bump to 2.6.38.3

4 files changed, 1949 insertions, 1147 deletions

diff --git a/PATCHCFG b/PATCHCFG
index c11e7b1..aad6cf6 100644
--- a/PATCHCFG
+++ b/PATCHCFG
@@ -10,18 +10,19 @@ SRCNAME="linux-2.6.38-ARCH"
 #   filename%patchlevel (file must be in patches/ subdirectory)
 PATCHES=(
          # add upstream patch from 2.6.37 series
-         ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-2.6.38.2.bz2%1
+         ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-2.6.38.3.bz2%1
 
          # add latest fixes from stable queue, if needed
          # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git
-         2.6.38.3-pre.patch%1
-  
+         kernel-2.6.38.4-pre.patch%1
+
+         # fix hibernate resume
+         # https://bugs.archlinux.org/task/23528
+         fix-hibernate-resume-2.6.38.patch%1
+
          # fix #19234 i1915 display size
          fix-i915.patch%1
 
-         # fix #23390 radeon kms
-         radeon-kms-sanity-checks.patch%1
-
          # fix i915 pipelining glitches
          # https://bugs.freedesktop.org/show_bug.cgi?id=34584
          i915-pipeline.patch%1
@@ -34,7 +35,7 @@ PATCHES=(
          aufs2-standalone-20110314.patch%1
         )
 # Name of the resulting patch (will be bzipped afterwards)
-PATCHNAME="patch-2.6.38.2-1-ARCH"
+PATCHNAME="patch-2.6.38.3-1-ARCH"
 
 # Run this before applying patches
 pre_apply() {
diff --git a/patches/2.6.38.3-pre.patch b/patches/2.6.38.3-pre.patch
deleted file mode 100644
index 6d5f835..0000000
--- a/patches/2.6.38.3-pre.patch
+++ /dev/null
@@ -1,1140 +0,0 @@
-From 677cd904aba939bc4cfdc3c1eada8ec46582127e Mon Sep 17 00:00:00 2001
-From: David Henningsson <david.henningsson@canonical.com>
-Date: Mon, 7 Feb 2011 15:19:34 +0100
-Subject: ALSA: HDA: New AD1984A model for Dell Precision R5500
-
-From: David Henningsson <david.henningsson@canonical.com>
-
-commit 677cd904aba939bc4cfdc3c1eada8ec46582127e upstream.
-
-For codec AD1984A, add a new model to support Dell Precision R5500
-or the microphone jack won't work correctly.
-
-BugLink: http://bugs.launchpad.net/bugs/741516
-Tested-by: Kent Baxley <kent.baxley@canonical.com>
-Signed-off-by: David Henningsson <david.henningsson@canonical.com>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- sound/pci/hda/patch_analog.c |   89 +++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 89 insertions(+)
-
---- a/sound/pci/hda/patch_analog.c
-+++ b/sound/pci/hda/patch_analog.c
-@@ -4353,6 +4353,84 @@ static int ad1984a_thinkpad_init(struct
- }
- 
- /*
-+ * Precision R5500
-+ * 0x12 - HP/line-out
-+ * 0x13 - speaker (mono)
-+ * 0x15 - mic-in
-+ */
-+
-+static struct hda_verb ad1984a_precision_verbs[] = {
-+	/* Unmute main output path */
-+	{0x03, AC_VERB_SET_AMP_GAIN_MUTE, 0x27}, /* 0dB */
-+	{0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE + 0x1f}, /* 0dB */
-+	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(5) + 0x17}, /* 0dB */
-+	/* Analog mixer; mute as default */
-+	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
-+	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)},
-+	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(2)},
-+	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(3)},
-+	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(4)},
-+	/* Select mic as input */
-+	{0x0c, AC_VERB_SET_CONNECT_SEL, 0x1},
-+	{0x0c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE + 0x27}, /* 0dB */
-+	/* Configure as mic */
-+	{0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
-+	{0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0x7002}, /* raise mic as default */
-+	/* HP unmute */
-+	{0x12, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
-+	/* turn on EAPD */
-+	{0x13, AC_VERB_SET_EAPD_BTLENABLE, 0x02},
-+	/* unsolicited event for pin-sense */
-+	{0x12, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | AD1884A_HP_EVENT},
-+	{ } /* end */
-+};
-+
-+static struct snd_kcontrol_new ad1984a_precision_mixers[] = {
-+	HDA_CODEC_VOLUME("Master Playback Volume", 0x21, 0x0, HDA_OUTPUT),
-+	HDA_CODEC_MUTE("Master Playback Switch", 0x21, 0x0, HDA_OUTPUT),
-+	HDA_CODEC_VOLUME("PCM Playback Volume", 0x20, 0x5, HDA_INPUT),
-+	HDA_CODEC_MUTE("PCM Playback Switch", 0x20, 0x5, HDA_INPUT),
-+	HDA_CODEC_VOLUME("Mic Playback Volume", 0x20, 0x01, HDA_INPUT),
-+	HDA_CODEC_MUTE("Mic Playback Switch", 0x20, 0x01, HDA_INPUT),
-+	HDA_CODEC_VOLUME("Mic Boost Volume", 0x15, 0x0, HDA_INPUT),
-+	HDA_CODEC_MUTE("Front Playback Switch", 0x12, 0x0, HDA_OUTPUT),
-+	HDA_CODEC_VOLUME("Speaker Playback Volume", 0x13, 0x0, HDA_OUTPUT),
-+	HDA_CODEC_VOLUME("Capture Volume", 0x0c, 0x0, HDA_OUTPUT),
-+	HDA_CODEC_MUTE("Capture Switch", 0x0c, 0x0, HDA_OUTPUT),
-+	{ } /* end */
-+};
-+
-+
-+/* mute internal speaker if HP is plugged */
-+static void ad1984a_precision_automute(struct hda_codec *codec)
-+{
-+	unsigned int present;
-+
-+	present = snd_hda_jack_detect(codec, 0x12);
-+	snd_hda_codec_amp_stereo(codec, 0x13, HDA_OUTPUT, 0,
-+				 HDA_AMP_MUTE, present ? HDA_AMP_MUTE : 0);
-+}
-+
-+
-+/* unsolicited event for HP jack sensing */
-+static void ad1984a_precision_unsol_event(struct hda_codec *codec,
-+					 unsigned int res)
-+{
-+	if ((res >> 26) != AD1884A_HP_EVENT)
-+		return;
-+	ad1984a_precision_automute(codec);
-+}
-+
-+/* initialize jack-sensing, too */
-+static int ad1984a_precision_init(struct hda_codec *codec)
-+{
-+	ad198x_init(codec);
-+	ad1984a_precision_automute(codec);
-+	return 0;
-+}
-+
-+
-+/*
-  * HP Touchsmart
-  * port-A (0x11)      - front hp-out
-  * port-B (0x14)      - unused
-@@ -4481,6 +4559,7 @@ enum {
- 	AD1884A_MOBILE,
- 	AD1884A_THINKPAD,
- 	AD1984A_TOUCHSMART,
-+	AD1984A_PRECISION,
- 	AD1884A_MODELS
- };
- 
-@@ -4490,9 +4569,11 @@ static const char * const ad1884a_models
- 	[AD1884A_MOBILE]	= "mobile",
- 	[AD1884A_THINKPAD]	= "thinkpad",
- 	[AD1984A_TOUCHSMART]	= "touchsmart",
-+	[AD1984A_PRECISION]	= "precision",
- };
- 
- static struct snd_pci_quirk ad1884a_cfg_tbl[] = {
-+	SND_PCI_QUIRK(0x1028, 0x04ac, "Precision R5500", AD1984A_PRECISION),
- 	SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE),
- 	SND_PCI_QUIRK(0x103c, 0x3037, "HP 2230s", AD1884A_LAPTOP),
- 	SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE),
-@@ -4586,6 +4667,14 @@ static int patch_ad1884a(struct hda_code
- 		codec->patch_ops.unsol_event = ad1984a_thinkpad_unsol_event;
- 		codec->patch_ops.init = ad1984a_thinkpad_init;
- 		break;
-+	case AD1984A_PRECISION:
-+		spec->mixers[0] = ad1984a_precision_mixers;
-+		spec->init_verbs[spec->num_init_verbs++] =
-+			ad1984a_precision_verbs;
-+		spec->multiout.dig_out_nid = 0;
-+		codec->patch_ops.unsol_event = ad1984a_precision_unsol_event;
-+		codec->patch_ops.init = ad1984a_precision_init;
-+		break;
- 	case AD1984A_TOUCHSMART:
- 		spec->mixers[0] = ad1984a_touchsmart_mixers;
- 		spec->init_verbs[0] = ad1984a_touchsmart_verbs;
-From 20b67dddcc5f29d3d0c900225d85e0ac655bc69d Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Wed, 23 Mar 2011 22:54:32 +0100
-Subject: ALSA: hda - Fix SPDIF out regression on ALC889
-
-From: Takashi Iwai <tiwai@suse.de>
-
-commit 20b67dddcc5f29d3d0c900225d85e0ac655bc69d upstream.
-
-The commit 5a8cfb4e8ae317d283f84122ed20faa069c5e0c4
-    ALSA: hda - Use ALC_INIT_DEFAULT for really default initialization
-changed to use the default initialization method for ALC889, but
-this caused a regression on SPDIF output on some machines.
-This seems due to the COEF setup included in the default init procedure.
-For making SPDIF working again, the COEF-setup has to be avoided for
-the id 0889.
-
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=24342
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- sound/pci/hda/patch_realtek.c |    2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -1360,7 +1360,7 @@ static void alc_auto_init_amp(struct hda
- 		case 0x10ec0883:
- 		case 0x10ec0885:
- 		case 0x10ec0887:
--		case 0x10ec0889:
-+		/*case 0x10ec0889:*/ /* this causes an SPDIF problem */
- 			alc889_coef_init(codec);
- 			break;
- 		case 0x10ec0888:
-From a45e3d6b13e97506b616980c0f122c3389bcefa4 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Thu, 24 Mar 2011 09:50:15 +0100
-Subject: ALSA: Fix yet another race in disconnection
-
-From: Takashi Iwai <tiwai@suse.de>
-
-commit a45e3d6b13e97506b616980c0f122c3389bcefa4 upstream.
-
-This patch fixes a race between snd_card_file_remove() and
-snd_card_disconnect().  When the card is added to shutdown_files list
-in snd_card_disconnect(), but it's freed in snd_card_file_remove() at
-the same time, the shutdown_files list gets corrupted.  The list member
-must be freed in snd_card_file_remove() as well.
-
-Reported-and-tested-by: Russ Dill <russ.dill@gmail.com>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- sound/core/init.c |    4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/sound/core/init.c
-+++ b/sound/core/init.c
-@@ -848,6 +848,7 @@ int snd_card_file_add(struct snd_card *c
- 		return -ENOMEM;
- 	mfile->file = file;
- 	mfile->disconnected_f_op = NULL;
-+	INIT_LIST_HEAD(&mfile->shutdown_list);
- 	spin_lock(&card->files_lock);
- 	if (card->shutdown) {
- 		spin_unlock(&card->files_lock);
-@@ -883,6 +884,9 @@ int snd_card_file_remove(struct snd_card
- 	list_for_each_entry(mfile, &card->files_list, list) {
- 		if (mfile->file == file) {
- 			list_del(&mfile->list);
-+			spin_lock(&shutdown_lock);
-+			list_del(&mfile->shutdown_list);
-+			spin_unlock(&shutdown_lock);
- 			if (mfile->disconnected_f_op)
- 				fops_put(mfile->disconnected_f_op);
- 			found = mfile;
-From 3674f19dabd15f9541079a588149a370d888f4e6 Mon Sep 17 00:00:00 2001
-From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
-Date: Fri, 25 Mar 2011 17:51:54 +1100
-Subject: ALSA: vmalloc buffers should use normal mmap
-
-From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
-
-commit 3674f19dabd15f9541079a588149a370d888f4e6 upstream.
-
-It's a big no-no to use pgprot_noncached() when mmap'ing such buffers
-into userspace since they are mapped cachable in kernel space.
-
-This can cause all sort of interesting things ranging from to garbled
-sound to lockups on various architectures. I've observed that usb-audio
-is broken on powerpc 4xx for example because of that.
-
-Also remove the now unused snd_pcm_lib_mmap_noncached(). It's
-an arch business to know when to use uncached mappings, there's
-already hacks for MIPS inside snd_pcm_default_mmap() and other
-archs are supposed to use dma_mmap_coherent().
-
-(See my separate patch that adds dma_mmap_coherent() to powerpc)
-
-Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- include/sound/pcm.h     |    4 +---
- sound/core/pcm_native.c |    9 ---------
- 2 files changed, 1 insertion(+), 12 deletions(-)
-
---- a/include/sound/pcm.h
-+++ b/include/sound/pcm.h
-@@ -1030,9 +1030,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc
- #define snd_pcm_lib_mmap_iomem	NULL
- #endif
- 
--int snd_pcm_lib_mmap_noncached(struct snd_pcm_substream *substream,
--			       struct vm_area_struct *area);
--#define snd_pcm_lib_mmap_vmalloc	snd_pcm_lib_mmap_noncached
-+#define snd_pcm_lib_mmap_vmalloc NULL
- 
- static inline void snd_pcm_limit_isa_dma_size(int dma, size_t *max)
- {
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -3201,15 +3201,6 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc
- EXPORT_SYMBOL(snd_pcm_lib_mmap_iomem);
- #endif /* SNDRV_PCM_INFO_MMAP */
- 
--/* mmap callback with pgprot_noncached */
--int snd_pcm_lib_mmap_noncached(struct snd_pcm_substream *substream,
--			       struct vm_area_struct *area)
--{
--	area->vm_page_prot = pgprot_noncached(area->vm_page_prot);
--	return snd_pcm_default_mmap(substream, area);
--}
--EXPORT_SYMBOL(snd_pcm_lib_mmap_noncached);
--
- /*
-  * mmap DMA buffer
-  */
-From 880f57318450dbead6a03f9e31a1468924d6dd88 Mon Sep 17 00:00:00 2001
-From: Frederic Weisbecker <fweisbec@gmail.com>
-Date: Wed, 23 Mar 2011 19:29:39 +0100
-Subject: perf: Better fit max unprivileged mlock pages for tools needs
-
-From: Frederic Weisbecker <fweisbec@gmail.com>
-
-commit 880f57318450dbead6a03f9e31a1468924d6dd88 upstream.
-
-The maximum kilobytes of locked memory that an unprivileged user
-can reserve is of 512 kB = 128 pages by default, scaled to the
-number of onlined CPUs, which fits well with the tools that use
-128 data pages by default.
-
-However tools actually use 129 pages, because they need one more
-for the user control page. Thus the default mlock threshold is
-not sufficient for the default tools needs and we always end up
-to evaluate the constant mlock rlimit policy, which doesn't have
-this scaling with the number of online CPUs.
