bump to 2.6.38.3

1 files changed, 1923 insertions, 0 deletions

diff --git a/patches/kernel-2.6.38.4-pre.patch b/patches/kernel-2.6.38.4-pre.patch
new file mode 100644
index 0000000..1e5ac15
--- /dev/null
+++ b/patches/kernel-2.6.38.4-pre.patch
@@ -0,0 +1,1923 @@
+From a626ca6a656450e9f4df91d0dda238fff23285f4 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 13 Apr 2011 08:07:28 -0700
+Subject: vm: fix vm_pgoff wrap in stack expansion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit a626ca6a656450e9f4df91d0dda238fff23285f4 upstream.
+
+Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed
+the case of a expanding mapping causing vm_pgoff wrapping when you used
+mremap.  But there was another case where we expand mappings hiding in
+plain sight: the automatic stack expansion.
+
+This fixes that case too.
+
+This one also found by Robert Święcki, using his nasty system call
+fuzzer tool.  Good job.
+
+Reported-and-tested-by: Robert Święcki <robert@swiecki.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mmap.c |   13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1814,11 +1814,14 @@ static int expand_downwards(struct vm_ar
+ 		size = vma->vm_end - address;
+ 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
+ 
+-		error = acct_stack_growth(vma, size, grow);
+-		if (!error) {
+-			vma->vm_start = address;
+-			vma->vm_pgoff -= grow;
+-			perf_event_mmap(vma);
++		error = -ENOMEM;
++		if (grow <= vma->vm_pgoff) {
++			error = acct_stack_growth(vma, size, grow);
++			if (!error) {
++				vma->vm_start = address;
++				vma->vm_pgoff -= grow;
++				perf_event_mmap(vma);
++			}
+ 		}
+ 	}
+ 	vma_unlock_anon_vma(vma);
+From 9bb09fa1b5b07459279301ac6220d575f307597b Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 7 Apr 2011 10:31:25 -0400
+Subject: drm/radeon/kms: pll tweaks for rv6xx
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 9bb09fa1b5b07459279301ac6220d575f307597b upstream.
+
+Prefer minm over maxp.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=35994
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -531,6 +531,12 @@ static u32 atombios_adjust_pll(struct dr
+ 			pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
+ 		else
+ 			pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
++
++		if ((rdev->family == CHIP_R600) ||
++		    (rdev->family == CHIP_RV610) ||
++		    (rdev->family == CHIP_RV630) ||
++		    (rdev->family == CHIP_RV670))
++			pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ 	} else {
+ 		pll->flags |= RADEON_PLL_LEGACY;
+ 
+From 71e16bfbd2b1c63d4d97cc5059694c9346aee340 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Tue, 12 Apr 2011 13:33:27 -0400
+Subject: drm/radeon/kms: fix suspend on rv530 asics
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 71e16bfbd2b1c63d4d97cc5059694c9346aee340 upstream.
+
+Apparently only rv515 asics need the workaround
+added in f24d86f1a49505cdea56728b853a5d0a3f8e3d11
+(drm/radeon/kms: fix resume regression for some r5xx laptops).
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=34709
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atom.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -32,6 +32,7 @@
+ #include "atom.h"
+ #include "atom-names.h"
+ #include "atom-bits.h"
++#include "radeon.h"
+ 
+ #define ATOM_COND_ABOVE		0
+ #define ATOM_COND_ABOVEOREQUAL	1
+@@ -101,7 +102,9 @@ static void debug_print_spaces(int n)
+ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ 				 uint32_t index, uint32_t data)
+ {
++	struct radeon_device *rdev = ctx->card->dev->dev_private;
+ 	uint32_t temp = 0xCDCDCDCD;
++
+ 	while (1)
+ 		switch (CU8(base)) {
+ 		case ATOM_IIO_NOP:
+@@ -112,7 +115,8 @@ static uint32_t atom_iio_execute(struct
+ 			base += 3;
+ 			break;
+ 		case ATOM_IIO_WRITE:
+-			(void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
++			if (rdev->family == CHIP_RV515)
++				(void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
+ 			ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
+ 			base += 3;
+ 			break;
+From 70945643722ffeac779d2529a348f99567fa5c33 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 14 Mar 2011 13:48:08 -0400
+Subject: cifs: always do is_path_accessible check in cifs_mount
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 70945643722ffeac779d2529a348f99567fa5c33 upstream.
+
+Currently, we skip doing the is_path_accessible check in cifs_mount if
+there is no prefixpath. I have a report of at least one server however
+that allows a TREE_CONNECT to a share that has a DFS referral at its
+root. The reporter in this case was using a UNC that had no prefixpath,
+so the is_path_accessible check was not triggered and the box later hit
+a BUG() because we were chasing a DFS referral on the root dentry for
+the mount.
+
+This patch fixes this by removing the check for a zero-length
+prefixpath.  That should make the is_path_accessible check be done in
+this situation and should allow the client to chase the DFS referral at
+mount time instead.
+
+Reported-and-Tested-by: Yogesh Sharma <ysharma@cymer.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2826,7 +2826,7 @@ try_mount_again:
+ 
+ remote_path_check:
+ 	/* check if a whole path (including prepath) is not remote */
+-	if (!rc && cifs_sb->prepathlen && tcon) {
++	if (!rc && tcon) {
+ 		/* build_path_to_root works only when we have a valid tcon */
+ 		full_path = cifs_build_path_to_root(cifs_sb, tcon);
+ 		if (full_path == NULL) {
+From 7797069305d13252fd66cf722aa8f2cbeb3c95cd Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 5 Apr 2011 16:23:47 -0700
+Subject: cifs: check for private_data before trying to put it
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 7797069305d13252fd66cf722aa8f2cbeb3c95cd upstream.
+
+cifs_close doesn't check that the filp->private_data is non-NULL before
+trying to put it. That can cause an oops in certain error conditions
+that can occur on open or lookup before the private_data is set.
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/file.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -575,8 +575,10 @@ reopen_error_exit:
+ 
+ int cifs_close(struct inode *inode, struct file *file)
+ {
+-	cifsFileInfo_put(file->private_data);
+-	file->private_data = NULL;
++	if (file->private_data != NULL) {
++		cifsFileInfo_put(file->private_data);
++		file->private_data = NULL;
++	}
+ 
+ 	/* return code from the ->release op is always ignored */
+ 	return 0;
+From 2b6c26a0a62cc0bab0ad487533d5581d7c293fef Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Fri, 25 Mar 2011 16:25:57 -0400
+Subject: cifs: set ra_pages in backing_dev_info
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 2b6c26a0a62cc0bab0ad487533d5581d7c293fef upstream.
+
+Commit 522440ed made cifs set backing_dev_info on the mapping attached
+to new inodes. This change caused a fairly significant read performance
+regression, as cifs started doing page-sized reads exclusively.
+
+By virtue of the fact that they're allocated as part of cifs_sb_info by
+kzalloc, the ra_pages on cifs BDIs get set to 0, which prevents any
+readahead. This forces the normal read codepaths to use readpage instead
+of readpages causing a four-fold increase in the number of read calls
+with the default rsize.
+
+Fix it by setting ra_pages in the BDI to the same value as that in the
+default_backing_dev_info.
+
+Fixes https://bugzilla.kernel.org/show_bug.cgi?id=31662
+
+Reported-and-Tested-by: Till <till2.schaefer@uni-dortmund.de>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsfs.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -127,6 +127,7 @@ cifs_read_super(struct super_block *sb,
+ 		kfree(cifs_sb);
+ 		return rc;
+ 	}
++	cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
+ 
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+ 	/* copy mount params to sb for use in submounts */
+From 157c249114508aa71daa308a426e15d81a4eed00 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Sat, 2 Apr 2011 07:34:30 -0400
+Subject: cifs: wrap received signature check in srv_mutex
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 157c249114508aa71daa308a426e15d81a4eed00 upstream.
+
+While testing my patchset to fix asynchronous writes, I hit a bunch
+of signature problems when testing with signing on. The problem seems
+to be that signature checks on receive can be running at the same
+time as a process that is sending, or even that multiple receives can
+be checking signatures at the same time, clobbering the same data
+structures.
+
+While we're at it, clean up the comments over cifs_calculate_signature
+and add a note that the srv_mutex should be held when calling this
+function.
+
+This patch seems to fix the problems for me, but I'm not clear on
+whether it's the best approach. If it is, then this should probably
+go to stable too.
