--- /dev/null
+From d010b757158a92686deb507de31b882bc843151b Mon Sep 17 00:00:00 2001
+From: Choi, David <David.Choi@Micrel.Com>
+Date: Wed, 27 Jan 2010 06:03:16 +0000
+Subject: drivers/net: ks8851_mll ethernet network driver
+
+From: Choi, David <David.Choi@Micrel.Com>
+
+[ Upstream commit aeedba8bd2cf2f6f7b45bc7853754a03bc926797 ]
+
+Hello David Miller,
+
+I fix a bug in ks8851_mll driver, which has existed since 2.6.32-rc6.
+
+>From : David J. Choi <david.choi@micrel.com>
+
+Fix a bug that the data pointers in the interrupt handler are set wrong, which is related with the 5th parameter of request_irq().
+
+Signed-off-by: David J. Choi <david.choi@micrel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/ks8851_mll.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ks8851_mll.c
++++ b/drivers/net/ks8851_mll.c
+@@ -854,8 +854,8 @@ static void ks_update_link_status(struct
+
+ static irqreturn_t ks_irq(int irq, void *pw)
+ {
+- struct ks_net *ks = pw;
+- struct net_device *netdev = ks->netdev;
++ struct net_device *netdev = pw;
++ struct ks_net *ks = netdev_priv(netdev);
+ u16 status;
+
+ /*this should be the first in IRQ handler */
--- /dev/null
+From 7e71c9e2e7704ebf044d4a964e02fbd2098a173f Mon Sep 17 00:00:00 2001
+From: Jerome Glisse <jglisse@redhat.com>
+Date: Sun, 17 Jan 2010 21:21:41 +0100
+Subject: drm/radeon/kms: Forbid creation of framebuffer with no valid GEM object
+
+From: Jerome Glisse <jglisse@redhat.com>
+
+commit 7e71c9e2e7704ebf044d4a964e02fbd2098a173f upstream.
+
+This will avoid oops if at later point the fb is use. Trying to create
+a framebuffer with no valid GEM object is bogus and should be forbidden
+as this patch does.
+
+Signed-off-by: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Dave Airlie <airlied@linux.ie>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -599,7 +599,11 @@ radeon_user_framebuffer_create(struct dr
+ struct drm_gem_object *obj;
+
+ obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handle);
+-
++ if (obj == NULL) {
++ dev_err(&dev->pdev->dev, "No GEM object associated to handle 0x%08X, "
++ "can't create framebuffer\n", mode_cmd->handle);
++ return NULL;
++ }
+ return radeon_framebuffer_create(dev, mode_cmd, obj);
+ }
+
--- /dev/null
+From 72d237c449362079ddbde7f16c94f0aca410491a Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Sun, 7 Feb 2010 17:26:30 +0000
+Subject: inet: Remove bogus IGMPv3 report handling
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit c6b471e6454c0e1c6d756672841cbaeae7c949f8 ]
+
+Currently we treat IGMPv3 reports as if it were an IGMPv2/v1 report.
+This is broken as IGMPv3 reports are formatted differently. So we
+end up suppressing a bogus multicast group (which should be harmless
+as long as the leading reserved field is zero).
+
+In fact, IGMPv3 does not allow membership report suppression so
+we should simply ignore IGMPv3 membership reports as a host.
