--- /dev/null
+From 30ae9139dc3b44d14a56fbbc2a3f8f63aa586a17 Mon Sep 17 00:00:00 2001
+From: Linus Lüssing <linus.luessing@web.de>
+Date: Tue, 22 Mar 2011 11:40:32 +0000
+Subject: bridge: Fix possibly wrong MLD queries' ethernet source address
+
+
+From: Linus Lüssing <linus.luessing@web.de>
+
+[ Upstream commit a7bff75b087e7a355838a32efe61707cfa73c194 ]
+
+The ipv6_dev_get_saddr() is currently called with an uninitialized
+destination address. Although in tests it usually seemed to nevertheless
+always fetch the right source address, there seems to be a possible race
+condition.
+
+Therefore this commit changes this, first setting the destination
+address and only after that fetching the source address.
+
+Reported-by: Jan Beulich <JBeulich@novell.com>
+Signed-off-by: Linus Lüssing <linus.luessing@web.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_multicast.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -445,9 +445,9 @@ static struct sk_buff *br_ip6_multicast_
+ ip6h->payload_len = htons(8 + sizeof(*mldq));
+ ip6h->nexthdr = IPPROTO_HOPOPTS;
+ ip6h->hop_limit = 1;
++ ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
+ ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+ &ip6h->saddr);
+- ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
+ ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
+
+ hopopt = (u8 *)(ip6h + 1);
--- /dev/null
+From 0589d1f7a527e5f4c4c6d16b734cfed4e3608f1c Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Fri, 18 Mar 2011 05:27:28 +0000
+Subject: bridge: Reset IPCB when entering IP stack on NF_FORWARD
+
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e ]
+
+Whenever we enter the IP stack proper from bridge netfilter we
+need to ensure that the skb is in a form the IP stack expects
+it to be in.
+
+The entry point on NF_FORWARD did not meet the requirements of
+the IP stack, therefore leading to potential crashes/panics.
+
+This patch fixes the problem.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_netfilter.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -741,6 +741,9 @@ static unsigned int br_nf_forward_ip(uns
+ nf_bridge->mask |= BRNF_PKT_TYPE;
+ }
+
++ if (br_parse_ip_options(skb))
++ return NF_DROP;
++
+ /* The physdev module checks on this */
+ nf_bridge->mask |= BRNF_BRIDGED;
+ nf_bridge->physoutdev = skb->dev;
--- /dev/null
+From 228f4d04e7d7a239b4c44e6f329aaec88f40e54a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 30 Mar 2011 16:57:46 -0700
+Subject: fib: add rtnl locking in ip_fib_net_exit
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit e2666f84958adb3a034b98e99699b55705117e01 ]
+
+Daniel J Blueman reported a lockdep splat in trie_firstleaf(), caused by
+RTNL being not locked before a call to fib_table_flush()
+
+Reported-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/fib_frontend.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1041,6 +1041,7 @@ static void ip_fib_net_exit(struct net *
+ fib4_rules_exit(net);
+ #endif
+
++ rtnl_lock();
+ for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
+ struct fib_table *tb;
+ struct hlist_head *head;
+@@ -1053,6 +1054,7 @@ static void ip_fib_net_exit(struct net *
+ fib_free_table(tb);
+ }
+ }
++ rtnl_unlock();
+ kfree(net->ipv4.fib_table_hash);
+ }
+
--- /dev/null
+From 4dbd99fd8453ae681dad8fc1e7aa2c05e16b0cc1 Mon Sep 17 00:00:00 2001
+From: Alex Dubov <oakad@yahoo.com>
+Date: Wed, 16 Mar 2011 17:57:13 +0000
+Subject: gianfar: Fall back to software tcp/udp checksum on older controllers
+
+
+From: Alex Dubov <oakad@yahoo.com>
+
+[ Upstream commit 4363c2fddb1399b728ef21ee8101c148a311ea45 ]
+
+As specified by errata eTSEC49 of MPC8548 and errata eTSEC12 of MPC83xx,
+older revisions of gianfar controllers will be unable to calculate a TCP/UDP
+packet checksum for some alignments of the appropriate FCB. This patch checks
+for FCB alignment on such controllers and falls back to software checksumming
+if the alignment is known to be bad.
