--- /dev/null
+From 81357a281dcc454841532c46b30e6f2ba12b73ea Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Thu, 24 May 2012 14:32:20 +0200
+Subject: ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 81357a281dcc454841532c46b30e6f2ba12b73ea upstream.
+
+ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA
+failed. In this case it frees the skb passed to it.
+If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still
+linked into the tid buffer list and must be dequeued before being released.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -64,7 +64,8 @@ static void ath_tx_update_baw(struct ath
+ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
+ struct ath_txq *txq,
+ struct ath_atx_tid *tid,
+- struct sk_buff *skb);
++ struct sk_buff *skb,
++ bool dequeue);
+
+ enum {
+ MCS_HT20,
+@@ -811,7 +812,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_
+ fi = get_frame_info(skb);
+ bf = fi->bf;
+ if (!fi->bf)
+- bf = ath_tx_setup_buffer(sc, txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txq, tid, skb, true);
+
+ if (!bf)
+ continue;
+@@ -1726,7 +1727,7 @@ static void ath_tx_send_ampdu(struct ath
+ return;
+ }
+
+- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb, false);
+ if (!bf)
+ return;
+
+@@ -1753,7 +1754,7 @@ static void ath_tx_send_normal(struct at
+
+ bf = fi->bf;
+ if (!bf)
+- bf = ath_tx_setup_buffer(sc, txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txq, tid, skb, false);
+
+ if (!bf)
+ return;
+@@ -1814,7 +1815,8 @@ u8 ath_txchainmask_reduction(struct ath_
+ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
+ struct ath_txq *txq,
+ struct ath_atx_tid *tid,
+- struct sk_buff *skb)
++ struct sk_buff *skb,
++ bool dequeue)
+ {
+ struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ struct ath_frame_info *fi = get_frame_info(skb);
+@@ -1863,6 +1865,8 @@ static struct ath_buf *ath_tx_setup_buff
+ return bf;
+
+ error:
++ if (dequeue)
++ __skb_unlink(skb, &tid->buf_q);
+ dev_kfree_skb_any(skb);
+ return NULL;
+ }
+@@ -1893,7 +1897,7 @@ static void ath_tx_start_dma(struct ath_
+ */
+ ath_tx_send_ampdu(sc, tid, skb, txctl);
+ } else {
+- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb, false);
+ if (!bf)
+ return;
+
--- /dev/null
+From c50ac050811d6485616a193eb0f37bfbd191cc89 Mon Sep 17 00:00:00 2001
+From: Dave Hansen <dave@linux.vnet.ibm.com>
+Date: Tue, 29 May 2012 15:06:46 -0700
+Subject: hugetlb: fix resv_map leak in error path
+
+From: Dave Hansen <dave@linux.vnet.ibm.com>
+
+commit c50ac050811d6485616a193eb0f37bfbd191cc89 upstream.
+
+When called for anonymous (non-shared) mappings, hugetlb_reserve_pages()
+does a resv_map_alloc(). It depends on code in hugetlbfs's
+vm_ops->close() to release that allocation.
+
+However, in the mmap() failure path, we do a plain unmap_region() without
+the remove_vma() which actually calls vm_ops->close().
+
+This is a decent fix. This leak could get reintroduced if new code (say,
+after hugetlb_reserve_pages() in hugetlbfs_file_mmap()) decides to return
+an error. But, I think it would have to unroll the reservation anyway.
+
+Christoph's test case:
+
+ http://marc.info/?l=linux-mm&m=133728900729735
+
+This patch applies to 3.4 and later. A version for earlier kernels is at
+https://lkml.org/lkml/2012/5/22/418.
