Merge branch 'master' of https://projects.archlinux.org/git/linux-2.6-ARCH

Conflicts:
	PATCHCFG

1 files changed, 1140 insertions, 0 deletions

diff --git a/patches/2.6.38.3-pre.patch b/patches/2.6.38.3-pre.patch
new file mode 100644
index 0000000..6d5f835
--- /dev/null
+++ b/patches/2.6.38.3-pre.patch
@@ -0,0 +1,1140 @@
+From 677cd904aba939bc4cfdc3c1eada8ec46582127e Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 7 Feb 2011 15:19:34 +0100
+Subject: ALSA: HDA: New AD1984A model for Dell Precision R5500
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 677cd904aba939bc4cfdc3c1eada8ec46582127e upstream.
+
+For codec AD1984A, add a new model to support Dell Precision R5500
+or the microphone jack won't work correctly.
+
+BugLink: http://bugs.launchpad.net/bugs/741516
+Tested-by: Kent Baxley <kent.baxley@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_analog.c |   89 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 89 insertions(+)
+
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -4353,6 +4353,84 @@ static int ad1984a_thinkpad_init(struct
+ }
+ 
+ /*
++ * Precision R5500
++ * 0x12 - HP/line-out
++ * 0x13 - speaker (mono)
++ * 0x15 - mic-in
++ */
++
++static struct hda_verb ad1984a_precision_verbs[] = {
++	/* Unmute main output path */
++	{0x03, AC_VERB_SET_AMP_GAIN_MUTE, 0x27}, /* 0dB */
++	{0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE + 0x1f}, /* 0dB */
++	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(5) + 0x17}, /* 0dB */
++	/* Analog mixer; mute as default */
++	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
++	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)},
++	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(2)},
++	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(3)},
++	{0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(4)},
++	/* Select mic as input */
++	{0x0c, AC_VERB_SET_CONNECT_SEL, 0x1},
++	{0x0c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE + 0x27}, /* 0dB */
++	/* Configure as mic */
++	{0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
++	{0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0x7002}, /* raise mic as default */
++	/* HP unmute */
++	{0x12, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
++	/* turn on EAPD */
++	{0x13, AC_VERB_SET_EAPD_BTLENABLE, 0x02},
++	/* unsolicited event for pin-sense */
++	{0x12, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | AD1884A_HP_EVENT},
++	{ } /* end */
++};
++
++static struct snd_kcontrol_new ad1984a_precision_mixers[] = {
++	HDA_CODEC_VOLUME("Master Playback Volume", 0x21, 0x0, HDA_OUTPUT),
++	HDA_CODEC_MUTE("Master Playback Switch", 0x21, 0x0, HDA_OUTPUT),
++	HDA_CODEC_VOLUME("PCM Playback Volume", 0x20, 0x5, HDA_INPUT),
++	HDA_CODEC_MUTE("PCM Playback Switch", 0x20, 0x5, HDA_INPUT),
++	HDA_CODEC_VOLUME("Mic Playback Volume", 0x20, 0x01, HDA_INPUT),
++	HDA_CODEC_MUTE("Mic Playback Switch", 0x20, 0x01, HDA_INPUT),
++	HDA_CODEC_VOLUME("Mic Boost Volume", 0x15, 0x0, HDA_INPUT),
++	HDA_CODEC_MUTE("Front Playback Switch", 0x12, 0x0, HDA_OUTPUT),
++	HDA_CODEC_VOLUME("Speaker Playback Volume", 0x13, 0x0, HDA_OUTPUT),
++	HDA_CODEC_VOLUME("Capture Volume", 0x0c, 0x0, HDA_OUTPUT),
++	HDA_CODEC_MUTE("Capture Switch", 0x0c, 0x0, HDA_OUTPUT),
++	{ } /* end */
++};
++
++
++/* mute internal speaker if HP is plugged */
++static void ad1984a_precision_automute(struct hda_codec *codec)
++{
++	unsigned int present;
++
++	present = snd_hda_jack_detect(codec, 0x12);
++	snd_hda_codec_amp_stereo(codec, 0x13, HDA_OUTPUT, 0,
++				 HDA_AMP_MUTE, present ? HDA_AMP_MUTE : 0);
++}
++
++
++/* unsolicited event for HP jack sensing */
++static void ad1984a_precision_unsol_event(struct hda_codec *codec,
++					 unsigned int res)
++{
++	if ((res >> 26) != AD1884A_HP_EVENT)
++		return;
++	ad1984a_precision_automute(codec);
++}
++
++/* initialize jack-sensing, too */
++static int ad1984a_precision_init(struct hda_codec *codec)
++{
++	ad198x_init(codec);
++	ad1984a_precision_automute(codec);
++	return 0;
++}
++
++
++/*
+  * HP Touchsmart
+  * port-A (0x11)      - front hp-out
+  * port-B (0x14)      - unused
+@@ -4481,6 +4559,7 @@ enum {
+ 	AD1884A_MOBILE,
+ 	AD1884A_THINKPAD,
+ 	AD1984A_TOUCHSMART,
++	AD1984A_PRECISION,
+ 	AD1884A_MODELS
+ };
+ 
+@@ -4490,9 +4569,11 @@ static const char * const ad1884a_models
+ 	[AD1884A_MOBILE]	= "mobile",
+ 	[AD1884A_THINKPAD]	= "thinkpad",
+ 	[AD1984A_TOUCHSMART]	= "touchsmart",
++	[AD1984A_PRECISION]	= "precision",
+ };
+ 
+ static struct snd_pci_quirk ad1884a_cfg_tbl[] = {
++	SND_PCI_QUIRK(0x1028, 0x04ac, "Precision R5500", AD1984A_PRECISION),
+ 	SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE),
+ 	SND_PCI_QUIRK(0x103c, 0x3037, "HP 2230s", AD1884A_LAPTOP),
+ 	SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE),
+@@ -4586,6 +4667,14 @@ static int patch_ad1884a(struct hda_code
+ 		codec->patch_ops.unsol_event = ad1984a_thinkpad_unsol_event;
+ 		codec->patch_ops.init = ad1984a_thinkpad_init;
+ 		break;
++	case AD1984A_PRECISION:
++		spec->mixers[0] = ad1984a_precision_mixers;
++		spec->init_verbs[spec->num_init_verbs++] =
++			ad1984a_precision_verbs;
++		spec->multiout.dig_out_nid = 0;
++		codec->patch_ops.unsol_event = ad1984a_precision_unsol_event;
++		codec->patch_ops.init = ad1984a_precision_init;
++		break;
+ 	case AD1984A_TOUCHSMART:
+ 		spec->mixers[0] = ad1984a_touchsmart_mixers;
+ 		spec->init_verbs[0] = ad1984a_touchsmart_verbs;
+From 20b67dddcc5f29d3d0c900225d85e0ac655bc69d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 23 Mar 2011 22:54:32 +0100
+Subject: ALSA: hda - Fix SPDIF out regression on ALC889
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 20b67dddcc5f29d3d0c900225d85e0ac655bc69d upstream.