+
+This patch does exactly that. I kept the case statement for it
+so people won't accidentally add it back thinking that we overlooked
+this case.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/igmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -946,7 +946,6 @@ int igmp_rcv(struct sk_buff *skb)
+ break;
+ case IGMP_HOST_MEMBERSHIP_REPORT:
+ case IGMPV2_HOST_MEMBERSHIP_REPORT:
+- case IGMPV3_HOST_MEMBERSHIP_REPORT:
+ /* Is it our report looped back? */
+ if (skb_rtable(skb)->fl.iif == 0)
+ break;
+@@ -960,6 +959,7 @@ int igmp_rcv(struct sk_buff *skb)
+ in_dev_put(in_dev);
+ return pim_rcv_v1(skb);
+ #endif
++ case IGMPV3_HOST_MEMBERSHIP_REPORT:
+ case IGMP_DVMRP:
+ case IGMP_TRACE:
+ case IGMP_HOST_LEAVE_MESSAGE:
--- /dev/null
+From 71216676c488e3e4d6d4f4174160544e80256311 Mon Sep 17 00:00:00 2001
+From: Shan Wei <shanwei@cn.fujitsu.com>
+Date: Tue, 26 Jan 2010 02:40:38 +0000
+Subject: ipv6: conntrack: Add member of user to nf_ct_frag6_queue structure
+
+From: Shan Wei <shanwei@cn.fujitsu.com>
+
+[ Upstream commit c92b544bd5d8e7ed7d81c77bbecab6df2a95aa53 ]
+
+The commit 0b5ccb2(title:ipv6: reassembly: use seperate reassembly queues for
+conntrack and local delivery) has broken the saddr&&daddr member of
+nf_ct_frag6_queue when creating new queue. And then hash value
+generated by nf_hashfn() was not equal with that generated by fq_find().
+So, a new received fragment can't be inserted to right queue.
+
+The patch fixes the bug with adding member of user to nf_ct_frag6_queue structure.
+
+Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
+Acked-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/netfilter/nf_conntrack_reasm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -63,6 +63,7 @@ struct nf_ct_frag6_queue
+ struct inet_frag_queue q;
+
+ __be32 id; /* fragment id */
++ u32 user;
+ struct in6_addr saddr;
+ struct in6_addr daddr;
+
--- /dev/null
+From 794c08d6d7116ce39f42c1f2ff36a3b767a0fa8f Mon Sep 17 00:00:00 2001
+From: Ajit Khaparde <ajitk@serverengines.com>
+Date: Sun, 21 Feb 2010 18:43:37 -0800
+Subject: net: bug fix for vlan + gro issue
+
+From: Ajit Khaparde <ajitk@serverengines.com>
+
+[ Upstream commit e76b69cc0133952c98aa1ad6330cacacd269fd64 ]
+
+Traffic (tcp) doesnot start on a vlan interface when gro is enabled.
+Even the tcp handshake was not taking place.
+This is because, the eth_type_trans call before the netif_receive_skb
+in napi_gro_finish() resets the skb->dev to napi->dev from the previously
+set vlan netdev interface. This causes the ip_route_input to drop the
+incoming packet considering it as a packet coming from a martian source.
+
+I could repro this on 2.6.32.7 (stable) and 2.6.33-rc7.
+With this fix, the traffic starts and the test runs fine on both vlan
+and non-vlan interfaces.
+
+CC: Herbert Xu <herbert@gondor.apana.org.au>
+CC: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Ajit Khaparde <ajitk@serverengines.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2630,7 +2630,7 @@ int napi_frags_finish(struct napi_struct
+ switch (ret) {
+ case GRO_NORMAL:
+ case GRO_HELD:
+- skb->protocol = eth_type_trans(skb, napi->dev);
++ skb->protocol = eth_type_trans(skb, skb->dev);
+
+ if (ret == GRO_NORMAL)
+ return netif_receive_skb(skb);
--- /dev/null
+From f1e3f35280103eb05f50952af208fac3eac367c7 Mon Sep 17 00:00:00 2001
+From: Eric W. Biederman <ebiederm@xmission.com>
+Date: Fri, 19 Feb 2010 13:22:59 +0000
+Subject: net: Fix sysctl restarts...
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 88af182e389097997c5e2a0b42285b3522796759 ]
+
+Yuck. It turns out that when we restart sysctls we were restarting
+with the values already changed. Which unfortunately meant that
+the second time through we thought there was no change and skipped
+all kinds of work, despite the fact that there was indeed a change.