+
+Cc: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsencrypt.c |   15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -30,12 +30,13 @@
+ #include <linux/ctype.h>
+ #include <linux/random.h>
+ 
+-/* Calculate and return the CIFS signature based on the mac key and SMB PDU */
+-/* the 16 byte signature must be allocated by the caller  */
+-/* Note we only use the 1st eight bytes */
+-/* Note that the smb header signature field on input contains the
+-	sequence number before this function is called */
+-
++/*
++ * Calculate and return the CIFS signature based on the mac key and SMB PDU.
++ * The 16 byte signature must be allocated by the caller. Note we only use the
++ * 1st eight bytes and that the smb header signature field on input contains
++ * the sequence number before this function is called. Also, this function
++ * should be called with the server->srv_mutex held.
++ */
+ static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
+ 				struct TCP_Server_Info *server, char *signature)
+ {
+@@ -209,8 +210,10 @@ int cifs_verify_signature(struct smb_hdr
+ 					cpu_to_le32(expected_sequence_number);
+ 	cifs_pdu->Signature.Sequence.Reserved = 0;
+ 
++	mutex_lock(&server->srv_mutex);
+ 	rc = cifs_calculate_signature(cifs_pdu, server,
+ 		what_we_think_sig_should_be);
++	mutex_unlock(&server->srv_mutex);
+ 
+ 	if (rc)
+ 		return rc;
+From 14ddc3188d50855ae2a419a6aced995e2834e5d4 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Fri, 4 Feb 2011 09:23:33 -0300
+Subject: [media] video: sn9c102: world-wirtable sysfs files
+
+From: Vasiliy Kulikov <segoon@openwall.com>
+
+commit 14ddc3188d50855ae2a419a6aced995e2834e5d4 upstream.
+
+Don't allow everybody to change video settings.
+
+Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Acked-by: Luca Risolia <luca.risolia@studio.unibo.it>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/sn9c102/sn9c102_core.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/video/sn9c102/sn9c102_core.c
++++ b/drivers/media/video/sn9c102/sn9c102_core.c
+@@ -1430,9 +1430,9 @@ static DEVICE_ATTR(i2c_reg, S_IRUGO | S_
+ 		   sn9c102_show_i2c_reg, sn9c102_store_i2c_reg);
+ static DEVICE_ATTR(i2c_val, S_IRUGO | S_IWUSR,
+ 		   sn9c102_show_i2c_val, sn9c102_store_i2c_val);
+-static DEVICE_ATTR(green, S_IWUGO, NULL, sn9c102_store_green);
+-static DEVICE_ATTR(blue, S_IWUGO, NULL, sn9c102_store_blue);
+-static DEVICE_ATTR(red, S_IWUGO, NULL, sn9c102_store_red);
++static DEVICE_ATTR(green, S_IWUSR, NULL, sn9c102_store_green);
++static DEVICE_ATTR(blue, S_IWUSR, NULL, sn9c102_store_blue);
++static DEVICE_ATTR(red, S_IWUSR, NULL, sn9c102_store_red);
+ static DEVICE_ATTR(frame_header, S_IRUGO, sn9c102_show_frame_header, NULL);
+ 
+ 
+From 8c559d30b4e59cf6994215ada1fe744928f494bf Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Fri, 4 Feb 2011 15:24:19 +0300
+Subject: UBIFS: restrict world-writable debugfs files
+
+From: Vasiliy Kulikov <segoon@openwall.com>
+
+commit 8c559d30b4e59cf6994215ada1fe744928f494bf upstream.
+
+Don't allow everybody to dump sensitive information about filesystems.
+
+Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/debug.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -2844,19 +2844,19 @@ int dbg_debugfs_init_fs(struct ubifs_inf
+ 	}
+ 
+ 	fname = "dump_lprops";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_lprops = dent;
+ 
+ 	fname = "dump_budg";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_budg = dent;
+ 
+ 	fname = "dump_tnc";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_tnc = dent;
+From c6b358748e19ce7e230b0926ac42696bc485a562 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 28 Mar 2011 12:05:31 +0200
+Subject: ALSA: hda - Fix pin-config of Gigabyte mobo
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c6b358748e19ce7e230b0926ac42696bc485a562 upstream.
+
+Use pin-fix instead of the static quirk for Gigabyte mobos 1458:a002.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=677256
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c |   21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9932,7 +9932,6 @@ static struct snd_pci_quirk alc882_cfg_t
+ 	SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD),
+ 	SND_PCI_QUIRK(0x10f1, 0x2350, "TYAN-S2350", ALC888_6ST_DELL),
+ 	SND_PCI_QUIRK(0x108e, 0x534d, NULL, ALC883_3ST_6ch),
+-	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P35 DS3R", ALC882_6ST_DIG),
+ 
+ 	SND_PCI_QUIRK(0x1462, 0x0349, "MSI", ALC883_TARGA_2ch_DIG),
+ 	SND_PCI_QUIRK(0x1462, 0x040d, "MSI", ALC883_TARGA_2ch_DIG),
+@@ -10769,6 +10768,7 @@ enum {
+ 	PINFIX_LENOVO_Y530,
+ 	PINFIX_PB_M5210,
+ 	PINFIX_ACER_ASPIRE_7736,
++	PINFIX_GIGABYTE_880GM,
+ };
+ 
+ static const struct alc_fixup alc882_fixups[] = {
+@@ -10800,6 +10800,13 @@ static const struct alc_fixup alc882_fix
+ 		.type = ALC_FIXUP_SKU,
+ 		.v.sku = ALC_FIXUP_SKU_IGNORE,
+ 	},
++	[PINFIX_GIGABYTE_880GM] = {
++		.type = ALC_FIXUP_PINS,
++		.v.pins = (const struct alc_pincfg[]) {
++			{ 0x14, 0x1114410 }, /* set as speaker */
++			{ }
++		}
++	},
+ };
+ 
+ static struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -10807,6 +10814,7 @@ static struct snd_pci_quirk alc882_fixup
+ 	SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530),
+ 	SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX),
+ 	SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", PINFIX_ACER_ASPIRE_7736),
++	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", PINFIX_GIGABYTE_880GM),
+ 	{}
+ };
+ 
+@@ -18851,8 +18859,6 @@ static struct snd_pci_quirk alc662_cfg_t
+ 		      ALC662_3ST_6ch_DIG),
+ 	SND_PCI_QUIRK(0x1179, 0xff6e, "Toshiba NB20x", ALC662_AUTO),
+ 	SND_PCI_QUIRK(0x144d, 0xca00, "Samsung NC10", ALC272_SAMSUNG_NC10),
+-	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte 945GCM-S2L",
+-		      ALC662_3ST_6ch_DIG),
+ 	SND_PCI_QUIRK(0x152d, 0x2304, "Quanta WH1", ALC663_ASUS_H13),
+ 	SND_PCI_QUIRK(0x1565, 0x820f, "Biostar TA780G M2+", ALC662_3ST_6ch_DIG),
+ 	SND_PCI_QUIRK(0x1631, 0xc10c, "PB RS65", ALC663_ASUS_M51VA),
+@@ -19526,6 +19532,7 @@ enum {
+ 	ALC662_FIXUP_IDEAPAD,
+ 	ALC272_FIXUP_MARIO,
+ 	ALC662_FIXUP_CZC_P10T,
++	ALC662_FIXUP_GIGABYTE,
+ };
+ 
+ static const struct alc_fixup alc662_fixups[] = {
+@@ -19554,12 +19561,20 @@ static const struct alc_fixup alc662_fix
+ 			{}
+ 		}
+ 	},
++	[ALC662_FIXUP_GIGABYTE] = {
++		.type = ALC_FIXUP_PINS,
++		.v.pins = (const struct alc_pincfg[]) {
++			{ 0x14, 0x1114410 }, /* set as speaker */
++			{ }
++		}
++	},
+ };
+ 
+ static struct snd_pci_quirk alc662_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+ 	SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
+ 	SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
++	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", ALC662_FIXUP_GIGABYTE),
+ 	SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+ 	SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+ 	SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
+From 468c3f924f043cad7a04f4f4d5224a2c9bc886c1 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Sun, 13 Mar 2011 06:54:31 +0000
+Subject: NET: cdc-phonet, handle empty phonet header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 468c3f924f043cad7a04f4f4d5224a2c9bc886c1 upstream.