+
+The commit 5a8cfb4e8ae317d283f84122ed20faa069c5e0c4
+    ALSA: hda - Use ALC_INIT_DEFAULT for really default initialization
+changed to use the default initialization method for ALC889, but
+this caused a regression on SPDIF output on some machines.
+This seems due to the COEF setup included in the default init procedure.
+For making SPDIF working again, the COEF-setup has to be avoided for
+the id 0889.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=24342
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1360,7 +1360,7 @@ static void alc_auto_init_amp(struct hda
+ 		case 0x10ec0883:
+ 		case 0x10ec0885:
+ 		case 0x10ec0887:
+-		case 0x10ec0889:
++		/*case 0x10ec0889:*/ /* this causes an SPDIF problem */
+ 			alc889_coef_init(codec);
+ 			break;
+ 		case 0x10ec0888:
+From a45e3d6b13e97506b616980c0f122c3389bcefa4 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 24 Mar 2011 09:50:15 +0100
+Subject: ALSA: Fix yet another race in disconnection
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit a45e3d6b13e97506b616980c0f122c3389bcefa4 upstream.
+
+This patch fixes a race between snd_card_file_remove() and
+snd_card_disconnect().  When the card is added to shutdown_files list
+in snd_card_disconnect(), but it's freed in snd_card_file_remove() at
+the same time, the shutdown_files list gets corrupted.  The list member
+must be freed in snd_card_file_remove() as well.
+
+Reported-and-tested-by: Russ Dill <russ.dill@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/init.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -848,6 +848,7 @@ int snd_card_file_add(struct snd_card *c
+ 		return -ENOMEM;
+ 	mfile->file = file;
+ 	mfile->disconnected_f_op = NULL;
++	INIT_LIST_HEAD(&mfile->shutdown_list);
+ 	spin_lock(&card->files_lock);
+ 	if (card->shutdown) {
+ 		spin_unlock(&card->files_lock);
+@@ -883,6 +884,9 @@ int snd_card_file_remove(struct snd_card
+ 	list_for_each_entry(mfile, &card->files_list, list) {
+ 		if (mfile->file == file) {
+ 			list_del(&mfile->list);
++			spin_lock(&shutdown_lock);
++			list_del(&mfile->shutdown_list);
++			spin_unlock(&shutdown_lock);
+ 			if (mfile->disconnected_f_op)
+ 				fops_put(mfile->disconnected_f_op);
+ 			found = mfile;
+From 3674f19dabd15f9541079a588149a370d888f4e6 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 25 Mar 2011 17:51:54 +1100
+Subject: ALSA: vmalloc buffers should use normal mmap
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit 3674f19dabd15f9541079a588149a370d888f4e6 upstream.
+
+It's a big no-no to use pgprot_noncached() when mmap'ing such buffers
+into userspace since they are mapped cachable in kernel space.
+
+This can cause all sort of interesting things ranging from to garbled
+sound to lockups on various architectures. I've observed that usb-audio
+is broken on powerpc 4xx for example because of that.
+
+Also remove the now unused snd_pcm_lib_mmap_noncached(). It's
+an arch business to know when to use uncached mappings, there's
+already hacks for MIPS inside snd_pcm_default_mmap() and other
+archs are supposed to use dma_mmap_coherent().
+
+(See my separate patch that adds dma_mmap_coherent() to powerpc)
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/sound/pcm.h     |    4 +---
+ sound/core/pcm_native.c |    9 ---------
+ 2 files changed, 1 insertion(+), 12 deletions(-)
+
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -1030,9 +1030,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc
+ #define snd_pcm_lib_mmap_iomem	NULL
+ #endif
+ 
+-int snd_pcm_lib_mmap_noncached(struct snd_pcm_substream *substream,
+-			       struct vm_area_struct *area);
+-#define snd_pcm_lib_mmap_vmalloc	snd_pcm_lib_mmap_noncached
++#define snd_pcm_lib_mmap_vmalloc NULL
+ 
+ static inline void snd_pcm_limit_isa_dma_size(int dma, size_t *max)
+ {
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -3201,15 +3201,6 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc
+ EXPORT_SYMBOL(snd_pcm_lib_mmap_iomem);
+ #endif /* SNDRV_PCM_INFO_MMAP */
+ 
+-/* mmap callback with pgprot_noncached */
+-int snd_pcm_lib_mmap_noncached(struct snd_pcm_substream *substream,
+-			       struct vm_area_struct *area)
+-{
+-	area->vm_page_prot = pgprot_noncached(area->vm_page_prot);
+-	return snd_pcm_default_mmap(substream, area);
+-}
+-EXPORT_SYMBOL(snd_pcm_lib_mmap_noncached);
+-
+ /*
+  * mmap DMA buffer
+  */
+From 880f57318450dbead6a03f9e31a1468924d6dd88 Mon Sep 17 00:00:00 2001
+From: Frederic Weisbecker <fweisbec@gmail.com>
+Date: Wed, 23 Mar 2011 19:29:39 +0100
+Subject: perf: Better fit max unprivileged mlock pages for tools needs
+
+From: Frederic Weisbecker <fweisbec@gmail.com>
+
+commit 880f57318450dbead6a03f9e31a1468924d6dd88 upstream.