+
+Signed-off-by: Alex Dubov <oakad@yahoo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/gianfar.c | 16 ++++++++++++++--
+ drivers/net/gianfar.h | 1 +
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/gianfar.c
++++ b/drivers/net/gianfar.c
+@@ -950,6 +950,11 @@ static void gfar_detect_errata(struct gf
+ (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
+ priv->errata |= GFAR_ERRATA_A002;
+
++ /* MPC8313 Rev < 2.0, MPC8548 rev 2.0 */
++ if ((pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020) ||
++ (pvr == 0x80210020 && mod == 0x8030 && rev == 0x0020))
++ priv->errata |= GFAR_ERRATA_12;
++
+ if (priv->errata)
+ dev_info(dev, "enabled errata workarounds, flags: 0x%x\n",
+ priv->errata);
+@@ -2156,8 +2161,15 @@ static int gfar_start_xmit(struct sk_buf
+ /* Set up checksumming */
+ if (CHECKSUM_PARTIAL == skb->ip_summed) {
+ fcb = gfar_add_fcb(skb);
+- lstatus |= BD_LFLAG(TXBD_TOE);
+- gfar_tx_checksum(skb, fcb);
++ /* as specified by errata */
++ if (unlikely(gfar_has_errata(priv, GFAR_ERRATA_12)
++ && ((unsigned long)fcb % 0x20) > 0x18)) {
++ __skb_pull(skb, GMAC_FCB_LEN);
++ skb_checksum_help(skb);
++ } else {
++ lstatus |= BD_LFLAG(TXBD_TOE);
++ gfar_tx_checksum(skb, fcb);
++ }
+ }
+
+ if (vlan_tx_tag_present(skb)) {
+--- a/drivers/net/gianfar.h
++++ b/drivers/net/gianfar.h
+@@ -1039,6 +1039,7 @@ enum gfar_errata {
+ GFAR_ERRATA_74 = 0x01,
+ GFAR_ERRATA_76 = 0x02,
+ GFAR_ERRATA_A002 = 0x04,
++ GFAR_ERRATA_12 = 0x08, /* a.k.a errata eTSEC49 */
+ };
+
+ /* Struct stolen almost completely (and shamelessly) from the FCC enet source
--- /dev/null
+From 2f288c99c4ba53a7ddbb5a7a77e42ae72d6da3b9 Mon Sep 17 00:00:00 2001
+From: James Chapman <jchapman@katalix.com>
+Date: Mon, 21 Mar 2011 18:10:25 -0700
+Subject: l2tp: fix possible oops on l2tp_eth module unload
+
+
+From: James Chapman <jchapman@katalix.com>
+
+[ Upstream commit 8aa525a9340da4227797a06221ca08399006635f ]
+
+A struct used in the l2tp_eth driver for registering network namespace
+ops was incorrectly marked as __net_initdata, leading to oops when
+module unloaded.
+
+BUG: unable to handle kernel paging request at ffffffffa00ec098
+IP: [<ffffffff8123dbd8>] ops_exit_list+0x7/0x4b
+PGD 142d067 PUD 1431063 PMD 195da8067 PTE 0
+Oops: 0000 [#1] SMP
+last sysfs file: /sys/module/l2tp_eth/refcnt
+Call Trace:
+ [<ffffffff8123dc94>] ? unregister_pernet_operations+0x32/0x93
+ [<ffffffff8123dd20>] ? unregister_pernet_device+0x2b/0x38
+ [<ffffffff81068b6e>] ? sys_delete_module+0x1b8/0x222
+ [<ffffffff810c7300>] ? do_munmap+0x254/0x318
+ [<ffffffff812c64e5>] ? page_fault+0x25/0x30
+ [<ffffffff812c6952>] ? system_call_fastpath+0x16/0x1b
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/l2tp/l2tp_eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/l2tp/l2tp_eth.c
++++ b/net/l2tp/l2tp_eth.c
+@@ -283,7 +283,7 @@ static __net_init int l2tp_eth_init_net(
+ return 0;
+ }
+
+-static __net_initdata struct pernet_operations l2tp_eth_net_ops = {
++static struct pernet_operations l2tp_eth_net_ops = {
+ .init = l2tp_eth_init_net,
+ .id = &l2tp_eth_net_id,
+ .size = sizeof(struct l2tp_eth_net),
--- /dev/null
+From c751cf0998164651824e1f68d124110d448d5ec3 Mon Sep 17 00:00:00 2001
+From: Eric W. Biederman <ebiederm@aristanetworks.com>
+Date: Mon, 21 Mar 2011 18:23:34 -0700
+Subject: net ipv6: Fix duplicate /proc/sys/net/ipv6/neigh directory entries.