+
+I have fixed this the simplest way possible by restoring the changed
+values when we restart the sysctl write.
+
+One of my coworkers spotted this bug when after disabling forwarding
+on an interface pings were still forwarded.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ net/ipv4/devinet.c | 7 ++++++-
+ net/ipv6/addrconf.c | 16 ++++++++++++++--
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -1351,14 +1351,19 @@ static int devinet_sysctl_forward(ctl_ta
+ {
+ int *valp = ctl->data;
+ int val = *valp;
++ loff_t pos = *ppos;
+ int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+
+ if (write && *valp != val) {
+ struct net *net = ctl->extra2;
+
+ if (valp != &IPV4_DEVCONF_DFLT(net, FORWARDING)) {
+- if (!rtnl_trylock())
++ if (!rtnl_trylock()) {
++ /* Restore the original values before restarting */
++ *valp = val;
++ *ppos = pos;
+ return restart_syscall();
++ }
+ if (valp == &IPV4_DEVCONF_ALL(net, FORWARDING)) {
+ inet_forward_change(net);
+ } else if (*valp) {
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -504,8 +504,11 @@ static int addrconf_fixup_forwarding(str
+ if (p == &net->ipv6.devconf_dflt->forwarding)
+ return 0;
+
+- if (!rtnl_trylock())
++ if (!rtnl_trylock()) {
++ /* Restore the original values before restarting */
++ *p = old;
+ return restart_syscall();
++ }
+
+ if (p == &net->ipv6.devconf_all->forwarding) {
+ __s32 newf = net->ipv6.devconf_all->forwarding;
+@@ -3991,12 +3994,15 @@ int addrconf_sysctl_forward(ctl_table *c
+ {
+ int *valp = ctl->data;
+ int val = *valp;
++ loff_t pos = *ppos;
+ int ret;
+
+ ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+
+ if (write)
+ ret = addrconf_fixup_forwarding(ctl, valp, val);
++ if (ret)
++ *ppos = pos;
+ return ret;
+ }
+
+@@ -4075,8 +4081,11 @@ static int addrconf_disable_ipv6(struct
+ if (p == &net->ipv6.devconf_dflt->disable_ipv6)
+ return 0;
+
+- if (!rtnl_trylock())
++ if (!rtnl_trylock()) {
++ /* Restore the original values before restarting */
++ *p = old;
+ return restart_syscall();
++ }
+
+ if (p == &net->ipv6.devconf_all->disable_ipv6) {
+ __s32 newf = net->ipv6.devconf_all->disable_ipv6;
+@@ -4095,12 +4104,15 @@ int addrconf_sysctl_disable(ctl_table *c
+ {
+ int *valp = ctl->data;
+ int val = *valp;
++ loff_t pos = *ppos;
+ int ret;
+
+ ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+
+ if (write)
+ ret = addrconf_disable_ipv6(ctl, valp, val);
++ if (ret)
++ *ppos = pos;
+ return ret;
+ }
+
--- /dev/null
+From da4776a487d2f650d59d8770f46ecb61df8d142b Mon Sep 17 00:00:00 2001
+From: Eric W. Biederman <ebiederm@xmission.com>
+Date: Fri, 19 Feb 2010 13:23:47 +0000
+Subject: net-sysfs: Use rtnl_trylock in wireless sysfs methods.