+
+The maximum kilobytes of locked memory that an unprivileged user
+can reserve is of 512 kB = 128 pages by default, scaled to the
+number of onlined CPUs, which fits well with the tools that use
+128 data pages by default.
+
+However tools actually use 129 pages, because they need one more
+for the user control page. Thus the default mlock threshold is
+not sufficient for the default tools needs and we always end up
+to evaluate the constant mlock rlimit policy, which doesn't have
+this scaling with the number of online CPUs.
+
+Hence, on systems that have more than 16 CPUs, we overlap the
+rlimit threshold and fail to mmap:
+
+	$ perf record ls
+	Error: failed to mmap with 1 (Operation not permitted)
+
+Just increase the max unprivileged mlock threshold by one page
+so that it supports well perf tools even after 16 CPUs.
+
+Reported-by: Han Pingtian <phan@redhat.com>
+Reported-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Stephane Eranian <eranian@google.com>
+LKML-Reference: <1300904979-5508-1-git-send-email-fweisbec@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -62,7 +62,8 @@ static struct srcu_struct pmus_srcu;
+  */
+ int sysctl_perf_event_paranoid __read_mostly = 1;
+ 
+-int sysctl_perf_event_mlock __read_mostly = 512; /* 'free' kb per user */
++/* Minimum for 128 pages + 1 for the user control page */
++int sysctl_perf_event_mlock __read_mostly = 516; /* 'free' kb per user */
+ 
+ /*
+  * max perf event sample rate
+From cda6587c21a887254c8ed4b58da8fcc4040ab557 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 23 Mar 2011 02:44:30 +0000
+Subject: myri10ge: fix rmmod crash
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit cda6587c21a887254c8ed4b58da8fcc4040ab557 upstream.
+
+Rmmod myri10ge crash at free_netdev() -> netif_napi_del(), because napi
+structures are already deallocated. To fix call netif_napi_del() before
+kfree() at myri10ge_free_slices().
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/myri10ge/myri10ge.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/myri10ge/myri10ge.c
++++ b/drivers/net/myri10ge/myri10ge.c
+@@ -3645,6 +3645,7 @@ static void myri10ge_free_slices(struct
+ 			dma_free_coherent(&pdev->dev, bytes,
+ 					  ss->fw_stats, ss->fw_stats_bus);
+ 			ss->fw_stats = NULL;
++			netif_napi_del(&ss->napi);
+ 		}
+ 	}
+ 	kfree(mgp->ss);
+From 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 Mon Sep 17 00:00:00 2001
+From: Bud Brown <bud.brown@redhat.com>
+Date: Wed, 23 Mar 2011 20:47:11 +0100
+Subject: cciss: fix lost command issue
+
+From: Bud Brown <bud.brown@redhat.com>
+
+commit 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 upstream.
+
+Under certain workloads a command may seem to get lost. IOW, the Smart Array
+thinks all commands have been completed but we still have commands in our
+completion queue. This may lead to system instability, filesystems going
+read-only, or even panics depending on the affected filesystem. We add an
+extra read to force the write to complete.
+
+Testing shows this extra read avoids the problem.
+
+Signed-off-by: Mike Miller <mike.miller@hp.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/cciss.h |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/block/cciss.h
++++ b/drivers/block/cciss.h
+@@ -222,6 +222,7 @@ static void SA5_submit_command( ctlr_inf
+ 			h->ctlr, c->busaddr);
+ #endif /* CCISS_DEBUG */
+          writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
++	readl(h->vaddr + SA5_REQUEST_PORT_OFFSET);
+ 	 h->commands_outstanding++;
+ 	 if ( h->commands_outstanding > h->max_outstanding)
+ 		h->max_outstanding = h->commands_outstanding;
+From 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 Mon Sep 17 00:00:00 2001
+From: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
+Date: Mon, 21 Mar 2011 18:27:21 +0530
+Subject: ath9k: Fix kernel panic in AR2427
+
+From: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
+
+commit 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 upstream.
+
+Kernel panic occurs just after AR2427 establishes connection with AP.
+Unless aggregation is enabled we don't initialize the TID structure.
+Thus accesing the elements of the TID structure when aggregation is
+disabled, leads to NULL pointer dereferencing.
