--- /dev/null
+From 5960f8eec97369034004398d38e6bb795d7eee72 Mon Sep 17 00:00:00 2001
+From: Shan Wei <shanwei@cn.fujitsu.com>
+Date: Wed, 17 Nov 2010 11:55:08 -0800
+Subject: 8139cp: fix checksum broken
+
+
+From: Shan Wei <shanwei@cn.fujitsu.com>
+
+[ Upstream commit 24b7ea9f6c9787fad885442ed0cc010f1aa69cca ]
+
+I am not family with RealTek RTL-8139C+ series 10/100 PCI Ethernet driver.
+I try to guess the meaning of RxProtoIP and IPFail.
+RxProtoIP stands for received IPv4 packet that upper protocol is not tcp and udp.
+!(status & IPFail) is true means that driver correctly to check checksum in IPv4 header.
+
+If these are right, driver will set ip_summed with CHECKSUM_UNNECESSARY for other
+upper protocol, e.g. sctp, igmp protocol. This will cause protocol stack ignores
+checksum check for packets with invalid checksum.
+
+This patch is only compile-test.
+
+Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/8139cp.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/8139cp.c
++++ b/drivers/net/8139cp.c
+@@ -490,13 +490,11 @@ static inline unsigned int cp_rx_csum_ok
+ {
+ unsigned int protocol = (status >> 16) & 0x3;
+
+- if (likely((protocol == RxProtoTCP) && (!(status & TCPFail))))
++ if (((protocol == RxProtoTCP) && !(status & TCPFail)) ||
++ ((protocol == RxProtoUDP) && !(status & UDPFail)))
+ return 1;
+- else if ((protocol == RxProtoUDP) && (!(status & UDPFail)))
+- return 1;
+- else if ((protocol == RxProtoIP) && (!(status & IPFail)))
+- return 1;
+- return 0;
++ else
++ return 0;
+ }
+
+ static int cp_rx_poll(struct napi_struct *napi, int budget)
--- /dev/null
+From a1e61b5127af75c0126e38533c25936c422c1191 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 25 Nov 2010 04:11:39 +0000
+Subject: af_unix: limit recursion level
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 25888e30319f8896fc656fc68643e6a078263060 ]
+
+Its easy to eat all kernel memory and trigger NMI watchdog, using an
+exploit program that queues unix sockets on top of others.
+
+lkml ref : http://lkml.org/lkml/2010/11/25/8
+
+This mechanism is used in applications, one choice we have is to have a
+recursion limit.
+
+Other limits might be needed as well (if we queue other types of files),
+since the passfd mechanism is currently limited by socket receive queue
+sizes only.
+
+Add a recursion_level to unix socket, allowing up to 4 levels.
+
+Each time we send an unix socket through sendfd mechanism, we copy its
+recursion level (plus one) to receiver. This recursion level is cleared
+when socket receive queue is emptied.
+
+Reported-by: Марк Коренберг <socketpair@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/net/af_unix.h | 2 ++
+ net/unix/af_unix.c | 37 ++++++++++++++++++++++++++++++++-----
+ net/unix/garbage.c | 2 +-
+ 3 files changed, 35 insertions(+), 6 deletions(-)
+
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *f
+ extern void unix_notinflight(struct file *fp);
+ extern void unix_gc(void);
+ extern void wait_for_unix_gc(void);
++extern struct sock *unix_get_socket(struct file *filp);
+
+ #define UNIX_HASH_SIZE 256
+
+@@ -56,6 +57,7 @@ struct unix_sock {
+ spinlock_t lock;
+ unsigned int gc_candidate : 1;
+ unsigned int gc_maybe_cycle : 1;
++ unsigned char recursion_level;
+ struct socket_wq peer_wq;
+ };
+ #define unix_sk(__sk) ((struct unix_sock *)__sk)
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1343,9 +1343,25 @@ static void unix_destruct_scm(struct sk_
+ sock_wfree(skb);
+ }
+
++#define MAX_RECURSION_LEVEL 4
++
+ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ {
+ int i;
++ unsigned char max_level = 0;
