--- /dev/null
+From 96830a57de1197519b62af6a4c9ceea556c18c3d Mon Sep 17 00:00:00 2001
+From: Michael Abbott <michael.abbott@diamond.ac.uk>
+Date: Thu, 24 Sep 2009 10:15:19 +0200
+Subject: Fix idle time field in /proc/uptime
+
+From: Michael Abbott <michael.abbott@diamond.ac.uk>
+
+commit 96830a57de1197519b62af6a4c9ceea556c18c3d upstream.
+
+Git commit 79741dd changes idle cputime accounting, but unfortunately
+the /proc/uptime file hasn't caught up. Here the idle time calculation
+from /proc/stat is copied over.
+
+Signed-off-by: Michael Abbott <michael.abbott@diamond.ac.uk>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/uptime.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/uptime.c
++++ b/fs/proc/uptime.c
+@@ -4,13 +4,18 @@
+ #include <linux/sched.h>
+ #include <linux/seq_file.h>
+ #include <linux/time.h>
++#include <linux/kernel_stat.h>
+ #include <asm/cputime.h>
+
+ static int uptime_proc_show(struct seq_file *m, void *v)
+ {
+ struct timespec uptime;
+ struct timespec idle;
+- cputime_t idletime = cputime_add(init_task.utime, init_task.stime);
++ int i;
++ cputime_t idletime = cputime_zero;
++
++ for_each_possible_cpu(i)
++ idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
+
+ do_posix_clock_monotonic_gettime(&uptime);
+ monotonic_to_bootbased(&uptime);
--- /dev/null
+From akpm@linux-foundation.org Thu Oct 1 15:24:58 2009
+From: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
+Date: Mon, 21 Sep 2009 17:01:04 -0700
+Subject: hugetlb: restore interleaving of bootmem huge pages (2.6.31)
+To: torvalds@linux-foundation.org
+Cc: Lee.Schermerhorn@hp.com, lee.schermerhorn@hp.com, ak@linux.intel.com, eric.whitney@hp.com, mel@csn.ul.ie, rientjes@google.com, agl@us.ibm.com, apw@canonical.com, akpm@linux-foundation.org, stable@kernel.org
+Message-ID: <200909220001.n8M014vN026389@imap1.linux-foundation.org>
+
+
+From: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
+
+Not upstream as it is fixed differently in .32
+
+I noticed that alloc_bootmem_huge_page() will only advance to the next
+node on failure to allocate a huge page. I asked about this on linux-mm
+and linux-numa, cc'ing the usual huge page suspects. Mel Gorman
+responded:
+
+ I strongly suspect that the same node being used until allocation
+ failure instead of round-robin is an oversight and not deliberate
+ at all. It appears to be a side-effect of a fix made way back in
+ commit 63b4613c3f0d4b724ba259dc6c201bb68b884e1a ["hugetlb: fix
+ hugepage allocation with memoryless nodes"]. Prior to that patch
+ it looked like allocations would always round-robin even when
+ allocation was successful.
+
+Andy Whitcroft countered that the existing behavior looked like Andi
+Kleen's original implementation and suggested that we ask him. We did and
+Andy replied that his intention was to interleave the allocations. So,
+...
+
+This patch moves the advance of the hstate next node from which to
+allocate up before the test for success of the attempted allocation. This
+will unconditionally advance the next node from which to alloc,
+interleaving successful allocations over the nodes with sufficient
+contiguous memory, and skipping over nodes that fail the huge page
+allocation attempt.
+
+Note that alloc_bootmem_huge_page() will only be called for huge pages of
+order > MAX_ORDER.
+
+Signed-off-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Adam Litke <agl@us.ibm.com>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: Eric Whitney <eric.whitney@hp.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1017,6 +1017,7 @@ int __weak alloc_bootmem_huge_page(struc
+ NODE_DATA(h->hugetlb_next_nid),
+ huge_page_size(h), huge_page_size(h), 0);
+
++ hstate_next_node(h);
+ if (addr) {
+ /*
+ * Use the beginning of the huge page to store the
+@@ -1026,7 +1027,6 @@ int __weak alloc_bootmem_huge_page(struc
+ m = addr;
+ goto found;
+ }
+- hstate_next_node(h);
+ nr_nodes--;
+ }
+ return 0;
--- /dev/null
+From benh@kernel.crashing.org Thu Oct 1 15:35:28 2009
+From: Rex Feany <RFeany@mrv.com>
+Date: Thu, 24 Sep 2009 17:16:54 +1000
+Subject: powerpc/8xx: Fix regression introduced by cache coherency rewrite
+To: stable <stable@kernel.org>
+Cc: linuxppc-dev list <linuxppc-dev@ozlabs.org>, RFeany@mrv.com
+Message-ID: <1253776614.7103.434.camel@pasglop>
+
+From: Rex Feany <RFeany@mrv.com>
+
+commit e0908085fc2391c85b85fb814ae1df377c8e0dcb upstream.
+
+After upgrading to the latest kernel on my mpc875 userspace started
+running incredibly slow (hours to get to a shell, even!).