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit b8afe6416101549e877f8470f2a160df69676166 ]
+
+The wireless sysfs methods like the rest of the networking sysfs
+methods are removed with the rtnl_lock held and block until
+the existing methods stop executing. So use rtnl_trylock
+and restart_syscall so that the code continues to work.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/net-sysfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -366,7 +366,8 @@ static ssize_t wireless_show(struct devi
+ const struct iw_statistics *iw;
+ ssize_t ret = -EINVAL;
+
+- rtnl_lock();
++ if (!rtnl_trylock())
++ return restart_syscall();
+ if (dev_isalive(dev)) {
+ iw = get_wireless_stats(dev);
+ if (iw)
airo-fix-setting-zero-length-wep-key.patch
idr-fix-a-critical-misallocation-bug-take-2.patch
switch-proc-self-to-nd_set_link.patch
+sparc-align-clone-and-signal-stacks-to-16-bytes.patch
+sparc32-fix-page_to_phys.patch
+sparc32-fix-struct-stat-uid-gid-types.patch
+sparc-leds_resource.end-assigned-to-itself-in-clock_board_probe.patch
+sparc64-fix-sun4u-execute-bit-check-in-tsb-i-tlb-load.patch
+net-fix-sysctl-restarts.patch
+net-sysfs-use-rtnl_trylock-in-wireless-sysfs-methods.patch
+net-bug-fix-for-vlan-gro-issue.patch
+inet-remove-bogus-igmpv3-report-handling.patch
+ipv6-conntrack-add-member-of-user-to-nf_ct_frag6_queue-structure.patch
+drivers-net-ks8851_mll-ethernet-network-driver.patch
+sky2-fix-transmit-dma-map-leakage.patch
+drm-radeon-kms-forbid-creation-of-framebuffer-with-no-valid-gem-object.patch
--- /dev/null
+From 016555f9b8c8253790a916fe1bf008e67f22854e Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Mon, 1 Feb 2010 13:41:47 +0000
+Subject: sky2: fix transmit DMA map leakage
+
+From: stephen hemminger <shemminger@vyatta.com>
+
+[ Upstream commit f6815077e75c5b7f55b56fc3788e328514d4e72a ]
+
+The book keeping structure for transmit always had the flags value
+cleared so transmit DMA maps were never released correctly.
+Based on patch by Jarek Poplawski, problem observed by Michael Breuer.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -1008,11 +1008,8 @@ static void sky2_prefetch_init(struct sk
+ static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2, u16 *slot)
+ {
+ struct sky2_tx_le *le = sky2->tx_le + *slot;
+- struct tx_ring_info *re = sky2->tx_ring + *slot;
+
+ *slot = RING_NEXT(*slot, sky2->tx_ring_size);
+- re->flags = 0;
+- re->skb = NULL;
+ le->ctrl = 0;
+ return le;
+ }
+@@ -1580,8 +1577,7 @@ static unsigned tx_le_req(const struct s
+ return count;
+ }
+
+-static void sky2_tx_unmap(struct pci_dev *pdev,
+- const struct tx_ring_info *re)
++static void sky2_tx_unmap(struct pci_dev *pdev, struct tx_ring_info *re)
+ {
+ if (re->flags & TX_MAP_SINGLE)
+ pci_unmap_single(pdev, pci_unmap_addr(re, mapaddr),
+@@ -1591,6 +1587,7 @@ static void sky2_tx_unmap(struct pci_dev
+ pci_unmap_page(pdev, pci_unmap_addr(re, mapaddr),
+ pci_unmap_len(re, maplen),
+ PCI_DMA_TODEVICE);
++ re->flags = 0;
+ }
+
+ /*
+@@ -1797,6 +1794,7 @@ static void sky2_tx_complete(struct sky2
+ dev->stats.tx_packets++;
+ dev->stats.tx_bytes += skb->len;
+
++ re->skb = NULL;
+ dev_kfree_skb_any(skb);
+
+ sky2->tx_next = RING_NEXT(idx, sky2->tx_ring_size);
--- /dev/null
+From 36417f7f6a26998efc0a7bc9d505e614cbab539a Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Sun, 21 Feb 2010 19:14:37 -0800
+Subject: sparc: Align clone and signal stacks to 16 bytes.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commits f036d9f3985a529a81e582f68aa984eb7b20d54d
+ and 440ab7ac2d6b735fb278a1ff1674f6716314c6bb ]
+
+This is mandatory for 64-bit processes, and doing it also for 32-bit
+processes saves a conditional in the compat case.