+
+Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>
+Acked-by: Mel Gorman <mel@csn.ul.ie>
+Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Reported-by: Christoph Lameter <cl@linux.com>
+Tested-by: Christoph Lameter <cl@linux.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2157,6 +2157,15 @@ static void hugetlb_vm_op_open(struct vm
+ kref_get(&reservations->refs);
+ }
+
++static void resv_map_put(struct vm_area_struct *vma)
++{
++ struct resv_map *reservations = vma_resv_map(vma);
++
++ if (!reservations)
++ return;
++ kref_put(&reservations->refs, resv_map_release);
++}
++
+ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+ {
+ struct hstate *h = hstate_vma(vma);
+@@ -2173,7 +2182,7 @@ static void hugetlb_vm_op_close(struct v
+ reserve = (end - start) -
+ region_count(&reservations->regions, start, end);
+
+- kref_put(&reservations->refs, resv_map_release);
++ resv_map_put(vma);
+
+ if (reserve) {
+ hugetlb_acct_memory(h, -reserve);
+@@ -2990,12 +2999,16 @@ int hugetlb_reserve_pages(struct inode *
+ set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
+ }
+
+- if (chg < 0)
+- return chg;
++ if (chg < 0) {
++ ret = chg;
++ goto out_err;
++ }
+
+ /* There must be enough pages in the subpool for the mapping */
+- if (hugepage_subpool_get_pages(spool, chg))
+- return -ENOSPC;
++ if (hugepage_subpool_get_pages(spool, chg)) {
++ ret = -ENOSPC;
++ goto out_err;
++ }
+
+ /*
+ * Check enough hugepages are available for the reservation.
+@@ -3004,7 +3017,7 @@ int hugetlb_reserve_pages(struct inode *
+ ret = hugetlb_acct_memory(h, chg);
+ if (ret < 0) {
+ hugepage_subpool_put_pages(spool, chg);
+- return ret;
++ goto out_err;
+ }
+
+ /*
+@@ -3021,6 +3034,9 @@ int hugetlb_reserve_pages(struct inode *
+ if (!vma || vma->vm_flags & VM_MAYSHARE)
+ region_add(&inode->i_mapping->private_list, from, to);
+ return 0;
++out_err:
++ resv_map_put(vma);
++ return ret;
+ }
+
+ void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
--- /dev/null
+From 9dde0ae3769875ec1370cb316e50c54b57d52c1a Mon Sep 17 00:00:00 2001
+From: Richard Cochran <richardcochran@gmail.com>
+Date: Wed, 23 May 2012 18:19:51 +0200
+Subject: ixp4xx: fix compilation by adding gpiolib support
+
+From: Richard Cochran <richardcochran@gmail.com>
+
+commit 9dde0ae3769875ec1370cb316e50c54b57d52c1a upstream.
+
+Once again, ixp4xx no longer even compiles. This patch fixes the issue
+by converting over to gpiolib. This patch was first made by Imre and
+posted by Marc, and I added in Russell's suggestion to empty the gpio
+header file.
+
+This fix should also go for 3.1, 3.2, 3.3, and 3.4.
+
+Signed-off-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/Kconfig | 2
+ arch/arm/mach-ixp4xx/common.c | 48 ++++++++++++++++++
+ arch/arm/mach-ixp4xx/include/mach/gpio.h | 79 -------------------------------
+ 3 files changed, 48 insertions(+), 81 deletions(-)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -556,7 +556,7 @@ config ARCH_IXP4XX
+ select ARCH_HAS_DMA_SET_COHERENT_MASK
+ select CLKSRC_MMIO
+ select CPU_XSCALE
+- select GENERIC_GPIO
++ select ARCH_REQUIRE_GPIOLIB
+ select GENERIC_CLOCKEVENTS
+ select MIGHT_HAVE_PCI
+ select NEED_MACH_IO_H
+--- a/arch/arm/mach-ixp4xx/common.c
++++ b/arch/arm/mach-ixp4xx/common.c
+@@ -28,6 +28,7 @@
+ #include <linux/clockchips.h>
+ #include <linux/io.h>
+ #include <linux/export.h>
++#include <linux/gpio.h>
+
+ #include <mach/udc.h>
+ #include <mach/hardware.h>
+@@ -107,7 +108,7 @@ static signed char irq2gpio[32] = {