+
+[  191.320358] Call Trace:
+[  191.320364]  [<fd250ea7>] ? ath9k_tx+0xa7/0x200 [ath9k]
+[  191.320376]  [<fd1ec7fc>] ? __ieee80211_tx+0x5c/0x1e0 [mac80211]
+[  191.320386]  [<fd1edd2b>] ? ieee80211_tx+0x7b/0x90 [mac80211]
+[  191.320395]  [<fd1edddd>] ? ieee80211_xmit+0x9d/0x1d0 [mac80211]
+[  191.320401]  [<c014218f>] ? wake_up_state+0xf/0x20
+[  191.320405]  [<c015dbc8>] ? signal_wake_up+0x28/0x40
+[  191.320410]  [<c012a578>] ? default_spin_lock_flags+0x8/0x10
+[  191.320420]  [<fd1ee308>] ? ieee80211_subif_start_xmit+0x2e8/0x7c0
+[mac80211]
+[  191.320425]  [<c058f905>] ? do_page_fault+0x295/0x3a0
+[  191.320431]  [<c04c4a3d>] ? dev_hard_start_xmit+0x1ad/0x210
+[  191.320436]  [<c04d96b5>] ? sch_direct_xmit+0x105/0x170
+[  191.320445]  [<fd1f161a>] ? get_sta_flags+0x2a/0x40 [mac80211]
+[  191.320449]  [<c04c780f>] ? dev_queue_xmit+0x37f/0x4b0
+[  191.320452]  [<c04d75b0>] ? eth_header+0x0/0xb0
+[  191.320456]  [<c04cc479>] ? neigh_resolve_output+0xe9/0x310
+[  191.320461]  [<c053d295>] ? ip6_output_finish+0xa5/0x110
+[  191.320464]  [<c053e354>] ? ip6_output2+0x134/0x250
+[  191.320468]  [<c053f7dd>] ? ip6_output+0x6d/0x100
+[  191.320471]  [<c0559665>] ? mld_sendpack+0x395/0x3e0
+[  191.320475]  [<c0557f81>] ? add_grhead+0x31/0xa0
+[  191.320478]  [<c055a83c>] ? mld_send_cr+0x1bc/0x2b0
+[  191.320482]  [<c01535d9>] ? irq_exit+0x39/0x70
+[  191.320485]  [<c055a940>] ? mld_ifc_timer_expire+0x10/0x40
+[  191.320489]  [<c015b92e>] ? run_timer_softirq+0x13e/0x2c0
+[  191.320493]  [<c0103a30>] ? common_interrupt+0x30/0x40
+[  191.320498]  [<c055a930>] ? mld_ifc_timer_expire+0x0/0x40
+[  191.320502]  [<c0153358>] ? __do_softirq+0x98/0x1b0
+[  191.320506]  [<c01534b5>] ? do_softirq+0x45/0x50
+[  191.320509]  [<c0153605>] ? irq_exit+0x65/0x70
+[  191.320513]  [<c05917dc>] ? smp_apic_timer_interrupt+0x5c/0x8b
+[  191.320516]  [<c0103df1>] ? apic_timer_interrupt+0x31/0x40
+[  191.320521]  [<c016007b>] ? k_getrusage+0x12b/0x2f0
+[  191.320525]  [<c039e384>] ? acpi_idle_enter_simple+0x117/0x148
+[  191.320529]  [<c04a20da>] ? cpuidle_idle_call+0x7a/0x100
+[  191.320532]  [<c01021d4>] ? cpu_idle+0x94/0xd0
+[  191.320536]  [<c057ab88>] ? rest_init+0x58/0x60
+[  191.320541]  [<c07a58ec>] ? start_kernel+0x351/0x357
+[  191.320544]  [<c07a53c7>] ? unknown_bootoption+0x0/0x19e
+[  191.320548]  [<c07a50aa>] ? i386_start_kernel+0xaa/0xb1
+[  191.320550] Code: 03 66 3d 00 03 0f 84 7c 02 00 00 83 c3 18 0f b6 03
+8b 4d e0 89 c3 83 e3 0f 6b c3 48 89 5d d8 8d 04 06 8d 50 0c 89 55 d0 8b
+40 20 <8b> 00 3b 01 0f 85 8e 02 00 00 f6 47 20 40 0f 84 29 ff ff ff 8b
+[  191.320634] EIP: [<fd2586d4>] ath_tx_start+0x474/0x770 [ath9k] SS:ESP
+0068:c0761a90
+[  191.320642] CR2: 0000000000000000
+[  191.320647] ---[ end trace 9296ef23b9076ece ]---
+[  191.320650] Kernel panic - not syncing: Fatal exception in interrupt
+
+Signed-off-by: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1699,8 +1699,8 @@ static void ath_tx_start_dma(struct ath_
+ 	u8 tidno;
+ 
+ 	spin_lock_bh(&txctl->txq->axq_lock);
+-
+-	if (ieee80211_is_data_qos(hdr->frame_control) && txctl->an) {
++	if ((sc->sc_flags & SC_OP_TXAGGR) && txctl->an &&
++		ieee80211_is_data_qos(hdr->frame_control)) {
+ 		tidno = ieee80211_get_qos_ctl(hdr)[0] &
+ 			IEEE80211_QOS_CTL_TID_MASK;
+ 		tid = ATH_AN_2_TID(txctl->an, tidno);
+From 4d00135a680727f6c3be78f8befaac009030e4df Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+Date: Wed, 23 Mar 2011 11:42:57 -0400
+Subject: sound/oss/opl3: validate voice and channel indexes
+
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+
+commit 4d00135a680727f6c3be78f8befaac009030e4df upstream.
+
+User-controllable indexes for voice and channel values may cause reading
+and writing beyond the bounds of their respective arrays, leading to
+potentially exploitable memory corruption.  Validate these indexes.
+
+Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/oss/opl3.c |   15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/sound/oss/opl3.c
++++ b/sound/oss/opl3.c
+@@ -849,6 +849,10 @@ static int opl3_load_patch(int dev, int
+ 
+ static void opl3_panning(int dev, int voice, int value)
+ {
++
++	if (voice < 0 || voice >= devc->nr_voice)
++		return;
++
+ 	devc->voc[voice].panning = value;
+ }
+ 
+@@ -1066,8 +1070,15 @@ static int opl3_alloc_voice(int dev, int
+ 
+ static void opl3_setup_voice(int dev, int voice, int chn)
+ {
+-	struct channel_info *info =
+-	&synth_devs[dev]->chn_info[chn];
++	struct channel_info *info;
++
++	if (voice < 0 || voice >= devc->nr_voice)
++		return;
++
++	if (chn < 0 || chn > 15)
++		return;
++
++	info = &synth_devs[dev]->chn_info[chn];
+ 
+ 	opl3_set_instr(dev, voice, info->pgm_num);
+ 
+From 8bc8aecdc5e26cfda12dbd6867af4aa67836da6a Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Mon, 21 Mar 2011 20:01:00 +0100
+Subject: mac80211: initialize sta->last_rx in sta_info_alloc
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 8bc8aecdc5e26cfda12dbd6867af4aa67836da6a upstream.