-
-Hence, on systems that have more than 16 CPUs, we overlap the
-rlimit threshold and fail to mmap:
-
-	$ perf record ls
-	Error: failed to mmap with 1 (Operation not permitted)
-
-Just increase the max unprivileged mlock threshold by one page
-so that it supports well perf tools even after 16 CPUs.
-
-Reported-by: Han Pingtian <phan@redhat.com>
-Reported-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
-Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
-Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Cc: Stephane Eranian <eranian@google.com>
-LKML-Reference: <1300904979-5508-1-git-send-email-fweisbec@gmail.com>
-Signed-off-by: Ingo Molnar <mingo@elte.hu>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- kernel/perf_event.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/kernel/perf_event.c
-+++ b/kernel/perf_event.c
-@@ -62,7 +62,8 @@ static struct srcu_struct pmus_srcu;
-  */
- int sysctl_perf_event_paranoid __read_mostly = 1;
- 
--int sysctl_perf_event_mlock __read_mostly = 512; /* 'free' kb per user */
-+/* Minimum for 128 pages + 1 for the user control page */
-+int sysctl_perf_event_mlock __read_mostly = 516; /* 'free' kb per user */
- 
- /*
-  * max perf event sample rate
-From cda6587c21a887254c8ed4b58da8fcc4040ab557 Mon Sep 17 00:00:00 2001
-From: Stanislaw Gruszka <sgruszka@redhat.com>
-Date: Wed, 23 Mar 2011 02:44:30 +0000
-Subject: myri10ge: fix rmmod crash
-
-From: Stanislaw Gruszka <sgruszka@redhat.com>
-
-commit cda6587c21a887254c8ed4b58da8fcc4040ab557 upstream.
-
-Rmmod myri10ge crash at free_netdev() -> netif_napi_del(), because napi
-structures are already deallocated. To fix call netif_napi_del() before
-kfree() at myri10ge_free_slices().
-
-Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/net/myri10ge/myri10ge.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/myri10ge/myri10ge.c
-+++ b/drivers/net/myri10ge/myri10ge.c
-@@ -3645,6 +3645,7 @@ static void myri10ge_free_slices(struct
- 			dma_free_coherent(&pdev->dev, bytes,
- 					  ss->fw_stats, ss->fw_stats_bus);
- 			ss->fw_stats = NULL;
-+			netif_napi_del(&ss->napi);
- 		}
- 	}
- 	kfree(mgp->ss);
-From 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 Mon Sep 17 00:00:00 2001
-From: Bud Brown <bud.brown@redhat.com>
-Date: Wed, 23 Mar 2011 20:47:11 +0100
-Subject: cciss: fix lost command issue
-
-From: Bud Brown <bud.brown@redhat.com>
-
-commit 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 upstream.
-
-Under certain workloads a command may seem to get lost. IOW, the Smart Array
-thinks all commands have been completed but we still have commands in our
-completion queue. This may lead to system instability, filesystems going
-read-only, or even panics depending on the affected filesystem. We add an
-extra read to force the write to complete.
-
-Testing shows this extra read avoids the problem.
-
-Signed-off-by: Mike Miller <mike.miller@hp.com>
-Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/block/cciss.h |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/block/cciss.h
-+++ b/drivers/block/cciss.h
-@@ -222,6 +222,7 @@ static void SA5_submit_command( ctlr_inf
- 			h->ctlr, c->busaddr);
- #endif /* CCISS_DEBUG */
-          writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
-+	readl(h->vaddr + SA5_REQUEST_PORT_OFFSET);
- 	 h->commands_outstanding++;
- 	 if ( h->commands_outstanding > h->max_outstanding)
- 		h->max_outstanding = h->commands_outstanding;
-From 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 Mon Sep 17 00:00:00 2001
-From: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
-Date: Mon, 21 Mar 2011 18:27:21 +0530
-Subject: ath9k: Fix kernel panic in AR2427
-
-From: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
-
-commit 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 upstream.
-
-Kernel panic occurs just after AR2427 establishes connection with AP.
-Unless aggregation is enabled we don't initialize the TID structure.
-Thus accesing the elements of the TID structure when aggregation is
-disabled, leads to NULL pointer dereferencing.
-
-[  191.320358] Call Trace:
-[  191.320364]  [<fd250ea7>] ? ath9k_tx+0xa7/0x200 [ath9k]
-[  191.320376]  [<fd1ec7fc>] ? __ieee80211_tx+0x5c/0x1e0 [mac80211]
-[  191.320386]  [<fd1edd2b>] ? ieee80211_tx+0x7b/0x90 [mac80211]
-[  191.320395]  [<fd1edddd>] ? ieee80211_xmit+0x9d/0x1d0 [mac80211]
-[  191.320401]  [<c014218f>] ? wake_up_state+0xf/0x20
-[  191.320405]  [<c015dbc8>] ? signal_wake_up+0x28/0x40
-[  191.320410]  [<c012a578>] ? default_spin_lock_flags+0x8/0x10
-[  191.320420]  [<fd1ee308>] ? ieee80211_subif_start_xmit+0x2e8/0x7c0
-[mac80211]
-[  191.320425]  [<c058f905>] ? do_page_fault+0x295/0x3a0
-[  191.320431]  [<c04c4a3d>] ? dev_hard_start_xmit+0x1ad/0x210
-[  191.320436]  [<c04d96b5>] ? sch_direct_xmit+0x105/0x170
-[  191.320445]  [<fd1f161a>] ? get_sta_flags+0x2a/0x40 [mac80211]
-[  191.320449]  [<c04c780f>] ? dev_queue_xmit+0x37f/0x4b0
-[  191.320452]  [<c04d75b0>] ? eth_header+0x0/0xb0
-[  191.320456]  [<c04cc479>] ? neigh_resolve_output+0xe9/0x310
-[  191.320461]  [<c053d295>] ? ip6_output_finish+0xa5/0x110
-[  191.320464]  [<c053e354>] ? ip6_output2+0x134/0x250
-[  191.320468]  [<c053f7dd>] ? ip6_output+0x6d/0x100
-[  191.320471]  [<c0559665>] ? mld_sendpack+0x395/0x3e0
-[  191.320475]  [<c0557f81>] ? add_grhead+0x31/0xa0
-[  191.320478]  [<c055a83c>] ? mld_send_cr+0x1bc/0x2b0
-[  191.320482]  [<c01535d9>] ? irq_exit+0x39/0x70
-[  191.320485]  [<c055a940>] ? mld_ifc_timer_expire+0x10/0x40
-[  191.320489]  [<c015b92e>] ? run_timer_softirq+0x13e/0x2c0
-[  191.320493]  [<c0103a30>] ? common_interrupt+0x30/0x40
-[  191.320498]  [<c055a930>] ? mld_ifc_timer_expire+0x0/0x40
-[  191.320502]  [<c0153358>] ? __do_softirq+0x98/0x1b0
-[  191.320506]  [<c01534b5>] ? do_softirq+0x45/0x50
-[  191.320509]  [<c0153605>] ? irq_exit+0x65/0x70
-[  191.320513]  [<c05917dc>] ? smp_apic_timer_interrupt+0x5c/0x8b
-[  191.320516]  [<c0103df1>] ? apic_timer_interrupt+0x31/0x40
-[  191.320521]  [<c016007b>] ? k_getrusage+0x12b/0x2f0
-[  191.320525]  [<c039e384>] ? acpi_idle_enter_simple+0x117/0x148
-[  191.320529]  [<c04a20da>] ? cpuidle_idle_call+0x7a/0x100
-[  191.320532]  [<c01021d4>] ? cpu_idle+0x94/0xd0
-[  191.320536]  [<c057ab88>] ? rest_init+0x58/0x60
-[  191.320541]  [<c07a58ec>] ? start_kernel+0x351/0x357
-[  191.320544]  [<c07a53c7>] ? unknown_bootoption+0x0/0x19e
-[  191.320548]  [<c07a50aa>] ? i386_start_kernel+0xaa/0xb1
-[  191.320550] Code: 03 66 3d 00 03 0f 84 7c 02 00 00 83 c3 18 0f b6 03
-8b 4d e0 89 c3 83 e3 0f 6b c3 48 89 5d d8 8d 04 06 8d 50 0c 89 55 d0 8b
-40 20 <8b> 00 3b 01 0f 85 8e 02 00 00 f6 47 20 40 0f 84 29 ff ff ff 8b
-[  191.320634] EIP: [<fd2586d4>] ath_tx_start+0x474/0x770 [ath9k] SS:ESP
-0068:c0761a90
-[  191.320642] CR2: 0000000000000000
-[  191.320647] ---[ end trace 9296ef23b9076ece ]---
-[  191.320650] Kernel panic - not syncing: Fatal exception in interrupt
-
-Signed-off-by: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
-Signed-off-by: John W. Linville <linville@tuxdriver.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/net/wireless/ath/ath9k/xmit.c |    4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -1699,8 +1699,8 @@ static void ath_tx_start_dma(struct ath_
- 	u8 tidno;
- 
- 	spin_lock_bh(&txctl->txq->axq_lock);
--
--	if (ieee80211_is_data_qos(hdr->frame_control) && txctl->an) {
-+	if ((sc->sc_flags & SC_OP_TXAGGR) && txctl->an &&
-+		ieee80211_is_data_qos(hdr->frame_control)) {
- 		tidno = ieee80211_get_qos_ctl(hdr)[0] &
- 			IEEE80211_QOS_CTL_TID_MASK;
- 		tid = ATH_AN_2_TID(txctl->an, tidno);
-From 4d00135a680727f6c3be78f8befaac009030e4df Mon Sep 17 00:00:00 2001
-From: Dan Rosenberg <drosenberg@vsecurity.com>
-Date: Wed, 23 Mar 2011 11:42:57 -0400
-Subject: sound/oss/opl3: validate voice and channel indexes
-
-From: Dan Rosenberg <drosenberg@vsecurity.com>
-
-commit 4d00135a680727f6c3be78f8befaac009030e4df upstream.
-
-User-controllable indexes for voice and channel values may cause reading
-and writing beyond the bounds of their respective arrays, leading to
-potentially exploitable memory corruption.  Validate these indexes.
-
-Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- sound/oss/opl3.c |   15 +++++++++++++--
- 1 file changed, 13 insertions(+), 2 deletions(-)
-
---- a/sound/oss/opl3.c
-+++ b/sound/oss/opl3.c
-@@ -849,6 +849,10 @@ static int opl3_load_patch(int dev, int
- 
- static void opl3_panning(int dev, int voice, int value)
- {
-+
-+	if (voice < 0 || voice >= devc->nr_voice)
-+		return;
-+
- 	devc->voc[voice].panning = value;
- }
- 
-@@ -1066,8 +1070,15 @@ static int opl3_alloc_voice(int dev, int
- 
- static void opl3_setup_voice(int dev, int voice, int chn)
- {
--	struct channel_info *info =
--	&synth_devs[dev]->chn_info[chn];
-+	struct channel_info *info;
-+
-+	if (voice < 0 || voice >= devc->nr_voice)
-+		return;
-+
-+	if (chn < 0 || chn > 15)
-+		return;
-+
-+	info = &synth_devs[dev]->chn_info[chn];
- 
- 	opl3_set_instr(dev, voice, info->pgm_num);
- 
-From 8bc8aecdc5e26cfda12dbd6867af4aa67836da6a Mon Sep 17 00:00:00 2001
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Mon, 21 Mar 2011 20:01:00 +0100
-Subject: mac80211: initialize sta->last_rx in sta_info_alloc
-
-From: Felix Fietkau <nbd@openwrt.org>
-
-commit 8bc8aecdc5e26cfda12dbd6867af4aa67836da6a upstream.
-
-This field is used to determine the inactivity time. When in AP mode,
-hostapd uses it for kicking out inactive clients after a while. Without this
-patch, hostapd immediately deauthenticates a new client if it checks the
-inactivity time before the client sends its first data frame.
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-Signed-off-by: John W. Linville <linville@tuxdriver.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- net/mac80211/sta_info.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -243,6 +243,7 @@ struct sta_info *sta_info_alloc(struct i
- 	memcpy(sta->sta.addr, addr, ETH_ALEN);
- 	sta->local = local;
- 	sta->sdata = sdata;
-+	sta->last_rx = jiffies;
- 
- 	ewma_init(&sta->avg_signal, 1024, 8);
- 
-From 877a55979c189c590e819a61cbbe2b7947875f17 Mon Sep 17 00:00:00 2001
-From: John Hughes <john@Calva.COM>
-Date: Wed, 4 Nov 2009 19:01:22 +0100
-Subject: [SCSI] ses: show devices for enclosures with no page 7
-
-From: John Hughes <john@Calva.COM>
-
-commit 877a55979c189c590e819a61cbbe2b7947875f17 upstream.
-
-enclosure page 7 gives us the "pretty" names of the enclosure slots.
-Without a page 7, we can still use the enclosure code as long as we
-make up numeric names for the slots. Unfortunately, the current code
-fails to add any devices because the check for page 10 is in the wrong
-place if we have no page 7.  Fix it so that devices show up even if
-the enclosure has no page 7.
-
-Signed-off-by: James Bottomley <James.Bottomley@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/scsi/ses.c |    4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/scsi/ses.c
-+++ b/drivers/scsi/ses.c
-@@ -390,9 +390,9 @@ static void ses_enclosure_data_process(s
- 		len = (desc_ptr[2] << 8) + desc_ptr[3];
- 		/* skip past overall descriptor */
- 		desc_ptr += len + 4;
--		if (ses_dev->page10)
--			addl_desc_ptr = ses_dev->page10 + 8;
- 	}
-+	if (ses_dev->page10)
-+		addl_desc_ptr = ses_dev->page10 + 8;
- 	type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
- 	components = 0;
- 	for (i = 0; i < types; i++, type_ptr += 4) {
-From d1e12de804f9d8ad114786ca7c2ce593cba79891 Mon Sep 17 00:00:00 2001
-From: Krishnasamy, Somasundaram <Somasundaram.Krishnasamy@lsi.com>
-Date: Mon, 28 Feb 2011 18:13:22 -0500
-Subject: [SCSI] ses: Avoid kernel panic when lun 0 is not mapped
-
-From: Krishnasamy, Somasundaram <Somasundaram.Krishnasamy@lsi.com>
-
-commit d1e12de804f9d8ad114786ca7c2ce593cba79891 upstream.
-
-During device discovery, scsi mid layer sends INQUIRY command to LUN
-0. If the LUN 0 is not mapped to host, it creates a temporary
-scsi_device with LUN id 0 and sends REPORT_LUNS command to it. After
-the REPORT_LUNS succeeds, it walks through the LUN table and adds each
-LUN found to sysfs. At the end of REPORT_LUNS lun table scan, it will
-delete the temporary scsi_device of LUN 0.