+
+Currently, for N 5800 XM I get:
+cdc_phonet: probe of 1-6:1.10 failed with error -22
+
+It's because phonet_header is empty. Extra altsetting looks like
+there:
+E 05 24 00 01 10 03 24 ab 05 24 06 0a 0b 04 24 fd  .$....$..$....$.
+E 00                                               .
+
+I don't see the header used anywhere so just check if the phonet
+descriptor is there, not the structure itself.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Cc: David S. Miller <davem@davemloft.net>
+Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/usb/cdc-phonet.c |    9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/usb/cdc-phonet.c
++++ b/drivers/net/usb/cdc-phonet.c
+@@ -328,13 +328,13 @@ int usbpn_probe(struct usb_interface *in
+ {
+ 	static const char ifname[] = "usbpn%d";
+ 	const struct usb_cdc_union_desc *union_header = NULL;
+-	const struct usb_cdc_header_desc *phonet_header = NULL;
+ 	const struct usb_host_interface *data_desc;
+ 	struct usb_interface *data_intf;
+ 	struct usb_device *usbdev = interface_to_usbdev(intf);
+ 	struct net_device *dev;
+ 	struct usbpn_dev *pnd;
+ 	u8 *data;
++	int phonet = 0;
+ 	int len, err;
+ 
+ 	data = intf->altsetting->extra;
+@@ -355,10 +355,7 @@ int usbpn_probe(struct usb_interface *in
+ 					(struct usb_cdc_union_desc *)data;
+ 				break;
+ 			case 0xAB:
+-				if (phonet_header || dlen < 5)
+-					break;
+-				phonet_header =
+-					(struct usb_cdc_header_desc *)data;
++				phonet = 1;
+ 				break;
+ 			}
+ 		}
+@@ -366,7 +363,7 @@ int usbpn_probe(struct usb_interface *in
+ 		len -= dlen;
+ 	}
+ 
+-	if (!union_header || !phonet_header)
++	if (!union_header || !phonet)
+ 		return -EINVAL;
+ 
+ 	data_intf = usb_ifnum_to_if(usbdev, union_header->bSlaveInterface0);
+From e938c287ea8d977e079f07464ac69923412663ce Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@novell.com>
+Date: Tue, 1 Mar 2011 14:28:02 +0000
+Subject: x86: Fix a bogus unwind annotation in lib/semaphore_32.S
+
+From: Jan Beulich <JBeulich@novell.com>
+
+commit e938c287ea8d977e079f07464ac69923412663ce upstream.
+
+'simple' would have required specifying current frame address
+and return address location manually, but that's obviously not
+the case (and not necessary) here.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+LKML-Reference: <4D6D1082020000780003454C@vpn.id2.novell.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/lib/semaphore_32.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/lib/semaphore_32.S
++++ b/arch/x86/lib/semaphore_32.S
+@@ -36,7 +36,7 @@
+  */
+ #ifdef CONFIG_SMP
+ ENTRY(__write_lock_failed)
+-	CFI_STARTPROC simple
++	CFI_STARTPROC
+ 	FRAME
+ 2: 	LOCK_PREFIX
+ 	addl	$ RW_LOCK_BIAS,(%eax)
+From b4a6b3436531f6c5256e6d60d388c3c28ff1a0e9 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Thu, 24 Feb 2011 15:33:24 -0500
+Subject: [IA64] tioca: Fix assignment from incompatible pointer warnings
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit b4a6b3436531f6c5256e6d60d388c3c28ff1a0e9 upstream.
+
+The prototype for sn_pci_provider->{dma_map,dma_map_consistent} expects
+an unsigned long instead of a u64.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/sn/pci/tioca_provider.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/ia64/sn/pci/tioca_provider.c
++++ b/arch/ia64/sn/pci/tioca_provider.c
+@@ -509,7 +509,7 @@ tioca_dma_unmap(struct pci_dev *pdev, dm
+  * use the GART mapped mode.
+  */
+ static u64
+-tioca_dma_map(struct pci_dev *pdev, u64 paddr, size_t byte_count, int dma_flags)
++tioca_dma_map(struct pci_dev *pdev, unsigned long paddr, size_t byte_count, int dma_flags)
+ {
+ 	u64 mapaddr;
+ 
+From c1d036c4d1cb00b7e8473a2ad0a78f13e13a8183 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Thu, 24 Feb 2011 17:23:09 -0500
+Subject: [IA64] mca.c: Fix cast from integer to pointer warning
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit c1d036c4d1cb00b7e8473a2ad0a78f13e13a8183 upstream.
+
+ia64_mca_cpu_init has a void *data local variable that is assigned
+the value from either __get_free_pages() or mca_bootmem(). The problem
+is that __get_free_pages returns an unsigned long and mca_bootmem, via
+alloc_bootmem(), returns a void *. format_mca_init_stack takes the void *,
+and it's also used with __pa(), but that casts it to long anyway.
+
+This results in the following build warning:
+
+arch/ia64/kernel/mca.c:1898: warning: assignment makes pointer from
+integer without a cast
+
+Cast the return of __get_free_pages to a void * to avoid
+the warning.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/kernel/mca.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/ia64/kernel/mca.c
++++ b/arch/ia64/kernel/mca.c
+@@ -1859,7 +1859,8 @@ ia64_mca_cpu_init(void *cpu_data)
+ 			data = mca_bootmem();
+ 			first_time = 0;
+ 		} else
+-			data = __get_free_pages(GFP_KERNEL, get_order(sz));
++			data = (void *)__get_free_pages(GFP_KERNEL,
++							get_order(sz));
+ 		if (!data)
+ 			panic("Could not allocate MCA memory for cpu %d\n",
+ 					cpu);
+From 95042f9eb78a8d9a17455e2ef263f2f310ecef15 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 12 Apr 2011 14:15:51 -0700
+Subject: vm: fix mlock() on stack guard page
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 95042f9eb78a8d9a17455e2ef263f2f310ecef15 upstream.
+
+Commit 53a7706d5ed8 ("mlock: do not hold mmap_sem for extended periods
+of time") changed mlock() to care about the exact number of pages that
+__get_user_pages() had brought it.  Before, it would only care about
+errors.
+
+And that doesn't work, because we also handled one page specially in
+__mlock_vma_pages_range(), namely the stack guard page.  So when that
+case was handled, the number of pages that the function returned was off
+by one.  In particular, it could be zero, and then the caller would end
+up not making any progress at all.
+
+Rather than try to fix up that off-by-one error for the mlock case
+specially, this just moves the logic to handle the stack guard page
+into__get_user_pages() itself, thus making all the counts come out
+right automatically.
+
+Reported-by: Robert Święcki <robert@swiecki.net>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ mm/memory.c |   26 ++++++++++++++++++--------
+ mm/mlock.c  |   13 -------------
+ 2 files changed, 18 insertions(+), 21 deletions(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1410,6 +1410,13 @@ no_page_table:
+ 	return page;
+ }
+ 
++static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
++{
++	return (vma->vm_flags & VM_GROWSDOWN) &&
++		(vma->vm_start == addr) &&
++		!vma_stack_continue(vma->vm_prev, addr);
++}
++
+ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ 		     unsigned long start, int nr_pages, unsigned int gup_flags,
+ 		     struct page **pages, struct vm_area_struct **vmas,
+@@ -1439,7 +1446,6 @@ int __get_user_pages(struct task_struct
+ 		vma = find_extend_vma(mm, start);
+ 		if (!vma && in_gate_area(tsk, start)) {
+ 			unsigned long pg = start & PAGE_MASK;
+-			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
+ 			pgd_t *pgd;
+ 			pud_t *pud;
+ 			pmd_t *pmd;
+@@ -1464,10 +1470,11 @@ int __get_user_pages(struct task_struct
+ 				pte_unmap(pte);
+ 				return i ? : -EFAULT;
+ 			}
++			vma = get_gate_vma(tsk);
+ 			if (pages) {
+ 				struct page *page;
+ 
+-				page = vm_normal_page(gate_vma, start, *pte);
++				page = vm_normal_page(vma, start, *pte);
+ 				if (!page) {
+ 					if (!(gup_flags & FOLL_DUMP) &&
+ 					     is_zero_pfn(pte_pfn(*pte)))
+@@ -1481,12 +1488,7 @@ int __get_user_pages(struct task_struct
+ 				get_page(page);
+ 			}
+ 			pte_unmap(pte);
+-			if (vmas)
+-				vmas[i] = gate_vma;
+-			i++;
+-			start += PAGE_SIZE;
+-			nr_pages--;
+-			continue;
++			goto next_page;
+ 		}
+ 
+ 		if (!vma ||
+@@ -1500,6 +1502,13 @@ int __get_user_pages(struct task_struct
+ 			continue;
+ 		}
+ 
++		/*
++		 * If we don't actually want the page itself,
++		 * and it's the stack guard page, just skip it.
