ports.
diff --git a/queue-3.0/series b/queue-3.0/series
index d115d5b66d..c404118473 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -82,3 +82,15 @@ proc-fix-a-race-in-do_io_accounting.patch
 n_gsm-fix-the-wrong-fcs-handling.patch
 ehci-only-power-off-port-if-over-current-is-active.patch
 ehci-fix-direction-handling-for-interrupt-data-toggles.patch
+cfg80211-really-ignore-the-regulatory-request.patch
+memcg-fix-behavior-of-mem_cgroup_resize_limit.patch
+tty-serial-fix-xscale-serial-ports-e.g.-ce4100.patch
+serial-sc26xx-fix-link-error.patch
+powerpc-pseries-hvconsole-fix-dropped-console-output.patch
+hvc_console-improve-tty-console-put_chars-handling.patch
+ipc-sem.c-fix-race-with-concurrent-semtimedop-timeouts.patch
+apparmor-fix-reference-to-rcu-protected-pointer-outside-of.patch
+apparmor-fix-masking-of-capabilities-in-complain-mode.patch
+oom-task-mm-null-doesn-t-mean-the-memory-was-freed.patch
+rt2x00-add-device-id-for-rt539f-device.patch
+gfs2-fix-mount-hang-caused-by-certain-access-pattern-to-sysfs-files.patch
diff --git a/queue-3.0/tty-serial-fix-xscale-serial-ports-e.g.-ce4100.patch b/queue-3.0/tty-serial-fix-xscale-serial-ports-e.g.-ce4100.patch
new file mode 100644
index 0000000000..afd7ede8e0
--- /dev/null
+++ b/queue-3.0/tty-serial-fix-xscale-serial-ports-e.g.-ce4100.patch
@@ -0,0 +1,37 @@
+From 5568181f188ae9485a0cdbea5ea48f63d186a298 Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Fri, 17 Jun 2011 09:45:07 -0600
+Subject: tty/serial: Fix XSCALE serial ports, e.g. ce4100
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit 5568181f188ae9485a0cdbea5ea48f63d186a298 upstream.
+
+Commit 4539c24fe4f92c09ee668ef959d3e8180df619b9 "tty/serial: Add
+explicit PORT_TEGRA type" introduced separate flags describing the need
+for IER bits UUE and RTOIE. Both bits are required for the XSCALE port
+type. While that patch updated uart_config[] as required, the auto-probing
+code wasn't updated to set the RTOIE flag when an XSCALE port type was
+detected. This caused such ports to stop working. This patch rectifies
+that.
+
+Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/serial/8250.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250.c
++++ b/drivers/tty/serial/8250.c
+@@ -1107,7 +1107,7 @@ static void autoconfig_16550a(struct uar
+ 			 */
+ 			DEBUG_AUTOCONF("Xscale ");
+ 			up->port.type = PORT_XSCALE;
+-			up->capabilities |= UART_CAP_UUE;
++			up->capabilities |= UART_CAP_UUE | UART_CAP_RTOIE;
+ 			return;
+ 		}
+ 	} else {