+ 7, 8, 9, 10, 11, 12, -1, -1,
+ };
+
+-int gpio_to_irq(int gpio)
++static int ixp4xx_gpio_to_irq(struct gpio_chip *chip, unsigned gpio)
+ {
+ int irq;
+
+@@ -117,7 +118,6 @@ int gpio_to_irq(int gpio)
+ }
+ return -EINVAL;
+ }
+-EXPORT_SYMBOL(gpio_to_irq);
+
+ int irq_to_gpio(unsigned int irq)
+ {
+@@ -383,12 +383,56 @@ static struct platform_device *ixp46x_de
+ unsigned long ixp4xx_exp_bus_size;
+ EXPORT_SYMBOL(ixp4xx_exp_bus_size);
+
++static int ixp4xx_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
++{
++ gpio_line_config(gpio, IXP4XX_GPIO_IN);
++
++ return 0;
++}
++
++static int ixp4xx_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
++ int level)
++{
++ gpio_line_set(gpio, level);
++ gpio_line_config(gpio, IXP4XX_GPIO_OUT);
++
++ return 0;
++}
++
++static int ixp4xx_gpio_get_value(struct gpio_chip *chip, unsigned gpio)
++{
++ int value;
++
++ gpio_line_get(gpio, &value);
++
++ return value;
++}
++
++static void ixp4xx_gpio_set_value(struct gpio_chip *chip, unsigned gpio,
++ int value)
++{
++ gpio_line_set(gpio, value);
++}
++
++static struct gpio_chip ixp4xx_gpio_chip = {
++ .label = "IXP4XX_GPIO_CHIP",
++ .direction_input = ixp4xx_gpio_direction_input,
++ .direction_output = ixp4xx_gpio_direction_output,
++ .get = ixp4xx_gpio_get_value,
++ .set = ixp4xx_gpio_set_value,
++ .to_irq = ixp4xx_gpio_to_irq,
++ .base = 0,
++ .ngpio = 16,
++};
++
+ void __init ixp4xx_sys_init(void)
+ {
+ ixp4xx_exp_bus_size = SZ_16M;
+
+ platform_add_devices(ixp4xx_devices, ARRAY_SIZE(ixp4xx_devices));
+
++ gpiochip_add(&ixp4xx_gpio_chip);
++
+ if (cpu_is_ixp46x()) {
+ int region;
+
+--- a/arch/arm/mach-ixp4xx/include/mach/gpio.h
++++ b/arch/arm/mach-ixp4xx/include/mach/gpio.h
+@@ -1,79 +1,2 @@
+-/*
+- * arch/arm/mach-ixp4xx/include/mach/gpio.h
+- *
+- * IXP4XX GPIO wrappers for arch-neutral GPIO calls
+- *
+- * Written by Milan Svoboda <msvoboda@ra.rockwell.com>
+- * Based on PXA implementation by Philipp Zabel <philipp.zabel@gmail.com>
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, write to the Free Software
+- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+- *
+- */
+-
+-#ifndef __ASM_ARCH_IXP4XX_GPIO_H
+-#define __ASM_ARCH_IXP4XX_GPIO_H
+-
+-#include <linux/kernel.h>
+-#include <mach/hardware.h>
+-
+-#define __ARM_GPIOLIB_COMPLEX
+-
+-static inline int gpio_request(unsigned gpio, const char *label)
+-{
+- return 0;
+-}
+-
+-static inline void gpio_free(unsigned gpio)
+-{
+- might_sleep();
+-
+- return;
+-}
+-
+-static inline int gpio_direction_input(unsigned gpio)
+-{
+- gpio_line_config(gpio, IXP4XX_GPIO_IN);
+- return 0;
+-}
+-
+-static inline int gpio_direction_output(unsigned gpio, int level)
+-{
+- gpio_line_set(gpio, level);
+- gpio_line_config(gpio, IXP4XX_GPIO_OUT);
+- return 0;
+-}
+-
+-static inline int gpio_get_value(unsigned gpio)
+-{
+- int value;
+-
+- gpio_line_get(gpio, &value);
+-
+- return value;
+-}
+-
+-static inline void gpio_set_value(unsigned gpio, int value)
+-{
+- gpio_line_set(gpio, value);
+-}
+-
+-#include <asm-generic/gpio.h> /* cansleep wrappers */
+-
+-extern int gpio_to_irq(int gpio);
+-#define gpio_to_irq gpio_to_irq
+-extern int irq_to_gpio(unsigned int irq);
+-
+-#endif
++/* empty */
+
--- /dev/null
+From 7b21aea04d084916ac4e0e8852dcc9cd60ec0d1d Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Tue, 29 May 2012 02:00:22 -0700
+Subject: mac80211: fix ADDBA declined after suspend with wowlan
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit 7b21aea04d084916ac4e0e8852dcc9cd60ec0d1d upstream.