-
-When scsi devices are added to sysfs, it calls add_dev function of all
-the registered class interfaces. If ses driver has been registered,
-ses_intf_add() of ses module will be called. This function calls
-scsi_device_enclosure() to check the inquiry data for EncServ
-bit. Since inquiry was not allocated for temporary LUN 0 scsi_device,
-it will cause NULL pointer exception.
-
-To fix the problem, sdev->inquiry is checked for NULL before reading it.
-
-Signed-off-by: Somasundaram Krishnasamy <Somasundaram.Krishnasamy@lsi.com>
-Signed-off-by: Babu Moger <babu.moger@lsi.com>
-Signed-off-by: James Bottomley <James.Bottomley@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- include/scsi/scsi_device.h |    2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/include/scsi/scsi_device.h
-+++ b/include/scsi/scsi_device.h
-@@ -461,7 +461,7 @@ static inline int scsi_device_qas(struct
- }
- static inline int scsi_device_enclosure(struct scsi_device *sdev)
- {
--	return sdev->inquiry[6] & (1<<6);
-+	return sdev->inquiry ? (sdev->inquiry[6] & (1<<6)) : 1;
- }
- 
- static inline int scsi_device_protection(struct scsi_device *sdev)
-From 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 Mon Sep 17 00:00:00 2001
-From: Rafael J. Wysocki <rjw@sisk.pl>
-Date: Sat, 5 Mar 2011 13:21:51 +0100
-Subject: PCI/ACPI: Report ASPM support to BIOS if not disabled from command line
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Rafael J. Wysocki <rjw@sisk.pl>
-
-commit 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 upstream.
-
-We need to distinguish the situation in which ASPM support is
-disabled from the command line or through .config from the situation
-in which it is disabled, because the hardware or BIOS can't handle
-it.  In the former case we should not report ASPM support to the BIOS
-through ACPI _OSC, but in the latter case we should do that.
-
-Introduce pcie_aspm_support_enabled() that can be used by
-acpi_pci_root_add() to determine whether or not it should report ASPM
-support to the BIOS through _OSC.
-
-References: https://bugzilla.kernel.org/show_bug.cgi?id=29722
-References: https://bugzilla.kernel.org/show_bug.cgi?id=20232
-Reported-and-tested-by: Ortwin Glück <odi@odi.ch>
-Reviewed-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
-Tested-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
-Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
-Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/acpi/pci_root.c |    2 +-
- drivers/pci/pcie/aspm.c |    7 +++++++
- include/linux/pci.h     |    7 +++----
- 3 files changed, 11 insertions(+), 5 deletions(-)
-
---- a/drivers/acpi/pci_root.c
-+++ b/drivers/acpi/pci_root.c
-@@ -564,7 +564,7 @@ static int __devinit acpi_pci_root_add(s
- 	/* Indicate support for various _OSC capabilities. */
- 	if (pci_ext_cfg_avail(root->bus->self))
- 		flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
--	if (pcie_aspm_enabled())
-+	if (pcie_aspm_support_enabled())
- 		flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
- 			OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
- 	if (pci_msi_enabled())
---- a/drivers/pci/pcie/aspm.c
-+++ b/drivers/pci/pcie/aspm.c
-@@ -69,6 +69,7 @@ struct pcie_link_state {
- };
- 
- static int aspm_disabled, aspm_force, aspm_clear_state;
-+static bool aspm_support_enabled = true;
- static DEFINE_MUTEX(aspm_lock);
- static LIST_HEAD(link_list);
- 
-@@ -896,6 +897,7 @@ static int __init pcie_aspm_disable(char
- {
- 	if (!strcmp(str, "off")) {
- 		aspm_disabled = 1;
-+		aspm_support_enabled = false;
- 		printk(KERN_INFO "PCIe ASPM is disabled\n");
- 	} else if (!strcmp(str, "force")) {
- 		aspm_force = 1;
-@@ -930,3 +932,8 @@ int pcie_aspm_enabled(void)
- }
- EXPORT_SYMBOL(pcie_aspm_enabled);
- 
-+bool pcie_aspm_support_enabled(void)
-+{
-+	return aspm_support_enabled;
-+}
-+EXPORT_SYMBOL(pcie_aspm_support_enabled);
---- a/include/linux/pci.h
-+++ b/include/linux/pci.h
-@@ -1002,12 +1002,11 @@ extern bool pcie_ports_auto;
- #endif
- 
- #ifndef CONFIG_PCIEASPM
--static inline int pcie_aspm_enabled(void)
--{
--	return 0;
--}
-+static inline int pcie_aspm_enabled(void) { return 0; }
-+static inline bool pcie_aspm_support_enabled(void) { return false; }
- #else
- extern int pcie_aspm_enabled(void);
-+extern bool pcie_aspm_support_enabled(void);
- #endif
- 
- #ifdef CONFIG_PCIEAER
-From 4b239f458c229de044d6905c2b0f9fe16ed9e01e Mon Sep 17 00:00:00 2001
-From: Yinghai Lu <yinghai@kernel.org>
-Date: Fri, 17 Dec 2010 16:58:28 -0800
-Subject: x86-64, mm: Put early page table high
-
-From: Yinghai Lu <yinghai@kernel.org>
-
-commit 4b239f458c229de044d6905c2b0f9fe16ed9e01e upstream.
-
-While dubug kdump, found current kernel will have problem with crashkernel=512M.
-
-It turns out that initial mapping is to 512M, and later initial mapping to 4G
-(acutally is 2040M in my platform), will put page table near 512M.
-then initial mapping to 128g will be near 2g.
-
-before this patch:
-[    0.000000] initial memory mapped : 0 - 20000000
-[    0.000000] init_memory_mapping: [0x00000000000000-0x0000007f74ffff]
-[    0.000000]  0000000000 - 007f600000 page 2M
-[    0.000000]  007f600000 - 007f750000 page 4k
-[    0.000000] kernel direct mapping tables up to 7f750000 @ [0x1fffc000-0x1fffffff]
-[    0.000000]     memblock_x86_reserve_range: [0x1fffc000-0x1fffdfff]          PGTABLE
-[    0.000000] init_memory_mapping: [0x00000100000000-0x0000207fffffff]
-[    0.000000]  0100000000 - 2080000000 page 2M
-[    0.000000] kernel direct mapping tables up to 2080000000 @ [0x7bc01000-0x7bc83fff]
-[    0.000000]     memblock_x86_reserve_range: [0x7bc01000-0x7bc7efff]          PGTABLE
-[    0.000000] RAMDISK: 7bc84000 - 7f745000
-[    0.000000] crashkernel reservation failed - No suitable area found.
-
-after patch:
-[    0.000000] initial memory mapped : 0 - 20000000
-[    0.000000] init_memory_mapping: [0x00000000000000-0x0000007f74ffff]
-[    0.000000]  0000000000 - 007f600000 page 2M
-[    0.000000]  007f600000 - 007f750000 page 4k
-[    0.000000] kernel direct mapping tables up to 7f750000 @ [0x7f74c000-0x7f74ffff]
-[    0.000000]     memblock_x86_reserve_range: [0x7f74c000-0x7f74dfff]          PGTABLE
-[    0.000000] init_memory_mapping: [0x00000100000000-0x0000207fffffff]
-[    0.000000]  0100000000 - 2080000000 page 2M
-[    0.000000] kernel direct mapping tables up to 2080000000 @ [0x207ff7d000-0x207fffffff]
-[    0.000000]     memblock_x86_reserve_range: [0x207ff7d000-0x207fffafff]          PGTABLE
-[    0.000000] RAMDISK: 7bc84000 - 7f745000
-[    0.000000]     memblock_x86_reserve_range: [0x17000000-0x36ffffff]     CRASH KERNEL
-[    0.000000] Reserving 512MB of memory at 368MB for crashkernel (System RAM: 133120MB)
-
-It means with the patch, page table for [0, 2g) will need 2g, instead of under 512M,
-page table for [4g, 128g) will be near 128g, instead of under 2g.
-
-That would good, if we have lots of memory above 4g, like 1024g, or 2048g or 16T, will not put
-related page table under 2g. that would be have chance to fill the under 2g if 1G or 2M page is
-not used.
-
-the code change will use add map_low_page() and update unmap_low_page() for 64bit, and use them
-to get access the corresponding high memory for page table setting.
-
-Signed-off-by: Yinghai Lu <yinghai@kernel.org>
-LKML-Reference: <4D0C0734.7060900@kernel.org>
-Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- arch/x86/mm/init.c    |    9 ++-----
- arch/x86/mm/init_64.c |   63 +++++++++++++++++++++-----------------------------
- 2 files changed, 30 insertions(+), 42 deletions(-)
-
---- a/arch/x86/mm/init.c
-+++ b/arch/x86/mm/init.c
-@@ -33,7 +33,7 @@ int direct_gbpages
- static void __init find_early_table_space(unsigned long end, int use_pse,
- 					  int use_gbpages)
- {
--	unsigned long puds, pmds, ptes, tables, start;
-+	unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
- 	phys_addr_t base;
- 
- 	puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
-@@ -73,12 +73,9 @@ static void __init find_early_table_spac
- 	 * need roughly 0.5KB per GB.
- 	 */
- #ifdef CONFIG_X86_32
--	start = 0x7000;
--#else
--	start = 0x8000;
-+	good_end = max_pfn_mapped << PAGE_SHIFT;
- #endif
--	base = memblock_find_in_range(start, max_pfn_mapped<<PAGE_SHIFT,
--					tables, PAGE_SIZE);
-+	base = memblock_find_in_range(start, good_end, tables, PAGE_SIZE);
- 	if (base == MEMBLOCK_ERROR)
- 		panic("Cannot find space for the kernel page tables");
- 
---- a/arch/x86/mm/init_64.c
-+++ b/arch/x86/mm/init_64.c
-@@ -334,12 +334,28 @@ static __ref void *alloc_low_page(unsign
- 	return adr;
- }
- 
-+static __ref void *map_low_page(void *virt)
-+{
-+	void *adr;
-+	unsigned long phys, left;
-+
-+	if (after_bootmem)
-+		return virt;
-+
-+	phys = __pa(virt);
-+	left = phys & (PAGE_SIZE - 1);
-+	adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
-+	adr = (void *)(((unsigned long)adr) | left);
-+
-+	return adr;
-+}
-+
- static __ref void unmap_low_page(void *adr)
- {
- 	if (after_bootmem)
- 		return;
- 
--	early_iounmap(adr, PAGE_SIZE);
-+	early_iounmap((void *)((unsigned long)adr & PAGE_MASK), PAGE_SIZE);
- }
- 
- static unsigned long __meminit
-@@ -387,15 +403,6 @@ phys_pte_init(pte_t *pte_page, unsigned
- }
- 
- static unsigned long __meminit
--phys_pte_update(pmd_t *pmd, unsigned long address, unsigned long end,
--		pgprot_t prot)
--{
--	pte_t *pte = (pte_t *)pmd_page_vaddr(*pmd);
--
--	return phys_pte_init(pte, address, end, prot);
--}
--
--static unsigned long __meminit
- phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
- 	      unsigned long page_size_mask, pgprot_t prot)
- {
-@@ -421,8 +428,10 @@ phys_pmd_init(pmd_t *pmd_page, unsigned
- 		if (pmd_val(*pmd)) {
- 			if (!pmd_large(*pmd)) {
- 				spin_lock(&init_mm.page_table_lock);
--				last_map_addr = phys_pte_update(pmd, address,
-+				pte = map_low_page((pte_t *)pmd_page_vaddr(*pmd));
-+				last_map_addr = phys_pte_init(pte, address,
- 								end, prot);
-+				unmap_low_page(pte);
- 				spin_unlock(&init_mm.page_table_lock);
- 				continue;
- 			}
-@@ -469,18 +478,6 @@ phys_pmd_init(pmd_t *pmd_page, unsigned
- }
- 
- static unsigned long __meminit
--phys_pmd_update(pud_t *pud, unsigned long address, unsigned long end,
--		unsigned long page_size_mask, pgprot_t prot)
--{
--	pmd_t *pmd = pmd_offset(pud, 0);
--	unsigned long last_map_addr;
--
--	last_map_addr = phys_pmd_init(pmd, address, end, page_size_mask, prot);
--	__flush_tlb_all();
--	return last_map_addr;
--}
--
--static unsigned long __meminit
- phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
- 			 unsigned long page_size_mask)
- {
-@@ -505,8 +502,11 @@ phys_pud_init(pud_t *pud_page, unsigned
- 
- 		if (pud_val(*pud)) {
- 			if (!pud_large(*pud)) {
--				last_map_addr = phys_pmd_update(pud, addr, end,
-+				pmd = map_low_page(pmd_offset(pud, 0));
-+				last_map_addr = phys_pmd_init(pmd, addr, end,
- 							 page_size_mask, prot);
-+				unmap_low_page(pmd);
-+				__flush_tlb_all();
- 				continue;
- 			}
- 			/*
-@@ -554,17 +554,6 @@ phys_pud_init(pud_t *pud_page, unsigned
- 	return last_map_addr;
- }
- 
--static unsigned long __meminit
--phys_pud_update(pgd_t *pgd, unsigned long addr, unsigned long end,
--		 unsigned long page_size_mask)
--{
--	pud_t *pud;
--
--	pud = (pud_t *)pgd_page_vaddr(*pgd);
--
--	return phys_pud_init(pud, addr, end, page_size_mask);
--}
--
- unsigned long __meminit
- kernel_physical_mapping_init(unsigned long start,
- 			     unsigned long end,
-@@ -588,8 +577,10 @@ kernel_physical_mapping_init(unsigned lo
- 			next = end;
- 
- 		if (pgd_val(*pgd)) {
--			last_map_addr = phys_pud_update(pgd, __pa(start),
-+			pud = map_low_page((pud_t *)pgd_page_vaddr(*pgd));
-+			last_map_addr = phys_pud_init(pud, __pa(start),
- 						 __pa(end), page_size_mask);
-+			unmap_low_page(pud);
- 			continue;
- 		}
- 
-From 50f198ae16ac66508d4b8d5a40967a8507ad19ee Mon Sep 17 00:00:00 2001
-From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
-Date: Wed, 9 Mar 2011 11:49:13 -0600
-Subject: eCryptfs: Unlock page in write_begin error path
-
-From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
-
-commit 50f198ae16ac66508d4b8d5a40967a8507ad19ee upstream.
-
-Unlock the page in error path of ecryptfs_write_begin(). This may
-happen, for example, if decryption fails while bring the page
-up-to-date.