+
+This fixes the glibc/nptl/tst-stdio1 test case, as well
+as many others, on 64-bit.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/kernel/process_32.c | 2 +-
+ arch/sparc/kernel/process_64.c | 8 ++++----
+ arch/sparc/kernel/signal32.c | 10 ++++++----
+ arch/sparc/kernel/signal_32.c | 6 ++++--
+ arch/sparc/kernel/signal_64.c | 8 +++++---
+ 5 files changed, 20 insertions(+), 14 deletions(-)
+
+--- a/arch/sparc/kernel/process_32.c
++++ b/arch/sparc/kernel/process_32.c
+@@ -526,7 +526,7 @@ int copy_thread(unsigned long clone_flag
+ * Set some valid stack frames to give to the child.
+ */
+ childstack = (struct sparc_stackf __user *)
+- (sp & ~0x7UL);
++ (sp & ~0xfUL);
+ parentstack = (struct sparc_stackf __user *)
+ regs->u_regs[UREG_FP];
+
+--- a/arch/sparc/kernel/process_64.c
++++ b/arch/sparc/kernel/process_64.c
+@@ -398,11 +398,11 @@ static unsigned long clone_stackframe(un
+ } else
+ __get_user(fp, &(((struct reg_window32 __user *)psp)->ins[6]));
+
+- /* Now 8-byte align the stack as this is mandatory in the
+- * Sparc ABI due to how register windows work. This hides
+- * the restriction from thread libraries etc. -DaveM
++ /* Now align the stack as this is mandatory in the Sparc ABI
++ * due to how register windows work. This hides the
++ * restriction from thread libraries etc.
+ */
+- csp &= ~7UL;
++ csp &= ~15UL;
+
+ distance = fp - psp;
+ rval = (csp - distance);
+--- a/arch/sparc/kernel/signal32.c
++++ b/arch/sparc/kernel/signal32.c
+@@ -120,8 +120,8 @@ struct rt_signal_frame32 {
+ };
+
+ /* Align macros */
+-#define SF_ALIGNEDSZ (((sizeof(struct signal_frame32) + 7) & (~7)))
+-#define RT_ALIGNEDSZ (((sizeof(struct rt_signal_frame32) + 7) & (~7)))
++#define SF_ALIGNEDSZ (((sizeof(struct signal_frame32) + 15) & (~15)))
++#define RT_ALIGNEDSZ (((sizeof(struct rt_signal_frame32) + 15) & (~15)))
+
+ int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
+ {
+@@ -420,15 +420,17 @@ static void __user *get_sigframe(struct
+ sp = current->sas_ss_sp + current->sas_ss_size;
+ }
+
++ sp -= framesize;
++
+ /* Always align the stack frame. This handles two cases. First,
+ * sigaltstack need not be mindful of platform specific stack
+ * alignment. Second, if we took this signal because the stack
+ * is not aligned properly, we'd like to take the signal cleanly
+ * and report that.
+ */
+- sp &= ~7UL;
++ sp &= ~15UL;
+
+- return (void __user *)(sp - framesize);
++ return (void __user *) sp;
+ }
+
+ static int save_fpu_state32(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+--- a/arch/sparc/kernel/signal_32.c
++++ b/arch/sparc/kernel/signal_32.c
+@@ -267,15 +267,17 @@ static inline void __user *get_sigframe(
+ sp = current->sas_ss_sp + current->sas_ss_size;
+ }
+
++ sp -= framesize;
++
+ /* Always align the stack frame. This handles two cases. First,
+ * sigaltstack need not be mindful of platform specific stack
+ * alignment. Second, if we took this signal because the stack
+ * is not aligned properly, we'd like to take the signal cleanly
+ * and report that.