+
+WLAN_STA_BLOCK_BA is set while suspending but doesn't get cleared
+when resuming in case of wowlan. This causes further ADDBA requests
+received to be rejected. Fix it by clearing it in the wowlan path
+as well.
+
+Signed-off-by: Eyal Shapira <eyal@wizery.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/util.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1321,6 +1321,12 @@ int ieee80211_reconfig(struct ieee80211_
+ }
+ }
+
++ /* add back keys */
++ list_for_each_entry(sdata, &local->interfaces, list)
++ if (ieee80211_sdata_running(sdata))
++ ieee80211_enable_keys(sdata);
++
++ wake_up:
+ /*
+ * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
+ * sessions can be established after a resume.
+@@ -1342,12 +1348,6 @@ int ieee80211_reconfig(struct ieee80211_
+ mutex_unlock(&local->sta_mtx);
+ }
+
+- /* add back keys */
+- list_for_each_entry(sdata, &local->interfaces, list)
+- if (ieee80211_sdata_running(sdata))
+- ieee80211_enable_keys(sdata);
+-
+- wake_up:
+ ieee80211_wake_queues_by_reason(hw,
+ IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+
--- /dev/null
+From 442209f31dafef9fde852858e1ce566b675b720d Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jonas.gorski@gmail.com>
+Date: Tue, 15 May 2012 17:47:52 +0200
+Subject: MIPS: BCM63XX: Add missing include for bcm63xx_gpio.h
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+commit 442209f31dafef9fde852858e1ce566b675b720d upstream.
+
+bcm63xx_gpio.h uses macros defined in bcm63xx_cpu.h without including it,
+leading to the following build failure:
+
+ CC [M] drivers/mmc/core/cd-gpio.o
+In file included from arch/mips/include/asm/mach-bcm63xx/gpio.h:4:0,
+ from arch/mips/include/asm/gpio.h:4,
+ from include/linux/gpio.h:30,
+ from drivers/mmc/core/cd-gpio.c:12:
+
+arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h: In function 'bcm63xx_gpio_count':
+arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:10:2: error: implicit declaration of function 'bcm63xx_get_cpu_id'
+arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:11:7: error: 'BCM6358_CPU_ID' undeclared (first use in this function)
+arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:11:7: note: each undeclared identifier is reported only once for each function it appears in
+arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:13:7: error: 'BCM6338_CPU_ID' undeclared (first use in this function)
+arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:15:7: error: 'BCM6345_CPU_ID' undeclared (first use in this function)
+arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:17:7: error: 'BCM6368_CPU_ID' undeclared (first use in this function)
+arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:19:7: error: 'BCM6348_CPU_ID' undeclared (first use in this function)
+
+make[7]: *** [drivers/mmc/core/cd-gpio.o] Error 1
+
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Maxime Bizon <mbizon@freebox.fr>
+Cc: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h
++++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h
+@@ -2,6 +2,7 @@
+ #define BCM63XX_GPIO_H
+
+ #include <linux/init.h>
++#include <bcm63xx_cpu.h>
+
+ int __init bcm63xx_gpio_init(void);
+
--- /dev/null
+From 5abc03cd919535c61b813f2319cb38326a41e810 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 14 May 2012 22:45:28 +0300
+Subject: NFS: kmalloc() doesn't return an ERR_PTR()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 5abc03cd919535c61b813f2319cb38326a41e810 upstream.
+
+Obviously we should check for NULL here instead of IS_ERR().