+
+
+From: Eric W. Biederman <ebiederm@aristanetworks.com>
+
+[ Upstream commit 9d2a8fa96a44ba242de3a6f56acaef7a40a97b97 ]
+
+When I was fixing issues with unregisgtering tables under /proc/sys/net/ipv6/neigh
+by adding a mount point it appears I missed a critical ordering issue, in the
+ipv6 initialization. I had not realized that ipv6_sysctl_register is called
+at the very end of the ipv6 initialization and in particular after we call
+neigh_sysctl_register from ndisc_init.
+
+"neigh" needs to be initialized in ipv6_static_sysctl_register which is
+the first ipv6 table to initialized, and definitely before ndisc_init.
+This removes the weirdness of duplicate tables while still providing a
+"neigh" mount point which prevents races in sysctl unregistering.
+
+This was initially reported at https://bugzilla.kernel.org/show_bug.cgi?id=31232
+Reported-by: sunkan@zappa.cx
+Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv6/sysctl_net_ipv6.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/net/ipv6/sysctl_net_ipv6.c
++++ b/net/ipv6/sysctl_net_ipv6.c
+@@ -17,6 +17,16 @@
+
+ static struct ctl_table empty[1];
+
++static ctl_table ipv6_static_skeleton[] = {
++ {
++ .procname = "neigh",
++ .maxlen = 0,
++ .mode = 0555,
++ .child = empty,
++ },
++ { }
++};
++
+ static ctl_table ipv6_table_template[] = {
+ {
+ .procname = "route",
+@@ -37,12 +47,6 @@ static ctl_table ipv6_table_template[] =
+ .mode = 0644,
+ .proc_handler = proc_dointvec
+ },
+- {
+- .procname = "neigh",
+- .maxlen = 0,
+- .mode = 0555,
+- .child = empty,
+- },
+ { }
+ };
+
+@@ -160,7 +164,7 @@ static struct ctl_table_header *ip6_base
+
+ int ipv6_static_sysctl_register(void)
+ {
+- ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
++ ip6_base = register_sysctl_paths(net_ipv6_ctl_path, ipv6_static_skeleton);
+ if (ip6_base == NULL)
+ return -ENOMEM;
+ return 0;
--- /dev/null
+From f041eaa28a108f73cf02e7059cf0616dfd43b232 Mon Sep 17 00:00:00 2001
+From: Dan Siemon <dan@coverfire.com>
+Date: Tue, 15 Mar 2011 13:56:07 +0000
+Subject: net_sched: fix ip_tos2prio
+
+
+From: Dan Siemon <dan@coverfire.com>
+
+[ Upstream commit 4a2b9c3756077c05dd8666e458a751d2248b61b6 ]
+
+ECN support incorrectly maps ECN BESTEFFORT packets to TC_PRIO_FILLER
+(1) instead of TC_PRIO_BESTEFFORT (0)
+
+This means ECN enabled flows are placed in pfifo_fast/prio low priority
+band, giving ECN enabled flows [ECT(0) and CE codepoints] higher drop
+probabilities.
+
+This is rather unfortunate, given we would like ECN being more widely
+used.
+
+Ref : http://www.coverfire.com/archives/2011/03/13/pfifo_fast-and-ecn/
+
+Signed-off-by: Dan Siemon <dan@coverfire.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Dave Täht <d@taht.net>
+Cc: Jonathan Morton <chromatix99@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/route.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -171,7 +171,7 @@ static struct dst_ops ipv4_dst_ops = {
+
+ const __u8 ip_tos2prio[16] = {
+ TC_PRIO_BESTEFFORT,
+- ECN_OR_COST(FILLER),
++ ECN_OR_COST(BESTEFFORT),
+ TC_PRIO_BESTEFFORT,
+ ECN_OR_COST(BESTEFFORT),
+ TC_PRIO_BULK,
--- /dev/null
+From 1a3ea69b2cb514439d4a5f6cabac89a845204f1b Mon Sep 17 00:00:00 2001
+From: Ulrich Weber <uweber@astaro.com>
+Date: Wed, 6 Apr 2011 14:04:49 -0700
+Subject: pppoe: drop PPPOX_ZOMBIEs in pppoe_flush_dev
+
+
+From: Ulrich Weber <uweber@astaro.com>
+
+[ Upstream commit ae07b0b221b6ab2edf9e3abd518aec6cd3f1ba66 ]
+
+otherwise we loop forever if a PPPoE socket was set
+to PPPOX_ZOMBIE state by a PADT message when the
+ethernet device is going down afterwards.
