3.9.8-100.fc17.gnu

15 files changed, 393 insertions, 417 deletions

diff --git a/freed-ora/current/f17/HID-input-return-ENODATA-if-reading-battery-attrs-fails.patch b/freed-ora/current/f17/HID-input-return-ENODATA-if-reading-battery-attrs-fails.patch
new file mode 100644
index 000000000..acdd66d48
--- /dev/null
+++ b/freed-ora/current/f17/HID-input-return-ENODATA-if-reading-battery-attrs-fails.patch
@@ -0,0 +1,55 @@
+From d0a934b764c67b4bf626f5b7cf725a6e3066afd2 Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann@gmail.com>
+Date: Mon, 13 May 2013 15:01:30 +0000
+Subject: HID: input: return ENODATA if reading battery attrs fails
+
+power_supply core has the bad habit of calling our battery callbacks
+from within power_supply_register(). Furthermore, if the callbacks
+fail with an unhandled error code, it will skip any uevent that it
+might currently process.
+So if HID-core registers battery devices, an "add" uevent is generated
+and the battery callbacks are called. These will gracefully fail due
+to timeouts as they might still hold locks on event processing. One
+could argue that this should be fixed in power_supply core, but the
+least we can do is to signal ENODATA so power_supply core will just
+skip the property and continue with the uevent.
+
+This fixes a bug where "add" and "remove" uevents are skipped for
+battery devices. upower is unable to track these devices and currently
+needs to ignore them.
+
+This patch also overwrites any other error code. I cannot see any reason
+why we should forward protocol- or I/O-errors to the power_supply core.
+We handle these errors in hid_ll_driver later, anyway, so just skip
+them. power_supply core cannot do anything useful with them, anyway,
+and we avoid skipping important uevents and confusing user-space.
+
+Thanks a lot to Daniel Nicoletti for pushing and investigating
+on this.
+
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Anton Vorontsov <cbou@mail.ru>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Reported-by: Daniel Nicoletti <dantti12@gmail.com>
+Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 945b815..c526a3c 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -354,10 +354,10 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ 					      dev->battery_report_type);
+ 
+ 		if (ret != 2) {
+-			if (ret >= 0)
+-				ret = -EINVAL;
++			ret = -ENODATA;
+ 			break;
+ 		}
++		ret = 0;
+ 
+ 		if (dev->battery_min < dev->battery_max &&
+ 		    buf[1] >= dev->battery_min &&
+--
+cgit v0.9.2
diff --git a/freed-ora/current/f17/ath3k-dont-use-stack-memory-for-DMA.patch b/freed-ora/current/f17/ath3k-dont-use-stack-memory-for-DMA.patch
new file mode 100644
index 000000000..610a00067
--- /dev/null
+++ b/freed-ora/current/f17/ath3k-dont-use-stack-memory-for-DMA.patch
@@ -0,0 +1,72 @@
+Memory allocated by vmalloc (including stack) can not be used for DMA,
+i.e. data pointer on usb_control_msg() should not point to stack memory.
+
+Resolves:
+https://bugzilla.redhat.com/show_bug.cgi?id=977558
+
+Reported-and-tested-by: Andy Lawrence <dr.diesel@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/bluetooth/ath3k.c | 38 +++++++++++++++++++++++++++++---------
+ 1 file changed, 29 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 11f467c..81b636c 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -193,24 +193,44 @@ error:
+ 
+ static int ath3k_get_state(struct usb_device *udev, unsigned char *state)
+ {
+-	int pipe = 0;
++	int ret, pipe = 0;
++	char *buf;
++
++	buf = kmalloc(1, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
+ 
+ 	pipe = usb_rcvctrlpipe(udev, 0);
+-	return usb_control_msg(udev, pipe, ATH3K_GETSTATE,
+-			USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+-			state, 0x01, USB_CTRL_SET_TIMEOUT);
++	ret = usb_control_msg(udev, pipe, ATH3K_GETSTATE,
++			      USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
++			      buf, 1, USB_CTRL_SET_TIMEOUT);
++
++	*state = *buf;
++	kfree(buf);
++
++	return ret;
+ }
+ 
+ static int ath3k_get_version(struct usb_device *udev,
+ 			struct ath3k_version *version)
+ {
+-	int pipe = 0;
++	int ret, pipe = 0;
++	char *buf;
++	const int size = sizeof(struct ath3k_version);
++	
++	buf = kmalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
+ 
+ 	pipe = usb_rcvctrlpipe(udev, 0);
+-	return usb_control_msg(udev, pipe, ATH3K_GETVERSION,
+-			USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, version,
+-			sizeof(struct ath3k_version),
+-			USB_CTRL_SET_TIMEOUT);
++	ret = usb_control_msg(udev, pipe, ATH3K_GETVERSION,
++			      USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
++			      buf, size, USB_CTRL_SET_TIMEOUT);
++
++	memcpy(version, buf, size);