++ int unix_sock_count = 0;
++
++ for (i = scm->fp->count - 1; i >= 0; i--) {
++ struct sock *sk = unix_get_socket(scm->fp->fp[i]);
++
++ if (sk) {
++ unix_sock_count++;
++ max_level = max(max_level,
++ unix_sk(sk)->recursion_level);
++ }
++ }
++ if (unlikely(max_level > MAX_RECURSION_LEVEL))
++ return -ETOOMANYREFS;
+
+ /*
+ * Need to duplicate file references for the sake of garbage
+@@ -1356,9 +1372,11 @@ static int unix_attach_fds(struct scm_co
+ if (!UNIXCB(skb).fp)
+ return -ENOMEM;
+
+- for (i = scm->fp->count-1; i >= 0; i--)
+- unix_inflight(scm->fp->fp[i]);
+- return 0;
++ if (unix_sock_count) {
++ for (i = scm->fp->count - 1; i >= 0; i--)
++ unix_inflight(scm->fp->fp[i]);
++ }
++ return max_level;
+ }
+
+ static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
+@@ -1393,6 +1411,7 @@ static int unix_dgram_sendmsg(struct kio
+ struct sk_buff *skb;
+ long timeo;
+ struct scm_cookie tmp_scm;
++ int max_level;
+
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+@@ -1431,8 +1450,9 @@ static int unix_dgram_sendmsg(struct kio
+ goto out;
+
+ err = unix_scm_to_skb(siocb->scm, skb, true);
+- if (err)
++ if (err < 0)
+ goto out_free;
++ max_level = err + 1;
+ unix_get_secdata(siocb->scm, skb);
+
+ skb_reset_transport_header(skb);
+@@ -1512,6 +1532,8 @@ restart:
+ }
+
+ skb_queue_tail(&other->sk_receive_queue, skb);
++ if (max_level > unix_sk(other)->recursion_level)
++ unix_sk(other)->recursion_level = max_level;
+ unix_state_unlock(other);
+ other->sk_data_ready(other, len);
+ sock_put(other);
+@@ -1542,6 +1564,7 @@ static int unix_stream_sendmsg(struct ki
+ int sent = 0;
+ struct scm_cookie tmp_scm;
+ bool fds_sent = false;
++ int max_level;
+
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+@@ -1605,10 +1628,11 @@ static int unix_stream_sendmsg(struct ki
+
+ /* Only send the fds in the first buffer */
+ err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
+- if (err) {
++ if (err < 0) {
+ kfree_skb(skb);
+ goto out_err;
+ }
++ max_level = err + 1;
+ fds_sent = true;
+
+ err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
+@@ -1624,6 +1648,8 @@ static int unix_stream_sendmsg(struct ki
+ goto pipe_err_free;
+
+ skb_queue_tail(&other->sk_receive_queue, skb);
++ if (max_level > unix_sk(other)->recursion_level)
++ unix_sk(other)->recursion_level = max_level;
+ unix_state_unlock(other);
+ other->sk_data_ready(other, size);
+ sent += size;
+@@ -1840,6 +1866,7 @@ static int unix_stream_recvmsg(struct ki
+ unix_state_lock(sk);
+ skb = skb_dequeue(&sk->sk_receive_queue);
+ if (skb == NULL) {
++ unix_sk(sk)->recursion_level = 0;
+ if (copied >= target)
+ goto unlock;
+
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -96,7 +96,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_w
+ unsigned int unix_tot_inflight;
+
+
+-static struct sock *unix_get_socket(struct file *filp)
++struct sock *unix_get_socket(struct file *filp)
+ {
+ struct sock *u_sock = NULL;
+ struct inode *inode = filp->f_path.dentry->d_inode;
--- /dev/null
+From b13723cb6f2a7b7d9ef39a1afca59e942fdf6fcd Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 24 Nov 2010 09:15:27 -0800
+Subject: af_unix: limit unix_tot_inflight
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 9915672d41273f5b77f1b3c29b391ffb7732b84b ]
+
+Vegard Nossum found a unix socket OOM was possible, posting an exploit
+program.
+
+My analysis is we can eat all LOWMEM memory before unix_gc() being
+called from unix_release_sock(). Moreover, the thread blocked in
+unix_gc() can consume huge amount of time to perform cleanup because of
+huge working set.