+
+This field is used to determine the inactivity time. When in AP mode,
+hostapd uses it for kicking out inactive clients after a while. Without this
+patch, hostapd immediately deauthenticates a new client if it checks the
+inactivity time before the client sends its first data frame.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/sta_info.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -243,6 +243,7 @@ struct sta_info *sta_info_alloc(struct i
+ 	memcpy(sta->sta.addr, addr, ETH_ALEN);
+ 	sta->local = local;
+ 	sta->sdata = sdata;
++	sta->last_rx = jiffies;
+ 
+ 	ewma_init(&sta->avg_signal, 1024, 8);
+ 
+From 877a55979c189c590e819a61cbbe2b7947875f17 Mon Sep 17 00:00:00 2001
+From: John Hughes <john@Calva.COM>
+Date: Wed, 4 Nov 2009 19:01:22 +0100
+Subject: [SCSI] ses: show devices for enclosures with no page 7
+
+From: John Hughes <john@Calva.COM>
+
+commit 877a55979c189c590e819a61cbbe2b7947875f17 upstream.
+
+enclosure page 7 gives us the "pretty" names of the enclosure slots.
+Without a page 7, we can still use the enclosure code as long as we
+make up numeric names for the slots. Unfortunately, the current code
+fails to add any devices because the check for page 10 is in the wrong
+place if we have no page 7.  Fix it so that devices show up even if
+the enclosure has no page 7.
+
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/ses.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -390,9 +390,9 @@ static void ses_enclosure_data_process(s
+ 		len = (desc_ptr[2] << 8) + desc_ptr[3];
+ 		/* skip past overall descriptor */
+ 		desc_ptr += len + 4;
+-		if (ses_dev->page10)
+-			addl_desc_ptr = ses_dev->page10 + 8;
+ 	}
++	if (ses_dev->page10)
++		addl_desc_ptr = ses_dev->page10 + 8;
+ 	type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
+ 	components = 0;
+ 	for (i = 0; i < types; i++, type_ptr += 4) {
+From d1e12de804f9d8ad114786ca7c2ce593cba79891 Mon Sep 17 00:00:00 2001
+From: Krishnasamy, Somasundaram <Somasundaram.Krishnasamy@lsi.com>
+Date: Mon, 28 Feb 2011 18:13:22 -0500
+Subject: [SCSI] ses: Avoid kernel panic when lun 0 is not mapped
+
+From: Krishnasamy, Somasundaram <Somasundaram.Krishnasamy@lsi.com>
+
+commit d1e12de804f9d8ad114786ca7c2ce593cba79891 upstream.
+
+During device discovery, scsi mid layer sends INQUIRY command to LUN
+0. If the LUN 0 is not mapped to host, it creates a temporary
+scsi_device with LUN id 0 and sends REPORT_LUNS command to it. After
+the REPORT_LUNS succeeds, it walks through the LUN table and adds each
+LUN found to sysfs. At the end of REPORT_LUNS lun table scan, it will
+delete the temporary scsi_device of LUN 0.
+
+When scsi devices are added to sysfs, it calls add_dev function of all
+the registered class interfaces. If ses driver has been registered,
+ses_intf_add() of ses module will be called. This function calls
+scsi_device_enclosure() to check the inquiry data for EncServ
+bit. Since inquiry was not allocated for temporary LUN 0 scsi_device,
+it will cause NULL pointer exception.
+
+To fix the problem, sdev->inquiry is checked for NULL before reading it.
+
+Signed-off-by: Somasundaram Krishnasamy <Somasundaram.Krishnasamy@lsi.com>
+Signed-off-by: Babu Moger <babu.moger@lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/scsi/scsi_device.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -461,7 +461,7 @@ static inline int scsi_device_qas(struct
+ }
+ static inline int scsi_device_enclosure(struct scsi_device *sdev)
+ {
+-	return sdev->inquiry[6] & (1<<6);
++	return sdev->inquiry ? (sdev->inquiry[6] & (1<<6)) : 1;
+ }
+ 
+ static inline int scsi_device_protection(struct scsi_device *sdev)
+From 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 Mon Sep 17 00:00:00 2001
+From: Rafael J. Wysocki <rjw@sisk.pl>
+Date: Sat, 5 Mar 2011 13:21:51 +0100
+Subject: PCI/ACPI: Report ASPM support to BIOS if not disabled from command line
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 upstream.
+
+We need to distinguish the situation in which ASPM support is
+disabled from the command line or through .config from the situation
+in which it is disabled, because the hardware or BIOS can't handle
+it.  In the former case we should not report ASPM support to the BIOS
+through ACPI _OSC, but in the latter case we should do that.
+
+Introduce pcie_aspm_support_enabled() that can be used by
+acpi_pci_root_add() to determine whether or not it should report ASPM
+support to the BIOS through _OSC.