++	kfree(buf);
++
++	return ret;
+ }
+ 
+ static int ath3k_load_fwfile(struct usb_device *udev,
+-- 
+1.7.11.7
diff --git a/freed-ora/current/f17/bridge-only-expire-the-mdb-entry-when-query-is-received.patch b/freed-ora/current/f17/bridge-only-expire-the-mdb-entry-when-query-is-received.patch
new file mode 100644
index 000000000..b58b57083
--- /dev/null
+++ b/freed-ora/current/f17/bridge-only-expire-the-mdb-entry-when-query-is-received.patch
@@ -0,0 +1,159 @@
+From 9f00b2e7cf241fa389733d41b615efdaa2cb0f5b Mon Sep 17 00:00:00 2001
+From: Cong Wang <amwang@redhat.com>
+Date: Tue, 21 May 2013 21:52:55 +0000
+Subject: bridge: only expire the mdb entry when query is received
+
+Currently we arm the expire timer when the mdb entry is added,
+however, this causes problem when there is no querier sent
+out after that.
+
+So we should only arm the timer when a corresponding query is
+received, as suggested by Herbert.
+
+And he also mentioned "if there is no querier then group
+subscriptions shouldn't expire. There has to be at least one querier
+in the network for this thing to work.  Otherwise it just degenerates
+into a non-snooping switch, which is OK."
+
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Stephen Hemminger <stephen@networkplumber.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Adam Baker <linux@baker-net.org.uk>
+Signed-off-by: Cong Wang <amwang@redhat.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+(limited to 'net/bridge')
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 2475147..40bda80 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -617,8 +617,6 @@ rehash:
+ 
+ 	mp->br = br;
+ 	mp->addr = *group;
+-	setup_timer(&mp->timer, br_multicast_group_expired,
+-		    (unsigned long)mp);
+ 
+ 	hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
+ 	mdb->size++;
+@@ -656,7 +654,6 @@ static int br_multicast_add_group(struct net_bridge *br,
+ 	struct net_bridge_mdb_entry *mp;
+ 	struct net_bridge_port_group *p;
+ 	struct net_bridge_port_group __rcu **pp;
+-	unsigned long now = jiffies;
+ 	int err;
+ 
+ 	spin_lock(&br->multicast_lock);
+@@ -671,7 +668,6 @@ static int br_multicast_add_group(struct net_bridge *br,
+ 
+ 	if (!port) {
+ 		mp->mglist = true;
+-		mod_timer(&mp->timer, now + br->multicast_membership_interval);
+ 		goto out;
+ 	}
+ 
+@@ -679,7 +675,7 @@ static int br_multicast_add_group(struct net_bridge *br,
+ 	     (p = mlock_dereference(*pp, br)) != NULL;
+ 	     pp = &p->next) {
+ 		if (p->port == port)
+-			goto found;
++			goto out;
+ 		if ((unsigned long)p->port < (unsigned long)port)
+ 			break;
+ 	}
+@@ -690,8 +686,6 @@ static int br_multicast_add_group(struct net_bridge *br,
+ 	rcu_assign_pointer(*pp, p);
+ 	br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
+ 
+-found:
+-	mod_timer(&p->timer, now + br->multicast_membership_interval);
+ out:
+ 	err = 0;
+ 
+@@ -1131,6 +1125,10 @@ static int br_ip4_multicast_query(struct net_bridge *br,
+ 	if (!mp)
+ 		goto out;
+ 
++	setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
++	mod_timer(&mp->timer, now + br->multicast_membership_interval);
++	mp->timer_armed = true;
++
+ 	max_delay *= br->multicast_last_member_count;
+ 
+ 	if (mp->mglist &&
+@@ -1205,6 +1203,10 @@ static int br_ip6_multicast_query(struct net_bridge *br,
+ 	if (!mp)
+ 		goto out;
+ 
++	setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
++	mod_timer(&mp->timer, now + br->multicast_membership_interval);
++	mp->timer_armed = true;
++
+ 	max_delay *= br->multicast_last_member_count;
+ 	if (mp->mglist &&
+ 	    (timer_pending(&mp->timer) ?
+@@ -1263,7 +1265,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ 			call_rcu_bh(&p->rcu, br_multicast_free_pg);
+ 			br_mdb_notify(br->dev, port, group, RTM_DELMDB);
+ 
+-			if (!mp->ports && !mp->mglist &&
++			if (!mp->ports && !mp->mglist && mp->timer_armed &&
+ 			    netif_running(br->dev))
+ 				mod_timer(&mp->timer, jiffies);
+ 		}
+@@ -1275,30 +1277,12 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ 		     br->multicast_last_member_interval;
+ 
+ 	if (!port) {
+-		if (mp->mglist &&
++		if (mp->mglist && mp->timer_armed &&
+ 		    (timer_pending(&mp->timer) ?
+ 		     time_after(mp->timer.expires, time) :
+ 		     try_to_del_timer_sync(&mp->timer) >= 0)) {
+ 			mod_timer(&mp->timer, time);
+ 		}
+-
+-		goto out;
+-	}
+-
+-	for (p = mlock_dereference(mp->ports, br);
+-	     p != NULL;
+-	     p = mlock_dereference(p->next, br)) {
+-		if (p->port != port)
+-			continue;
+-
+-		if (!hlist_unhashed(&p->mglist) &&
+-		    (timer_pending(&p->timer) ?
+-		     time_after(p->timer.expires, time) :
+-		     try_to_del_timer_sync(&p->timer) >= 0)) {
+-			mod_timer(&p->timer, time);