+
+One way to handle this is to have a sensible limit on unix_tot_inflight,
+tested from wait_for_unix_gc() and to force a call to unix_gc() if this
+limit is hit.
+
+This solves the OOM and also reduce overall latencies, and should not
+slowdown normal workloads.
+
+Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/unix/garbage.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struc
+ }
+
+ static bool gc_in_progress = false;
++#define UNIX_INFLIGHT_TRIGGER_GC 16000
+
+ void wait_for_unix_gc(void)
+ {
++ /*
++ * If number of inflight sockets is insane,
++ * force a garbage collect right now.
++ */
++ if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
++ unix_gc();
+ wait_event(unix_gc_wait, gc_in_progress == false);
+ }
+
--- /dev/null
+From 1e75090199d666bd15857a9cd5cc1e662878dfca Mon Sep 17 00:00:00 2001
+From: Hillf Danton <dhillf@gmail.com>
+Date: Fri, 10 Dec 2010 18:54:11 +0000
+Subject: bonding: Fix slave selection bug.
+
+
+From: Hillf Danton <dhillf@gmail.com>
+
+[ Upstream commit af3e5bd5f650163c2e12297f572910a1af1b8236 ]
+
+The returned slave is incorrect, if the net device under check is not
+charged yet by the master.
+
+Signed-off-by: Hillf Danton <dhillf@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/bonding/bonding.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bonding/bonding.h
++++ b/drivers/net/bonding/bonding.h
+@@ -240,11 +240,11 @@ static inline struct slave *bond_get_sla
+
+ bond_for_each_slave(bond, slave, i) {
+ if (slave->dev == slave_dev) {
+- break;
++ return slave;
+ }
+ }
+
+- return slave;
++ return 0;
+ }
+
+ static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
--- /dev/null
+From a85d2f3d0ecb5f841628d1963b8a534d5acd08f1 Mon Sep 17 00:00:00 2001
+From: David Stevens <dlstevens@us.ibm.com>
+Date: Tue, 14 Dec 2010 08:42:16 +0000
+Subject: bridge: fix IPv6 queries for bridge multicast snooping
+
+
+From: David Stevens <dlstevens@us.ibm.com>
+
+[ Upstream commit 04bdf0c9a451863e50fff627713a900a2cabb998 ]
+
+This patch fixes a missing ntohs() for bridge IPv6 multicast snooping.
+
+Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_multicast.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -437,7 +437,7 @@ static struct sk_buff *br_ip6_multicast_
+ ip6h = ipv6_hdr(skb);
+
+ *(__force __be32 *)ip6h = htonl(0x60000000);
+- ip6h->payload_len = 8 + sizeof(*mldq);
++ ip6h->payload_len = htons(8 + sizeof(*mldq));
+ ip6h->nexthdr = IPPROTO_HOPOPTS;
+ ip6h->hop_limit = 1;
+ ipv6_addr_set(&ip6h->saddr, 0, 0, 0, 0);
--- /dev/null
+From ad799b34e3d81861fa8cc5d4f4c8a5d6befadc4c Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Wed, 3 Nov 2010 13:31:05 +0000
+Subject: cls_cgroup: Fix crash on module unload
+
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit c00b2c9e79466d61979cd21af526cc6d5d0ee04f ]
+
+Somewhere along the lines net_cls_subsys_id became a macro when
+cls_cgroup is built as a module. Not only did it make cls_cgroup
+completely useless, it also causes it to crash on module unload.
+
+This patch fixes this by removing that macro.
+
+Thanks to Eric Dumazet for diagnosing this problem.
+
+Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Li Zefan <lizf@cn.fujitsu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/sched/cls_cgroup.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/net/sched/cls_cgroup.c
++++ b/net/sched/cls_cgroup.c
+@@ -34,8 +34,6 @@ struct cgroup_subsys net_cls_subsys = {
+ .populate = cgrp_populate,
+ #ifdef CONFIG_NET_CLS_CGROUP
+ .subsys_id = net_cls_subsys_id,
+-#else
+-#define net_cls_subsys_id net_cls_subsys.subsys_id
+ #endif
+ .module = THIS_MODULE,
+ };
--- /dev/null
+From 7b0b9f4142dfd88923f329b17c2e02a2ca3785ff Mon Sep 17 00:00:00 2001
+From: Joe Jin <joe.jin@oracle.com>
+Date: Mon, 6 Dec 2010 03:00:59 +0000
+Subject: driver/net/benet: fix be_cmd_multicast_set() memcpy bug
+
+
+From: Joe Jin <joe.jin@oracle.com>
+
+[ Upstream commit 3fd40d0ceac9c234243730f4d7a6ffdb2fd3023a ]
+
+Regarding benet be_cmd_multicast_set() function, now using
+netdev_for_each_mc_addr() helper for mac address copy, but
+when copying to req->mac[] did not increase of the index.