+
+References: https://bugzilla.kernel.org/show_bug.cgi?id=29722
+References: https://bugzilla.kernel.org/show_bug.cgi?id=20232
+Reported-and-tested-by: Ortwin Glück <odi@odi.ch>
+Reviewed-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+Tested-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/pci_root.c |    2 +-
+ drivers/pci/pcie/aspm.c |    7 +++++++
+ include/linux/pci.h     |    7 +++----
+ 3 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -564,7 +564,7 @@ static int __devinit acpi_pci_root_add(s
+ 	/* Indicate support for various _OSC capabilities. */
+ 	if (pci_ext_cfg_avail(root->bus->self))
+ 		flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
+-	if (pcie_aspm_enabled())
++	if (pcie_aspm_support_enabled())
+ 		flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
+ 			OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
+ 	if (pci_msi_enabled())
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -69,6 +69,7 @@ struct pcie_link_state {
+ };
+ 
+ static int aspm_disabled, aspm_force, aspm_clear_state;
++static bool aspm_support_enabled = true;
+ static DEFINE_MUTEX(aspm_lock);
+ static LIST_HEAD(link_list);
+ 
+@@ -896,6 +897,7 @@ static int __init pcie_aspm_disable(char
+ {
+ 	if (!strcmp(str, "off")) {
+ 		aspm_disabled = 1;
++		aspm_support_enabled = false;
+ 		printk(KERN_INFO "PCIe ASPM is disabled\n");
+ 	} else if (!strcmp(str, "force")) {
+ 		aspm_force = 1;
+@@ -930,3 +932,8 @@ int pcie_aspm_enabled(void)
+ }
+ EXPORT_SYMBOL(pcie_aspm_enabled);
+ 
++bool pcie_aspm_support_enabled(void)
++{
++	return aspm_support_enabled;
++}
++EXPORT_SYMBOL(pcie_aspm_support_enabled);
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1002,12 +1002,11 @@ extern bool pcie_ports_auto;
+ #endif
+ 
+ #ifndef CONFIG_PCIEASPM
+-static inline int pcie_aspm_enabled(void)
+-{
+-	return 0;
+-}
++static inline int pcie_aspm_enabled(void) { return 0; }
++static inline bool pcie_aspm_support_enabled(void) { return false; }
+ #else
+ extern int pcie_aspm_enabled(void);
++extern bool pcie_aspm_support_enabled(void);
+ #endif
+ 
+ #ifdef CONFIG_PCIEAER
+From 4b239f458c229de044d6905c2b0f9fe16ed9e01e Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Fri, 17 Dec 2010 16:58:28 -0800
+Subject: x86-64, mm: Put early page table high
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 4b239f458c229de044d6905c2b0f9fe16ed9e01e upstream.
+
+While dubug kdump, found current kernel will have problem with crashkernel=512M.
+
+It turns out that initial mapping is to 512M, and later initial mapping to 4G
+(acutally is 2040M in my platform), will put page table near 512M.
+then initial mapping to 128g will be near 2g.
+
+before this patch:
+[    0.000000] initial memory mapped : 0 - 20000000
+[    0.000000] init_memory_mapping: [0x00000000000000-0x0000007f74ffff]
+[    0.000000]  0000000000 - 007f600000 page 2M
+[    0.000000]  007f600000 - 007f750000 page 4k
+[    0.000000] kernel direct mapping tables up to 7f750000 @ [0x1fffc000-0x1fffffff]
+[    0.000000]     memblock_x86_reserve_range: [0x1fffc000-0x1fffdfff]          PGTABLE
+[    0.000000] init_memory_mapping: [0x00000100000000-0x0000207fffffff]
+[    0.000000]  0100000000 - 2080000000 page 2M
+[    0.000000] kernel direct mapping tables up to 2080000000 @ [0x7bc01000-0x7bc83fff]
+[    0.000000]     memblock_x86_reserve_range: [0x7bc01000-0x7bc7efff]          PGTABLE
+[    0.000000] RAMDISK: 7bc84000 - 7f745000
+[    0.000000] crashkernel reservation failed - No suitable area found.
+
+after patch:
+[    0.000000] initial memory mapped : 0 - 20000000
+[    0.000000] init_memory_mapping: [0x00000000000000-0x0000007f74ffff]
+[    0.000000]  0000000000 - 007f600000 page 2M
+[    0.000000]  007f600000 - 007f750000 page 4k
+[    0.000000] kernel direct mapping tables up to 7f750000 @ [0x7f74c000-0x7f74ffff]
+[    0.000000]     memblock_x86_reserve_range: [0x7f74c000-0x7f74dfff]          PGTABLE
+[    0.000000] init_memory_mapping: [0x00000100000000-0x0000207fffffff]
+[    0.000000]  0100000000 - 2080000000 page 2M
+[    0.000000] kernel direct mapping tables up to 2080000000 @ [0x207ff7d000-0x207fffffff]
+[    0.000000]     memblock_x86_reserve_range: [0x207ff7d000-0x207fffafff]          PGTABLE
+[    0.000000] RAMDISK: 7bc84000 - 7f745000
+[    0.000000]     memblock_x86_reserve_range: [0x17000000-0x36ffffff]     CRASH KERNEL
+[    0.000000] Reserving 512MB of memory at 368MB for crashkernel (System RAM: 133120MB)
+
+It means with the patch, page table for [0, 2g) will need 2g, instead of under 512M,
+page table for [4g, 128g) will be near 128g, instead of under 2g.
+
+That would good, if we have lots of memory above 4g, like 1024g, or 2048g or 16T, will not put
+related page table under 2g. that would be have chance to fill the under 2g if 1G or 2M page is
+not used.
+
+the code change will use add map_low_page() and update unmap_low_page() for 64bit, and use them
+to get access the corresponding high memory for page table setting.
+
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+LKML-Reference: <4D0C0734.7060900@kernel.org>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/init.c    |    9 ++-----
+ arch/x86/mm/init_64.c |   63 +++++++++++++++++++++-----------------------------
+ 2 files changed, 30 insertions(+), 42 deletions(-)
+
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -33,7 +33,7 @@ int direct_gbpages
+ static void __init find_early_table_space(unsigned long end, int use_pse,
+ 					  int use_gbpages)
+ {
+-	unsigned long puds, pmds, ptes, tables, start;
++	unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
+ 	phys_addr_t base;
+ 
+ 	puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
+@@ -73,12 +73,9 @@ static void __init find_early_table_spac
+ 	 * need roughly 0.5KB per GB.