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/idmap.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/fs/nfs/idmap.c
++++ b/fs/nfs/idmap.c
+@@ -640,20 +640,16 @@ static int nfs_idmap_legacy_upcall(struc
+ struct idmap_msg *im;
+ struct idmap *idmap = (struct idmap *)aux;
+ struct key *key = cons->key;
+- int ret;
++ int ret = -ENOMEM;
+
+ /* msg and im are freed in idmap_pipe_destroy_msg */
+ msg = kmalloc(sizeof(*msg), GFP_KERNEL);
+- if (IS_ERR(msg)) {
+- ret = PTR_ERR(msg);
++ if (!msg)
+ goto out0;
+- }
+
+ im = kmalloc(sizeof(*im), GFP_KERNEL);
+- if (IS_ERR(im)) {
+- ret = PTR_ERR(im);
++ if (!im)
+ goto out1;
+- }
+
+ ret = nfs_idmap_prepare_message(key->description, im, msg);
+ if (ret < 0)
--- /dev/null
+From fb13bfa7e1bcfdcfdece47c24b62f1a1cad957e9 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Mon, 28 May 2012 11:36:28 -0400
+Subject: NFSv4: Map NFS4ERR_SHARE_DENIED into an EACCES error instead of EIO
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit fb13bfa7e1bcfdcfdece47c24b62f1a1cad957e9 upstream.
+
+If a file OPEN is denied due to a share lock, the resulting
+NFS4ERR_SHARE_DENIED is currently mapped to the default EIO.
+This patch adds a more appropriate mapping, and brings Linux
+into line with what Solaris 10 does.
+
+See https://bugzilla.kernel.org/show_bug.cgi?id=43286
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -101,6 +101,8 @@ static int nfs4_map_errors(int err)
+ case -NFS4ERR_BADOWNER:
+ case -NFS4ERR_BADNAME:
+ return -EINVAL;
++ case -NFS4ERR_SHARE_DENIED:
++ return -EACCES;
+ default:
+ dprintk("%s could not handle NFSv4 error %d\n",
+ __func__, -err);
--- /dev/null
+From ed5fb2471b7060767957fb964eb1aaec71533ab1 Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Thu, 17 May 2012 10:34:34 -0400
+Subject: PARISC: fix boot failure on 32-bit systems caused by branch stubs placed before .text
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit ed5fb2471b7060767957fb964eb1aaec71533ab1 upstream.
+
+In certain configurations, the resulting kernel becomes too large to boot
+because the linker places the long branch stubs for the merged .text section
+at the very start of the image. As a result, the initial transfer of control
+jumps to an unexpected location. Fix this by placing the head text in a
+separate section so the stubs for .text are not at the start of the image.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/vmlinux.lds.S | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/kernel/vmlinux.lds.S
++++ b/arch/parisc/kernel/vmlinux.lds.S
+@@ -50,8 +50,10 @@ SECTIONS
+ . = KERNEL_BINARY_TEXT_START;
+
+ _text = .; /* Text and read-only data */
+- .text ALIGN(16) : {
++ .head ALIGN(16) : {
+ HEAD_TEXT
++ } = 0
++ .text ALIGN(16) : {
+ TEXT_TEXT
+ SCHED_TEXT
+ LOCK_TEXT
+@@ -65,7 +67,7 @@ SECTIONS
+ *(.fixup)
+ *(.lock.text) /* out-of-line lock text */
+ *(.gnu.warning)
+- } = 0
++ }
+ /* End of text section */
+ _etext = .;
+
--- /dev/null
+From 2f649c1f6f0fef445ce79a19b79e5ce8fe9d7f19 Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Parallels.com>
+Date: Mon, 21 May 2012 07:49:01 +0100
+Subject: PARISC: fix TLB fault path on PA2.0 narrow systems
+
+From: James Bottomley <JBottomley@Parallels.com>
+
+commit 2f649c1f6f0fef445ce79a19b79e5ce8fe9d7f19 upstream.
+
+commit 5e185581d7c46ddd33cd9c01106d1fc86efb9376
+Author: James Bottomley <JBottomley@Parallels.com>
+
+ [PARISC] fix PA1.1 oops on boot
+
+Didn't quite fix the crash on boot. It moved it from PA1.1 processors to
+PA2.0 narrow kernels. The final fix is to make sure the [id]tlb_miss_20 paths
+also work. Even on narrow systems, these paths require using the wide
+instructions becuase the tlb insertion format is wide. Fix this by
+conditioning the dep[wd],z on whether we're being called from _11 or _20[w]
+paths.