++		 */
++		if (!pages && stack_guard_page(vma, start))
++			goto next_page;
++
+ 		do {
+ 			struct page *page;
+ 			unsigned int foll_flags = gup_flags;
+@@ -1569,6 +1578,7 @@ int __get_user_pages(struct task_struct
+ 				flush_anon_page(vma, page, start);
+ 				flush_dcache_page(page);
+ 			}
++next_page:
+ 			if (vmas)
+ 				vmas[i] = vma;
+ 			i++;
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -135,13 +135,6 @@ void munlock_vma_page(struct page *page)
+ 	}
+ }
+ 
+-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
+-{
+-	return (vma->vm_flags & VM_GROWSDOWN) &&
+-		(vma->vm_start == addr) &&
+-		!vma_stack_continue(vma->vm_prev, addr);
+-}
+-
+ /**
+  * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
+  * @vma:   target vma
+@@ -188,12 +181,6 @@ static long __mlock_vma_pages_range(stru
+ 	if (vma->vm_flags & VM_LOCKED)
+ 		gup_flags |= FOLL_MLOCK;
+ 
+-	/* We don't try to access the guard page of a stack vma */
+-	if (stack_guard_page(vma, start)) {
+-		addr += PAGE_SIZE;
+-		nr_pages--;
+-	}
+-
+ 	return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
+ 				NULL, NULL, nonblocking);
+ }
+From c88ac00c5af70c2a0741da14b22cdcf8507ddd92 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Date: Tue, 29 Mar 2011 09:45:21 +0300
+Subject: UBIFS: fix assertion warnings
+
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+
+commit c88ac00c5af70c2a0741da14b22cdcf8507ddd92 upstream.
+
+This patch fixes UBIFS assertion warnings like:
+
+UBIFS assert failed in ubifs_leb_unmap at 135 (pid 29365)
+Pid: 29365, comm: integck Tainted: G          I 2.6.37-ubi-2.6+ #34
+Call Trace:
+ [<ffffffffa047c663>] ubifs_lpt_init+0x95e/0x9ee [ubifs]
+ [<ffffffffa04623a7>] ubifs_remount_fs+0x2c7/0x762 [ubifs]
+ [<ffffffff810f066e>] do_remount_sb+0xb6/0x101
+ [<ffffffff81106ff4>] ? do_mount+0x191/0x78e
+ [<ffffffff811070bb>] do_mount+0x258/0x78e
+ [<ffffffff810da1e8>] ? alloc_pages_current+0xa2/0xc5
+ [<ffffffff81107674>] sys_mount+0x83/0xbd
+ [<ffffffff81009a12>] system_call_fastpath+0x16/0x1b
+
+They happen when we re-mount from R/O mode to R/W mode. While
+re-mounting, we write to the media, but we still have the c->ro_mount
+flag set. The fix is very simple - just clear the flag before
+starting re-mounting R/W.
+
+These warnings are caused by the following commit:
+2ef13294d29bcfb306e0d360f1b97f37b647b0c0
+
+For -stable guys: this bug was introduced in 2.6.38, this is materieal
+for 2.6.38-stable.
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/super.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1543,6 +1543,7 @@ static int ubifs_remount_rw(struct ubifs
+ 	mutex_lock(&c->umount_mutex);
+ 	dbg_save_space_info(c);
+ 	c->remounting_rw = 1;
++	c->ro_mount = 0;
+ 	c->always_chk_crc = 1;
+ 
+ 	err = check_free_space(c);
+@@ -1648,7 +1649,6 @@ static int ubifs_remount_rw(struct ubifs
+ 	}
+ 
+ 	dbg_gen("re-mounted read-write");
+-	c->ro_mount = 0;
+ 	c->remounting_rw = 0;
+ 	c->always_chk_crc = 0;
+ 	err = dbg_check_space_info(c);
+@@ -1656,6 +1656,7 @@ static int ubifs_remount_rw(struct ubifs
+ 	return err;
+ 
+ out:
++	c->ro_mount = 1;
+ 	vfree(c->orph_buf);
+ 	c->orph_buf = NULL;
+ 	if (c->bgt) {
+From ab711fe08297de1485fff0a366e6db8828cafd6a Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Thu, 31 Mar 2011 10:29:26 +0200
+Subject: perf: Fix task context scheduling
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit ab711fe08297de1485fff0a366e6db8828cafd6a upstream.
+
+Jiri reported:
+
+ |
+ | - once an event is created by sys_perf_event_open, task context
+ |   is created and it stays even if the event is closed, until the
+ |   task is finished ... thats what I see in code and I assume it's
+ |   correct
+ |
+ | - when the task opens event, perf_sched_events jump label is
+ |   incremented and following callbacks are started from scheduler
+ |
+ |         __perf_event_task_sched_in
+ |         __perf_event_task_sched_out
+ |
+ |   These callback *in/out set/unset cpuctx->task_ctx value to the
+ |   task context.
+ |
+ | - close is called on event on CPU 0:
+ |         - the task is scheduled on CPU 0
+ |         - __perf_event_task_sched_in is called
+ |         - cpuctx->task_ctx is set
+ |         - perf_sched_events jump label is decremented and == 0
+ |         - __perf_event_task_sched_out is not called
+ |         - cpuctx->task_ctx on CPU 0 stays set
+ |
+ | - exit is called on CPU 1:
+ |         - the task is scheduled on CPU 1
+ |         - perf_event_exit_task is called
+ |         - task_ctx_sched_out unsets cpuctx->task_ctx on CPU 1
+ |         - put_ctx destroys the context
+ |
+ | - another call of perf_rotate_context on CPU 0 will use invalid
+ |   task_ctx pointer, and eventualy panic.
+ |
+
+Cure this the simplest possibly way by partially reverting the
+jump_label optimization for the sched_out case.
+
+Reported-and-tested-by: Jiri Olsa <jolsa@redhat.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Oleg Nesterov <oleg@redhat.com>
+LKML-Reference: <1301520405.4859.213.camel@twins>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/perf_event.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -1052,7 +1052,7 @@ void perf_event_task_sched_out(struct ta
+ {
+ 	perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 1, NULL, 0);
+ 
+-	COND_STMT(&perf_task_events, __perf_event_task_sched_out(task, next));
++	__perf_event_task_sched_out(task, next);
+ }
+ 
+ extern void perf_event_mmap(struct vm_area_struct *vma);
+From 30ae9139dc3b44d14a56fbbc2a3f8f63aa586a17 Mon Sep 17 00:00:00 2001
+From: Linus Lüssing <linus.luessing@web.de>
+Date: Tue, 22 Mar 2011 11:40:32 +0000
+Subject: bridge: Fix possibly wrong MLD queries' ethernet source address
+
+
+From: Linus Lüssing <linus.luessing@web.de>
+
+[ Upstream commit a7bff75b087e7a355838a32efe61707cfa73c194 ]
+
+The ipv6_dev_get_saddr() is currently called with an uninitialized
+destination address. Although in tests it usually seemed to nevertheless
+always fetch the right source address, there seems to be a possible race
+condition.
+
+Therefore this commit changes this, first setting the destination
+address and only after that fetching the source address.