+
+Signed-off-by: Ulrich Weber <uweber@astaro.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/pppoe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/pppoe.c
++++ b/drivers/net/pppoe.c
+@@ -317,7 +317,7 @@ static void pppoe_flush_dev(struct net_d
+ lock_sock(sk);
+
+ if (po->pppoe_dev == dev &&
+- sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
++ sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+ pppox_unbind_sock(sk);
+ sk->sk_state = PPPOX_ZOMBIE;
+ sk->sk_state_change(sk);
--- /dev/null
+From b51d6615ff5f9fc7c55727740b565b4eeafb7c4c Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 30 Mar 2011 17:51:36 -0700
+Subject: sctp: Pass __GFP_NOWARN to hash table allocation attempts.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit a84b50ceb7d640437d0dc28a2bef0d0de054de89 ]
+
+Like DCCP and other similar pieces of code, there are mechanisms
+here to try allocating smaller hash tables if the allocation
+fails. So pass in __GFP_NOWARN like the others do instead of
+emitting a scary message.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/sctp/protocol.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -1204,7 +1204,7 @@ SCTP_STATIC __init int sctp_init(void)
+ if ((sctp_assoc_hashsize > (64 * 1024)) && order > 0)
+ continue;
+ sctp_assoc_hashtable = (struct sctp_hashbucket *)
+- __get_free_pages(GFP_ATOMIC, order);
++ __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order);
+ } while (!sctp_assoc_hashtable && --order > 0);
+ if (!sctp_assoc_hashtable) {
+ pr_err("Failed association hash alloc\n");
+@@ -1237,7 +1237,7 @@ SCTP_STATIC __init int sctp_init(void)
+ if ((sctp_port_hashsize > (64 * 1024)) && order > 0)
+ continue;
+ sctp_port_hashtable = (struct sctp_bind_hashbucket *)
+- __get_free_pages(GFP_ATOMIC, order);
++ __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order);
+ } while (!sctp_port_hashtable && --order > 0);
+ if (!sctp_port_hashtable) {
+ pr_err("Failed bind hash alloc\n");
vm-fix-mlock-on-stack-guard-page.patch
ubifs-fix-assertion-warnings.patch
perf-fix-task-context-scheduling.patch
+bridge-fix-possibly-wrong-mld-queries-ethernet-source-address.patch
+fib-add-rtnl-locking-in-ip_fib_net_exit.patch
+gianfar-fall-back-to-software-tcp-udp-checksum-on-older-controllers.patch
+l2tp-fix-possible-oops-on-l2tp_eth-module-unload.patch
+net-ipv6-fix-duplicate-proc-sys-net-ipv6-neigh-directory-entries.patch
+net_sched-fix-ip_tos2prio.patch
+pppoe-drop-pppox_zombies-in-pppoe_flush_dev.patch
+sctp-pass-__gfp_nowarn-to-hash-table-allocation-attempts.patch
+tcp-avoid-cwnd-moderation-in-undo.patch
+xfrm-refcount-destination-entry-on-xfrm_lookup.patch
+vlan-should-take-into-account-needed_headroom.patch
+bridge-reset-ipcb-when-entering-ip-stack-on-nf_forward.patch
+sparc-fix-.size-directive-for-do_int_load.patch
+sparc32-fix-might-be-used-uninitialized-warning-in-do_sparc_fault.patch
+sparc32-pass-task_struct-to-schedule_tail-in-ret_from_fork.patch
+sparc64-fix-build-errors-with-gcc-4.6.0.patch
--- /dev/null
+From 919a6006d36ab51a70ca5d80e192cba953c874cb Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 9 Mar 2011 12:54:27 -0800
+Subject: sparc: Fix .size directive for do_int_load
+
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit 35043c428f1fcb92feb5792f5878a8852ee00771 ]
+
+gas used to accept (and ignore?) .size directives which referred to
+undefined symbols, as this does. In binutils 2.21 these are treated
+as errors.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/una_asm_64.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/una_asm_64.S
++++ b/arch/sparc/kernel/una_asm_64.S
+@@ -127,7 +127,7 @@ do_int_load:
+ wr %o5, 0x0, %asi
+ retl
+ mov 0, %o0
+- .size __do_int_load, .-__do_int_load
++ .size do_int_load, .-do_int_load
+
+ .section __ex_table,"a"
+ .word 4b, __retl_efault
--- /dev/null
+From c90b2d78650ae1ec6db90f07533e0382fa63acad Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 9 Mar 2011 13:00:47 -0800
+Subject: sparc32: Fix might-be-used-uninitialized warning in do_sparc_fault().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c816be7b5f24585baa9eba1f2413935f771d6ad6 ]
+
+When we try to handle vmalloc faults, we can take a code
+path which uses "code" before we actually set it.