+
+Cc: Sathya Perla <sathyap@serverengines.com>
+Cc: Subbu Seetharaman <subbus@serverengines.com>
+Cc: Sarveshwar Bandi <sarveshwarb@serverengines.com>
+Cc: Ajit Khaparde <ajitk@serverengines.com>
+Signed-off-by: Joe Jin <joe.jin@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/benet/be_cmds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/benet/be_cmds.c
++++ b/drivers/net/benet/be_cmds.c
+@@ -1179,7 +1179,7 @@ int be_cmd_multicast_set(struct be_adapt
+
+ i = 0;
+ netdev_for_each_mc_addr(ha, netdev)
+- memcpy(req->mac[i].byte, ha->addr, ETH_ALEN);
++ memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN);
+ } else {
+ req->promiscuous = 1;
+ }
--- /dev/null
+From ae6c6401042f6046ba1d67255dee4d55584c8095 Mon Sep 17 00:00:00 2001
+From: Nelson Elhage <nelhage@ksplice.com>
+Date: Wed, 8 Dec 2010 10:13:55 -0800
+Subject: econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.
+
+
+From: Nelson Elhage <nelhage@ksplice.com>
+
+[ Upstream commit f24b8bedf70c524775eabd51570c3fa7708a97b7 ]
+
+We need to drop the mutex and do a dev_put, so set an error code and break like
+the other paths, instead of returning directly.
+
+Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/econet/af_econet.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/econet/af_econet.c
++++ b/net/econet/af_econet.c
+@@ -661,8 +661,10 @@ static int ec_dev_ioctl(struct socket *s
+ err = 0;
+ switch (cmd) {
+ case SIOCSIFADDR:
+- if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
++ if (!capable(CAP_NET_ADMIN)) {
++ err = -EPERM;
++ break;
++ }
+
+ edev = dev->ec_ptr;
+ if (edev == NULL) {
--- /dev/null
+From ca737e3fe3069e4f6cd78104679e368c4e8bbafa Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 8 Dec 2010 18:42:23 -0800
+Subject: econet: Fix crash in aun_incoming().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 4e085e76cbe558b79b54cbab772f61185879bc64 ]
+
+Unconditional use of skb->dev won't work here,
+try to fetch the econet device via skb_dst()->dev
+instead.
+
+Suggested by Eric Dumazet.
+
+Reported-by: Nelson Elhage <nelhage@ksplice.com>
+Tested-by: Nelson Elhage <nelhage@ksplice.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/econet/af_econet.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/econet/af_econet.c
++++ b/net/econet/af_econet.c
+@@ -851,9 +851,13 @@ static void aun_incoming(struct sk_buff
+ {
+ struct iphdr *ip = ip_hdr(skb);
+ unsigned char stn = ntohl(ip->saddr) & 0xff;
++ struct dst_entry *dst = skb_dst(skb);
++ struct ec_device *edev = NULL;
+ struct sock *sk = NULL;
+ struct sk_buff *newskb;
+- struct ec_device *edev = skb->dev->ec_ptr;
++
++ if (dst)
++ edev = dst->dev->ec_ptr;
+
+ if (! edev)
+ goto bad;
--- /dev/null
+From 2874b37a3009f34d6a80a3b63f21ab73759430f7 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Mon, 6 Dec 2010 09:29:43 -0800
+Subject: filter: fix sk_filter rcu handling
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 46bcf14f44d8f31ecfdc8b6708ec15a3b33316d9 ]
+
+Pavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and
+sk_clone() in commit 47e958eac280c263397
+
+Problem is we can have several clones sharing a common sk_filter, and
+these clones might want to sk_filter_attach() their own filters at the
+same time, and can overwrite old_filter->rcu, corrupting RCU queues.