-
-Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- fs/ecryptfs/mmap.c |    5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/fs/ecryptfs/mmap.c
-+++ b/fs/ecryptfs/mmap.c
-@@ -374,6 +374,11 @@ static int ecryptfs_write_begin(struct f
- 	    && (pos != 0))
- 		zero_user(page, 0, PAGE_CACHE_SIZE);
- out:
-+	if (unlikely(rc)) {
-+		unlock_page(page);
-+		page_cache_release(page);
-+		*pagep = NULL;
-+	}
- 	return rc;
- }
- 
-From 1821df040ac3cd6a57518739f345da6d50ea9d3f Mon Sep 17 00:00:00 2001
-From: Roberto Sassu <roberto.sassu@polito.it>
-Date: Thu, 17 Mar 2011 12:48:50 +0100
-Subject: eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix
-
-From: Roberto Sassu <roberto.sassu@polito.it>
-
-commit 1821df040ac3cd6a57518739f345da6d50ea9d3f upstream.
-
-The pointer '(*auth_tok_key)' is set to NULL in case request_key()
-fails, in order to prevent its use by functions calling
-ecryptfs_keyring_auth_tok_for_sig().
-
-Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
-Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- fs/ecryptfs/keystore.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/fs/ecryptfs/keystore.c
-+++ b/fs/ecryptfs/keystore.c
-@@ -1563,6 +1563,7 @@ int ecryptfs_keyring_auth_tok_for_sig(st
- 		printk(KERN_ERR "Could not find key with description: [%s]\n",
- 		       sig);
- 		rc = process_request_key_err(PTR_ERR(*auth_tok_key));
-+		(*auth_tok_key) = NULL;
- 		goto out;
- 	}
- 	(*auth_tok) = ecryptfs_get_key_payload_data(*auth_tok_key);
-From 60af520cf264ea26b2af3a6871bbd71850522aea Mon Sep 17 00:00:00 2001
-From: Tadeusz Struk <tadeusz.struk@intel.com>
-Date: Sun, 13 Mar 2011 16:56:17 +0800
-Subject: crypto: aesni-intel - fixed problem with packets that are not multiple of 64bytes
-
-From: Tadeusz Struk <tadeusz.struk@intel.com>
-
-commit 60af520cf264ea26b2af3a6871bbd71850522aea upstream.
-
-This patch fixes problem with packets that are not multiple of 64bytes.
-
-Signed-off-by: Adrian Hoban <adrian.hoban@intel.com>
-Signed-off-by: Aidan O'Mahony <aidan.o.mahony@intel.com>
-Signed-off-by: Gabriele Paoloni <gabriele.paoloni@intel.com>
-Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- arch/x86/crypto/aesni-intel_asm.S  |    5 ++++-
- arch/x86/crypto/aesni-intel_glue.c |   14 ++++++++++++--
- 2 files changed, 16 insertions(+), 3 deletions(-)
-
---- a/arch/x86/crypto/aesni-intel_asm.S
-+++ b/arch/x86/crypto/aesni-intel_asm.S
-@@ -1612,6 +1612,7 @@ _zero_cipher_left_encrypt:
-         movdqa SHUF_MASK(%rip), %xmm10
- 	PSHUFB_XMM %xmm10, %xmm0
- 
-+
- 	ENCRYPT_SINGLE_BLOCK	%xmm0, %xmm1        # Encrypt(K, Yn)
- 	sub $16, %r11
- 	add %r13, %r11
-@@ -1634,7 +1635,9 @@ _zero_cipher_left_encrypt:
- 	# GHASH computation for the last <16 byte block
- 	sub	%r13, %r11
- 	add	$16, %r11
--	PSHUFB_XMM %xmm10, %xmm1
-+
-+	movdqa SHUF_MASK(%rip), %xmm10
-+	PSHUFB_XMM %xmm10, %xmm0
- 
- 	# shuffle xmm0 back to output as ciphertext
- 
---- a/arch/x86/crypto/aesni-intel_glue.c
-+++ b/arch/x86/crypto/aesni-intel_glue.c
-@@ -828,9 +828,15 @@ static int rfc4106_init(struct crypto_tf
- 	struct cryptd_aead *cryptd_tfm;
- 	struct aesni_rfc4106_gcm_ctx *ctx = (struct aesni_rfc4106_gcm_ctx *)
- 		PTR_ALIGN((u8 *)crypto_tfm_ctx(tfm), AESNI_ALIGN);
-+	struct crypto_aead *cryptd_child;
-+	struct aesni_rfc4106_gcm_ctx *child_ctx;
- 	cryptd_tfm = cryptd_alloc_aead("__driver-gcm-aes-aesni", 0, 0);
- 	if (IS_ERR(cryptd_tfm))
- 		return PTR_ERR(cryptd_tfm);
-+
-+	cryptd_child = cryptd_aead_child(cryptd_tfm);
-+	child_ctx = aesni_rfc4106_gcm_ctx_get(cryptd_child);
-+	memcpy(child_ctx, ctx, sizeof(*ctx));
- 	ctx->cryptd_tfm = cryptd_tfm;
- 	tfm->crt_aead.reqsize = sizeof(struct aead_request)
- 		+ crypto_aead_reqsize(&cryptd_tfm->base);
-@@ -925,6 +931,9 @@ static int rfc4106_set_key(struct crypto
- 	int ret = 0;
- 	struct crypto_tfm *tfm = crypto_aead_tfm(parent);
- 	struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(parent);
-+	struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
-+	struct aesni_rfc4106_gcm_ctx *child_ctx =
-+                                 aesni_rfc4106_gcm_ctx_get(cryptd_child);
- 	u8 *new_key_mem = NULL;
- 
- 	if (key_len < 4) {
-@@ -968,6 +977,7 @@ static int rfc4106_set_key(struct crypto
- 		goto exit;
- 	}
- 	ret = rfc4106_set_hash_subkey(ctx->hash_subkey, key, key_len);
-+	memcpy(child_ctx, ctx, sizeof(*ctx));
- exit:
- 	kfree(new_key_mem);
- 	return ret;
-@@ -999,7 +1009,6 @@ static int rfc4106_encrypt(struct aead_r
- 	int ret;
- 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- 	struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm);
--	struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
- 
- 	if (!irq_fpu_usable()) {
- 		struct aead_request *cryptd_req =
-@@ -1008,6 +1017,7 @@ static int rfc4106_encrypt(struct aead_r
- 		aead_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base);
- 		return crypto_aead_encrypt(cryptd_req);
- 	} else {
-+		struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
- 		kernel_fpu_begin();
- 		ret = cryptd_child->base.crt_aead.encrypt(req);
- 		kernel_fpu_end();
-@@ -1020,7 +1030,6 @@ static int rfc4106_decrypt(struct aead_r
- 	int ret;
- 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- 	struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm);
--	struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
- 
- 	if (!irq_fpu_usable()) {
- 		struct aead_request *cryptd_req =
-@@ -1029,6 +1038,7 @@ static int rfc4106_decrypt(struct aead_r
- 		aead_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base);
- 		return crypto_aead_decrypt(cryptd_req);
- 	} else {
-+		struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
- 		kernel_fpu_begin();
- 		ret = cryptd_child->base.crt_aead.decrypt(req);
- 		kernel_fpu_end();
diff --git a/patches/fix-hibernate-resume-2.6.38.patch b/patches/fix-hibernate-resume-2.6.38.patch
new file mode 100644
index 0000000..d5fffd8
--- /dev/null
+++ b/patches/fix-hibernate-resume-2.6.38.patch
@@ -0,0 +1,18 @@
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index 5a0484a..4be9b39 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -976,6 +976,11 @@ void __init setup_arch(char **cmdline_p)
+ 	paging_init();
+ 	x86_init.paging.pagetable_setup_done(swapper_pg_dir);
+ 
++	if (boot_cpu_data.cpuid_level >= 0) {
++		/* A CPU has %cr4 if and only if it has CPUID */
++		mmu_cr4_features = read_cr4();
++	}
++
+ #ifdef CONFIG_X86_32
+ 	/* sync back kernel address range */
+ 	clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
+
+  
\ No newline at end of file
diff --git a/patches/kernel-2.6.38.4-pre.patch b/patches/kernel-2.6.38.4-pre.patch
new file mode 100644
index 0000000..1e5ac15
--- /dev/null
+++ b/patches/kernel-2.6.38.4-pre.patch
@@ -0,0 +1,1923 @@
+From a626ca6a656450e9f4df91d0dda238fff23285f4 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 13 Apr 2011 08:07:28 -0700
+Subject: vm: fix vm_pgoff wrap in stack expansion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit a626ca6a656450e9f4df91d0dda238fff23285f4 upstream.
+
+Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed
+the case of a expanding mapping causing vm_pgoff wrapping when you used
+mremap.  But there was another case where we expand mappings hiding in
+plain sight: the automatic stack expansion.
+
+This fixes that case too.
+
+This one also found by Robert Święcki, using his nasty system call
+fuzzer tool.  Good job.
+
+Reported-and-tested-by: Robert Święcki <robert@swiecki.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mmap.c |   13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1814,11 +1814,14 @@ static int expand_downwards(struct vm_ar
+ 		size = vma->vm_end - address;
+ 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
+ 
+-		error = acct_stack_growth(vma, size, grow);
+-		if (!error) {
+-			vma->vm_start = address;
+-			vma->vm_pgoff -= grow;
+-			perf_event_mmap(vma);
++		error = -ENOMEM;
++		if (grow <= vma->vm_pgoff) {
++			error = acct_stack_growth(vma, size, grow);
++			if (!error) {
++				vma->vm_start = address;
++				vma->vm_pgoff -= grow;
++				perf_event_mmap(vma);
++			}
+ 		}
+ 	}
+ 	vma_unlock_anon_vma(vma);
+From 9bb09fa1b5b07459279301ac6220d575f307597b Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 7 Apr 2011 10:31:25 -0400
+Subject: drm/radeon/kms: pll tweaks for rv6xx
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 9bb09fa1b5b07459279301ac6220d575f307597b upstream.
+
+Prefer minm over maxp.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=35994
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -531,6 +531,12 @@ static u32 atombios_adjust_pll(struct dr
+ 			pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
+ 		else
+ 			pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
++
++		if ((rdev->family == CHIP_R600) ||
++		    (rdev->family == CHIP_RV610) ||
++		    (rdev->family == CHIP_RV630) ||
++		    (rdev->family == CHIP_RV670))
++			pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ 	} else {
+ 		pll->flags |= RADEON_PLL_LEGACY;
+ 
+From 71e16bfbd2b1c63d4d97cc5059694c9346aee340 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Tue, 12 Apr 2011 13:33:27 -0400
+Subject: drm/radeon/kms: fix suspend on rv530 asics
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 71e16bfbd2b1c63d4d97cc5059694c9346aee340 upstream.
+
+Apparently only rv515 asics need the workaround
+added in f24d86f1a49505cdea56728b853a5d0a3f8e3d11
+(drm/radeon/kms: fix resume regression for some r5xx laptops).
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=34709
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atom.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -32,6 +32,7 @@
+ #include "atom.h"
+ #include "atom-names.h"
+ #include "atom-bits.h"
++#include "radeon.h"
+ 
+ #define ATOM_COND_ABOVE		0
+ #define ATOM_COND_ABOVEOREQUAL	1
+@@ -101,7 +102,9 @@ static void debug_print_spaces(int n)
+ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ 				 uint32_t index, uint32_t data)
+ {
++	struct radeon_device *rdev = ctx->card->dev->dev_private;
+ 	uint32_t temp = 0xCDCDCDCD;
++
+ 	while (1)
+ 		switch (CU8(base)) {
+ 		case ATOM_IIO_NOP:
+@@ -112,7 +115,8 @@ static uint32_t atom_iio_execute(struct
+ 			base += 3;
+ 			break;
+ 		case ATOM_IIO_WRITE:
+-			(void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
++			if (rdev->family == CHIP_RV515)
++				(void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
+ 			ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
+ 			base += 3;
+ 			break;
+From 70945643722ffeac779d2529a348f99567fa5c33 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 14 Mar 2011 13:48:08 -0400
+Subject: cifs: always do is_path_accessible check in cifs_mount
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 70945643722ffeac779d2529a348f99567fa5c33 upstream.
+
+Currently, we skip doing the is_path_accessible check in cifs_mount if
+there is no prefixpath. I have a report of at least one server however
+that allows a TREE_CONNECT to a share that has a DFS referral at its
+root. The reporter in this case was using a UNC that had no prefixpath,
+so the is_path_accessible check was not triggered and the box later hit
+a BUG() because we were chasing a DFS referral on the root dentry for
+the mount.
+
+This patch fixes this by removing the check for a zero-length
+prefixpath.  That should make the is_path_accessible check be done in
+this situation and should allow the client to chase the DFS referral at
+mount time instead.
+
+Reported-and-Tested-by: Yogesh Sharma <ysharma@cymer.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2826,7 +2826,7 @@ try_mount_again:
+ 
+ remote_path_check:
+ 	/* check if a whole path (including prepath) is not remote */
+-	if (!rc && cifs_sb->prepathlen && tcon) {
++	if (!rc && tcon) {
+ 		/* build_path_to_root works only when we have a valid tcon */
+ 		full_path = cifs_build_path_to_root(cifs_sb, tcon);
+ 		if (full_path == NULL) {
+From 7797069305d13252fd66cf722aa8f2cbeb3c95cd Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 5 Apr 2011 16:23:47 -0700
+Subject: cifs: check for private_data before trying to put it
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 7797069305d13252fd66cf722aa8f2cbeb3c95cd upstream.
+
+cifs_close doesn't check that the filp->private_data is non-NULL before
+trying to put it. That can cause an oops in certain error conditions
+that can occur on open or lookup before the private_data is set.
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/file.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -575,8 +575,10 @@ reopen_error_exit:
+ 
+ int cifs_close(struct inode *inode, struct file *file)
+ {
+-	cifsFileInfo_put(file->private_data);
+-	file->private_data = NULL;
++	if (file->private_data != NULL) {
++		cifsFileInfo_put(file->private_data);
++		file->private_data = NULL;
++	}
+ 
+ 	/* return code from the ->release op is always ignored */
+ 	return 0;
+From 2b6c26a0a62cc0bab0ad487533d5581d7c293fef Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Fri, 25 Mar 2011 16:25:57 -0400
+Subject: cifs: set ra_pages in backing_dev_info
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 2b6c26a0a62cc0bab0ad487533d5581d7c293fef upstream.
+
+Commit 522440ed made cifs set backing_dev_info on the mapping attached
+to new inodes. This change caused a fairly significant read performance
+regression, as cifs started doing page-sized reads exclusively.
+
+By virtue of the fact that they're allocated as part of cifs_sb_info by
+kzalloc, the ra_pages on cifs BDIs get set to 0, which prevents any
+readahead. This forces the normal read codepaths to use readpage instead
+of readpages causing a four-fold increase in the number of read calls
+with the default rsize.
+
+Fix it by setting ra_pages in the BDI to the same value as that in the
+default_backing_dev_info.