+-		}
+-
+-		break;
+ 	}
+ 
+ out:
+@@ -1674,6 +1658,7 @@ void br_multicast_stop(struct net_bridge *br)
+ 		hlist_for_each_entry_safe(mp, n, &mdb->mhash[i],
+ 					  hlist[ver]) {
+ 			del_timer(&mp->timer);
++			mp->timer_armed = false;
+ 			call_rcu_bh(&mp->rcu, br_multicast_free_group);
+ 		}
+ 	}
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index e260710..1b0ac95 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -112,6 +112,7 @@ struct net_bridge_mdb_entry
+ 	struct timer_list		timer;
+ 	struct br_ip			addr;
+ 	bool				mglist;
++	bool				timer_armed;
+ };
+ 
+ struct net_bridge_mdb_htable
+--
+cgit v0.9.2
diff --git a/freed-ora/current/f17/bridge-send-query-as-soon-as-leave-is-received.patch b/freed-ora/current/f17/bridge-send-query-as-soon-as-leave-is-received.patch
new file mode 100644
index 000000000..8b6652e7e
--- /dev/null
+++ b/freed-ora/current/f17/bridge-send-query-as-soon-as-leave-is-received.patch
@@ -0,0 +1,57 @@
+From 6b7df111ece130fa979a0c4f58e53674c1e47d3e Mon Sep 17 00:00:00 2001
+From: Cong Wang <amwang@redhat.com>
+Date: Tue, 21 May 2013 21:52:56 +0000
+Subject: bridge: send query as soon as leave is received
+
+Continue sending queries when leave is received if the user marks
+it as a querier.
+
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Stephen Hemminger <stephen@networkplumber.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Adam Baker <linux@baker-net.org.uk>
+Signed-off-by: Cong Wang <amwang@redhat.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+(limited to 'net/bridge')
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 40bda80..37a4676 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1250,6 +1250,32 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ 	if (!mp)
+ 		goto out;
+ 
++	if (br->multicast_querier &&
++	    !timer_pending(&br->multicast_querier_timer)) {
++		__br_multicast_send_query(br, port, &mp->addr);
++
++		time = jiffies + br->multicast_last_member_count *
++				 br->multicast_last_member_interval;
++		mod_timer(port ? &port->multicast_query_timer :
++				 &br->multicast_query_timer, time);
++
++		for (p = mlock_dereference(mp->ports, br);
++		     p != NULL;
++		     p = mlock_dereference(p->next, br)) {
++			if (p->port != port)
++				continue;
++
++			if (!hlist_unhashed(&p->mglist) &&
++			    (timer_pending(&p->timer) ?
++			     time_after(p->timer.expires, time) :
++			     try_to_del_timer_sync(&p->timer) >= 0)) {
++				mod_timer(&p->timer, time);
++			}
++
++			break;
++		}
++	}
++
+ 	if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
+ 		struct net_bridge_port_group __rcu **pp;
+ 
+--
+cgit v0.9.2
diff --git a/freed-ora/current/f17/carl9170-fix-frame-drop-and-WARN-due-to-minstrel_ht-.patch b/freed-ora/current/f17/carl9170-fix-frame-drop-and-WARN-due-to-minstrel_ht-.patch
deleted file mode 100644
index a360731bd..000000000
--- a/freed-ora/current/f17/carl9170-fix-frame-drop-and-WARN-due-to-minstrel_ht-.patch
+++ /dev/null
@@ -1,160 +0,0 @@
-From 5f34608fa2acbfef5a06d0072a978c9943c28a2d Mon Sep 17 00:00:00 2001
-From: Christian Lamparter <chunkeey@googlemail.com>
-Date: Fri, 22 Feb 2013 01:30:44 +0100
-Subject: [PATCH] carl9170: fix frame drop and WARN due to minstrel_ht change
-
-With "mac80211/minstrel_ht: add support for using CCK rates"
-minstrel_ht selects legacy CCK rates as viable rates for
-outgoing frames which might be sent as part of an A-MPDU
-[IEEE80211_TX_CTL_AMPDU is set].
-
-This behavior triggered the following WARN_ON in the driver:
-> WARNING: at carl9170/tx.c:995 carl9170_op_tx+0x1dd/0x6fd
-The driver assumed that the rate control algorithm made a
-mistake and dropped the frame.
-
-This patch removes the noisy warning altogether and allows
-said A-MPDU frames with CCK sample and/or fallback rates to
-be transmitted seamlessly.
-
-Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
-Signed-off-by: John W. Linville <linville@tuxdriver.com>
----
- drivers/net/wireless/ath/carl9170/tx.c | 69 ++++++++++++++--------------------
- 1 file changed, 28 insertions(+), 41 deletions(-)
-
-diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
-index 9c0b150..c61cafa 100644
---- a/drivers/net/wireless/ath/carl9170/tx.c
-+++ b/drivers/net/wireless/ath/carl9170/tx.c
-@@ -387,8 +387,7 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
- 	u8 tid;
- 
- 	if (!(txinfo->flags & IEEE80211_TX_CTL_AMPDU) ||
--	    txinfo->flags & IEEE80211_TX_CTL_INJECTED ||
--	   (!(super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_AGGR))))
-+	    txinfo->flags & IEEE80211_TX_CTL_INJECTED)
- 		return;
- 
- 	rcu_read_lock();
-@@ -981,30 +980,6 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