+ */
+- sp &= ~7UL;
++ sp &= ~15UL;
+
+- return (void __user *)(sp - framesize);
++ return (void __user *) sp;
+ }
+
+ static inline int
+--- a/arch/sparc/kernel/signal_64.c
++++ b/arch/sparc/kernel/signal_64.c
+@@ -353,7 +353,7 @@ segv:
+ /* Checks if the fp is valid */
+ static int invalid_frame_pointer(void __user *fp, int fplen)
+ {
+- if (((unsigned long) fp) & 7)
++ if (((unsigned long) fp) & 15)
+ return 1;
+ return 0;
+ }
+@@ -396,15 +396,17 @@ static inline void __user *get_sigframe(
+ sp = current->sas_ss_sp + current->sas_ss_size;
+ }
+
++ sp -= framesize;
++
+ /* Always align the stack frame. This handles two cases. First,
+ * sigaltstack need not be mindful of platform specific stack
+ * alignment. Second, if we took this signal because the stack
+ * is not aligned properly, we'd like to take the signal cleanly
+ * and report that.
+ */
+- sp &= ~7UL;
++ sp &= ~15UL;
+
+- return (void __user *)(sp - framesize);
++ return (void __user *) sp;
+ }
+
+ static inline void
--- /dev/null
+From a1ed5b17d8dd1a3e81849a10b13f7693dc2c5dfd Mon Sep 17 00:00:00 2001
+From: Roel Kluin <roel.kluin@gmail.com>
+Date: Fri, 15 Jan 2010 01:27:49 -0800
+Subject: sparc: leds_resource.end assigned to itself in clock_board_probe()
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+[ Upstream commit 093171465235a8482fbf08a9a2e365247e1f7dd5 ]
+
+It should be a 1 byte region.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/kernel/central.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/central.c
++++ b/arch/sparc/kernel/central.c
+@@ -99,7 +99,7 @@ static int __devinit clock_board_probe(s
+
+ p->leds_resource.start = (unsigned long)
+ (p->clock_regs + CLOCK_CTRL);
+- p->leds_resource.end = p->leds_resource.end;
++ p->leds_resource.end = p->leds_resource.start;
+ p->leds_resource.name = "leds";
+
+ p->leds_pdev.name = "sunfire-clockboard-leds";
+@@ -194,7 +194,7 @@ static int __devinit fhc_probe(struct of
+ if (!p->central) {
+ p->leds_resource.start = (unsigned long)
+ (p->pregs + FHC_PREGS_CTRL);
+- p->leds_resource.end = p->leds_resource.end;
++ p->leds_resource.end = p->leds_resource.start;
+ p->leds_resource.name = "leds";
+
+ p->leds_pdev.name = "sunfire-fhc-leds";
--- /dev/null
+From b6b42a6576d06aac6a511c2b24722c4bab3e961f Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Thu, 14 Jan 2010 03:14:53 -0800
+Subject: sparc32: Fix page_to_phys().
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 8654164f54bd02787ae91db8526dcae8e7e34eeb ]
+
+It doesn't account for phys_base like it should, fix by using
+page_to_pfn().
+
+While we're here, make virt_to_page() use pfn_to_page() as well, so we
+consistently use the asm/memory-model.h abstractions instead of
+open-coding memory model assumptions.