+
+Amusingly gcc-3.3 notices this yet gcc-4.x does not.
+
+Reported-by: Bob Breuer <breuerr@mc.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/mm/fault_32.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/sparc/mm/fault_32.c
++++ b/arch/sparc/mm/fault_32.c
+@@ -240,11 +240,10 @@ asmlinkage void do_sparc_fault(struct pt
+ * only copy the information from the master page table,
+ * nothing more.
+ */
++ code = SEGV_MAPERR;
+ if (!ARCH_SUN4C && address >= TASK_SIZE)
+ goto vmalloc_fault;
+
+- code = SEGV_MAPERR;
+-
+ /*
+ * If we're in an interrupt or have no user
+ * context, we must not take the fault..
--- /dev/null
+From d4f295b7863f094b4d76ce10cb99f4617b5d00ad Mon Sep 17 00:00:00 2001
+From: Tkhai Kirill <tkhai@yandex.ru>
+Date: Thu, 31 Mar 2011 00:52:38 -0700
+Subject: sparc32: Pass task_struct to schedule_tail() in ret_from_fork
+
+
+From: Tkhai Kirill <tkhai@yandex.ru>
+
+[ Upstream commit 47c7c97a93a5b8f719093dbf83555090b3b8228b ]
+
+We have to pass task_struct of previous process to function
+schedule_tail(). Currently in ret_from_fork previous thread_info
+is passed:
+
+switch_to: mov %g6, %g3 /* previous thread_info in g6 */
+
+ret_from_fork: call schedule_tail
+ mov %g3, %o0 /* previous thread_info is passed */
+
+void schedule_tail(struct task_struct *prev);
+
+Signed-off-by: Tkhai Kirill <tkhai@yandex.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/entry.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/entry.S
++++ b/arch/sparc/kernel/entry.S
+@@ -1283,7 +1283,7 @@ linux_syscall_trace:
+ .globl ret_from_fork
+ ret_from_fork:
+ call schedule_tail
+- mov %g3, %o0
++ ld [%g3 + TI_TASK], %o0
+ b ret_sys_call
+ ld [%sp + STACKFRAME_SZ + PT_I0], %o0
+
--- /dev/null
+From 9567fc1bffdb332f7254c9bd2a913c80a6e18e16 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Sat, 26 Feb 2011 23:40:02 -0800
+Subject: sparc64: Fix build errors with gcc-4.6.0
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c6fee0810df4e0f4cf9c4834d2569ca01c02cffc ]
+
+Most of the warnings emitted (we fail arch/sparc file
+builds with -Werror) were legitimate but harmless, however
+one case (n2_pcr_write) was a genuine bug.
+
+Based almost entirely upon a patch by Sam Ravnborg.
+
+Reported-by: Dennis Gilmore <dennis@ausil.us>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/iommu.c | 3 ---
+ arch/sparc/kernel/ldc.c | 28 ++++++++++++++++++----------
+ arch/sparc/kernel/pci.c | 1 +
+ arch/sparc/kernel/pci_common.c | 11 +++++++----
+ arch/sparc/kernel/pci_fire.c | 2 --
+ arch/sparc/kernel/pci_schizo.c | 4 +---
+ arch/sparc/kernel/pci_sun4v.c | 3 +--
+ arch/sparc/kernel/pcr.c | 2 +-
+ arch/sparc/kernel/ptrace_64.c | 3 ++-
+ arch/sparc/kernel/smp_64.c | 11 ++++-------
+ arch/sparc/kernel/traps_64.c | 3 +--
+ 11 files changed, 36 insertions(+), 35 deletions(-)
+
+--- a/arch/sparc/kernel/iommu.c
++++ b/arch/sparc/kernel/iommu.c
+@@ -333,13 +333,10 @@ static void dma_4u_free_coherent(struct
+ void *cpu, dma_addr_t dvma)
+ {
+ struct iommu *iommu;
+- iopte_t *iopte;
+ unsigned long flags, order, npages;
+
+ npages = IO_PAGE_ALIGN(size) >> IO_PAGE_SHIFT;
+ iommu = dev->archdata.iommu;
+- iopte = iommu->page_table +
+- ((dvma - iommu->page_table_map_base) >> IO_PAGE_SHIFT);
+
+ spin_lock_irqsave(&iommu->lock, flags);
+
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -790,16 +790,20 @@ static void send_events(struct ldc_chann
+ static irqreturn_t ldc_rx(int irq, void *dev_id)
+ {
+ struct ldc_channel *lp = dev_id;
+- unsigned long orig_state, hv_err, flags;
++ unsigned long orig_state, flags;
+ unsigned int event_mask;
+
+ spin_lock_irqsave(&lp->lock, flags);
+
+ orig_state = lp->chan_state;
+- hv_err = sun4v_ldc_rx_get_state(lp->id,
+- &lp->rx_head,
+- &lp->rx_tail,
+- &lp->chan_state);
++
++ /* We should probably check for hypervisor errors here and
++ * reset the LDC channel if we get one.