- 
- 		SET_VAL(CARL9170_TX_SUPER_AMPDU_FACTOR,
- 			txc->s.ampdu_settings, factor);
--
--		for (i = 0; i < CARL9170_TX_MAX_RATES; i++) {
--			txrate = &info->control.rates[i];
--			if (txrate->idx >= 0) {
--				txc->s.ri[i] =
--					CARL9170_TX_SUPER_RI_AMPDU;
--
--				if (WARN_ON(!(txrate->flags &
--					      IEEE80211_TX_RC_MCS))) {
--					/*
--					 * Not sure if it's even possible
--					 * to aggregate non-ht rates with
--					 * this HW.
--					 */
--					goto err_out;
--				}
--				continue;
--			}
--
--			txrate->idx = 0;
--			txrate->count = ar->hw->max_rate_tries;
--		}
--
--		mac_tmp |= cpu_to_le16(AR9170_TX_MAC_AGGR);
- 	}
- 
- 	/*
-@@ -1012,11 +987,31 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
- 	 * taken from mac_control. For all fallback rate, the firmware
- 	 * updates the mac_control flags from the rate info field.
- 	 */
--	for (i = 1; i < CARL9170_TX_MAX_RATES; i++) {
-+	for (i = 0; i < CARL9170_TX_MAX_RATES; i++) {
-+		__le32 phy_set;
- 		txrate = &info->control.rates[i];
- 		if (txrate->idx < 0)
- 			break;
- 
-+		phy_set = carl9170_tx_physet(ar, info, txrate);
-+		if (i == 0) {
-+			/* first rate - part of the hw's frame header */
-+			txc->f.phy_control = phy_set;
-+
-+			if (ampdu && txrate->flags & IEEE80211_TX_RC_MCS)
-+				mac_tmp |= cpu_to_le16(AR9170_TX_MAC_AGGR);
-+			if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
-+				mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
-+			else if (carl9170_tx_cts_check(ar, txrate))
-+				mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
-+
-+		} else {
-+			/* fallback rates are stored in the firmware's
-+			 * retry rate set array.
-+			 */
-+			txc->s.rr[i - 1] = phy_set;
-+		}
-+
- 		SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[i],
- 			txrate->count);
- 
-@@ -1027,21 +1022,13 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
- 			txc->s.ri[i] |= (AR9170_TX_MAC_PROT_CTS <<
- 				CARL9170_TX_SUPER_RI_ERP_PROT_S);
- 
--		txc->s.rr[i - 1] = carl9170_tx_physet(ar, info, txrate);
-+		if (ampdu && (txrate->flags & IEEE80211_TX_RC_MCS))
-+			txc->s.ri[i] |= CARL9170_TX_SUPER_RI_AMPDU;
- 	}
- 
--	txrate = &info->control.rates[0];
--	SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[0], txrate->count);
--
--	if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
--		mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
--	else if (carl9170_tx_cts_check(ar, txrate))
--		mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
--
- 	txc->s.len = cpu_to_le16(skb->len);
- 	txc->f.length = cpu_to_le16(len + FCS_LEN);
- 	txc->f.mac_control = mac_tmp;
--	txc->f.phy_control = carl9170_tx_physet(ar, info, txrate);
- 
- 	arinfo = (void *)info->rate_driver_data;
- 	arinfo->timeout = jiffies;
-@@ -1381,9 +1368,9 @@ static void carl9170_tx(struct ar9170 *ar)
- }
- 
- static bool carl9170_tx_ampdu_queue(struct ar9170 *ar,
--	struct ieee80211_sta *sta, struct sk_buff *skb)
-+	struct ieee80211_sta *sta, struct sk_buff *skb,
-+	struct ieee80211_tx_info *txinfo)
- {
--	struct _carl9170_tx_superframe *super = (void *) skb->data;
- 	struct carl9170_sta_info *sta_info;
- 	struct carl9170_sta_tid *agg;
- 	struct sk_buff *iter;
-@@ -1450,7 +1437,7 @@ err_unlock:
- 
- err_unlock_rcu:
- 	rcu_read_unlock();
--	super->f.mac_control &= ~cpu_to_le16(AR9170_TX_MAC_AGGR);
-+	txinfo->flags &= ~IEEE80211_TX_CTL_AMPDU;
- 	carl9170_tx_status(ar, skb, false);
- 	ar->tx_dropped++;
- 	return false;
-@@ -1492,7 +1479,7 @@ void carl9170_op_tx(struct ieee80211_hw *hw,
- 		 * sta == NULL checks are redundant in this
- 		 * special case.
- 		 */
--		run = carl9170_tx_ampdu_queue(ar, sta, skb);
-+		run = carl9170_tx_ampdu_queue(ar, sta, skb, info);
- 		if (run)
- 			carl9170_tx_ampdu(ar);
- 
--- 
-1.7.11.7
-
diff --git a/freed-ora/current/f17/config-armv7-generic b/freed-ora/current/f17/config-armv7-generic
index 7b4d546c7..58c581629 100644
--- a/freed-ora/current/f17/config-armv7-generic
+++ b/freed-ora/current/f17/config-armv7-generic
@@ -50,10 +50,11 @@ CONFIG_ALWAYS_USE_PERSISTENT_CLOCK=y
 # CONFIG_ARM_ERRATA_326103 is not set
 # CONFIG_ARM_ERRATA_411920 is not set
 # Cortex-A8
-# CONFIG_ARM_ERRATA_430973 is not set
-# CONFIG_ARM_ERRATA_458693 is not set
-# CONFIG_ARM_ERRATA_460075 is not set
+CONFIG_ARM_ERRATA_430973=y
+CONFIG_ARM_ERRATA_458693=y
+CONFIG_ARM_ERRATA_460075=y
 # Cortex-A9
+CONFIG_ARM_ERRATA_643719=y
 CONFIG_ARM_ERRATA_720789=y
 CONFIG_ARM_ERRATA_742230=y
 CONFIG_ARM_ERRATA_742231=y
diff --git a/freed-ora/current/f17/deblob-check b/freed-ora/current/f17/deblob-check
index bac13c9bb..c339455e6 100755
--- a/freed-ora/current/f17/deblob-check
+++ b/freed-ora/current/f17/deblob-check
@@ -1,6 +1,6 @@
 #! /bin/sh
 