+
+Reported-by: Jan Beulich <JBeulich@novell.com>
+Signed-off-by: Linus Lüssing <linus.luessing@web.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_multicast.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -445,9 +445,9 @@ static struct sk_buff *br_ip6_multicast_
+ 	ip6h->payload_len = htons(8 + sizeof(*mldq));
+ 	ip6h->nexthdr = IPPROTO_HOPOPTS;
+ 	ip6h->hop_limit = 1;
++	ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
+ 	ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+ 			   &ip6h->saddr);
+-	ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
+ 	ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
+ 
+ 	hopopt = (u8 *)(ip6h + 1);
+From 228f4d04e7d7a239b4c44e6f329aaec88f40e54a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 30 Mar 2011 16:57:46 -0700
+Subject: fib: add rtnl locking in ip_fib_net_exit
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit e2666f84958adb3a034b98e99699b55705117e01 ]
+
+Daniel J Blueman reported a lockdep splat in trie_firstleaf(), caused by
+RTNL being not locked before a call to fib_table_flush()
+
+Reported-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/fib_frontend.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1041,6 +1041,7 @@ static void ip_fib_net_exit(struct net *
+ 	fib4_rules_exit(net);
+ #endif
+ 
++	rtnl_lock();
+ 	for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
+ 		struct fib_table *tb;
+ 		struct hlist_head *head;
+@@ -1053,6 +1054,7 @@ static void ip_fib_net_exit(struct net *
+ 			fib_free_table(tb);
+ 		}
+ 	}
++	rtnl_unlock();
+ 	kfree(net->ipv4.fib_table_hash);
+ }
+ 
+From 4dbd99fd8453ae681dad8fc1e7aa2c05e16b0cc1 Mon Sep 17 00:00:00 2001
+From: Alex Dubov <oakad@yahoo.com>
+Date: Wed, 16 Mar 2011 17:57:13 +0000
+Subject: gianfar: Fall back to software tcp/udp checksum on older controllers
+
+
+From: Alex Dubov <oakad@yahoo.com>
+
+[ Upstream commit 4363c2fddb1399b728ef21ee8101c148a311ea45 ]
+
+As specified by errata eTSEC49 of MPC8548 and errata eTSEC12 of MPC83xx,
+older revisions of gianfar controllers will be unable to calculate a TCP/UDP
+packet checksum for some alignments of the appropriate FCB. This patch checks
+for FCB alignment on such controllers and falls back to software checksumming
+if the alignment is known to be bad.
+
+Signed-off-by: Alex Dubov <oakad@yahoo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/gianfar.c |   16 ++++++++++++++--
+ drivers/net/gianfar.h |    1 +
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/gianfar.c
++++ b/drivers/net/gianfar.c
+@@ -950,6 +950,11 @@ static void gfar_detect_errata(struct gf
+ 			(pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
+ 		priv->errata |= GFAR_ERRATA_A002;
+ 
++	/* MPC8313 Rev < 2.0, MPC8548 rev 2.0 */
++	if ((pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020) ||
++			(pvr == 0x80210020 && mod == 0x8030 && rev == 0x0020))
++		priv->errata |= GFAR_ERRATA_12;
++
+ 	if (priv->errata)
+ 		dev_info(dev, "enabled errata workarounds, flags: 0x%x\n",
+ 			 priv->errata);
+@@ -2156,8 +2161,15 @@ static int gfar_start_xmit(struct sk_buf
+ 	/* Set up checksumming */
+ 	if (CHECKSUM_PARTIAL == skb->ip_summed) {
+ 		fcb = gfar_add_fcb(skb);
+-		lstatus |= BD_LFLAG(TXBD_TOE);
+-		gfar_tx_checksum(skb, fcb);
++		/* as specified by errata */
++		if (unlikely(gfar_has_errata(priv, GFAR_ERRATA_12)
++			     && ((unsigned long)fcb % 0x20) > 0x18)) {
++			__skb_pull(skb, GMAC_FCB_LEN);
++			skb_checksum_help(skb);
++		} else {
++			lstatus |= BD_LFLAG(TXBD_TOE);
++			gfar_tx_checksum(skb, fcb);
++		}
+ 	}
+ 
+ 	if (vlan_tx_tag_present(skb)) {
+--- a/drivers/net/gianfar.h
++++ b/drivers/net/gianfar.h
+@@ -1039,6 +1039,7 @@ enum gfar_errata {
+ 	GFAR_ERRATA_74		= 0x01,
+ 	GFAR_ERRATA_76		= 0x02,
+ 	GFAR_ERRATA_A002	= 0x04,
++	GFAR_ERRATA_12		= 0x08, /* a.k.a errata eTSEC49 */
+ };
+ 
+ /* Struct stolen almost completely (and shamelessly) from the FCC enet source
+From 2f288c99c4ba53a7ddbb5a7a77e42ae72d6da3b9 Mon Sep 17 00:00:00 2001
+From: James Chapman <jchapman@katalix.com>
+Date: Mon, 21 Mar 2011 18:10:25 -0700
+Subject: l2tp: fix possible oops on l2tp_eth module unload
+
+
+From: James Chapman <jchapman@katalix.com>
+
+[ Upstream commit 8aa525a9340da4227797a06221ca08399006635f ]
+
+A struct used in the l2tp_eth driver for registering network namespace
+ops was incorrectly marked as __net_initdata, leading to oops when
+module unloaded.
+
+BUG: unable to handle kernel paging request at ffffffffa00ec098
+IP: [<ffffffff8123dbd8>] ops_exit_list+0x7/0x4b
+PGD 142d067 PUD 1431063 PMD 195da8067 PTE 0
+Oops: 0000 [#1] SMP
+last sysfs file: /sys/module/l2tp_eth/refcnt
+Call Trace:
+ [<ffffffff8123dc94>] ? unregister_pernet_operations+0x32/0x93
+ [<ffffffff8123dd20>] ? unregister_pernet_device+0x2b/0x38
+ [<ffffffff81068b6e>] ? sys_delete_module+0x1b8/0x222
+ [<ffffffff810c7300>] ? do_munmap+0x254/0x318
+ [<ffffffff812c64e5>] ? page_fault+0x25/0x30
+ [<ffffffff812c6952>] ? system_call_fastpath+0x16/0x1b
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/l2tp/l2tp_eth.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/l2tp/l2tp_eth.c
++++ b/net/l2tp/l2tp_eth.c
+@@ -283,7 +283,7 @@ static __net_init int l2tp_eth_init_net(
+ 	return 0;
+ }
+ 
+-static __net_initdata struct pernet_operations l2tp_eth_net_ops = {
++static struct pernet_operations l2tp_eth_net_ops = {
+ 	.init = l2tp_eth_init_net,
+ 	.id   = &l2tp_eth_net_id,
+ 	.size = sizeof(struct l2tp_eth_net),
+From c751cf0998164651824e1f68d124110d448d5ec3 Mon Sep 17 00:00:00 2001
+From: Eric W. Biederman <ebiederm@aristanetworks.com>
+Date: Mon, 21 Mar 2011 18:23:34 -0700
+Subject: net ipv6: Fix duplicate /proc/sys/net/ipv6/neigh directory entries.
+
+
+From: Eric W. Biederman <ebiederm@aristanetworks.com>
+
+[ Upstream commit 9d2a8fa96a44ba242de3a6f56acaef7a40a97b97 ]
+
+When I was fixing issues with unregisgtering tables under /proc/sys/net/ipv6/neigh
+by adding a mount point it appears I missed a critical ordering issue, in the
+ipv6 initialization.  I had not realized that ipv6_sysctl_register is called
+at the very end of the ipv6 initialization and in particular after we call
+neigh_sysctl_register from ndisc_init.
+
+"neigh" needs to be initialized in ipv6_static_sysctl_register which is
+the first ipv6 table to initialized, and definitely before ndisc_init.
+This removes the weirdness of duplicate tables while still providing a
+"neigh" mount point which prevents races in sysctl unregistering.
+
+This was initially reported at https://bugzilla.kernel.org/show_bug.cgi?id=31232
+Reported-by: sunkan@zappa.cx
+Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv6/sysctl_net_ipv6.c |   18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/net/ipv6/sysctl_net_ipv6.c
++++ b/net/ipv6/sysctl_net_ipv6.c
+@@ -17,6 +17,16 @@
+ 
+ static struct ctl_table empty[1];
+ 
++static ctl_table ipv6_static_skeleton[] = {
++	{
++		.procname	= "neigh",
++		.maxlen		= 0,
++		.mode		= 0555,
++		.child		= empty,
++	},
++	{ }
++};
++
+ static ctl_table ipv6_table_template[] = {
+ 	{
+ 		.procname	= "route",
+@@ -37,12 +47,6 @@ static ctl_table ipv6_table_template[] =
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
+-	{
+-		.procname	= "neigh",
+-		.maxlen		= 0,
+-		.mode		= 0555,
+-		.child		= empty,
+-	},
+ 	{ }
+ };
+ 
+@@ -160,7 +164,7 @@ static struct ctl_table_header *ip6_base
+ 
+ int ipv6_static_sysctl_register(void)
+ {
+-	ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
++	ip6_base = register_sysctl_paths(net_ipv6_ctl_path, ipv6_static_skeleton);
+ 	if (ip6_base == NULL)
+ 		return -ENOMEM;
+ 	return 0;
+From f041eaa28a108f73cf02e7059cf0616dfd43b232 Mon Sep 17 00:00:00 2001
+From: Dan Siemon <dan@coverfire.com>
+Date: Tue, 15 Mar 2011 13:56:07 +0000
+Subject: net_sched: fix ip_tos2prio
+
+
+From: Dan Siemon <dan@coverfire.com>
+
+[ Upstream commit 4a2b9c3756077c05dd8666e458a751d2248b61b6 ]
+
+ECN support incorrectly maps ECN BESTEFFORT packets to TC_PRIO_FILLER
+(1) instead of TC_PRIO_BESTEFFORT (0)
+
+This means ECN enabled flows are placed in pfifo_fast/prio low priority
+band, giving ECN enabled flows [ECT(0) and CE codepoints] higher drop
+probabilities.