++ */
++ sun4v_ldc_rx_get_state(lp->id,
++ &lp->rx_head,
++ &lp->rx_tail,
++ &lp->chan_state);
+
+ ldcdbg(RX, "RX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n",
+ orig_state, lp->chan_state, lp->rx_head, lp->rx_tail);
+@@ -904,16 +908,20 @@ out:
+ static irqreturn_t ldc_tx(int irq, void *dev_id)
+ {
+ struct ldc_channel *lp = dev_id;
+- unsigned long flags, hv_err, orig_state;
++ unsigned long flags, orig_state;
+ unsigned int event_mask = 0;
+
+ spin_lock_irqsave(&lp->lock, flags);
+
+ orig_state = lp->chan_state;
+- hv_err = sun4v_ldc_tx_get_state(lp->id,
+- &lp->tx_head,
+- &lp->tx_tail,
+- &lp->chan_state);
++
++ /* We should probably check for hypervisor errors here and
++ * reset the LDC channel if we get one.
++ */
++ sun4v_ldc_tx_get_state(lp->id,
++ &lp->tx_head,
++ &lp->tx_tail,
++ &lp->chan_state);
+
+ ldcdbg(TX, " TX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n",
+ orig_state, lp->chan_state, lp->tx_head, lp->tx_tail);
+--- a/arch/sparc/kernel/pci.c
++++ b/arch/sparc/kernel/pci.c
+@@ -675,6 +675,7 @@ static void __devinit pci_bus_register_o
+ * humanoid.
+ */
+ err = sysfs_create_file(&dev->dev.kobj, &dev_attr_obppath.attr);
++ (void) err;
+ }
+ list_for_each_entry(child_bus, &bus->children, node)
+ pci_bus_register_of_sysfs(child_bus);
+--- a/arch/sparc/kernel/pci_common.c
++++ b/arch/sparc/kernel/pci_common.c
+@@ -295,14 +295,17 @@ static int sun4v_write_pci_cfg(struct pc
+ unsigned int bus = bus_dev->number;
+ unsigned int device = PCI_SLOT(devfn);
+ unsigned int func = PCI_FUNC(devfn);
+- unsigned long ret;
+
+ if (config_out_of_range(pbm, bus, devfn, where)) {
+ /* Do nothing. */
+ } else {
+- ret = pci_sun4v_config_put(devhandle,
+- HV_PCI_DEVICE_BUILD(bus, device, func),
+- where, size, value);
++ /* We don't check for hypervisor errors here, but perhaps
++ * we should and influence our return value depending upon
++ * what kind of error is thrown.
++ */
++ pci_sun4v_config_put(devhandle,
++ HV_PCI_DEVICE_BUILD(bus, device, func),
++ where, size, value);
+ }
+ return PCIBIOS_SUCCESSFUL;
+ }
+--- a/arch/sparc/kernel/pci_fire.c
++++ b/arch/sparc/kernel/pci_fire.c
+@@ -214,11 +214,9 @@ static int pci_fire_msi_setup(struct pci
+
+ static int pci_fire_msi_teardown(struct pci_pbm_info *pbm, unsigned long msi)
+ {
+- unsigned long msiqid;
+ u64 val;
+
+ val = upa_readq(pbm->pbm_regs + MSI_MAP(msi));
+- msiqid = (val & MSI_MAP_EQNUM);
+
+ val &= ~MSI_MAP_VALID;
+
+--- a/arch/sparc/kernel/pci_schizo.c
++++ b/arch/sparc/kernel/pci_schizo.c
+@@ -1313,7 +1313,7 @@ static int __devinit schizo_pbm_init(str
+ const struct linux_prom64_registers *regs;
+ struct device_node *dp = op->dev.of_node;
+ const char *chipset_name;
+- int is_pbm_a, err;
++ int err;
+
+ switch (chip_type) {
+ case PBM_CHIP_TYPE_TOMATILLO:
+@@ -1343,8 +1343,6 @@ static int __devinit schizo_pbm_init(str
+ */
+ regs = of_get_property(dp, "reg", NULL);
+
+- is_pbm_a = ((regs[0].phys_addr & 0x00700000) == 0x00600000);
+-
+ pbm->next = pci_pbm_root;
+ pci_pbm_root = pbm;
+
+--- a/arch/sparc/kernel/pci_sun4v.c
++++ b/arch/sparc/kernel/pci_sun4v.c
+@@ -580,7 +580,7 @@ static int __devinit pci_sun4v_iommu_ini
+ {
+ static const u32 vdma_default[] = { 0x80000000, 0x80000000 };
+ struct iommu *iommu = pbm->iommu;
+- unsigned long num_tsb_entries, sz, tsbsize;