+I tracked it down to commit 8d30c14cab30d405a05f2aaceda1e9ad57800f36,
+that patch removed a work-around for the 8xx. Adding it
+back makes my problem go away.
+
+Signed-off-by: Rex Feany <rfeany@mrv.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/mm/pgtable.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/mm/pgtable.c
++++ b/arch/powerpc/mm/pgtable.c
+@@ -30,6 +30,8 @@
+ #include <asm/tlbflush.h>
+ #include <asm/tlb.h>
+
++#include "mmu_decl.h"
++
+ static DEFINE_PER_CPU(struct pte_freelist_batch *, pte_freelist_cur);
+ static unsigned long pte_freelist_forced_free;
+
+@@ -119,7 +121,7 @@ void pte_free_finish(void)
+ /*
+ * Handle i/d cache flushing, called from set_pte_at() or ptep_set_access_flags()
+ */
+-static pte_t do_dcache_icache_coherency(pte_t pte)
++static pte_t do_dcache_icache_coherency(pte_t pte, unsigned long addr)
+ {
+ unsigned long pfn = pte_pfn(pte);
+ struct page *page;
+@@ -128,6 +130,17 @@ static pte_t do_dcache_icache_coherency(
+ return pte;
+ page = pfn_to_page(pfn);
+
++#ifdef CONFIG_8xx
++ /* On 8xx, cache control instructions (particularly
++ * "dcbst" from flush_dcache_icache) fault as write
++ * operation if there is an unpopulated TLB entry
++ * for the address in question. To workaround that,
++ * we invalidate the TLB here, thus avoiding dcbst
++ * misbehaviour.
++ */
++ _tlbil_va(addr, 0 /* 8xx doesn't care about PID */);
++#endif
++
+ if (!PageReserved(page) && !test_bit(PG_arch_1, &page->flags)) {
+ pr_debug("do_dcache_icache_coherency... flushing\n");
+ flush_dcache_icache_page(page);
+@@ -198,7 +211,7 @@ void set_pte_at(struct mm_struct *mm, un
+ */
+ pte = __pte(pte_val(pte) & ~_PAGE_HPTEFLAGS);
+ if (pte_need_exec_flush(pte, 1))
+- pte = do_dcache_icache_coherency(pte);
++ pte = do_dcache_icache_coherency(pte, addr);
+
+ /* Perform the setting of the PTE */
+ __set_pte_at(mm, addr, ptep, pte, 0);
+@@ -216,7 +229,7 @@ int ptep_set_access_flags(struct vm_area
+ {
+ int changed;
+ if (!dirty && pte_need_exec_flush(entry, 0))
+- entry = do_dcache_icache_coherency(entry);
++ entry = do_dcache_icache_coherency(entry, address);
+ changed = !pte_same(*(ptep), entry);
+ if (changed) {
+ if (!(vma->vm_flags & VM_HUGETLB))
--- /dev/null
+From benh@kernel.crashing.org Thu Oct 1 15:36:15 2009
+From: Weirich, Bernhard <Bernhard.Weirich@riedel.net>
+Date: Thu, 24 Sep 2009 17:16:53 +1000
+Subject: powerpc: Fix incorrect setting of __HAVE_ARCH_PTE_SPECIAL
+To: stable <stable@kernel.org>
+Cc: linuxppc-dev list <linuxppc-dev@ozlabs.org>, bernhard.weirich@riedel.net, RFeany@mrv.com
+Message-ID: <1253776613.7103.433.camel@pasglop>
+
+
+From: Weirich, Bernhard <Bernhard.Weirich@riedel.net>
+
+[I'm going to fix upstream differently, by having all CPU types
+actually support _PAGE_SPECIAL, but I prefer the simple and obvious
+fix for -stable. -- Ben]
+
+The test that decides whether to define __HAVE_ARCH_PTE_SPECIAL on
+powerpc is bogus and will end up always defining it, even when
+_PAGE_SPECIAL is not supported (in which case it's 0) such as on
+8xx or 40x processors.
+
+Signed-off-by: Bernhard Weirich <bernhard.weirich@riedel.net>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ arch/powerpc/include/asm/pte-common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/pte-common.h
++++ b/arch/powerpc/include/asm/pte-common.h
+@@ -176,7 +176,7 @@ extern unsigned long bad_call_to_PMD_PAG
+ #define HAVE_PAGE_AGP
+
+ /* Advertise support for _PAGE_SPECIAL */
+-#ifdef _PAGE_SPECIAL
++#if _PAGE_SPECIAL != 0
+ #define __HAVE_ARCH_PTE_SPECIAL
+ #endif
+
--- /dev/null
+From akpm@linux-foundation.org Thu Oct 1 15:23:18 2009
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Mon, 21 Sep 2009 17:01:02 -0700
+Subject: /proc/kcore: work around a BUG()
+To: torvalds@linux-foundation.org
+Cc: nick@craig-wood.com, kbowa@tuxedu.org, penberg@cs.helsinki.fi, akpm@linux-foundation.org, stable@kernel.org, kamezawa.hiroyu@jp.fujitsu.com
+Message-ID: <200909220001.n8M01223026302@imap1.linux-foundation.org>
+
+
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+Not upstream due to other fixes in .32
+
+
+Works around a BUG() which is triggered when the kernel accesses holes in
+vmalloc regions.