+
+This is rather unfortunate, given we would like ECN being more widely
+used.
+
+Ref : http://www.coverfire.com/archives/2011/03/13/pfifo_fast-and-ecn/
+
+Signed-off-by: Dan Siemon <dan@coverfire.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Dave Täht <d@taht.net>
+Cc: Jonathan Morton <chromatix99@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/route.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -171,7 +171,7 @@ static struct dst_ops ipv4_dst_ops = {
+ 
+ const __u8 ip_tos2prio[16] = {
+ 	TC_PRIO_BESTEFFORT,
+-	ECN_OR_COST(FILLER),
++	ECN_OR_COST(BESTEFFORT),
+ 	TC_PRIO_BESTEFFORT,
+ 	ECN_OR_COST(BESTEFFORT),
+ 	TC_PRIO_BULK,
+From 1a3ea69b2cb514439d4a5f6cabac89a845204f1b Mon Sep 17 00:00:00 2001
+From: Ulrich Weber <uweber@astaro.com>
+Date: Wed, 6 Apr 2011 14:04:49 -0700
+Subject: pppoe: drop PPPOX_ZOMBIEs in pppoe_flush_dev
+
+
+From: Ulrich Weber <uweber@astaro.com>
+
+[ Upstream commit ae07b0b221b6ab2edf9e3abd518aec6cd3f1ba66 ]
+
+otherwise we loop forever if a PPPoE socket was set
+to PPPOX_ZOMBIE state by a PADT message when the
+ethernet device is going down afterwards.
+
+Signed-off-by: Ulrich Weber <uweber@astaro.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/pppoe.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/pppoe.c
++++ b/drivers/net/pppoe.c
+@@ -317,7 +317,7 @@ static void pppoe_flush_dev(struct net_d
+ 			lock_sock(sk);
+ 
+ 			if (po->pppoe_dev == dev &&
+-			    sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
++			    sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+ 				pppox_unbind_sock(sk);
+ 				sk->sk_state = PPPOX_ZOMBIE;
+ 				sk->sk_state_change(sk);
+From b51d6615ff5f9fc7c55727740b565b4eeafb7c4c Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 30 Mar 2011 17:51:36 -0700
+Subject: sctp: Pass __GFP_NOWARN to hash table allocation attempts.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit a84b50ceb7d640437d0dc28a2bef0d0de054de89 ]
+
+Like DCCP and other similar pieces of code, there are mechanisms
+here to try allocating smaller hash tables if the allocation
+fails.  So pass in __GFP_NOWARN like the others do instead of
+emitting a scary message.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/sctp/protocol.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -1204,7 +1204,7 @@ SCTP_STATIC __init int sctp_init(void)
+ 		if ((sctp_assoc_hashsize > (64 * 1024)) && order > 0)
+ 			continue;
+ 		sctp_assoc_hashtable = (struct sctp_hashbucket *)
+-					__get_free_pages(GFP_ATOMIC, order);
++			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order);
+ 	} while (!sctp_assoc_hashtable && --order > 0);
+ 	if (!sctp_assoc_hashtable) {
+ 		pr_err("Failed association hash alloc\n");
+@@ -1237,7 +1237,7 @@ SCTP_STATIC __init int sctp_init(void)
+ 		if ((sctp_port_hashsize > (64 * 1024)) && order > 0)
+ 			continue;
+ 		sctp_port_hashtable = (struct sctp_bind_hashbucket *)
+-					__get_free_pages(GFP_ATOMIC, order);
++			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order);
+ 	} while (!sctp_port_hashtable && --order > 0);
+ 	if (!sctp_port_hashtable) {
+ 		pr_err("Failed bind hash alloc\n");
+From bd59e4b2b325a4f0fcd491a8ec55a619fef91ded Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Mon, 14 Mar 2011 10:57:03 +0000
+Subject: tcp: avoid cwnd moderation in undo
+
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit 67d4120a1793138bc9f4a6eb61d0fc5298ed97e0 ]
+
+In the current undo logic, cwnd is moderated after it was restored
+to the value prior entering fast-recovery. It was moderated first
+in tcp_try_undo_recovery then again in tcp_complete_cwr.
+
+Since the undo indicates recovery was false, these moderations
+are not necessary. If the undo is triggered when most of the
+outstanding data have been acknowledged, the (restored) cwnd is
+falsely pulled down to a small value.
+
+This patch removes these cwnd moderations if cwnd is undone
+  a) during fast-recovery
+	b) by receiving DSACKs past fast-recovery
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_input.c |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2659,7 +2659,7 @@ static void DBGUNDO(struct sock *sk, con
+ #define DBGUNDO(x...) do { } while (0)
+ #endif
+ 
+-static void tcp_undo_cwr(struct sock *sk, const int undo)
++static void tcp_undo_cwr(struct sock *sk, const int undo_ssthresh)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 
+@@ -2671,14 +2671,13 @@ static void tcp_undo_cwr(struct sock *sk
+ 		else
+ 			tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh << 1);
+ 
+-		if (undo && tp->prior_ssthresh > tp->snd_ssthresh) {
++		if (undo_ssthresh && tp->prior_ssthresh > tp->snd_ssthresh) {
+ 			tp->snd_ssthresh = tp->prior_ssthresh;
+ 			TCP_ECN_withdraw_cwr(tp);
+ 		}
+ 	} else {
+ 		tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh);
+ 	}
+-	tcp_moderate_cwnd(tp);
+ 	tp->snd_cwnd_stamp = tcp_time_stamp;
+ }
+ 
+@@ -2822,8 +2821,11 @@ static int tcp_try_undo_loss(struct sock
+ static inline void tcp_complete_cwr(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+-	tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+-	tp->snd_cwnd_stamp = tcp_time_stamp;
++	/* Do not moderate cwnd if it's already undone in cwr or recovery */
++	if (tp->undo_marker && tp->snd_cwnd > tp->snd_ssthresh) {
++		tp->snd_cwnd = tp->snd_ssthresh;
++		tp->snd_cwnd_stamp = tcp_time_stamp;
++	}
+ 	tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
+ }
+ 
+From 6677647340a5d58b48b792af078701f4068be4b4 Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Tue, 15 Mar 2011 21:12:49 +0000
+Subject: xfrm: Refcount destination entry on xfrm_lookup
+
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+[ Upstream commit fbd5060875d25f7764fd1c3d35b83a8ed1d88d7b ]
+
+We return a destination entry without refcount if a socket
+policy is found in xfrm_lookup. This triggers a warning on
+a negative refcount when freeeing this dst entry. So take
+a refcount in this case to fix it.
+
+This refcount was forgotten when xfrm changed to cache bundles
+instead of policies for outgoing flows.
+
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Acked-by: Timo Teräs <timo.teras@iki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_policy.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1778,6 +1778,8 @@ restart:
+ 				goto no_transform;
+ 			}
+ 
++			dst_hold(&xdst->u.dst);
++
+ 			spin_lock_bh(&xfrm_policy_sk_bundle_lock);
+ 			xdst->u.dst.next = xfrm_policy_sk_bundles;
+ 			xfrm_policy_sk_bundles = &xdst->u.dst;
+From c0fd11cf45228241f8b3fb42020b1c9493dcdac7 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 18 Mar 2011 00:27:27 +0000
+Subject: vlan: should take into account needed_headroom
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit d870bfb9d366c5d466c0f5419a4ec95a3f71ea8a ]
+
+Commit c95b819ad7 (gre: Use needed_headroom)
+made gre use needed_headroom instead of hard_header_len
+
+This uncover a bug in vlan code.
+
+We should make sure vlan devices take into account their
+real_dev->needed_headroom or we risk a crash in ipgre_header(), because
+we dont have enough room to push IP header in skb.