+ 	 */
+ #ifdef CONFIG_X86_32
+-	start = 0x7000;
+-#else
+-	start = 0x8000;
++	good_end = max_pfn_mapped << PAGE_SHIFT;
+ #endif
+-	base = memblock_find_in_range(start, max_pfn_mapped<<PAGE_SHIFT,
+-					tables, PAGE_SIZE);
++	base = memblock_find_in_range(start, good_end, tables, PAGE_SIZE);
+ 	if (base == MEMBLOCK_ERROR)
+ 		panic("Cannot find space for the kernel page tables");
+ 
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -334,12 +334,28 @@ static __ref void *alloc_low_page(unsign
+ 	return adr;
+ }
+ 
++static __ref void *map_low_page(void *virt)
++{
++	void *adr;
++	unsigned long phys, left;
++
++	if (after_bootmem)
++		return virt;
++
++	phys = __pa(virt);
++	left = phys & (PAGE_SIZE - 1);
++	adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
++	adr = (void *)(((unsigned long)adr) | left);
++
++	return adr;
++}
++
+ static __ref void unmap_low_page(void *adr)
+ {
+ 	if (after_bootmem)
+ 		return;
+ 
+-	early_iounmap(adr, PAGE_SIZE);
++	early_iounmap((void *)((unsigned long)adr & PAGE_MASK), PAGE_SIZE);
+ }
+ 
+ static unsigned long __meminit
+@@ -387,15 +403,6 @@ phys_pte_init(pte_t *pte_page, unsigned
+ }
+ 
+ static unsigned long __meminit
+-phys_pte_update(pmd_t *pmd, unsigned long address, unsigned long end,
+-		pgprot_t prot)
+-{
+-	pte_t *pte = (pte_t *)pmd_page_vaddr(*pmd);
+-
+-	return phys_pte_init(pte, address, end, prot);
+-}
+-
+-static unsigned long __meminit
+ phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
+ 	      unsigned long page_size_mask, pgprot_t prot)
+ {
+@@ -421,8 +428,10 @@ phys_pmd_init(pmd_t *pmd_page, unsigned
+ 		if (pmd_val(*pmd)) {
+ 			if (!pmd_large(*pmd)) {
+ 				spin_lock(&init_mm.page_table_lock);
+-				last_map_addr = phys_pte_update(pmd, address,
++				pte = map_low_page((pte_t *)pmd_page_vaddr(*pmd));
++				last_map_addr = phys_pte_init(pte, address,
+ 								end, prot);
++				unmap_low_page(pte);
+ 				spin_unlock(&init_mm.page_table_lock);
+ 				continue;
+ 			}
+@@ -469,18 +478,6 @@ phys_pmd_init(pmd_t *pmd_page, unsigned
+ }
+ 
+ static unsigned long __meminit
+-phys_pmd_update(pud_t *pud, unsigned long address, unsigned long end,
+-		unsigned long page_size_mask, pgprot_t prot)
+-{
+-	pmd_t *pmd = pmd_offset(pud, 0);
+-	unsigned long last_map_addr;
+-
+-	last_map_addr = phys_pmd_init(pmd, address, end, page_size_mask, prot);
+-	__flush_tlb_all();
+-	return last_map_addr;
+-}
+-
+-static unsigned long __meminit
+ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
+ 			 unsigned long page_size_mask)
+ {
+@@ -505,8 +502,11 @@ phys_pud_init(pud_t *pud_page, unsigned
+ 
+ 		if (pud_val(*pud)) {
+ 			if (!pud_large(*pud)) {
+-				last_map_addr = phys_pmd_update(pud, addr, end,
++				pmd = map_low_page(pmd_offset(pud, 0));
++				last_map_addr = phys_pmd_init(pmd, addr, end,
+ 							 page_size_mask, prot);
++				unmap_low_page(pmd);
++				__flush_tlb_all();
+ 				continue;
+ 			}
+ 			/*
+@@ -554,17 +554,6 @@ phys_pud_init(pud_t *pud_page, unsigned
+ 	return last_map_addr;
+ }
+ 
+-static unsigned long __meminit
+-phys_pud_update(pgd_t *pgd, unsigned long addr, unsigned long end,
+-		 unsigned long page_size_mask)
+-{
+-	pud_t *pud;
+-
+-	pud = (pud_t *)pgd_page_vaddr(*pgd);
+-
+-	return phys_pud_init(pud, addr, end, page_size_mask);
+-}
+-
+ unsigned long __meminit
+ kernel_physical_mapping_init(unsigned long start,
+ 			     unsigned long end,
+@@ -588,8 +577,10 @@ kernel_physical_mapping_init(unsigned lo
+ 			next = end;
+ 
+ 		if (pgd_val(*pgd)) {
+-			last_map_addr = phys_pud_update(pgd, __pa(start),
++			pud = map_low_page((pud_t *)pgd_page_vaddr(*pgd));
++			last_map_addr = phys_pud_init(pud, __pa(start),
+ 						 __pa(end), page_size_mask);
++			unmap_low_page(pud);
+ 			continue;
+ 		}
+ 
+From 50f198ae16ac66508d4b8d5a40967a8507ad19ee Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Wed, 9 Mar 2011 11:49:13 -0600
+Subject: eCryptfs: Unlock page in write_begin error path
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit 50f198ae16ac66508d4b8d5a40967a8507ad19ee upstream.
+
+Unlock the page in error path of ecryptfs_write_begin(). This may
+happen, for example, if decryption fails while bring the page
+up-to-date.
+
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/mmap.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/ecryptfs/mmap.c
++++ b/fs/ecryptfs/mmap.c
+@@ -374,6 +374,11 @@ static int ecryptfs_write_begin(struct f
+ 	    && (pos != 0))
+ 		zero_user(page, 0, PAGE_CACHE_SIZE);
+ out:
++	if (unlikely(rc)) {
++		unlock_page(page);
++		page_cache_release(page);
++		*pagep = NULL;
++	}
+ 	return rc;
+ }
+ 
+From 1821df040ac3cd6a57518739f345da6d50ea9d3f Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@polito.it>
+Date: Thu, 17 Mar 2011 12:48:50 +0100
+Subject: eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix
+
+From: Roberto Sassu <roberto.sassu@polito.it>
+
+commit 1821df040ac3cd6a57518739f345da6d50ea9d3f upstream.
+
+The pointer '(*auth_tok_key)' is set to NULL in case request_key()
+fails, in order to prevent its use by functions calling
+ecryptfs_keyring_auth_tok_for_sig().