++ unsigned long num_tsb_entries, sz;
+ u32 dma_mask, dma_offset;
+ const u32 *vdma;
+
+@@ -596,7 +596,6 @@ static int __devinit pci_sun4v_iommu_ini
+
+ dma_mask = (roundup_pow_of_two(vdma[1]) - 1UL);
+ num_tsb_entries = vdma[1] / IO_PAGE_SIZE;
+- tsbsize = num_tsb_entries * sizeof(iopte_t);
+
+ dma_offset = vdma[0];
+
+--- a/arch/sparc/kernel/pcr.c
++++ b/arch/sparc/kernel/pcr.c
+@@ -81,7 +81,7 @@ static void n2_pcr_write(u64 val)
+ unsigned long ret;
+
+ ret = sun4v_niagara2_setperf(HV_N2_PERF_SPARC_CTL, val);
+- if (val != HV_EOK)
++ if (ret != HV_EOK)
+ write_pcr(val);
+ }
+
+--- a/arch/sparc/kernel/ptrace_64.c
++++ b/arch/sparc/kernel/ptrace_64.c
+@@ -1086,6 +1086,7 @@ asmlinkage int syscall_trace_enter(struc
+
+ asmlinkage void syscall_trace_leave(struct pt_regs *regs)
+ {
++#ifdef CONFIG_AUDITSYSCALL
+ if (unlikely(current->audit_context)) {
+ unsigned long tstate = regs->tstate;
+ int result = AUDITSC_SUCCESS;
+@@ -1095,7 +1096,7 @@ asmlinkage void syscall_trace_leave(stru
+
+ audit_syscall_exit(result, regs->u_regs[UREG_I0]);
+ }
+-
++#endif
+ if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
+ trace_sys_exit(regs, regs->u_regs[UREG_G1]);
+
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -189,7 +189,7 @@ static inline long get_delta (long *rt,
+ void smp_synchronize_tick_client(void)
+ {
+ long i, delta, adj, adjust_latency = 0, done = 0;
+- unsigned long flags, rt, master_time_stamp, bound;
++ unsigned long flags, rt, master_time_stamp;
+ #if DEBUG_TICK_SYNC
+ struct {
+ long rt; /* roundtrip time */
+@@ -208,10 +208,8 @@ void smp_synchronize_tick_client(void)
+ {
+ for (i = 0; i < NUM_ROUNDS; i++) {
+ delta = get_delta(&rt, &master_time_stamp);
+- if (delta == 0) {
++ if (delta == 0)
+ done = 1; /* let's lock on to this... */
+- bound = rt;
+- }
+
+ if (!done) {
+ if (i > 0) {
+@@ -933,13 +931,12 @@ void smp_flush_dcache_page_impl(struct p
+ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
+ {
+ void *pg_addr;
+- int this_cpu;
+ u64 data0;
+
+ if (tlb_type == hypervisor)
+ return;
+
+- this_cpu = get_cpu();
++ preempt_disable();
+
+ #ifdef CONFIG_DEBUG_DCFLUSH
+ atomic_inc(&dcpage_flushes);
+@@ -964,7 +961,7 @@ void flush_dcache_page_all(struct mm_str
+ }
+ __local_flush_dcache_page(page);
+
+- put_cpu();
++ preempt_enable();
+ }
+
+ void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -2152,7 +2152,7 @@ static void user_instruction_dump(unsign
+
+ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
+ {
+- unsigned long fp, thread_base, ksp;
++ unsigned long fp, ksp;
+ struct thread_info *tp;
+ int count = 0;
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+@@ -2173,7 +2173,6 @@ void show_stack(struct task_struct *tsk,
+ flushw_all();
+
+ fp = ksp + STACK_BIAS;
+- thread_base = (unsigned long) tp;
+
+ printk("Call Trace:\n");
+ do {
--- /dev/null
+From bd59e4b2b325a4f0fcd491a8ec55a619fef91ded Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Mon, 14 Mar 2011 10:57:03 +0000
+Subject: tcp: avoid cwnd moderation in undo
+
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit 67d4120a1793138bc9f4a6eb61d0fc5298ed97e0 ]
+
+In the current undo logic, cwnd is moderated after it was restored
+to the value prior entering fast-recovery. It was moderated first
+in tcp_try_undo_recovery then again in tcp_complete_cwr.