+
+Tested-by: Helge Deller <deller@gmx.de>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/entry.S | 30 +++++++++++++++++-------------
+ 1 file changed, 17 insertions(+), 13 deletions(-)
+
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -552,7 +552,7 @@
+ * entry (identifying the physical page) and %r23 up with
+ * the from tlb entry (or nothing if only a to entry---for
+ * clear_user_page_asm) */
+- .macro do_alias spc,tmp,tmp1,va,pte,prot,fault
++ .macro do_alias spc,tmp,tmp1,va,pte,prot,fault,patype
+ cmpib,COND(<>),n 0,\spc,\fault
+ ldil L%(TMPALIAS_MAP_START),\tmp
+ #if defined(CONFIG_64BIT) && (TMPALIAS_MAP_START >= 0x80000000)
+@@ -581,11 +581,15 @@
+ */
+ cmpiclr,= 0x01,\tmp,%r0
+ ldi (_PAGE_DIRTY|_PAGE_READ|_PAGE_WRITE),\prot
+-#ifdef CONFIG_64BIT
++.ifc \patype,20
+ depd,z \prot,8,7,\prot
+-#else
++.else
++.ifc \patype,11
+ depw,z \prot,8,7,\prot
+-#endif
++.else
++ .error "undefined PA type to do_alias"
++.endif
++.endif
+ /*
+ * OK, it is in the temp alias region, check whether "from" or "to".
+ * Check "subtle" note in pacache.S re: r23/r26.
+@@ -1189,7 +1193,7 @@ dtlb_miss_20w:
+ nop
+
+ dtlb_check_alias_20w:
+- do_alias spc,t0,t1,va,pte,prot,dtlb_fault
++ do_alias spc,t0,t1,va,pte,prot,dtlb_fault,20
+
+ idtlbt pte,prot
+
+@@ -1213,7 +1217,7 @@ nadtlb_miss_20w:
+ nop
+
+ nadtlb_check_alias_20w:
+- do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate
++ do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate,20
+
+ idtlbt pte,prot
+
+@@ -1245,7 +1249,7 @@ dtlb_miss_11:
+ nop
+
+ dtlb_check_alias_11:
+- do_alias spc,t0,t1,va,pte,prot,dtlb_fault
++ do_alias spc,t0,t1,va,pte,prot,dtlb_fault,11
+
+ idtlba pte,(va)
+ idtlbp prot,(va)
+@@ -1277,7 +1281,7 @@ nadtlb_miss_11:
+ nop
+
+ nadtlb_check_alias_11:
+- do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate
++ do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate,11
+
+ idtlba pte,(va)
+ idtlbp prot,(va)
+@@ -1304,7 +1308,7 @@ dtlb_miss_20:
+ nop
+
+ dtlb_check_alias_20:
+- do_alias spc,t0,t1,va,pte,prot,dtlb_fault
++ do_alias spc,t0,t1,va,pte,prot,dtlb_fault,20
+
+ idtlbt pte,prot
+
+@@ -1330,7 +1334,7 @@ nadtlb_miss_20:
+ nop
+
+ nadtlb_check_alias_20:
+- do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate
++ do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate,20
+
+ idtlbt pte,prot
+
+@@ -1457,7 +1461,7 @@ naitlb_miss_20w:
+ nop
+
+ naitlb_check_alias_20w:
+- do_alias spc,t0,t1,va,pte,prot,naitlb_fault
++ do_alias spc,t0,t1,va,pte,prot,naitlb_fault,20
+
+ iitlbt pte,prot
+
+@@ -1511,7 +1515,7 @@ naitlb_miss_11:
+ nop
+
+ naitlb_check_alias_11:
+- do_alias spc,t0,t1,va,pte,prot,itlb_fault
++ do_alias spc,t0,t1,va,pte,prot,itlb_fault,11
+
+ iitlba pte,(%sr0, va)
+ iitlbp prot,(%sr0, va)
+@@ -1557,7 +1561,7 @@ naitlb_miss_20:
+ nop
+
+ naitlb_check_alias_20:
+- do_alias spc,t0,t1,va,pte,prot,naitlb_fault
++ do_alias spc,t0,t1,va,pte,prot,naitlb_fault,20
+
+ iitlbt pte,prot
+
iwlwifi-do-not-use-shadow-registers-by-default.patch
cifs-include-backup-intent-search-flags-during-searches-try-2.patch
cifs-fix-oops-while-traversing-open-file-list-try-4.patch
+parisc-fix-boot-failure-on-32-bit-systems-caused-by-branch-stubs-placed-before-.text.patch
+parisc-fix-tlb-fault-path-on-pa2.0-narrow-systems.patch
+solos-pci-fix-dma-support.patch