+
+Tested-by: Kristoffer Glembo <kristoffer@gaisler.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/include/asm/io_32.h | 2 +-
+ arch/sparc/include/asm/page_32.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/include/asm/io_32.h
++++ b/arch/sparc/include/asm/io_32.h
+@@ -8,7 +8,7 @@
+ #include <asm/page.h> /* IO address mapping routines need this */
+ #include <asm/system.h>
+
+-#define page_to_phys(page) (((page) - mem_map) << PAGE_SHIFT)
++#define page_to_phys(page) (page_to_pfn(page) << PAGE_SHIFT)
+
+ static inline u32 flip_dword (u32 l)
+ {
+--- a/arch/sparc/include/asm/page_32.h
++++ b/arch/sparc/include/asm/page_32.h
+@@ -143,7 +143,7 @@ extern unsigned long pfn_base;
+ #define phys_to_virt __va
+
+ #define ARCH_PFN_OFFSET (pfn_base)
+-#define virt_to_page(kaddr) (mem_map + ((((unsigned long)(kaddr)-PAGE_OFFSET)>>PAGE_SHIFT)))
++#define virt_to_page(kaddr) pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
+
+ #define pfn_valid(pfn) (((pfn) >= (pfn_base)) && (((pfn)-(pfn_base)) < max_mapnr))
+ #define virt_addr_valid(kaddr) ((((unsigned long)(kaddr)-PAGE_OFFSET)>>PAGE_SHIFT) < max_mapnr)
--- /dev/null
+From 90e3119273d5a4279ce60316afa4a27415fc04a7 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Sun, 21 Feb 2010 18:03:16 -0800
+Subject: sparc32: Fix struct stat uid/gid types.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 2531be413b3f2f64c0282073de89fe52bbcbbab5 ]
+
+Commit 085219f79cad89291699bd2bfb21c9fdabafe65f
+("sparc32: use proper types in struct stat")
+
+Accidently changed the struct stat uid/gid members
+to uid_t and gid_t, but those get set to
+__kernel_uid32_t and __kernel_gid32_t respectively.
+Those are of type 'int' but the structure is meant
+to have 'short'. So use uid16_t and gid16_t to
+correct this.
+
+Reported-by: Rob Landley <rob@landley.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/include/asm/stat.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/include/asm/stat.h
++++ b/arch/sparc/include/asm/stat.h
+@@ -53,8 +53,8 @@ struct stat {
+ ino_t st_ino;
+ mode_t st_mode;
+ short st_nlink;
+- uid_t st_uid;
+- gid_t st_gid;
++ uid16_t st_uid;
++ gid16_t st_gid;
+ unsigned short st_rdev;
+ off_t st_size;
+ time_t st_atime;
--- /dev/null
+From 6f46b7822fcc46d20da07cefe2cce2dae346bd0f Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Fri, 19 Feb 2010 15:19:52 -0800
+Subject: sparc64: Fix sun4u execute bit check in TSB I-TLB load.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 1f474646fdc36b457606bbcd6a3592e6cbd31ac4 ]
+
+Thanks to testcase and report from Brad Spengler:
+
+--------------------
+#include <stdio.h>
+
+typedef int (* _wee)(void);
+
+int main(void)
+{
+ char buf[8] = { '\x81', '\xc7', '\xe0', '\x08', '\x81', '\xe8',
+ '\x00', '\x00' };
+ _wee wee;
+ printf("%p\n", &buf);
+ wee = (_wee)&buf;
+ wee();
+
+ return 0;
+}
+--------------------
+
+TSB I-tlb load code tries to use andcc to check the _PAGE_EXEC_4U bit,
+but that's bit 12 so it gets sign extended all the way up to bit 63
+and the test nearly always passes as a result.
+
+Use sethi to fix the bug.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/kernel/tsb.S | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/tsb.S
++++ b/arch/sparc/kernel/tsb.S
+@@ -191,10 +191,12 @@ tsb_dtlb_load:
+
+ tsb_itlb_load:
+ /* Executable bit must be set. */
+-661: andcc %g5, _PAGE_EXEC_4U, %g0
+- .section .sun4v_1insn_patch, "ax"
++661: sethi %hi(_PAGE_EXEC_4U), %g4
++ andcc %g5, %g4, %g0
++ .section .sun4v_2insn_patch, "ax"
+ .word 661b
+ andcc %g5, _PAGE_EXEC_4V, %g0
++ nop
+ .previous
+
+ be,pn %xcc, tsb_do_fault
projects / thirdparty / kernel / stable-queue.git / commitdiff