+
+Fixes https://bugzilla.kernel.org/show_bug.cgi?id=31662
+
+Reported-and-Tested-by: Till <till2.schaefer@uni-dortmund.de>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsfs.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -127,6 +127,7 @@ cifs_read_super(struct super_block *sb,
+ 		kfree(cifs_sb);
+ 		return rc;
+ 	}
++	cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
+ 
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+ 	/* copy mount params to sb for use in submounts */
+From 157c249114508aa71daa308a426e15d81a4eed00 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Sat, 2 Apr 2011 07:34:30 -0400
+Subject: cifs: wrap received signature check in srv_mutex
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 157c249114508aa71daa308a426e15d81a4eed00 upstream.
+
+While testing my patchset to fix asynchronous writes, I hit a bunch
+of signature problems when testing with signing on. The problem seems
+to be that signature checks on receive can be running at the same
+time as a process that is sending, or even that multiple receives can
+be checking signatures at the same time, clobbering the same data
+structures.
+
+While we're at it, clean up the comments over cifs_calculate_signature
+and add a note that the srv_mutex should be held when calling this
+function.
+
+This patch seems to fix the problems for me, but I'm not clear on
+whether it's the best approach. If it is, then this should probably
+go to stable too.
+
+Cc: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsencrypt.c |   15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -30,12 +30,13 @@
+ #include <linux/ctype.h>
+ #include <linux/random.h>
+ 
+-/* Calculate and return the CIFS signature based on the mac key and SMB PDU */
+-/* the 16 byte signature must be allocated by the caller  */
+-/* Note we only use the 1st eight bytes */
+-/* Note that the smb header signature field on input contains the
+-	sequence number before this function is called */
+-
++/*
++ * Calculate and return the CIFS signature based on the mac key and SMB PDU.
++ * The 16 byte signature must be allocated by the caller. Note we only use the
++ * 1st eight bytes and that the smb header signature field on input contains
++ * the sequence number before this function is called. Also, this function
++ * should be called with the server->srv_mutex held.
++ */
+ static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
+ 				struct TCP_Server_Info *server, char *signature)
+ {
+@@ -209,8 +210,10 @@ int cifs_verify_signature(struct smb_hdr
+ 					cpu_to_le32(expected_sequence_number);
+ 	cifs_pdu->Signature.Sequence.Reserved = 0;
+ 
++	mutex_lock(&server->srv_mutex);
+ 	rc = cifs_calculate_signature(cifs_pdu, server,
+ 		what_we_think_sig_should_be);
++	mutex_unlock(&server->srv_mutex);
+ 
+ 	if (rc)
+ 		return rc;
+From 14ddc3188d50855ae2a419a6aced995e2834e5d4 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Fri, 4 Feb 2011 09:23:33 -0300
+Subject: [media] video: sn9c102: world-wirtable sysfs files
+
+From: Vasiliy Kulikov <segoon@openwall.com>
+
+commit 14ddc3188d50855ae2a419a6aced995e2834e5d4 upstream.
+
+Don't allow everybody to change video settings.
+
+Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Acked-by: Luca Risolia <luca.risolia@studio.unibo.it>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/sn9c102/sn9c102_core.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/video/sn9c102/sn9c102_core.c
++++ b/drivers/media/video/sn9c102/sn9c102_core.c
+@@ -1430,9 +1430,9 @@ static DEVICE_ATTR(i2c_reg, S_IRUGO | S_
+ 		   sn9c102_show_i2c_reg, sn9c102_store_i2c_reg);
+ static DEVICE_ATTR(i2c_val, S_IRUGO | S_IWUSR,
+ 		   sn9c102_show_i2c_val, sn9c102_store_i2c_val);
+-static DEVICE_ATTR(green, S_IWUGO, NULL, sn9c102_store_green);
+-static DEVICE_ATTR(blue, S_IWUGO, NULL, sn9c102_store_blue);
+-static DEVICE_ATTR(red, S_IWUGO, NULL, sn9c102_store_red);
++static DEVICE_ATTR(green, S_IWUSR, NULL, sn9c102_store_green);
++static DEVICE_ATTR(blue, S_IWUSR, NULL, sn9c102_store_blue);
++static DEVICE_ATTR(red, S_IWUSR, NULL, sn9c102_store_red);
+ static DEVICE_ATTR(frame_header, S_IRUGO, sn9c102_show_frame_header, NULL);
+ 
+ 
+From 8c559d30b4e59cf6994215ada1fe744928f494bf Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Fri, 4 Feb 2011 15:24:19 +0300
+Subject: UBIFS: restrict world-writable debugfs files
+
+From: Vasiliy Kulikov <segoon@openwall.com>
+
+commit 8c559d30b4e59cf6994215ada1fe744928f494bf upstream.
+
+Don't allow everybody to dump sensitive information about filesystems.
+
+Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/debug.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -2844,19 +2844,19 @@ int dbg_debugfs_init_fs(struct ubifs_inf
+ 	}
+ 
+ 	fname = "dump_lprops";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_lprops = dent;
+ 
+ 	fname = "dump_budg";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_budg = dent;
+ 
+ 	fname = "dump_tnc";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_tnc = dent;
+From c6b358748e19ce7e230b0926ac42696bc485a562 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 28 Mar 2011 12:05:31 +0200
+Subject: ALSA: hda - Fix pin-config of Gigabyte mobo
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c6b358748e19ce7e230b0926ac42696bc485a562 upstream.
+
+Use pin-fix instead of the static quirk for Gigabyte mobos 1458:a002.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=677256
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c |   21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9932,7 +9932,6 @@ static struct snd_pci_quirk alc882_cfg_t
+ 	SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD),
+ 	SND_PCI_QUIRK(0x10f1, 0x2350, "TYAN-S2350", ALC888_6ST_DELL),
+ 	SND_PCI_QUIRK(0x108e, 0x534d, NULL, ALC883_3ST_6ch),
+-	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P35 DS3R", ALC882_6ST_DIG),
+ 
+ 	SND_PCI_QUIRK(0x1462, 0x0349, "MSI", ALC883_TARGA_2ch_DIG),
+ 	SND_PCI_QUIRK(0x1462, 0x040d, "MSI", ALC883_TARGA_2ch_DIG),
+@@ -10769,6 +10768,7 @@ enum {
+ 	PINFIX_LENOVO_Y530,
+ 	PINFIX_PB_M5210,
+ 	PINFIX_ACER_ASPIRE_7736,
++	PINFIX_GIGABYTE_880GM,
+ };
+ 
+ static const struct alc_fixup alc882_fixups[] = {
+@@ -10800,6 +10800,13 @@ static const struct alc_fixup alc882_fix
+ 		.type = ALC_FIXUP_SKU,
+ 		.v.sku = ALC_FIXUP_SKU_IGNORE,
+ 	},
++	[PINFIX_GIGABYTE_880GM] = {
++		.type = ALC_FIXUP_PINS,
++		.v.pins = (const struct alc_pincfg[]) {
++			{ 0x14, 0x1114410 }, /* set as speaker */
++			{ }
++		}
++	},
+ };
+ 
+ static struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -10807,6 +10814,7 @@ static struct snd_pci_quirk alc882_fixup
+ 	SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530),
+ 	SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX),
+ 	SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", PINFIX_ACER_ASPIRE_7736),
++	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", PINFIX_GIGABYTE_880GM),
+ 	{}
+ };
+ 
+@@ -18851,8 +18859,6 @@ static struct snd_pci_quirk alc662_cfg_t
+ 		      ALC662_3ST_6ch_DIG),
+ 	SND_PCI_QUIRK(0x1179, 0xff6e, "Toshiba NB20x", ALC662_AUTO),
+ 	SND_PCI_QUIRK(0x144d, 0xca00, "Samsung NC10", ALC272_SAMSUNG_NC10),
+-	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte 945GCM-S2L",
+-		      ALC662_3ST_6ch_DIG),
+ 	SND_PCI_QUIRK(0x152d, 0x2304, "Quanta WH1", ALC663_ASUS_H13),
+ 	SND_PCI_QUIRK(0x1565, 0x820f, "Biostar TA780G M2+", ALC662_3ST_6ch_DIG),
+ 	SND_PCI_QUIRK(0x1631, 0xc10c, "PB RS65", ALC663_ASUS_M51VA),
+@@ -19526,6 +19532,7 @@ enum {
+ 	ALC662_FIXUP_IDEAPAD,
+ 	ALC272_FIXUP_MARIO,
+ 	ALC662_FIXUP_CZC_P10T,
++	ALC662_FIXUP_GIGABYTE,
+ };
+ 
+ static const struct alc_fixup alc662_fixups[] = {
+@@ -19554,12 +19561,20 @@ static const struct alc_fixup alc662_fix
+ 			{}
+ 		}
+ 	},
++	[ALC662_FIXUP_GIGABYTE] = {
++		.type = ALC_FIXUP_PINS,
++		.v.pins = (const struct alc_pincfg[]) {
++			{ 0x14, 0x1114410 }, /* set as speaker */
++			{ }
++		}
++	},
+ };
+ 
+ static struct snd_pci_quirk alc662_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+ 	SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
+ 	SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
++	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", ALC662_FIXUP_GIGABYTE),
+ 	SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+ 	SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+ 	SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
+From 468c3f924f043cad7a04f4f4d5224a2c9bc886c1 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Sun, 13 Mar 2011 06:54:31 +0000
+Subject: NET: cdc-phonet, handle empty phonet header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 468c3f924f043cad7a04f4f4d5224a2c9bc886c1 upstream.
+
+Currently, for N 5800 XM I get:
+cdc_phonet: probe of 1-6:1.10 failed with error -22
+
+It's because phonet_header is empty. Extra altsetting looks like
+there:
+E 05 24 00 01 10 03 24 ab 05 24 06 0a 0b 04 24 fd  .$....$..$....$.
+E 00                                               .
+
+I don't see the header used anywhere so just check if the phonet
+descriptor is there, not the structure itself.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Cc: David S. Miller <davem@davemloft.net>
+Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/usb/cdc-phonet.c |    9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/usb/cdc-phonet.c
++++ b/drivers/net/usb/cdc-phonet.c
+@@ -328,13 +328,13 @@ int usbpn_probe(struct usb_interface *in
+ {
+ 	static const char ifname[] = "usbpn%d";
+ 	const struct usb_cdc_union_desc *union_header = NULL;
+-	const struct usb_cdc_header_desc *phonet_header = NULL;
+ 	const struct usb_host_interface *data_desc;
+ 	struct usb_interface *data_intf;
+ 	struct usb_device *usbdev = interface_to_usbdev(intf);
+ 	struct net_device *dev;
+ 	struct usbpn_dev *pnd;
+ 	u8 *data;
++	int phonet = 0;
+ 	int len, err;
+ 
+ 	data = intf->altsetting->extra;
+@@ -355,10 +355,7 @@ int usbpn_probe(struct usb_interface *in
+ 					(struct usb_cdc_union_desc *)data;
+ 				break;
+ 			case 0xAB:
+-				if (phonet_header || dlen < 5)
+-					break;
+-				phonet_header =
+-					(struct usb_cdc_header_desc *)data;
++				phonet = 1;
+ 				break;
+ 			}
+ 		}
+@@ -366,7 +363,7 @@ int usbpn_probe(struct usb_interface *in
+ 		len -= dlen;
+ 	}
+ 
+-	if (!union_header || !phonet_header)
++	if (!union_header || !phonet)
+ 		return -EINVAL;
+ 
+ 	data_intf = usb_ifnum_to_if(usbdev, union_header->bSlaveInterface0);
+From e938c287ea8d977e079f07464ac69923412663ce Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@novell.com>
+Date: Tue, 1 Mar 2011 14:28:02 +0000
+Subject: x86: Fix a bogus unwind annotation in lib/semaphore_32.S
+
+From: Jan Beulich <JBeulich@novell.com>
+
+commit e938c287ea8d977e079f07464ac69923412663ce upstream.
+
+'simple' would have required specifying current frame address
+and return address location manually, but that's obviously not
+the case (and not necessary) here.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+LKML-Reference: <4D6D1082020000780003454C@vpn.id2.novell.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/lib/semaphore_32.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/lib/semaphore_32.S
++++ b/arch/x86/lib/semaphore_32.S
+@@ -36,7 +36,7 @@
+  */
+ #ifdef CONFIG_SMP
+ ENTRY(__write_lock_failed)
+-	CFI_STARTPROC simple
++	CFI_STARTPROC
+ 	FRAME
+ 2: 	LOCK_PREFIX
+ 	addl	$ RW_LOCK_BIAS,(%eax)
+From b4a6b3436531f6c5256e6d60d388c3c28ff1a0e9 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Thu, 24 Feb 2011 15:33:24 -0500
+Subject: [IA64] tioca: Fix assignment from incompatible pointer warnings
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit b4a6b3436531f6c5256e6d60d388c3c28ff1a0e9 upstream.
+
+The prototype for sn_pci_provider->{dma_map,dma_map_consistent} expects
+an unsigned long instead of a u64.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/sn/pci/tioca_provider.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/ia64/sn/pci/tioca_provider.c
++++ b/arch/ia64/sn/pci/tioca_provider.c
+@@ -509,7 +509,7 @@ tioca_dma_unmap(struct pci_dev *pdev, dm
+  * use the GART mapped mode.
+  */
+ static u64
+-tioca_dma_map(struct pci_dev *pdev, u64 paddr, size_t byte_count, int dma_flags)
++tioca_dma_map(struct pci_dev *pdev, unsigned long paddr, size_t byte_count, int dma_flags)
+ {
+ 	u64 mapaddr;
+ 
+From c1d036c4d1cb00b7e8473a2ad0a78f13e13a8183 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Thu, 24 Feb 2011 17:23:09 -0500
+Subject: [IA64] mca.c: Fix cast from integer to pointer warning
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit c1d036c4d1cb00b7e8473a2ad0a78f13e13a8183 upstream.
+
+ia64_mca_cpu_init has a void *data local variable that is assigned
+the value from either __get_free_pages() or mca_bootmem(). The problem
+is that __get_free_pages returns an unsigned long and mca_bootmem, via
+alloc_bootmem(), returns a void *. format_mca_init_stack takes the void *,
+and it's also used with __pa(), but that casts it to long anyway.
+
+This results in the following build warning:
+
+arch/ia64/kernel/mca.c:1898: warning: assignment makes pointer from
+integer without a cast
+
+Cast the return of __get_free_pages to a void * to avoid
+the warning.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/kernel/mca.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/ia64/kernel/mca.c
++++ b/arch/ia64/kernel/mca.c
+@@ -1859,7 +1859,8 @@ ia64_mca_cpu_init(void *cpu_data)
+ 			data = mca_bootmem();
+ 			first_time = 0;
+ 		} else
+-			data = __get_free_pages(GFP_KERNEL, get_order(sz));
++			data = (void *)__get_free_pages(GFP_KERNEL,
++							get_order(sz));
+ 		if (!data)
+ 			panic("Could not allocate MCA memory for cpu %d\n",
+ 					cpu);
+From 95042f9eb78a8d9a17455e2ef263f2f310ecef15 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 12 Apr 2011 14:15:51 -0700
+Subject: vm: fix mlock() on stack guard page
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 95042f9eb78a8d9a17455e2ef263f2f310ecef15 upstream.