+
+Reported-by: Diddi Oscarsson <diddi@diddi.se>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Patrick McHardy <kaber@trash.net>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/8021q/vlan_dev.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -707,6 +707,7 @@ static int vlan_dev_init(struct net_devi
+ 	dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid;
+ #endif
+ 
++	dev->needed_headroom = real_dev->needed_headroom;
+ 	if (real_dev->features & NETIF_F_HW_VLAN_TX) {
+ 		dev->header_ops      = real_dev->header_ops;
+ 		dev->hard_header_len = real_dev->hard_header_len;
+From 0589d1f7a527e5f4c4c6d16b734cfed4e3608f1c Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Fri, 18 Mar 2011 05:27:28 +0000
+Subject: bridge: Reset IPCB when entering IP stack on NF_FORWARD
+
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e ]
+
+Whenever we enter the IP stack proper from bridge netfilter we
+need to ensure that the skb is in a form the IP stack expects
+it to be in.
+
+The entry point on NF_FORWARD did not meet the requirements of
+the IP stack, therefore leading to potential crashes/panics.
+
+This patch fixes the problem.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_netfilter.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -741,6 +741,9 @@ static unsigned int br_nf_forward_ip(uns
+ 		nf_bridge->mask |= BRNF_PKT_TYPE;
+ 	}
+ 
++	if (br_parse_ip_options(skb))
++		return NF_DROP;
++
+ 	/* The physdev module checks on this */
+ 	nf_bridge->mask |= BRNF_BRIDGED;
+ 	nf_bridge->physoutdev = skb->dev;
+From 919a6006d36ab51a70ca5d80e192cba953c874cb Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 9 Mar 2011 12:54:27 -0800
+Subject: sparc: Fix .size directive for do_int_load
+
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit 35043c428f1fcb92feb5792f5878a8852ee00771 ]
+
+gas used to accept (and ignore?) .size directives which referred to
+undefined symbols, as this does.  In binutils 2.21 these are treated
+as errors.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/una_asm_64.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/una_asm_64.S
++++ b/arch/sparc/kernel/una_asm_64.S
+@@ -127,7 +127,7 @@ do_int_load:
+ 	wr	%o5, 0x0, %asi
+ 	retl
+ 	 mov	0, %o0
+-	.size	__do_int_load, .-__do_int_load
++	.size	do_int_load, .-do_int_load
+ 
+ 	.section	__ex_table,"a"
+ 	.word		4b, __retl_efault
+From c90b2d78650ae1ec6db90f07533e0382fa63acad Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 9 Mar 2011 13:00:47 -0800
+Subject: sparc32: Fix might-be-used-uninitialized warning in do_sparc_fault().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c816be7b5f24585baa9eba1f2413935f771d6ad6 ]
+
+When we try to handle vmalloc faults, we can take a code
+path which uses "code" before we actually set it.
+
+Amusingly gcc-3.3 notices this yet gcc-4.x does not.
+
+Reported-by: Bob Breuer <breuerr@mc.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/mm/fault_32.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/sparc/mm/fault_32.c
++++ b/arch/sparc/mm/fault_32.c
+@@ -240,11 +240,10 @@ asmlinkage void do_sparc_fault(struct pt
+ 	 * only copy the information from the master page table,
+ 	 * nothing more.
+ 	 */
++	code = SEGV_MAPERR;
+ 	if (!ARCH_SUN4C && address >= TASK_SIZE)
+ 		goto vmalloc_fault;
+ 
+-	code = SEGV_MAPERR;
+-
+ 	/*
+ 	 * If we're in an interrupt or have no user
+ 	 * context, we must not take the fault..
+From d4f295b7863f094b4d76ce10cb99f4617b5d00ad Mon Sep 17 00:00:00 2001
+From: Tkhai Kirill <tkhai@yandex.ru>
+Date: Thu, 31 Mar 2011 00:52:38 -0700
+Subject: sparc32: Pass task_struct to schedule_tail() in ret_from_fork
+
+
+From: Tkhai Kirill <tkhai@yandex.ru>
+
+[ Upstream commit 47c7c97a93a5b8f719093dbf83555090b3b8228b ]
+
+We have to pass task_struct of previous process to function
+schedule_tail(). Currently in ret_from_fork previous thread_info
+is passed:
+
+switch_to: mov %g6, %g3 /* previous thread_info in g6 */
+
+ret_from_fork: call    schedule_tail
+                mov    %g3, %o0 /* previous thread_info is passed */
+
+void schedule_tail(struct task_struct *prev);
+
+Signed-off-by: Tkhai Kirill <tkhai@yandex.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/entry.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/entry.S
++++ b/arch/sparc/kernel/entry.S
+@@ -1283,7 +1283,7 @@ linux_syscall_trace:
+ 	.globl	ret_from_fork
+ ret_from_fork:
+ 	call	schedule_tail
+-	 mov	%g3, %o0
++	 ld	[%g3 + TI_TASK], %o0
+ 	b	ret_sys_call
+ 	 ld	[%sp + STACKFRAME_SZ + PT_I0], %o0
+ 
+From 9567fc1bffdb332f7254c9bd2a913c80a6e18e16 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Sat, 26 Feb 2011 23:40:02 -0800
+Subject: sparc64: Fix build errors with gcc-4.6.0
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c6fee0810df4e0f4cf9c4834d2569ca01c02cffc ]
+
+Most of the warnings emitted (we fail arch/sparc file
+builds with -Werror) were legitimate but harmless, however
+one case (n2_pcr_write) was a genuine bug.
+
+Based almost entirely upon a patch by Sam Ravnborg.
+
+Reported-by: Dennis Gilmore <dennis@ausil.us>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/iommu.c      |    3 ---
+ arch/sparc/kernel/ldc.c        |   28 ++++++++++++++++++----------
+ arch/sparc/kernel/pci.c        |    1 +
+ arch/sparc/kernel/pci_common.c |   11 +++++++----
+ arch/sparc/kernel/pci_fire.c   |    2 --
+ arch/sparc/kernel/pci_schizo.c |    4 +---
+ arch/sparc/kernel/pci_sun4v.c  |    3 +--
+ arch/sparc/kernel/pcr.c        |    2 +-
+ arch/sparc/kernel/ptrace_64.c  |    3 ++-
+ arch/sparc/kernel/smp_64.c     |   11 ++++-------
+ arch/sparc/kernel/traps_64.c   |    3 +--
+ 11 files changed, 36 insertions(+), 35 deletions(-)
+
+--- a/arch/sparc/kernel/iommu.c
++++ b/arch/sparc/kernel/iommu.c
+@@ -333,13 +333,10 @@ static void dma_4u_free_coherent(struct
+ 				 void *cpu, dma_addr_t dvma)
+ {
+ 	struct iommu *iommu;
+-	iopte_t *iopte;
+ 	unsigned long flags, order, npages;
+ 
+ 	npages = IO_PAGE_ALIGN(size) >> IO_PAGE_SHIFT;
+ 	iommu = dev->archdata.iommu;
+-	iopte = iommu->page_table +
+-		((dvma - iommu->page_table_map_base) >> IO_PAGE_SHIFT);
+ 
+ 	spin_lock_irqsave(&iommu->lock, flags);
+ 
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -790,16 +790,20 @@ static void send_events(struct ldc_chann
+ static irqreturn_t ldc_rx(int irq, void *dev_id)
+ {
+ 	struct ldc_channel *lp = dev_id;
+-	unsigned long orig_state, hv_err, flags;
++	unsigned long orig_state, flags;
+ 	unsigned int event_mask;
+ 
+ 	spin_lock_irqsave(&lp->lock, flags);
+ 
+ 	orig_state = lp->chan_state;
+-	hv_err = sun4v_ldc_rx_get_state(lp->id,
+-					&lp->rx_head,
+-					&lp->rx_tail,
+-					&lp->chan_state);
++
++	/* We should probably check for hypervisor errors here and
++	 * reset the LDC channel if we get one.
++	 */
++	sun4v_ldc_rx_get_state(lp->id,
++			       &lp->rx_head,
++			       &lp->rx_tail,
++			       &lp->chan_state);
+ 
+ 	ldcdbg(RX, "RX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n",
+ 	       orig_state, lp->chan_state, lp->rx_head, lp->rx_tail);
+@@ -904,16 +908,20 @@ out:
+ static irqreturn_t ldc_tx(int irq, void *dev_id)
+ {
+ 	struct ldc_channel *lp = dev_id;
+-	unsigned long flags, hv_err, orig_state;
++	unsigned long flags, orig_state;
+ 	unsigned int event_mask = 0;
+ 
+ 	spin_lock_irqsave(&lp->lock, flags);
+ 
+ 	orig_state = lp->chan_state;
+-	hv_err = sun4v_ldc_tx_get_state(lp->id,
+-					&lp->tx_head,
+-					&lp->tx_tail,
+-					&lp->chan_state);
++
++	/* We should probably check for hypervisor errors here and
++	 * reset the LDC channel if we get one.