+
+Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/keystore.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -1563,6 +1563,7 @@ int ecryptfs_keyring_auth_tok_for_sig(st
+ 		printk(KERN_ERR "Could not find key with description: [%s]\n",
+ 		       sig);
+ 		rc = process_request_key_err(PTR_ERR(*auth_tok_key));
++		(*auth_tok_key) = NULL;
+ 		goto out;
+ 	}
+ 	(*auth_tok) = ecryptfs_get_key_payload_data(*auth_tok_key);
+From 60af520cf264ea26b2af3a6871bbd71850522aea Mon Sep 17 00:00:00 2001
+From: Tadeusz Struk <tadeusz.struk@intel.com>
+Date: Sun, 13 Mar 2011 16:56:17 +0800
+Subject: crypto: aesni-intel - fixed problem with packets that are not multiple of 64bytes
+
+From: Tadeusz Struk <tadeusz.struk@intel.com>
+
+commit 60af520cf264ea26b2af3a6871bbd71850522aea upstream.
+
+This patch fixes problem with packets that are not multiple of 64bytes.
+
+Signed-off-by: Adrian Hoban <adrian.hoban@intel.com>
+Signed-off-by: Aidan O'Mahony <aidan.o.mahony@intel.com>
+Signed-off-by: Gabriele Paoloni <gabriele.paoloni@intel.com>
+Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/crypto/aesni-intel_asm.S  |    5 ++++-
+ arch/x86/crypto/aesni-intel_glue.c |   14 ++++++++++++--
+ 2 files changed, 16 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/crypto/aesni-intel_asm.S
++++ b/arch/x86/crypto/aesni-intel_asm.S
+@@ -1612,6 +1612,7 @@ _zero_cipher_left_encrypt:
+         movdqa SHUF_MASK(%rip), %xmm10
+ 	PSHUFB_XMM %xmm10, %xmm0
+ 
++
+ 	ENCRYPT_SINGLE_BLOCK	%xmm0, %xmm1        # Encrypt(K, Yn)
+ 	sub $16, %r11
+ 	add %r13, %r11
+@@ -1634,7 +1635,9 @@ _zero_cipher_left_encrypt:
+ 	# GHASH computation for the last <16 byte block
+ 	sub	%r13, %r11
+ 	add	$16, %r11
+-	PSHUFB_XMM %xmm10, %xmm1
++
++	movdqa SHUF_MASK(%rip), %xmm10
++	PSHUFB_XMM %xmm10, %xmm0
+ 
+ 	# shuffle xmm0 back to output as ciphertext
+ 
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -828,9 +828,15 @@ static int rfc4106_init(struct crypto_tf
+ 	struct cryptd_aead *cryptd_tfm;
+ 	struct aesni_rfc4106_gcm_ctx *ctx = (struct aesni_rfc4106_gcm_ctx *)
+ 		PTR_ALIGN((u8 *)crypto_tfm_ctx(tfm), AESNI_ALIGN);
++	struct crypto_aead *cryptd_child;
++	struct aesni_rfc4106_gcm_ctx *child_ctx;
+ 	cryptd_tfm = cryptd_alloc_aead("__driver-gcm-aes-aesni", 0, 0);
+ 	if (IS_ERR(cryptd_tfm))
+ 		return PTR_ERR(cryptd_tfm);
++
++	cryptd_child = cryptd_aead_child(cryptd_tfm);
++	child_ctx = aesni_rfc4106_gcm_ctx_get(cryptd_child);
++	memcpy(child_ctx, ctx, sizeof(*ctx));
+ 	ctx->cryptd_tfm = cryptd_tfm;
+ 	tfm->crt_aead.reqsize = sizeof(struct aead_request)
+ 		+ crypto_aead_reqsize(&cryptd_tfm->base);
+@@ -925,6 +931,9 @@ static int rfc4106_set_key(struct crypto
+ 	int ret = 0;
+ 	struct crypto_tfm *tfm = crypto_aead_tfm(parent);
+ 	struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(parent);
++	struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
++	struct aesni_rfc4106_gcm_ctx *child_ctx =
++                                 aesni_rfc4106_gcm_ctx_get(cryptd_child);
+ 	u8 *new_key_mem = NULL;
+ 
+ 	if (key_len < 4) {
+@@ -968,6 +977,7 @@ static int rfc4106_set_key(struct crypto
+ 		goto exit;
+ 	}
+ 	ret = rfc4106_set_hash_subkey(ctx->hash_subkey, key, key_len);
++	memcpy(child_ctx, ctx, sizeof(*ctx));
+ exit:
+ 	kfree(new_key_mem);
+ 	return ret;
+@@ -999,7 +1009,6 @@ static int rfc4106_encrypt(struct aead_r
+ 	int ret;
+ 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ 	struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm);
+-	struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
+ 
+ 	if (!irq_fpu_usable()) {
+ 		struct aead_request *cryptd_req =
+@@ -1008,6 +1017,7 @@ static int rfc4106_encrypt(struct aead_r
+ 		aead_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base);
+ 		return crypto_aead_encrypt(cryptd_req);
+ 	} else {
++		struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
+ 		kernel_fpu_begin();
+ 		ret = cryptd_child->base.crt_aead.encrypt(req);
+ 		kernel_fpu_end();
+@@ -1020,7 +1030,6 @@ static int rfc4106_decrypt(struct aead_r
+ 	int ret;
+ 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ 	struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm);
+-	struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
+ 
+ 	if (!irq_fpu_usable()) {
+ 		struct aead_request *cryptd_req =
+@@ -1029,6 +1038,7 @@ static int rfc4106_decrypt(struct aead_r
+ 		aead_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base);
+ 		return crypto_aead_decrypt(cryptd_req);
+ 	} else {
++		struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
+ 		kernel_fpu_begin();
+ 		ret = cryptd_child->base.crt_aead.decrypt(req);
+ 		kernel_fpu_end();