+
+Commit 53a7706d5ed8 ("mlock: do not hold mmap_sem for extended periods
+of time") changed mlock() to care about the exact number of pages that
+__get_user_pages() had brought it.  Before, it would only care about
+errors.
+
+And that doesn't work, because we also handled one page specially in
+__mlock_vma_pages_range(), namely the stack guard page.  So when that
+case was handled, the number of pages that the function returned was off
+by one.  In particular, it could be zero, and then the caller would end
+up not making any progress at all.
+
+Rather than try to fix up that off-by-one error for the mlock case
+specially, this just moves the logic to handle the stack guard page
+into__get_user_pages() itself, thus making all the counts come out
+right automatically.
+
+Reported-by: Robert Święcki <robert@swiecki.net>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ mm/memory.c |   26 ++++++++++++++++++--------
+ mm/mlock.c  |   13 -------------
+ 2 files changed, 18 insertions(+), 21 deletions(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1410,6 +1410,13 @@ no_page_table:
+ 	return page;
+ }
+ 
++static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
++{
++	return (vma->vm_flags & VM_GROWSDOWN) &&
++		(vma->vm_start == addr) &&
++		!vma_stack_continue(vma->vm_prev, addr);
++}
++
+ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ 		     unsigned long start, int nr_pages, unsigned int gup_flags,
+ 		     struct page **pages, struct vm_area_struct **vmas,
+@@ -1439,7 +1446,6 @@ int __get_user_pages(struct task_struct
+ 		vma = find_extend_vma(mm, start);
+ 		if (!vma && in_gate_area(tsk, start)) {
+ 			unsigned long pg = start & PAGE_MASK;
+-			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
+ 			pgd_t *pgd;
+ 			pud_t *pud;
+ 			pmd_t *pmd;
+@@ -1464,10 +1470,11 @@ int __get_user_pages(struct task_struct
+ 				pte_unmap(pte);
+ 				return i ? : -EFAULT;
+ 			}
++			vma = get_gate_vma(tsk);
+ 			if (pages) {
+ 				struct page *page;
+ 
+-				page = vm_normal_page(gate_vma, start, *pte);
++				page = vm_normal_page(vma, start, *pte);
+ 				if (!page) {
+ 					if (!(gup_flags & FOLL_DUMP) &&
+ 					     is_zero_pfn(pte_pfn(*pte)))
+@@ -1481,12 +1488,7 @@ int __get_user_pages(struct task_struct
+ 				get_page(page);
+ 			}
+ 			pte_unmap(pte);
+-			if (vmas)
+-				vmas[i] = gate_vma;
+-			i++;
+-			start += PAGE_SIZE;
+-			nr_pages--;
+-			continue;
++			goto next_page;
+ 		}
+ 
+ 		if (!vma ||
+@@ -1500,6 +1502,13 @@ int __get_user_pages(struct task_struct
+ 			continue;
+ 		}
+ 
++		/*
++		 * If we don't actually want the page itself,
++		 * and it's the stack guard page, just skip it.
++		 */
++		if (!pages && stack_guard_page(vma, start))
++			goto next_page;
++
+ 		do {
+ 			struct page *page;
+ 			unsigned int foll_flags = gup_flags;
+@@ -1569,6 +1578,7 @@ int __get_user_pages(struct task_struct
+ 				flush_anon_page(vma, page, start);
+ 				flush_dcache_page(page);
+ 			}
++next_page:
+ 			if (vmas)
+ 				vmas[i] = vma;
+ 			i++;
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -135,13 +135,6 @@ void munlock_vma_page(struct page *page)
+ 	}
+ }
+ 
+-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
+-{
+-	return (vma->vm_flags & VM_GROWSDOWN) &&
+-		(vma->vm_start == addr) &&
+-		!vma_stack_continue(vma->vm_prev, addr);
+-}
+-
+ /**
+  * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
+  * @vma:   target vma
+@@ -188,12 +181,6 @@ static long __mlock_vma_pages_range(stru
+ 	if (vma->vm_flags & VM_LOCKED)
+ 		gup_flags |= FOLL_MLOCK;
+ 
+-	/* We don't try to access the guard page of a stack vma */
+-	if (stack_guard_page(vma, start)) {
+-		addr += PAGE_SIZE;
+-		nr_pages--;
+-	}
+-
+ 	return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
+ 				NULL, NULL, nonblocking);
+ }
+From c88ac00c5af70c2a0741da14b22cdcf8507ddd92 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Date: Tue, 29 Mar 2011 09:45:21 +0300
+Subject: UBIFS: fix assertion warnings
+
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+
+commit c88ac00c5af70c2a0741da14b22cdcf8507ddd92 upstream.
+
+This patch fixes UBIFS assertion warnings like:
+
+UBIFS assert failed in ubifs_leb_unmap at 135 (pid 29365)
+Pid: 29365, comm: integck Tainted: G          I 2.6.37-ubi-2.6+ #34
+Call Trace:
+ [<ffffffffa047c663>] ubifs_lpt_init+0x95e/0x9ee [ubifs]
+ [<ffffffffa04623a7>] ubifs_remount_fs+0x2c7/0x762 [ubifs]
+ [<ffffffff810f066e>] do_remount_sb+0xb6/0x101
+ [<ffffffff81106ff4>] ? do_mount+0x191/0x78e
+ [<ffffffff811070bb>] do_mount+0x258/0x78e
+ [<ffffffff810da1e8>] ? alloc_pages_current+0xa2/0xc5
+ [<ffffffff81107674>] sys_mount+0x83/0xbd
+ [<ffffffff81009a12>] system_call_fastpath+0x16/0x1b
+
+They happen when we re-mount from R/O mode to R/W mode. While
+re-mounting, we write to the media, but we still have the c->ro_mount
+flag set. The fix is very simple - just clear the flag before
+starting re-mounting R/W.
+
+These warnings are caused by the following commit:
+2ef13294d29bcfb306e0d360f1b97f37b647b0c0
+
+For -stable guys: this bug was introduced in 2.6.38, this is materieal
+for 2.6.38-stable.
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/super.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1543,6 +1543,7 @@ static int ubifs_remount_rw(struct ubifs
+ 	mutex_lock(&c->umount_mutex);
+ 	dbg_save_space_info(c);
+ 	c->remounting_rw = 1;
++	c->ro_mount = 0;
+ 	c->always_chk_crc = 1;
+ 
+ 	err = check_free_space(c);
+@@ -1648,7 +1649,6 @@ static int ubifs_remount_rw(struct ubifs
+ 	}
+ 
+ 	dbg_gen("re-mounted read-write");
+-	c->ro_mount = 0;
+ 	c->remounting_rw = 0;
+ 	c->always_chk_crc = 0;
+ 	err = dbg_check_space_info(c);
+@@ -1656,6 +1656,7 @@ static int ubifs_remount_rw(struct ubifs
+ 	return err;
+ 
+ out:
++	c->ro_mount = 1;
+ 	vfree(c->orph_buf);
+ 	c->orph_buf = NULL;
+ 	if (c->bgt) {
+From ab711fe08297de1485fff0a366e6db8828cafd6a Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Thu, 31 Mar 2011 10:29:26 +0200
+Subject: perf: Fix task context scheduling
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit ab711fe08297de1485fff0a366e6db8828cafd6a upstream.
+
+Jiri reported:
+
+ |
+ | - once an event is created by sys_perf_event_open, task context
+ |   is created and it stays even if the event is closed, until the
+ |   task is finished ... thats what I see in code and I assume it's
+ |   correct
+ |
+ | - when the task opens event, perf_sched_events jump label is
+ |   incremented and following callbacks are started from scheduler
+ |
+ |         __perf_event_task_sched_in
+ |         __perf_event_task_sched_out
+ |
+ |   These callback *in/out set/unset cpuctx->task_ctx value to the
+ |   task context.
+ |
+ | - close is called on event on CPU 0:
+ |         - the task is scheduled on CPU 0
+ |         - __perf_event_task_sched_in is called
+ |         - cpuctx->task_ctx is set
+ |         - perf_sched_events jump label is decremented and == 0
+ |         - __perf_event_task_sched_out is not called
+ |         - cpuctx->task_ctx on CPU 0 stays set
+ |
+ | - exit is called on CPU 1:
+ |         - the task is scheduled on CPU 1
+ |         - perf_event_exit_task is called
+ |         - task_ctx_sched_out unsets cpuctx->task_ctx on CPU 1
+ |         - put_ctx destroys the context
+ |
+ | - another call of perf_rotate_context on CPU 0 will use invalid
+ |   task_ctx pointer, and eventualy panic.
+ |
+
+Cure this the simplest possibly way by partially reverting the
+jump_label optimization for the sched_out case.
+
+Reported-and-tested-by: Jiri Olsa <jolsa@redhat.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Oleg Nesterov <oleg@redhat.com>
+LKML-Reference: <1301520405.4859.213.camel@twins>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/perf_event.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -1052,7 +1052,7 @@ void perf_event_task_sched_out(struct ta
+ {
+ 	perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 1, NULL, 0);
+ 
+-	COND_STMT(&perf_task_events, __perf_event_task_sched_out(task, next));
++	__perf_event_task_sched_out(task, next);
+ }
+ 
+ extern void perf_event_mmap(struct vm_area_struct *vma);
+From 30ae9139dc3b44d14a56fbbc2a3f8f63aa586a17 Mon Sep 17 00:00:00 2001
+From: Linus Lüssing <linus.luessing@web.de>
+Date: Tue, 22 Mar 2011 11:40:32 +0000
+Subject: bridge: Fix possibly wrong MLD queries' ethernet source address
+
+
+From: Linus Lüssing <linus.luessing@web.de>
+
+[ Upstream commit a7bff75b087e7a355838a32efe61707cfa73c194 ]
+
+The ipv6_dev_get_saddr() is currently called with an uninitialized
+destination address. Although in tests it usually seemed to nevertheless
+always fetch the right source address, there seems to be a possible race
+condition.
+
+Therefore this commit changes this, first setting the destination
+address and only after that fetching the source address.
+
+Reported-by: Jan Beulich <JBeulich@novell.com>
+Signed-off-by: Linus Lüssing <linus.luessing@web.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_multicast.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -445,9 +445,9 @@ static struct sk_buff *br_ip6_multicast_
+ 	ip6h->payload_len = htons(8 + sizeof(*mldq));
+ 	ip6h->nexthdr = IPPROTO_HOPOPTS;
+ 	ip6h->hop_limit = 1;
++	ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
+ 	ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+ 			   &ip6h->saddr);
+-	ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
+ 	ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
+ 
+ 	hopopt = (u8 *)(ip6h + 1);
+From 228f4d04e7d7a239b4c44e6f329aaec88f40e54a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 30 Mar 2011 16:57:46 -0700
+Subject: fib: add rtnl locking in ip_fib_net_exit
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit e2666f84958adb3a034b98e99699b55705117e01 ]
+
+Daniel J Blueman reported a lockdep splat in trie_firstleaf(), caused by
+RTNL being not locked before a call to fib_table_flush()
+
+Reported-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/fib_frontend.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1041,6 +1041,7 @@ static void ip_fib_net_exit(struct net *
+ 	fib4_rules_exit(net);
+ #endif
+ 
++	rtnl_lock();
+ 	for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
+ 		struct fib_table *tb;
+ 		struct hlist_head *head;
+@@ -1053,6 +1054,7 @@ static void ip_fib_net_exit(struct net *
+ 			fib_free_table(tb);
+ 		}
+ 	}
++	rtnl_unlock();
+ 	kfree(net->ipv4.fib_table_hash);
+ }
+ 
+From 4dbd99fd8453ae681dad8fc1e7aa2c05e16b0cc1 Mon Sep 17 00:00:00 2001
+From: Alex Dubov <oakad@yahoo.com>
+Date: Wed, 16 Mar 2011 17:57:13 +0000
+Subject: gianfar: Fall back to software tcp/udp checksum on older controllers
+
+
+From: Alex Dubov <oakad@yahoo.com>
+
+[ Upstream commit 4363c2fddb1399b728ef21ee8101c148a311ea45 ]
+
+As specified by errata eTSEC49 of MPC8548 and errata eTSEC12 of MPC83xx,
+older revisions of gianfar controllers will be unable to calculate a TCP/UDP
+packet checksum for some alignments of the appropriate FCB. This patch checks
+for FCB alignment on such controllers and falls back to software checksumming
+if the alignment is known to be bad.
+
+Signed-off-by: Alex Dubov <oakad@yahoo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/gianfar.c |   16 ++++++++++++++--
+ drivers/net/gianfar.h |    1 +
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/gianfar.c
++++ b/drivers/net/gianfar.c
+@@ -950,6 +950,11 @@ static void gfar_detect_errata(struct gf
+ 			(pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
+ 		priv->errata |= GFAR_ERRATA_A002;
+ 
++	/* MPC8313 Rev < 2.0, MPC8548 rev 2.0 */
++	if ((pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020) ||
++			(pvr == 0x80210020 && mod == 0x8030 && rev == 0x0020))
++		priv->errata |= GFAR_ERRATA_12;
++
+ 	if (priv->errata)
+ 		dev_info(dev, "enabled errata workarounds, flags: 0x%x\n",
+ 			 priv->errata);
+@@ -2156,8 +2161,15 @@ static int gfar_start_xmit(struct sk_buf
+ 	/* Set up checksumming */
+ 	if (CHECKSUM_PARTIAL == skb->ip_summed) {
+ 		fcb = gfar_add_fcb(skb);
+-		lstatus |= BD_LFLAG(TXBD_TOE);
+-		gfar_tx_checksum(skb, fcb);
++		/* as specified by errata */
++		if (unlikely(gfar_has_errata(priv, GFAR_ERRATA_12)
++			     && ((unsigned long)fcb % 0x20) > 0x18)) {
++			__skb_pull(skb, GMAC_FCB_LEN);
++			skb_checksum_help(skb);
++		} else {
++			lstatus |= BD_LFLAG(TXBD_TOE);
++			gfar_tx_checksum(skb, fcb);
++		}
+ 	}
+ 
+ 	if (vlan_tx_tag_present(skb)) {
+--- a/drivers/net/gianfar.h
++++ b/drivers/net/gianfar.h
+@@ -1039,6 +1039,7 @@ enum gfar_errata {
+ 	GFAR_ERRATA_74		= 0x01,
+ 	GFAR_ERRATA_76		= 0x02,
+ 	GFAR_ERRATA_A002	= 0x04,
++	GFAR_ERRATA_12		= 0x08, /* a.k.a errata eTSEC49 */
+ };
+ 
+ /* Struct stolen almost completely (and shamelessly) from the FCC enet source
+From 2f288c99c4ba53a7ddbb5a7a77e42ae72d6da3b9 Mon Sep 17 00:00:00 2001
+From: James Chapman <jchapman@katalix.com>
+Date: Mon, 21 Mar 2011 18:10:25 -0700
+Subject: l2tp: fix possible oops on l2tp_eth module unload
+
+
+From: James Chapman <jchapman@katalix.com>
+
+[ Upstream commit 8aa525a9340da4227797a06221ca08399006635f ]
+
+A struct used in the l2tp_eth driver for registering network namespace
+ops was incorrectly marked as __net_initdata, leading to oops when
+module unloaded.