+mips-bcm63xx-add-missing-include-for-bcm63xx_gpio.h.patch
+mac80211-fix-addba-declined-after-suspend-with-wowlan.patch
+ixp4xx-fix-compilation-by-adding-gpiolib-support.patch
+ath9k-fix-a-use-after-free-bug-when-ath_tx_setup_buffer-fails.patch
+x86-amd-xen-avoid-null-pointer-paravirt-references.patch
+nfs-kmalloc-doesn-t-return-an-err_ptr.patch
+nfsv4-map-nfs4err_share_denied-into-an-eacces-error-instead-of-eio.patch
+hugetlb-fix-resv_map-leak-in-error-path.patch
--- /dev/null
+From b4bd8ad9bb311e8536f726f7a633620ccd358cde Mon Sep 17 00:00:00 2001
+From: David Woodhouse <dwmw2@infradead.org>
+Date: Thu, 24 May 2012 04:58:27 +0000
+Subject: solos-pci: Fix DMA support
+
+From: David Woodhouse <dwmw2@infradead.org>
+
+commit b4bd8ad9bb311e8536f726f7a633620ccd358cde upstream.
+
+DMA support has finally made its way to the top of the TODO list, having
+realised that a Geode using MMIO can't keep up with two ADSL2+ lines
+each running at 21Mb/s.
+
+This patch fixes a couple of bugs in the DMA support in the driver, so
+once the corresponding FPGA update is complete and tested everything
+should work properly.
+
+We weren't storing the currently-transmitting skb, so we were never
+unmapping it and never freeing/popping it when the TX was done.
+And the addition of pci_set_master() is fairly self-explanatory.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/atm/solos-pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/atm/solos-pci.c
++++ b/drivers/atm/solos-pci.c
+@@ -984,6 +984,7 @@ static uint32_t fpga_tx(struct solos_car
+ } else if (skb && card->using_dma) {
+ SKB_CB(skb)->dma_addr = pci_map_single(card->dev, skb->data,
+ skb->len, PCI_DMA_TODEVICE);
++ card->tx_skb[port] = skb;
+ iowrite32(SKB_CB(skb)->dma_addr,
+ card->config_regs + TX_DMA_ADDR(port));
+ }
+@@ -1152,7 +1153,8 @@ static int fpga_probe(struct pci_dev *de
+ db_fpga_upgrade = db_firmware_upgrade = 0;
+ }
+
+- if (card->fpga_version >= DMA_SUPPORTED){
++ if (card->fpga_version >= DMA_SUPPORTED) {
++ pci_set_master(dev);
+ card->using_dma = 1;
+ } else {
+ card->using_dma = 0;
--- /dev/null
+From 1ab46fd319bcf1fcd9fb6311727d532b580e4eba Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad@darnok.org>
+Date: Wed, 30 May 2012 18:23:56 -0400
+Subject: x86, amd, xen: Avoid NULL pointer paravirt references
+
+From: Konrad Rzeszutek Wilk <konrad@darnok.org>
+
+commit 1ab46fd319bcf1fcd9fb6311727d532b580e4eba upstream.
+
+Stub out MSR methods that aren't actually needed. This fixes a crash
+as Xen Dom0 on AMD Trinity systems. A bigger patch should be added to
+remove the paravirt machinery completely for the methods which
+apparently have no users!
+
+Reported-by: Andre Przywara <andre.przywara@amd.com>
+Link: http://lkml.kernel.org/r/20120530222356.GA28417@andromeda.dapyr.net
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/xen/enlighten.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1106,7 +1106,10 @@ static const struct pv_cpu_ops xen_cpu_o
+ .wbinvd = native_wbinvd,
+
+ .read_msr = native_read_msr_safe,
++ .rdmsr_regs = native_rdmsr_safe_regs,
+ .write_msr = xen_write_msr_safe,
++ .wrmsr_regs = native_wrmsr_safe_regs,
++
+ .read_tsc = native_read_tsc,
+ .read_pmc = native_read_pmc,
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