-# deblob-check version 2013-06-10
+# deblob-check version 2013-06-27
 # Inspired in gNewSense's find-firmware script.
 # Written by Alexandre Oliva <lxoliva@fsfla.org>
 
@@ -3332,6 +3332,7 @@ set_except () {
 
   */patch-3.9*)
     initnc '\([;][/][*]@@[ ]-[0-9]*,[0-9]*[ ][+][0-9]*,[0-9]*[ ]@@[ ]\)\?static[ ]const[ ]u32[ ]ar9485_1_1_baseband_pos\([*][/][;]\)\?' drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+    accept '\([;][/][*]@@[ ]-[0-9]*,[0-9]*[ ][+][0-9]*,[0-9]*[ ]@@[ ]\)\?static[ ]int[ ]_request_firmware_load\(struct[*][/][;]\)\?' drivers/base/firmware_class.c
     ;;
 
   */patch-3.8*)
diff --git a/freed-ora/current/f17/kernel.spec b/freed-ora/current/f17/kernel.spec
index ba0aa4ec5..0b84ba83f 100644
--- a/freed-ora/current/f17/kernel.spec
+++ b/freed-ora/current/f17/kernel.spec
@@ -104,7 +104,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 7
+%define stable_update 8
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -814,26 +814,25 @@ Patch25035: block-do-not-pass-disk-names-as-format-strings.patch
 #CVE-2013-2164 rhbz 973100 973109
 Patch25038: cdrom-use-kzalloc-for-failing-hardware.patch
 
-#rhbz 954181
-Patch25039: vhost_net-clear-msg.control-for-non-zerocopy-case-during-tx.patch
-Patch25040: tuntap-set-SOCK_ZEROCOPY-flag-during-open.patch
-
-#rhbz 973185
-Patch25041: x86-mtrr-Fix-original-mtrr-range-get-for-mtrr_cleanup.patch
-Patch25042: x86-range-make-add_range-use-blank-slot.patch
-
 #rhbz 950735
 Patch25045: rt2800-fix-RT5390-RT3290-TX-power-settings-regression.patch
 
 #rhbz 969644
 Patch25046: KVM-x86-handle-idiv-overflow-at-kvm_write_tsc.patch
 
-#rhbz 967271
-Patch25049: carl9170-fix-frame-drop-and-WARN-due-to-minstrel_ht-.patch
-
 Patch25050: iwlwifi-pcie-fix-race-in-queue-unmapping.patch
 Patch25051: iwlwifi-pcie-wake-the-queue-if-stopped-when-being-unmapped.patch
 
+#rhbz 903741
+Patch25052: HID-input-return-ENODATA-if-reading-battery-attrs-fails.patch
+
+#rhbz 880035
+Patch25053: bridge-only-expire-the-mdb-entry-when-query-is-received.patch
+Patch25054: bridge-send-query-as-soon-as-leave-is-received.patch
+
+#rhbz 977558
+Patch25055: ath3k-dont-use-stack-memory-for-DMA.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1606,26 +1605,25 @@ ApplyPatch block-do-not-pass-disk-names-as-format-strings.patch
 #CVE-2013-2164 rhbz 973100 973109
 ApplyPatch cdrom-use-kzalloc-for-failing-hardware.patch
 
