--- /dev/null
+From 7ea6600148c265b1fd53e521022b1d7aec81d974 Mon Sep 17 00:00:00 2001
+From: Serge E. Hallyn <serue@us.ibm.com>
+Date: Tue, 29 Dec 2009 14:50:19 -0600
+Subject: generic_permission: MAY_OPEN is not write access
+
+From: Serge E. Hallyn <serue@us.ibm.com>
+
+commit 7ea6600148c265b1fd53e521022b1d7aec81d974 upstream.
+
+generic_permission was refusing CAP_DAC_READ_SEARCH-enabled
+processes from opening DAC-protected files read-only, because
+do_filp_open adds MAY_OPEN to the open mask.
+
+Ignore MAY_OPEN. After this patch, CAP_DAC_READ_SEARCH is
+again sufficient to open(fname, O_RDONLY) on a file to which
+DAC otherwise refuses us read permission.
+
+Reported-by: Mike Kazantsev <mk.fraggod@gmail.com>
+Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
+Tested-by: Mike Kazantsev <mk.fraggod@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/namei.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -234,6 +234,7 @@ int generic_permission(struct inode *ino
+ /*
+ * Searching includes executable on directories, else just read.
+ */
++ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
+ if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
+ if (capable(CAP_DAC_READ_SEARCH))
+ return 0;
--- /dev/null
+From hugh.dickins@tiscali.co.uk Tue Jan 5 10:54:39 2010
+From: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Date: Wed, 30 Dec 2009 23:00:30 +0000 (GMT)
+Subject: ksm: fix mlockfreed to munlocked
+To: stable@kernel.org
+Cc: Andrea Arcangeli <aarcange@redhat.com>, Chris Wright <chrisw@redhat.com>, Rik van Riel <riel@redhat.com>, Mel Gorman <mel@csn.ul.ie>, Izik Eidus <ieidus@redhat.com>, KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>, Andrew Morton <akpm@linux-foundation.org>
+Message-ID: <alpine.LSU.2.00.0912302254090.7519@sister.anvils>
+
+From: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+
+2.6.33-rc1 commit 73848b4684e84a84cfd1555af78d41158f31e16b, adjusted
+to include 31e855ea7173bdb0520f9684580423a9560f66e0's movement of
+the unlock_page(oldpage), but omit other intervening cleanups.
+
+When KSM merges an mlocked page, it has been forgetting to munlock it:
+that's been left to free_page_mlock(), which reports it in /proc/vmstat
+as unevictable_pgs_mlockfreed instead of unevictable_pgs_munlocked,
+which indicates that such pages _might_ be left unevictable for long
+after they should be evictable. Call munlock_vma_page() to fix that.
+
+Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/internal.h | 3 ++-
+ mm/ksm.c | 14 +++++++-------
+ mm/mlock.c | 4 ++--
+ 3 files changed, 11 insertions(+), 10 deletions(-)
+
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -107,9 +107,10 @@ static inline int is_mlocked_vma(struct
+ }
+
+ /*
+- * must be called with vma's mmap_sem held for read, and page locked.
++ * must be called with vma's mmap_sem held for read or write, and page locked.
+ */
+ extern void mlock_vma_page(struct page *page);
++extern void munlock_vma_page(struct page *page);
+
+ /*
+ * Clear the page's PageMlocked(). This can be useful in a situation where
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -34,6 +34,7 @@
+ #include <linux/ksm.h>
+
+ #include <asm/tlbflush.h>
++#include "internal.h"
+
+ /*
+ * A few notes about the KSM scanning process,
+@@ -767,15 +768,14 @@ static int try_to_merge_one_page(struct
+ * ptes are necessarily already write-protected. But in either
+ * case, we need to lock and check page_count is not raised.
+ */
+- if (write_protect_page(vma, oldpage, &orig_pte)) {
+- unlock_page(oldpage);
+- goto out_putpage;
+- }
+- unlock_page(oldpage);
+-
+- if (pages_identical(oldpage, newpage))
++ if (write_protect_page(vma, oldpage, &orig_pte) == 0 &&
++ pages_identical(oldpage, newpage))
+ err = replace_page(vma, oldpage, newpage, orig_pte);
+
++ if ((vma->vm_flags & VM_LOCKED) && !err)
++ munlock_vma_page(oldpage);
++
++ unlock_page(oldpage);
+ out_putpage:
+ put_page(oldpage);
+ put_page(newpage);
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -99,14 +99,14 @@ void mlock_vma_page(struct page *page)
+ * not get another chance to clear PageMlocked. If we successfully
+ * isolate the page and try_to_munlock() detects other VM_LOCKED vmas
+ * mapping the page, it will restore the PageMlocked state, unless the page
+- * is mapped in a non-linear vma. So, we go ahead and SetPageMlocked(),
++ * is mapped in a non-linear vma. So, we go ahead and ClearPageMlocked(),
+ * perhaps redundantly.
+ * If we lose the isolation race, and the page is mapped by other VM_LOCKED
+ * vmas, we'll detect this in vmscan--via try_to_munlock() or try_to_unmap()
+ * either of which will restore the PageMlocked state by calling
+ * mlock_vma_page() above, if it can grab the vma's mmap sem.
+ */
+-static void munlock_vma_page(struct page *page)
++void munlock_vma_page(struct page *page)
+ {
+ BUG_ON(!PageLocked(page));
+
--- /dev/null
+From 93b6bd26b74efe46b4579592560f9f1cb7b61994 Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Mon, 14 Dec 2009 20:33:55 +0100
+Subject: rt2x00: Disable powersaving for rt61pci and rt2800pci.
+
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+
+commit 93b6bd26b74efe46b4579592560f9f1cb7b61994 upstream.
+
+We've had many reports of rt61pci failures with powersaving enabled.
+Therefore, as a stop-gap measure, disable powersaving of the rt61pci
+until we have found a proper solution.
+Also disable powersaving on rt2800pci as it most probably will show
+the same problem.
+
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt61pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2538,6 +2538,11 @@ static int rt61pci_probe_hw_mode(struct
+ unsigned int i;
+
+ /*
++ * Disable powersaving as default.
++ */
++ rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
++
++ /*
+ * Initialize all hw fields.
+ */
+ rt2x00dev->hw->flags =