+
+BUG: unable to handle kernel paging request at ffffffffa00ec098
+IP: [<ffffffff8123dbd8>] ops_exit_list+0x7/0x4b
+PGD 142d067 PUD 1431063 PMD 195da8067 PTE 0
+Oops: 0000 [#1] SMP
+last sysfs file: /sys/module/l2tp_eth/refcnt
+Call Trace:
+ [<ffffffff8123dc94>] ? unregister_pernet_operations+0x32/0x93
+ [<ffffffff8123dd20>] ? unregister_pernet_device+0x2b/0x38
+ [<ffffffff81068b6e>] ? sys_delete_module+0x1b8/0x222
+ [<ffffffff810c7300>] ? do_munmap+0x254/0x318
+ [<ffffffff812c64e5>] ? page_fault+0x25/0x30
+ [<ffffffff812c6952>] ? system_call_fastpath+0x16/0x1b
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/l2tp/l2tp_eth.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/l2tp/l2tp_eth.c
++++ b/net/l2tp/l2tp_eth.c
+@@ -283,7 +283,7 @@ static __net_init int l2tp_eth_init_net(
+ 	return 0;
+ }
+ 
+-static __net_initdata struct pernet_operations l2tp_eth_net_ops = {
++static struct pernet_operations l2tp_eth_net_ops = {
+ 	.init = l2tp_eth_init_net,
+ 	.id   = &l2tp_eth_net_id,
+ 	.size = sizeof(struct l2tp_eth_net),
+From c751cf0998164651824e1f68d124110d448d5ec3 Mon Sep 17 00:00:00 2001
+From: Eric W. Biederman <ebiederm@aristanetworks.com>
+Date: Mon, 21 Mar 2011 18:23:34 -0700
+Subject: net ipv6: Fix duplicate /proc/sys/net/ipv6/neigh directory entries.
+
+
+From: Eric W. Biederman <ebiederm@aristanetworks.com>
+
+[ Upstream commit 9d2a8fa96a44ba242de3a6f56acaef7a40a97b97 ]
+
+When I was fixing issues with unregisgtering tables under /proc/sys/net/ipv6/neigh
+by adding a mount point it appears I missed a critical ordering issue, in the
+ipv6 initialization.  I had not realized that ipv6_sysctl_register is called
+at the very end of the ipv6 initialization and in particular after we call
+neigh_sysctl_register from ndisc_init.
+
+"neigh" needs to be initialized in ipv6_static_sysctl_register which is
+the first ipv6 table to initialized, and definitely before ndisc_init.
+This removes the weirdness of duplicate tables while still providing a
+"neigh" mount point which prevents races in sysctl unregistering.
+
+This was initially reported at https://bugzilla.kernel.org/show_bug.cgi?id=31232
+Reported-by: sunkan@zappa.cx
+Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv6/sysctl_net_ipv6.c |   18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/net/ipv6/sysctl_net_ipv6.c
++++ b/net/ipv6/sysctl_net_ipv6.c
+@@ -17,6 +17,16 @@
+ 
+ static struct ctl_table empty[1];
+ 
++static ctl_table ipv6_static_skeleton[] = {
++	{
++		.procname	= "neigh",
++		.maxlen		= 0,
++		.mode		= 0555,
++		.child		= empty,
++	},
++	{ }
++};
++
+ static ctl_table ipv6_table_template[] = {
+ 	{
+ 		.procname	= "route",
+@@ -37,12 +47,6 @@ static ctl_table ipv6_table_template[] =
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
+-	{
+-		.procname	= "neigh",
+-		.maxlen		= 0,
+-		.mode		= 0555,
+-		.child		= empty,
+-	},
+ 	{ }
+ };
+ 
+@@ -160,7 +164,7 @@ static struct ctl_table_header *ip6_base
+ 
+ int ipv6_static_sysctl_register(void)
+ {
+-	ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
++	ip6_base = register_sysctl_paths(net_ipv6_ctl_path, ipv6_static_skeleton);
+ 	if (ip6_base == NULL)
+ 		return -ENOMEM;
+ 	return 0;
+From f041eaa28a108f73cf02e7059cf0616dfd43b232 Mon Sep 17 00:00:00 2001
+From: Dan Siemon <dan@coverfire.com>
+Date: Tue, 15 Mar 2011 13:56:07 +0000
+Subject: net_sched: fix ip_tos2prio
+
+
+From: Dan Siemon <dan@coverfire.com>
+
+[ Upstream commit 4a2b9c3756077c05dd8666e458a751d2248b61b6 ]
+
+ECN support incorrectly maps ECN BESTEFFORT packets to TC_PRIO_FILLER
+(1) instead of TC_PRIO_BESTEFFORT (0)
+
+This means ECN enabled flows are placed in pfifo_fast/prio low priority
+band, giving ECN enabled flows [ECT(0) and CE codepoints] higher drop
+probabilities.
+
+This is rather unfortunate, given we would like ECN being more widely
+used.
+
+Ref : http://www.coverfire.com/archives/2011/03/13/pfifo_fast-and-ecn/
+
+Signed-off-by: Dan Siemon <dan@coverfire.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Dave Täht <d@taht.net>
+Cc: Jonathan Morton <chromatix99@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/route.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -171,7 +171,7 @@ static struct dst_ops ipv4_dst_ops = {
+ 
+ const __u8 ip_tos2prio[16] = {
+ 	TC_PRIO_BESTEFFORT,
+-	ECN_OR_COST(FILLER),
++	ECN_OR_COST(BESTEFFORT),
+ 	TC_PRIO_BESTEFFORT,
+ 	ECN_OR_COST(BESTEFFORT),
+ 	TC_PRIO_BULK,
+From 1a3ea69b2cb514439d4a5f6cabac89a845204f1b Mon Sep 17 00:00:00 2001
+From: Ulrich Weber <uweber@astaro.com>
+Date: Wed, 6 Apr 2011 14:04:49 -0700
+Subject: pppoe: drop PPPOX_ZOMBIEs in pppoe_flush_dev
+
+
+From: Ulrich Weber <uweber@astaro.com>
+
+[ Upstream commit ae07b0b221b6ab2edf9e3abd518aec6cd3f1ba66 ]
+
+otherwise we loop forever if a PPPoE socket was set
+to PPPOX_ZOMBIE state by a PADT message when the
+ethernet device is going down afterwards.
+
+Signed-off-by: Ulrich Weber <uweber@astaro.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/pppoe.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/pppoe.c
++++ b/drivers/net/pppoe.c
+@@ -317,7 +317,7 @@ static void pppoe_flush_dev(struct net_d
+ 			lock_sock(sk);
+ 
+ 			if (po->pppoe_dev == dev &&
+-			    sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
++			    sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+ 				pppox_unbind_sock(sk);
+ 				sk->sk_state = PPPOX_ZOMBIE;
+ 				sk->sk_state_change(sk);
+From b51d6615ff5f9fc7c55727740b565b4eeafb7c4c Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 30 Mar 2011 17:51:36 -0700
+Subject: sctp: Pass __GFP_NOWARN to hash table allocation attempts.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit a84b50ceb7d640437d0dc28a2bef0d0de054de89 ]
+
+Like DCCP and other similar pieces of code, there are mechanisms
+here to try allocating smaller hash tables if the allocation
+fails.  So pass in __GFP_NOWARN like the others do instead of
+emitting a scary message.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/sctp/protocol.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -1204,7 +1204,7 @@ SCTP_STATIC __init int sctp_init(void)
+ 		if ((sctp_assoc_hashsize > (64 * 1024)) && order > 0)
+ 			continue;
+ 		sctp_assoc_hashtable = (struct sctp_hashbucket *)
+-					__get_free_pages(GFP_ATOMIC, order);
++			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order);
+ 	} while (!sctp_assoc_hashtable && --order > 0);
+ 	if (!sctp_assoc_hashtable) {
+ 		pr_err("Failed association hash alloc\n");
+@@ -1237,7 +1237,7 @@ SCTP_STATIC __init int sctp_init(void)
+ 		if ((sctp_port_hashsize > (64 * 1024)) && order > 0)
+ 			continue;
+ 		sctp_port_hashtable = (struct sctp_bind_hashbucket *)
+-					__get_free_pages(GFP_ATOMIC, order);
++			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order);
+ 	} while (!sctp_port_hashtable && --order > 0);
+ 	if (!sctp_port_hashtable) {
+ 		pr_err("Failed bind hash alloc\n");
+From bd59e4b2b325a4f0fcd491a8ec55a619fef91ded Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Mon, 14 Mar 2011 10:57:03 +0000
+Subject: tcp: avoid cwnd moderation in undo
+
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit 67d4120a1793138bc9f4a6eb61d0fc5298ed97e0 ]
+
+In the current undo logic, cwnd is moderated after it was restored
+to the value prior entering fast-recovery. It was moderated first
+in tcp_try_undo_recovery then again in tcp_complete_cwr.
+
+Since the undo indicates recovery was false, these moderations
+are not necessary. If the undo is triggered when most of the
+outstanding data have been acknowledged, the (restored) cwnd is
+falsely pulled down to a small value.
+
+This patch removes these cwnd moderations if cwnd is undone
+  a) during fast-recovery
+	b) by receiving DSACKs past fast-recovery
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_input.c |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2659,7 +2659,7 @@ static void DBGUNDO(struct sock *sk, con
+ #define DBGUNDO(x...) do { } while (0)
+ #endif
+ 
+-static void tcp_undo_cwr(struct sock *sk, const int undo)
++static void tcp_undo_cwr(struct sock *sk, const int undo_ssthresh)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 
+@@ -2671,14 +2671,13 @@ static void tcp_undo_cwr(struct sock *sk
+ 		else
+ 			tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh << 1);
+ 
+-		if (undo && tp->prior_ssthresh > tp->snd_ssthresh) {
++		if (undo_ssthresh && tp->prior_ssthresh > tp->snd_ssthresh) {
+ 			tp->snd_ssthresh = tp->prior_ssthresh;
+ 			TCP_ECN_withdraw_cwr(tp);
+ 		}
+ 	} else {
+ 		tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh);
+ 	}
+-	tcp_moderate_cwnd(tp);
+ 	tp->snd_cwnd_stamp = tcp_time_stamp;
+ }
+ 
+@@ -2822,8 +2821,11 @@ static int tcp_try_undo_loss(struct sock
+ static inline void tcp_complete_cwr(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+-	tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+-	tp->snd_cwnd_stamp = tcp_time_stamp;
++	/* Do not moderate cwnd if it's already undone in cwr or recovery */
++	if (tp->undo_marker && tp->snd_cwnd > tp->snd_ssthresh) {
++		tp->snd_cwnd = tp->snd_ssthresh;
++		tp->snd_cwnd_stamp = tcp_time_stamp;
++	}
+ 	tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
+ }
+ 
+From 6677647340a5d58b48b792af078701f4068be4b4 Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Tue, 15 Mar 2011 21:12:49 +0000
+Subject: xfrm: Refcount destination entry on xfrm_lookup
+
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+[ Upstream commit fbd5060875d25f7764fd1c3d35b83a8ed1d88d7b ]
+
+We return a destination entry without refcount if a socket
+policy is found in xfrm_lookup. This triggers a warning on
+a negative refcount when freeeing this dst entry. So take
+a refcount in this case to fix it.
+
+This refcount was forgotten when xfrm changed to cache bundles
+instead of policies for outgoing flows.
+
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Acked-by: Timo Teräs <timo.teras@iki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_policy.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1778,6 +1778,8 @@ restart:
+ 				goto no_transform;
+ 			}
+ 
++			dst_hold(&xdst->u.dst);
++
+ 			spin_lock_bh(&xfrm_policy_sk_bundle_lock);
+ 			xdst->u.dst.next = xfrm_policy_sk_bundles;
+ 			xfrm_policy_sk_bundles = &xdst->u.dst;
+From c0fd11cf45228241f8b3fb42020b1c9493dcdac7 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 18 Mar 2011 00:27:27 +0000
+Subject: vlan: should take into account needed_headroom
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit d870bfb9d366c5d466c0f5419a4ec95a3f71ea8a ]
+
+Commit c95b819ad7 (gre: Use needed_headroom)
+made gre use needed_headroom instead of hard_header_len
+
+This uncover a bug in vlan code.
+
+We should make sure vlan devices take into account their
+real_dev->needed_headroom or we risk a crash in ipgre_header(), because
+we dont have enough room to push IP header in skb.
+
+Reported-by: Diddi Oscarsson <diddi@diddi.se>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Patrick McHardy <kaber@trash.net>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/8021q/vlan_dev.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -707,6 +707,7 @@ static int vlan_dev_init(struct net_devi
+ 	dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid;
+ #endif
+ 
++	dev->needed_headroom = real_dev->needed_headroom;
+ 	if (real_dev->features & NETIF_F_HW_VLAN_TX) {
+ 		dev->header_ops      = real_dev->header_ops;
+ 		dev->hard_header_len = real_dev->hard_header_len;
+From 0589d1f7a527e5f4c4c6d16b734cfed4e3608f1c Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Fri, 18 Mar 2011 05:27:28 +0000
+Subject: bridge: Reset IPCB when entering IP stack on NF_FORWARD
+
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e ]
+
+Whenever we enter the IP stack proper from bridge netfilter we
+need to ensure that the skb is in a form the IP stack expects
+it to be in.
+
+The entry point on NF_FORWARD did not meet the requirements of
+the IP stack, therefore leading to potential crashes/panics.