-#rhbz 954181
-ApplyPatch vhost_net-clear-msg.control-for-non-zerocopy-case-during-tx.patch
-ApplyPatch tuntap-set-SOCK_ZEROCOPY-flag-during-open.patch
-
-#rhbz 973185
-ApplyPatch x86-mtrr-Fix-original-mtrr-range-get-for-mtrr_cleanup.patch
-ApplyPatch x86-range-make-add_range-use-blank-slot.patch
-
 #rhbz 950735
 ApplyPatch rt2800-fix-RT5390-RT3290-TX-power-settings-regression.patch
 
 #rhbz 969644
 ApplyPatch KVM-x86-handle-idiv-overflow-at-kvm_write_tsc.patch
 
-#rhbz 967271
-ApplyPatch carl9170-fix-frame-drop-and-WARN-due-to-minstrel_ht-.patch
-
 ApplyPatch iwlwifi-pcie-fix-race-in-queue-unmapping.patch
 ApplyPatch iwlwifi-pcie-wake-the-queue-if-stopped-when-being-unmapped.patch
 
+#rhbz 903741
+ApplyPatch HID-input-return-ENODATA-if-reading-battery-attrs-fails.patch
+
+#rhbz 880035
+ApplyPatch bridge-only-expire-the-mdb-entry-when-query-is-received.patch
+ApplyPatch bridge-send-query-as-soon-as-leave-is-received.patch
+
+#rhbz 977558
+ApplyPatch ath3k-dont-use-stack-memory-for-DMA.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2488,6 +2486,21 @@ fi
 #    '-'      |  |
 #              '-'
 %changelog
+* Thu Jun 27 2013 Alexandre Oliva<lxoliva@fsfla.org> -libre
+- GNU Linux-libre 3.9.8-gnu.
+
+* Thu Jun 27 2013 Josh Boyer <jwboyer@redhat.com> - 3.9.8-100
+- Linux v3.9.8
+
+* Thu Jun 27 2013 Josh Boyer <jwboyer@redhat.com>
+- Fix stack memory usage for DMA in ath3k (rhbz 977558)
+
+* Wed Jun 26 2013 Josh Boyer <jwboyer@redhat.com>
+- Add two patches to fix bridge networking issues (rhbz 880035)
+
+* Mon Jun 24 2013 Josh Boyer <jwboyer@redhat.com>
+- Fix battery issue with bluetooth keyboards (rhbz 903741)
+
 * Fri Jun 21 2013 Alexandre Oliva<lxoliva@fsfla.org> -libre
 - GNU Linux-libre 3.9.7-gnu.
 