+
+Since the undo indicates recovery was false, these moderations
+are not necessary. If the undo is triggered when most of the
+outstanding data have been acknowledged, the (restored) cwnd is
+falsely pulled down to a small value.
+
+This patch removes these cwnd moderations if cwnd is undone
+ a) during fast-recovery
+ b) by receiving DSACKs past fast-recovery
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_input.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2659,7 +2659,7 @@ static void DBGUNDO(struct sock *sk, con
+ #define DBGUNDO(x...) do { } while (0)
+ #endif
+
+-static void tcp_undo_cwr(struct sock *sk, const int undo)
++static void tcp_undo_cwr(struct sock *sk, const int undo_ssthresh)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+
+@@ -2671,14 +2671,13 @@ static void tcp_undo_cwr(struct sock *sk
+ else
+ tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh << 1);
+
+- if (undo && tp->prior_ssthresh > tp->snd_ssthresh) {
++ if (undo_ssthresh && tp->prior_ssthresh > tp->snd_ssthresh) {
+ tp->snd_ssthresh = tp->prior_ssthresh;
+ TCP_ECN_withdraw_cwr(tp);
+ }
+ } else {
+ tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh);
+ }
+- tcp_moderate_cwnd(tp);
+ tp->snd_cwnd_stamp = tcp_time_stamp;
+ }
+
+@@ -2822,8 +2821,11 @@ static int tcp_try_undo_loss(struct sock
+ static inline void tcp_complete_cwr(struct sock *sk)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+- tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+- tp->snd_cwnd_stamp = tcp_time_stamp;
++ /* Do not moderate cwnd if it's already undone in cwr or recovery */
++ if (tp->undo_marker && tp->snd_cwnd > tp->snd_ssthresh) {
++ tp->snd_cwnd = tp->snd_ssthresh;
++ tp->snd_cwnd_stamp = tcp_time_stamp;
++ }
+ tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
+ }
+
--- /dev/null
+From c0fd11cf45228241f8b3fb42020b1c9493dcdac7 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 18 Mar 2011 00:27:27 +0000
+Subject: vlan: should take into account needed_headroom
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit d870bfb9d366c5d466c0f5419a4ec95a3f71ea8a ]
+
+Commit c95b819ad7 (gre: Use needed_headroom)
+made gre use needed_headroom instead of hard_header_len
+
+This uncover a bug in vlan code.
+
+We should make sure vlan devices take into account their
+real_dev->needed_headroom or we risk a crash in ipgre_header(), because
+we dont have enough room to push IP header in skb.
+
+Reported-by: Diddi Oscarsson <diddi@diddi.se>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Patrick McHardy <kaber@trash.net>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/8021q/vlan_dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -707,6 +707,7 @@ static int vlan_dev_init(struct net_devi
+ dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid;
+ #endif
+
++ dev->needed_headroom = real_dev->needed_headroom;
+ if (real_dev->features & NETIF_F_HW_VLAN_TX) {
+ dev->header_ops = real_dev->header_ops;
+ dev->hard_header_len = real_dev->hard_header_len;
--- /dev/null
+From 6677647340a5d58b48b792af078701f4068be4b4 Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Tue, 15 Mar 2011 21:12:49 +0000
+Subject: xfrm: Refcount destination entry on xfrm_lookup
+
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+[ Upstream commit fbd5060875d25f7764fd1c3d35b83a8ed1d88d7b ]
+
+We return a destination entry without refcount if a socket
+policy is found in xfrm_lookup. This triggers a warning on
+a negative refcount when freeeing this dst entry. So take
+a refcount in this case to fix it.
+
+This refcount was forgotten when xfrm changed to cache bundles
+instead of policies for outgoing flows.
+
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Acked-by: Timo Teräs <timo.teras@iki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_policy.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1778,6 +1778,8 @@ restart:
+ goto no_transform;
+ }
+
++ dst_hold(&xdst->u.dst);
++
+ spin_lock_bh(&xfrm_policy_sk_bundle_lock);
+ xdst->u.dst.next = xfrm_policy_sk_bundles;
+ xfrm_policy_sk_bundles = &xdst->u.dst;
projects / thirdparty / kernel / stable-queue.git / commitdiff