++	 */
++	sun4v_ldc_tx_get_state(lp->id,
++			       &lp->tx_head,
++			       &lp->tx_tail,
++			       &lp->chan_state);
+ 
+ 	ldcdbg(TX, " TX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n",
+ 	       orig_state, lp->chan_state, lp->tx_head, lp->tx_tail);
+--- a/arch/sparc/kernel/pci.c
++++ b/arch/sparc/kernel/pci.c
+@@ -675,6 +675,7 @@ static void __devinit pci_bus_register_o
+ 		 * humanoid.
+ 		 */
+ 		err = sysfs_create_file(&dev->dev.kobj, &dev_attr_obppath.attr);
++		(void) err;
+ 	}
+ 	list_for_each_entry(child_bus, &bus->children, node)
+ 		pci_bus_register_of_sysfs(child_bus);
+--- a/arch/sparc/kernel/pci_common.c
++++ b/arch/sparc/kernel/pci_common.c
+@@ -295,14 +295,17 @@ static int sun4v_write_pci_cfg(struct pc
+ 	unsigned int bus = bus_dev->number;
+ 	unsigned int device = PCI_SLOT(devfn);
+ 	unsigned int func = PCI_FUNC(devfn);
+-	unsigned long ret;
+ 
+ 	if (config_out_of_range(pbm, bus, devfn, where)) {
+ 		/* Do nothing. */
+ 	} else {
+-		ret = pci_sun4v_config_put(devhandle,
+-				HV_PCI_DEVICE_BUILD(bus, device, func),
+-				where, size, value);
++		/* We don't check for hypervisor errors here, but perhaps
++		 * we should and influence our return value depending upon
++		 * what kind of error is thrown.
++		 */
++		pci_sun4v_config_put(devhandle,
++				     HV_PCI_DEVICE_BUILD(bus, device, func),
++				     where, size, value);
+ 	}
+ 	return PCIBIOS_SUCCESSFUL;
+ }
+--- a/arch/sparc/kernel/pci_fire.c
++++ b/arch/sparc/kernel/pci_fire.c
+@@ -214,11 +214,9 @@ static int pci_fire_msi_setup(struct pci
+ 
+ static int pci_fire_msi_teardown(struct pci_pbm_info *pbm, unsigned long msi)
+ {
+-	unsigned long msiqid;
+ 	u64 val;
+ 
+ 	val = upa_readq(pbm->pbm_regs + MSI_MAP(msi));
+-	msiqid = (val & MSI_MAP_EQNUM);
+ 
+ 	val &= ~MSI_MAP_VALID;
+ 
+--- a/arch/sparc/kernel/pci_schizo.c
++++ b/arch/sparc/kernel/pci_schizo.c
+@@ -1313,7 +1313,7 @@ static int __devinit schizo_pbm_init(str
+ 	const struct linux_prom64_registers *regs;
+ 	struct device_node *dp = op->dev.of_node;
+ 	const char *chipset_name;
+-	int is_pbm_a, err;
++	int err;
+ 
+ 	switch (chip_type) {
+ 	case PBM_CHIP_TYPE_TOMATILLO:
+@@ -1343,8 +1343,6 @@ static int __devinit schizo_pbm_init(str
+ 	 */
+ 	regs = of_get_property(dp, "reg", NULL);
+ 
+-	is_pbm_a = ((regs[0].phys_addr & 0x00700000) == 0x00600000);
+-
+ 	pbm->next = pci_pbm_root;
+ 	pci_pbm_root = pbm;
+ 
+--- a/arch/sparc/kernel/pci_sun4v.c
++++ b/arch/sparc/kernel/pci_sun4v.c
+@@ -580,7 +580,7 @@ static int __devinit pci_sun4v_iommu_ini
+ {
+ 	static const u32 vdma_default[] = { 0x80000000, 0x80000000 };
+ 	struct iommu *iommu = pbm->iommu;
+-	unsigned long num_tsb_entries, sz, tsbsize;
++	unsigned long num_tsb_entries, sz;
+ 	u32 dma_mask, dma_offset;
+ 	const u32 *vdma;
+ 
+@@ -596,7 +596,6 @@ static int __devinit pci_sun4v_iommu_ini
+ 
+ 	dma_mask = (roundup_pow_of_two(vdma[1]) - 1UL);
+ 	num_tsb_entries = vdma[1] / IO_PAGE_SIZE;
+-	tsbsize = num_tsb_entries * sizeof(iopte_t);
+ 
+ 	dma_offset = vdma[0];
+ 
+--- a/arch/sparc/kernel/pcr.c
++++ b/arch/sparc/kernel/pcr.c
+@@ -81,7 +81,7 @@ static void n2_pcr_write(u64 val)
+ 	unsigned long ret;
+ 
+ 	ret = sun4v_niagara2_setperf(HV_N2_PERF_SPARC_CTL, val);
+-	if (val != HV_EOK)
++	if (ret != HV_EOK)
+ 		write_pcr(val);
+ }
+ 
+--- a/arch/sparc/kernel/ptrace_64.c
++++ b/arch/sparc/kernel/ptrace_64.c
+@@ -1086,6 +1086,7 @@ asmlinkage int syscall_trace_enter(struc
+ 
+ asmlinkage void syscall_trace_leave(struct pt_regs *regs)
+ {
++#ifdef CONFIG_AUDITSYSCALL
+ 	if (unlikely(current->audit_context)) {
+ 		unsigned long tstate = regs->tstate;
+ 		int result = AUDITSC_SUCCESS;
+@@ -1095,7 +1096,7 @@ asmlinkage void syscall_trace_leave(stru
+ 
+ 		audit_syscall_exit(result, regs->u_regs[UREG_I0]);
+ 	}
+-
++#endif
+ 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
+ 		trace_sys_exit(regs, regs->u_regs[UREG_G1]);
+ 
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -189,7 +189,7 @@ static inline long get_delta (long *rt,
+ void smp_synchronize_tick_client(void)
+ {
+ 	long i, delta, adj, adjust_latency = 0, done = 0;
+-	unsigned long flags, rt, master_time_stamp, bound;
++	unsigned long flags, rt, master_time_stamp;
+ #if DEBUG_TICK_SYNC
+ 	struct {
+ 		long rt;	/* roundtrip time */
+@@ -208,10 +208,8 @@ void smp_synchronize_tick_client(void)
+ 	{
+ 		for (i = 0; i < NUM_ROUNDS; i++) {
+ 			delta = get_delta(&rt, &master_time_stamp);
+-			if (delta == 0) {
++			if (delta == 0)
+ 				done = 1;	/* let's lock on to this... */
+-				bound = rt;
+-			}
+ 
+ 			if (!done) {
+ 				if (i > 0) {
+@@ -933,13 +931,12 @@ void smp_flush_dcache_page_impl(struct p
+ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
+ {
+ 	void *pg_addr;
+-	int this_cpu;
+ 	u64 data0;
+ 
+ 	if (tlb_type == hypervisor)
+ 		return;
+ 
+-	this_cpu = get_cpu();
++	preempt_disable();
+ 
+ #ifdef CONFIG_DEBUG_DCFLUSH
+ 	atomic_inc(&dcpage_flushes);
+@@ -964,7 +961,7 @@ void flush_dcache_page_all(struct mm_str
+ 	}
+ 	__local_flush_dcache_page(page);
+ 
+-	put_cpu();
++	preempt_enable();
+ }
+ 
+ void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -2152,7 +2152,7 @@ static void user_instruction_dump(unsign
+ 
+ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
+ {
+-	unsigned long fp, thread_base, ksp;
++	unsigned long fp, ksp;
+ 	struct thread_info *tp;
+ 	int count = 0;
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+@@ -2173,7 +2173,6 @@ void show_stack(struct task_struct *tsk,
+ 		flushw_all();
+ 
+ 	fp = ksp + STACK_BIAS;
+-	thread_base = (unsigned long) tp;
+ 
+ 	printk("Call Trace:\n");
+ 	do {