diff --git a/freed-ora/current/f17/patch-3.9-gnu-3.9.7-gnu.xz.sign b/freed-ora/current/f17/patch-3.9-gnu-3.9.7-gnu.xz.sign
deleted file mode 100644
index a4690f6a4..000000000
--- a/freed-ora/current/f17/patch-3.9-gnu-3.9.7-gnu.xz.sign
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.19 (GNU/Linux)
-
-iEYEABECAAYFAlHDrdIACgkQvLfPh359R6eQXwCfWtrq1uho5nAsNrdrQNqayrEq
-bY4An1OcecYRONK5mxkYC+XCETPsJWfu
-=IQ+m
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f17/patch-3.9-gnu-3.9.8-gnu.xz.sign b/freed-ora/current/f17/patch-3.9-gnu-3.9.8-gnu.xz.sign
new file mode 100644
index 000000000..b85172723
--- /dev/null
+++ b/freed-ora/current/f17/patch-3.9-gnu-3.9.8-gnu.xz.sign
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (GNU/Linux)
+
+iEYEABECAAYFAlHMsw8ACgkQvLfPh359R6d5DACeMzKKqKcj07T9pw+anQIE70bE
+n/oAn2iZLRxkWag5FtJlfxZqQ0sgV0qh
+=miKX
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f17/sources b/freed-ora/current/f17/sources
index b55243541..ee88a4837 100644
--- a/freed-ora/current/f17/sources
+++ b/freed-ora/current/f17/sources
@@ -1,2 +1,2 @@
 120df29f88622dabf7015a22c7cc8e25  linux-libre-3.9-gnu.tar.xz
-4f5c670da16dc80fe9482892b636f99d  patch-3.9-gnu-3.9.7-gnu.xz
+b628d7ff09667dc5546993bb83461d45  patch-3.9-gnu-3.9.8-gnu.xz
diff --git a/freed-ora/current/f17/tuntap-set-SOCK_ZEROCOPY-flag-during-open.patch b/freed-ora/current/f17/tuntap-set-SOCK_ZEROCOPY-flag-during-open.patch
deleted file mode 100644
index 75de6ccce..000000000
--- a/freed-ora/current/f17/tuntap-set-SOCK_ZEROCOPY-flag-during-open.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-tuntap: set SOCK_ZEROCOPY flag during open
-
-Commit 54f968d6efdbf7dec36faa44fc11f01b0e4d1990
-(tuntap: move socket to tun_file) forgets to set SOCK_ZEROCOPY flag, which will
-prevent vhost_net from doing zercopy w/ tap. This patch fixes this by setting
-it during file open.
-
-Cc: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-
----
-
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 89776c5..ff5312d 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -2159,6 +2159,8 @@ static int tun_chr_open(struct inode *inode, struct file * file)
- 	set_bit(SOCK_EXTERNALLY_ALLOCATED, &tfile->socket.flags);
- 	INIT_LIST_HEAD(&tfile->next);
- 
-+	sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
-+
- 	return 0;
- }
- 
diff --git a/freed-ora/current/f17/vhost_net-clear-msg.control-for-non-zerocopy-case-during-tx.patch b/freed-ora/current/f17/vhost_net-clear-msg.control-for-non-zerocopy-case-during-tx.patch
deleted file mode 100644
index 4455bbc0b..000000000
--- a/freed-ora/current/f17/vhost_net-clear-msg.control-for-non-zerocopy-case-during-tx.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 3add6ae9e1b854a9ddbe0dc17ff4ec48a2dac9fe Mon Sep 17 00:00:00 2001
-From: Jason Wang <jasowang@redhat.com>
-Date: Wed, 5 Jun 2013 07:40:46 +0000
-Subject: [PATCH] vhost_net: clear msg.control for non-zerocopy case during tx
-
-When we decide not use zero-copy, msg.control should be set to NULL otherwise
-macvtap/tap may set zerocopy callbacks which may decrease the kref of ubufs
-wrongly.
-
-Bug were introduced by commit cedb9bdce099206290a2bdd02ce47a7b253b6a84
-(vhost-net: skip head management if no outstanding).
-
-This solves the following warnings:
-
-WARNING: at include/linux/kref.h:47 handle_tx+0x477/0x4b0 [vhost_net]()
-Modules linked in: vhost_net macvtap macvlan tun nfsd exportfs bridge stp llc openvswitch kvm_amd kvm bnx2 megaraid_sas [last unloaded: tun]
-CPU: 5 PID: 8670 Comm: vhost-8668 Not tainted 3.10.0-rc2+ #1566
-Hardware name: Dell Inc. PowerEdge R715/00XHKG, BIOS 1.5.2 04/19/2011
-ffffffffa0198323 ffff88007c9ebd08 ffffffff81796b73 ffff88007c9ebd48
-ffffffff8103d66b 000000007b773e20 ffff8800779f0000 ffff8800779f43f0
-ffff8800779f8418 000000000000015c 0000000000000062 ffff88007c9ebd58
-Call Trace:
-[<ffffffff81796b73>] dump_stack+0x19/0x1e
-[<ffffffff8103d66b>] warn_slowpath_common+0x6b/0xa0
-[<ffffffff8103d6b5>] warn_slowpath_null+0x15/0x20
-[<ffffffffa0197627>] handle_tx+0x477/0x4b0 [vhost_net]
-[<ffffffffa0197690>] handle_tx_kick+0x10/0x20 [vhost_net]
-[<ffffffffa019541e>] vhost_worker+0xfe/0x1a0 [vhost_net]
-[<ffffffffa0195320>] ? vhost_attach_cgroups_work+0x30/0x30 [vhost_net]
-[<ffffffffa0195320>] ? vhost_attach_cgroups_work+0x30/0x30 [vhost_net]
-[<ffffffff81061f46>] kthread+0xc6/0xd0
-[<ffffffff81061e80>] ? kthread_freezable_should_stop+0x70/0x70
-[<ffffffff817a1aec>] ret_from_fork+0x7c/0xb0
-[<ffffffff81061e80>] ? kthread_freezable_should_stop+0x70/0x70
-
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/vhost/net.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
-index ec6fb3f..3980e66 100644
---- a/drivers/vhost/net.c
-+++ b/drivers/vhost/net.c
-@@ -353,7 +353,9 @@ static void handle_tx(struct vhost_net *net)
- 				kref_get(&ubufs->kref);
- 			}
- 			vq->upend_idx = (vq->upend_idx + 1) % UIO_MAXIOV;
--		}
-+		} else
-+			msg.msg_control = NULL;
-+