+
+BUG: unable to handle kernel paging request at fa54c000
+IP: [<c04f687a>] read_kcore+0x260/0x31a
+*pde = 3540b067 *pte = 00000000
+Oops: 0000 [#1] SMP
+last sysfs file: /sys/devices/pci0000:00/0000:00:1c.2/0000:03:00.0/ieee80211/phy0/rfkill0/state
+Modules linked in: fuse sco bridge stp llc bnep l2cap bluetooth sunrpc nf_conntrack_ftp ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 cpufreq_ondemand acpi_cpufreq dm_multipath uinput usb_storage arc4 ecb snd_hda_codec_realtek snd_hda_intel ath5k snd_hda_codec snd_hwdep iTCO_wdt snd_pcm iTCO_vendor_support pcspkr i2c_i801 mac80211 joydev snd_timer serio_raw r8169 snd soundcore mii snd_page_alloc ath cfg80211 ata_generic i915 drm i2c_algo_bit i2c_core video output [last unloaded: scsi_wait_scan]
+Sep 4 12:45:16 tuxedu kernel: Pid: 2266, comm: cat Not tainted (2.6.31-rc8 #2) Joybook Lite U101
+EIP: 0060:[<c04f687a>] EFLAGS: 00010286 CPU: 0
+EIP is at read_kcore+0x260/0x31a
+EAX: f5e5ea00 EBX: fa54d000 ECX: 00000400 EDX: 00001000
+ESI: fa54c000 EDI: f44ad000 EBP: e4533f4c ESP: e4533f24
+DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+Process cat (pid: 2266, ti=e4532000 task=f09d19a0 task.ti=e4532000)
+Stack:
+00005000 00000000 f44ad000 09d9c000 00003000 fa54c000 00001000 f6d16f60
+ e4520b80 fffffffb e4533f70 c04ef8eb e4533f98 00008000 09d97000 c04f661a
+ e4520b80 09d97000 c04ef88c e4533f8c c04ba531 e4533f98 c04c0930 e4520b80
+Call Trace:
+[<c04ef8eb>] ? proc_reg_read+0x5f/0x73
+[<c04f661a>] ? read_kcore+0x0/0x31a
+[<c04ef88c>] ? proc_reg_read+0x0/0x73
+[<c04ba531>] ? vfs_read+0x82/0xe1
+[<c04c0930>] ? path_put+0x1a/0x1d
+[<c04ba62e>] ? sys_read+0x40/0x62
+[<c0403298>] ? sysenter_do_call+0x12/0x2d
+Code: 39 f3 89 ca 0f 43 f3 89 fb 29 f2 29 f3 39 cf 0f 46 d3 29 55 dc 8d 1c 32 f6 40 0c 01 75 18 89 d1 89 f7 c1 e9 02 2b 7d ec 03 7d e0 <f3> a5 89 d1 83 e1 03 74 02 f3 a4 8b 00 83 7d dc 00 74 04 85 c0
+EIP: [<c04f687a>] read_kcore+0x260/0x31a SS:ESP 0068:e4533f24
+CR2: 00000000fa54c000
+
+
+To access vmalloc area which may have memory holes, copy_from_user is
+useful. So this:
+
+ # cat /proc/kcore > /dev/null
+
+will not panic.
+
+This is a minimal fix, suitable for 2.6.30.x and 2.6.31. More extensive
+/proc/kcore changes are planned for 2.6.32.
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Tested-by: Nick Craig-Wood <nick@craig-wood.com>
+Cc: Pekka Enberg <penberg@cs.helsinki.fi>
+Reported-by: <kbowa@tuxedu.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/kcore.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -361,7 +361,13 @@ read_kcore(struct file *file, char __use
+ /* don't dump ioremap'd stuff! (TA) */
+ if (m->flags & VM_IOREMAP)
+ continue;
+- memcpy(elf_buf + (vmstart - start),
++ /*
++ * we may access memory holes, then use
++ * ex_table. checking return value just for
++ * avoid warnings.
++ */
++ vmsize = __copy_from_user_inatomic(
++ elf_buf + (vmstart - start),
+ (char *)vmstart, vmsize);
+ }
+ read_unlock(&vmlist_lock);
netfilter-bridge-refcount-fix.patch
netfilter-ebt_ulog-fix-checkentry-return-value.patch
netfilter-nf_nat-fix-inverted-logic-for-persistent-nat-mappings.patch
+fix-idle-time-field-in-proc-uptime.patch
+hugetlb-restore-interleaving-of-bootmem-huge-pages.patch
+powerpc-8xx-fix-regression-introduced-by-cache-coherency-rewrite.patch
+powerpc-fix-incorrect-setting-of-__have_arch_pte_special.patch
+proc-kcore-work-around-a-bug.patch