+
+This patch fixes the problem.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_netfilter.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -741,6 +741,9 @@ static unsigned int br_nf_forward_ip(uns
+ 		nf_bridge->mask |= BRNF_PKT_TYPE;
+ 	}
+ 
++	if (br_parse_ip_options(skb))
++		return NF_DROP;
++
+ 	/* The physdev module checks on this */
+ 	nf_bridge->mask |= BRNF_BRIDGED;
+ 	nf_bridge->physoutdev = skb->dev;
+From 919a6006d36ab51a70ca5d80e192cba953c874cb Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 9 Mar 2011 12:54:27 -0800
+Subject: sparc: Fix .size directive for do_int_load
+
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit 35043c428f1fcb92feb5792f5878a8852ee00771 ]
+
+gas used to accept (and ignore?) .size directives which referred to
+undefined symbols, as this does.  In binutils 2.21 these are treated
+as errors.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/una_asm_64.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/una_asm_64.S
++++ b/arch/sparc/kernel/una_asm_64.S
+@@ -127,7 +127,7 @@ do_int_load:
+ 	wr	%o5, 0x0, %asi
+ 	retl
+ 	 mov	0, %o0
+-	.size	__do_int_load, .-__do_int_load
++	.size	do_int_load, .-do_int_load
+ 
+ 	.section	__ex_table,"a"
+ 	.word		4b, __retl_efault
+From c90b2d78650ae1ec6db90f07533e0382fa63acad Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 9 Mar 2011 13:00:47 -0800
+Subject: sparc32: Fix might-be-used-uninitialized warning in do_sparc_fault().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c816be7b5f24585baa9eba1f2413935f771d6ad6 ]
+
+When we try to handle vmalloc faults, we can take a code
+path which uses "code" before we actually set it.
+
+Amusingly gcc-3.3 notices this yet gcc-4.x does not.
+
+Reported-by: Bob Breuer <breuerr@mc.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/mm/fault_32.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/sparc/mm/fault_32.c
++++ b/arch/sparc/mm/fault_32.c
+@@ -240,11 +240,10 @@ asmlinkage void do_sparc_fault(struct pt
+ 	 * only copy the information from the master page table,
+ 	 * nothing more.
+ 	 */
++	code = SEGV_MAPERR;
+ 	if (!ARCH_SUN4C && address >= TASK_SIZE)
+ 		goto vmalloc_fault;
+ 
+-	code = SEGV_MAPERR;
+-
+ 	/*
+ 	 * If we're in an interrupt or have no user
+ 	 * context, we must not take the fault..
+From d4f295b7863f094b4d76ce10cb99f4617b5d00ad Mon Sep 17 00:00:00 2001
+From: Tkhai Kirill <tkhai@yandex.ru>
+Date: Thu, 31 Mar 2011 00:52:38 -0700
+Subject: sparc32: Pass task_struct to schedule_tail() in ret_from_fork
+
+
+From: Tkhai Kirill <tkhai@yandex.ru>
+
+[ Upstream commit 47c7c97a93a5b8f719093dbf83555090b3b8228b ]
+
+We have to pass task_struct of previous process to function
+schedule_tail(). Currently in ret_from_fork previous thread_info
+is passed:
+
+switch_to: mov %g6, %g3 /* previous thread_info in g6 */
+
+ret_from_fork: call    schedule_tail
+                mov    %g3, %o0 /* previous thread_info is passed */
+
+void schedule_tail(struct task_struct *prev);
+
+Signed-off-by: Tkhai Kirill <tkhai@yandex.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/entry.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/entry.S
++++ b/arch/sparc/kernel/entry.S
+@@ -1283,7 +1283,7 @@ linux_syscall_trace:
+ 	.globl	ret_from_fork
+ ret_from_fork:
+ 	call	schedule_tail
+-	 mov	%g3, %o0
++	 ld	[%g3 + TI_TASK], %o0
+ 	b	ret_sys_call
+ 	 ld	[%sp + STACKFRAME_SZ + PT_I0], %o0
+ 
+From 9567fc1bffdb332f7254c9bd2a913c80a6e18e16 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Sat, 26 Feb 2011 23:40:02 -0800
+Subject: sparc64: Fix build errors with gcc-4.6.0
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c6fee0810df4e0f4cf9c4834d2569ca01c02cffc ]
+
+Most of the warnings emitted (we fail arch/sparc file
+builds with -Werror) were legitimate but harmless, however
+one case (n2_pcr_write) was a genuine bug.
+
+Based almost entirely upon a patch by Sam Ravnborg.
+
+Reported-by: Dennis Gilmore <dennis@ausil.us>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/iommu.c      |    3 ---
+ arch/sparc/kernel/ldc.c        |   28 ++++++++++++++++++----------
+ arch/sparc/kernel/pci.c        |    1 +
+ arch/sparc/kernel/pci_common.c |   11 +++++++----
+ arch/sparc/kernel/pci_fire.c   |    2 --
+ arch/sparc/kernel/pci_schizo.c |    4 +---
+ arch/sparc/kernel/pci_sun4v.c  |    3 +--
+ arch/sparc/kernel/pcr.c        |    2 +-
+ arch/sparc/kernel/ptrace_64.c  |    3 ++-
+ arch/sparc/kernel/smp_64.c     |   11 ++++-------
+ arch/sparc/kernel/traps_64.c   |    3 +--
+ 11 files changed, 36 insertions(+), 35 deletions(-)
+
+--- a/arch/sparc/kernel/iommu.c
++++ b/arch/sparc/kernel/iommu.c
+@@ -333,13 +333,10 @@ static void dma_4u_free_coherent(struct
+ 				 void *cpu, dma_addr_t dvma)
+ {
+ 	struct iommu *iommu;
+-	iopte_t *iopte;
+ 	unsigned long flags, order, npages;
+ 
+ 	npages = IO_PAGE_ALIGN(size) >> IO_PAGE_SHIFT;
+ 	iommu = dev->archdata.iommu;
+-	iopte = iommu->page_table +
+-		((dvma - iommu->page_table_map_base) >> IO_PAGE_SHIFT);
+ 
+ 	spin_lock_irqsave(&iommu->lock, flags);
+ 
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -790,16 +790,20 @@ static void send_events(struct ldc_chann
+ static irqreturn_t ldc_rx(int irq, void *dev_id)
+ {
+ 	struct ldc_channel *lp = dev_id;
+-	unsigned long orig_state, hv_err, flags;
++	unsigned long orig_state, flags;
+ 	unsigned int event_mask;
+ 
+ 	spin_lock_irqsave(&lp->lock, flags);
+ 
+ 	orig_state = lp->chan_state;
+-	hv_err = sun4v_ldc_rx_get_state(lp->id,
+-					&lp->rx_head,
+-					&lp->rx_tail,
+-					&lp->chan_state);
++
++	/* We should probably check for hypervisor errors here and
++	 * reset the LDC channel if we get one.
++	 */
++	sun4v_ldc_rx_get_state(lp->id,
++			       &lp->rx_head,
++			       &lp->rx_tail,
++			       &lp->chan_state);
+ 
+ 	ldcdbg(RX, "RX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n",
+ 	       orig_state, lp->chan_state, lp->rx_head, lp->rx_tail);
+@@ -904,16 +908,20 @@ out:
+ static irqreturn_t ldc_tx(int irq, void *dev_id)
+ {
+ 	struct ldc_channel *lp = dev_id;
+-	unsigned long flags, hv_err, orig_state;
++	unsigned long flags, orig_state;
+ 	unsigned int event_mask = 0;
+ 
+ 	spin_lock_irqsave(&lp->lock, flags);
+ 
+ 	orig_state = lp->chan_state;
+-	hv_err = sun4v_ldc_tx_get_state(lp->id,
+-					&lp->tx_head,
+-					&lp->tx_tail,
+-					&lp->chan_state);
++
++	/* We should probably check for hypervisor errors here and
++	 * reset the LDC channel if we get one.
++	 */
++	sun4v_ldc_tx_get_state(lp->id,
++			       &lp->tx_head,
++			       &lp->tx_tail,
++			       &lp->chan_state);
+ 
+ 	ldcdbg(TX, " TX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n",
+ 	       orig_state, lp->chan_state, lp->tx_head, lp->tx_tail);
+--- a/arch/sparc/kernel/pci.c
++++ b/arch/sparc/kernel/pci.c
+@@ -675,6 +675,7 @@ static void __devinit pci_bus_register_o
+ 		 * humanoid.
+ 		 */
+ 		err = sysfs_create_file(&dev->dev.kobj, &dev_attr_obppath.attr);
++		(void) err;
+ 	}
+ 	list_for_each_entry(child_bus, &bus->children, node)
+ 		pci_bus_register_of_sysfs(child_bus);
+--- a/arch/sparc/kernel/pci_common.c
++++ b/arch/sparc/kernel/pci_common.c
+@@ -295,14 +295,17 @@ static int sun4v_write_pci_cfg(struct pc
+ 	unsigned int bus = bus_dev->number;
+ 	unsigned int device = PCI_SLOT(devfn);
+ 	unsigned int func = PCI_FUNC(devfn);
+-	unsigned long ret;
+ 
+ 	if (config_out_of_range(pbm, bus, devfn, where)) {
+ 		/* Do nothing. */
+ 	} else {
+-		ret = pci_sun4v_config_put(devhandle,
+-				HV_PCI_DEVICE_BUILD(bus, device, func),
+-				where, size, value);
++		/* We don't check for hypervisor errors here, but perhaps
++		 * we should and influence our return value depending upon
++		 * what kind of error is thrown.
++		 */
++		pci_sun4v_config_put(devhandle,
++				     HV_PCI_DEVICE_BUILD(bus, device, func),
++				     where, size, value);
+ 	}
+ 	return PCIBIOS_SUCCESSFUL;
+ }
+--- a/arch/sparc/kernel/pci_fire.c
++++ b/arch/sparc/kernel/pci_fire.c
+@@ -214,11 +214,9 @@ static int pci_fire_msi_setup(struct pci
+ 
+ static int pci_fire_msi_teardown(struct pci_pbm_info *pbm, unsigned long msi)
+ {
+-	unsigned long msiqid;
+ 	u64 val;
+ 
+ 	val = upa_readq(pbm->pbm_regs + MSI_MAP(msi));
+-	msiqid = (val & MSI_MAP_EQNUM);
+ 
+ 	val &= ~MSI_MAP_VALID;
+ 
+--- a/arch/sparc/kernel/pci_schizo.c
++++ b/arch/sparc/kernel/pci_schizo.c
+@@ -1313,7 +1313,7 @@ static int __devinit schizo_pbm_init(str
+ 	const struct linux_prom64_registers *regs;
+ 	struct device_node *dp = op->dev.of_node;
+ 	const char *chipset_name;
+-	int is_pbm_a, err;
++	int err;
+ 
+ 	switch (chip_type) {
+ 	case PBM_CHIP_TYPE_TOMATILLO:
+@@ -1343,8 +1343,6 @@ static int __devinit schizo_pbm_init(str
+ 	 */
+ 	regs = of_get_property(dp, "reg", NULL);
+ 
+-	is_pbm_a = ((regs[0].phys_addr & 0x00700000) == 0x00600000);
+-
+ 	pbm->next = pci_pbm_root;
+ 	pci_pbm_root = pbm;
+ 
+--- a/arch/sparc/kernel/pci_sun4v.c
++++ b/arch/sparc/kernel/pci_sun4v.c
+@@ -580,7 +580,7 @@ static int __devinit pci_sun4v_iommu_ini
+ {
+ 	static const u32 vdma_default[] = { 0x80000000, 0x80000000 };
+ 	struct iommu *iommu = pbm->iommu;
+-	unsigned long num_tsb_entries, sz, tsbsize;
++	unsigned long num_tsb_entries, sz;
+ 	u32 dma_mask, dma_offset;
+ 	const u32 *vdma;
+ 
+@@ -596,7 +596,6 @@ static int __devinit pci_sun4v_iommu_ini
+ 
+ 	dma_mask = (roundup_pow_of_two(vdma[1]) - 1UL);
+ 	num_tsb_entries = vdma[1] / IO_PAGE_SIZE;
+-	tsbsize = num_tsb_entries * sizeof(iopte_t);
+ 
+ 	dma_offset = vdma[0];
+ 
+--- a/arch/sparc/kernel/pcr.c
++++ b/arch/sparc/kernel/pcr.c
+@@ -81,7 +81,7 @@ static void n2_pcr_write(u64 val)
+ 	unsigned long ret;
+ 
+ 	ret = sun4v_niagara2_setperf(HV_N2_PERF_SPARC_CTL, val);
+-	if (val != HV_EOK)
++	if (ret != HV_EOK)
+ 		write_pcr(val);
+ }
+ 
+--- a/arch/sparc/kernel/ptrace_64.c
++++ b/arch/sparc/kernel/ptrace_64.c
+@@ -1086,6 +1086,7 @@ asmlinkage int syscall_trace_enter(struc
+ 
+ asmlinkage void syscall_trace_leave(struct pt_regs *regs)
+ {
++#ifdef CONFIG_AUDITSYSCALL
+ 	if (unlikely(current->audit_context)) {
+ 		unsigned long tstate = regs->tstate;
+ 		int result = AUDITSC_SUCCESS;
+@@ -1095,7 +1096,7 @@ asmlinkage void syscall_trace_leave(stru
+ 
+ 		audit_syscall_exit(result, regs->u_regs[UREG_I0]);
+ 	}
+-
++#endif
+ 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
+ 		trace_sys_exit(regs, regs->u_regs[UREG_G1]);
+ 
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -189,7 +189,7 @@ static inline long get_delta (long *rt,
+ void smp_synchronize_tick_client(void)
+ {
+ 	long i, delta, adj, adjust_latency = 0, done = 0;
+-	unsigned long flags, rt, master_time_stamp, bound;
++	unsigned long flags, rt, master_time_stamp;
+ #if DEBUG_TICK_SYNC
+ 	struct {
+ 		long rt;	/* roundtrip time */
+@@ -208,10 +208,8 @@ void smp_synchronize_tick_client(void)
+ 	{
+ 		for (i = 0; i < NUM_ROUNDS; i++) {
+ 			delta = get_delta(&rt, &master_time_stamp);
+-			if (delta == 0) {
++			if (delta == 0)
+ 				done = 1;	/* let's lock on to this... */
+-				bound = rt;
+-			}
+ 
+ 			if (!done) {
+ 				if (i > 0) {
+@@ -933,13 +931,12 @@ void smp_flush_dcache_page_impl(struct p
+ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
+ {
+ 	void *pg_addr;
+-	int this_cpu;
+ 	u64 data0;
+ 
+ 	if (tlb_type == hypervisor)
+ 		return;
+ 
+-	this_cpu = get_cpu();
++	preempt_disable();
+ 
+ #ifdef CONFIG_DEBUG_DCFLUSH
+ 	atomic_inc(&dcpage_flushes);
+@@ -964,7 +961,7 @@ void flush_dcache_page_all(struct mm_str
+ 	}
+ 	__local_flush_dcache_page(page);
+ 
+-	put_cpu();
++	preempt_enable();
+ }
+ 
+ void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -2152,7 +2152,7 @@ static void user_instruction_dump(unsign
+ 
+ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
+ {
+-	unsigned long fp, thread_base, ksp;
++	unsigned long fp, ksp;
+ 	struct thread_info *tp;
+ 	int count = 0;
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+@@ -2173,7 +2173,6 @@ void show_stack(struct task_struct *tsk,
+ 		flushw_all();
+ 
+ 	fp = ksp + STACK_BIAS;
+-	thread_base = (unsigned long) tp;
+ 
+ 	printk("Call Trace:\n");
+ 	do {