- 		/* TODO: Check specific error and bomb out unless ENOBUFS? */
- 		err = sock->ops->sendmsg(NULL, sock, &msg, len);
- 		if (unlikely(err < 0)) {
--- 
-1.8.1.4
-
diff --git a/freed-ora/current/f17/x86-mtrr-Fix-original-mtrr-range-get-for-mtrr_cleanup.patch b/freed-ora/current/f17/x86-mtrr-Fix-original-mtrr-range-get-for-mtrr_cleanup.patch
deleted file mode 100644
index 7c8b930f7..000000000
--- a/freed-ora/current/f17/x86-mtrr-Fix-original-mtrr-range-get-for-mtrr_cleanup.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-Joshua reported: Commit cd7b304dfaf1 (x86, range: fix missing merge
-during add range) broke mtrr cleanup on his setup in 3.9.5.
-corresponding commit in upstream is fbe06b7bae7c.
-
-  *BAD*gran_size: 64K chunk_size: 16M num_reg: 6 lose cover RAM: -0G
-
-https://bugzilla.kernel.org/show_bug.cgi?id=59491
-
-So it rejects new var mtrr layout.
-
-It turns out we have some problem with initial mtrr range retrievel.
-current sequence is:
-	x86_get_mtrr_mem_range
-		==> bunchs of add_range_with_merge
-		==> bunchs of subract_range
-		==> clean_sort_range
-	add_range_with_merge for [0,1M)
-	sort_range()
-
-add_range_with_merge could have blank slots, so we can not just
-sort only, that will have final result have extra blank slot in head.
-
-So move that calling add_range_with_merge for [0,1M), with that we
-could avoid extra clean_sort_range calling.
-
-Reported-by: Joshua Covington <joshuacov@googlemail.com>
-Tested-by: Joshua Covington <joshuacov@googlemail.com>
-Signed-off-by: Yinghai Lu <yinghai@kernel.org>
-Cc: <stable@vger.kernel.org> v3.9
-
----
- arch/x86/kernel/cpu/mtrr/cleanup.c |    8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-Index: linux-2.6/arch/x86/kernel/cpu/mtrr/cleanup.c
-===================================================================
---- linux-2.6.orig/arch/x86/kernel/cpu/mtrr/cleanup.c
-+++ linux-2.6/arch/x86/kernel/cpu/mtrr/cleanup.c
-@@ -714,15 +714,15 @@ int __init mtrr_cleanup(unsigned address
- 	if (mtrr_tom2)
- 		x_remove_size = (mtrr_tom2 >> PAGE_SHIFT) - x_remove_base;
- 
--	nr_range = x86_get_mtrr_mem_range(range, 0, x_remove_base, x_remove_size);
- 	/*
- 	 * [0, 1M) should always be covered by var mtrr with WB
- 	 * and fixed mtrrs should take effect before var mtrr for it:
- 	 */
--	nr_range = add_range_with_merge(range, RANGE_NUM, nr_range, 0,
-+	nr_range = add_range_with_merge(range, RANGE_NUM, 0, 0,
- 					1ULL<<(20 - PAGE_SHIFT));
--	/* Sort the ranges: */
--	sort_range(range, nr_range);
-+	/* add from var mtrr at last */
-+	nr_range = x86_get_mtrr_mem_range(range, nr_range,
-+					  x_remove_base, x_remove_size);
- 
- 	range_sums = sum_ranges(range, nr_range);
- 	printk(KERN_INFO "total RAM covered: %ldM\n",
---
-To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html
-Please read the FAQ at  http://www.tux.org/lkml/
\ No newline at end of file
diff --git a/freed-ora/current/f17/x86-range-make-add_range-use-blank-slot.patch b/freed-ora/current/f17/x86-range-make-add_range-use-blank-slot.patch
deleted file mode 100644
index 8a04f4f5c..000000000
--- a/freed-ora/current/f17/x86-range-make-add_range-use-blank-slot.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-Now add_range_with_merge will generate blank slot as subtract_range.
-we could reach the array limit because of blank slots.
-
-We can let add_range to have second try to use blank slot.
-
-Also use WARN_ONCE to print trace.
-
-Reported-by: Joshua Covington <joshuacov@googlemail.com>
-Signed-off-by: Yinghai Lu <yinghai@kernel.org>
-Cc: <stable@vger.kernel.org> v3.9
----
- kernel/range.c |   34 ++++++++++++++++++++++------------
- 1 file changed, 22 insertions(+), 12 deletions(-)
-
-diff --git a/kernel/range.c b/kernel/range.c
-index 98883ed..8ca718a 100644
---- a/kernel/range.c
-+++ b/kernel/range.c
-@@ -3,23 +3,34 @@
-  */
- #include <linux/kernel.h>
- #include <linux/init.h>
-+#include <linux/bug.h>
- #include <linux/sort.h>
--
- #include <linux/range.h>
- 
- int add_range(struct range *range, int az, int nr_range, u64 start, u64 end)
- {
--	if (start >= end)
--		return nr_range;
-+	int i;
- 
--	/* Out of slots: */
--	if (nr_range >= az)
-+	if (start >= end)
- 		return nr_range;
- 
--	range[nr_range].start = start;
--	range[nr_range].end = end;
-+	/* Out of slots ? */
-+	if (nr_range < az) {
-+		i = nr_range;
-+		nr_range++;
-+	} else {
-+		/* find blank slot */
-+		for (i = 0; i < az; i++)
-+			if (!range[i].end)
-+				break;
-+		if (i == az) {
-+			WARN_ONCE(1, "run out of slot in ranges\n");
-+			return az;
-+		}
-+	}
- 
--	nr_range++;
-+	range[i].start = start;
-+	range[i].end = end;
- 
- 	return nr_range;
- }
-@@ -99,7 +110,7 @@ void subtract_range(struct range *range, int az, u64 start, u64 end)
- 				range[i].end = range[j].end;
- 				range[i].start = end;
- 			} else {
--				printk(KERN_ERR "run of slot in ranges\n");
-+				WARN_ONCE(1,"run of slot in ranges\n");
- 			}
- 			range[j].end = start;
- 			continue;
--- 
-1.8.1.4
-