+
+We can not use filter->rcu without being sure no other thread could do
+the same thing.
+
+Switch code to a more conventional ref-counting technique : Do the
+atomic decrement immediately and queue one rcu call back when last
+reference is released.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/net/sock.h | 4 +++-
+ net/core/filter.c | 19 ++++++-------------
+ 2 files changed, 9 insertions(+), 14 deletions(-)
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1155,6 +1155,8 @@ extern void sk_common_release(struct soc
+ /* Initialise core socket variables */
+ extern void sock_init_data(struct socket *sock, struct sock *sk);
+
++extern void sk_filter_release_rcu(struct rcu_head *rcu);
++
+ /**
+ * sk_filter_release - release a socket filter
+ * @fp: filter to remove
+@@ -1165,7 +1167,7 @@ extern void sock_init_data(struct socket
+ static inline void sk_filter_release(struct sk_filter *fp)
+ {
+ if (atomic_dec_and_test(&fp->refcnt))
+- kfree(fp);
++ call_rcu_bh(&fp->rcu, sk_filter_release_rcu);
+ }
+
+ static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -589,23 +589,16 @@ int sk_chk_filter(struct sock_filter *fi
+ EXPORT_SYMBOL(sk_chk_filter);
+
+ /**
+- * sk_filter_rcu_release: Release a socket filter by rcu_head
++ * sk_filter_release_rcu - Release a socket filter by rcu_head
+ * @rcu: rcu_head that contains the sk_filter to free
+ */
+-static void sk_filter_rcu_release(struct rcu_head *rcu)
++void sk_filter_release_rcu(struct rcu_head *rcu)
+ {
+ struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
+
+- sk_filter_release(fp);
+-}
+-
+-static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
+-{
+- unsigned int size = sk_filter_len(fp);
+-
+- atomic_sub(size, &sk->sk_omem_alloc);
+- call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
++ kfree(fp);
+ }
++EXPORT_SYMBOL(sk_filter_release_rcu);
+
+ /**
+ * sk_attach_filter - attach a socket filter
+@@ -650,7 +643,7 @@ int sk_attach_filter(struct sock_fprog *
+ rcu_read_unlock_bh();
+
+ if (old_fp)
+- sk_filter_delayed_uncharge(sk, old_fp);
++ sk_filter_uncharge(sk, old_fp);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(sk_attach_filter);
+@@ -664,7 +657,7 @@ int sk_detach_filter(struct sock *sk)
+ filter = rcu_dereference_bh(sk->sk_filter);
+ if (filter) {
+ rcu_assign_pointer(sk->sk_filter, NULL);
+- sk_filter_delayed_uncharge(sk, filter);
++ sk_filter_uncharge(sk, filter);
+ ret = 0;
+ }
+ rcu_read_unlock_bh();
--- /dev/null
+From 63eeabe277682c5513fc10dca72bc2393243a0da Mon Sep 17 00:00:00 2001
+From: Changli Gao <xiaosuo@gmail.com>
+Date: Sat, 4 Dec 2010 14:09:08 +0000
+Subject: ifb: goto resched directly if error happens and dp->tq isn't empty
+
+
+From: Changli Gao <xiaosuo@gmail.com>
+
+[ Upstream commit 75c1c82566f23dd539fb7ccbf57a1caa7ba82628 ]
+
+If we break the loop when there are still skbs in tq and no skb in
+rq, the skbs will be left in txq until new skbs are enqueued into rq.
+In rare cases, no new skb is queued, then these skbs will stay in rq
+forever.
+
+After this patch, if tq isn't empty when we break the loop, we goto
+resched directly.
+
+Signed-off-by: Changli Gao <xiaosuo@gmail.com>
+Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/ifb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -104,6 +104,8 @@ static void ri_tasklet(unsigned long dev
+ rcu_read_unlock();
+ dev_kfree_skb(skb);
+ stats->tx_dropped++;
++ if (skb_queue_len(&dp->tq) != 0)
++ goto resched;
+ break;
+ }
+ rcu_read_unlock();
--- /dev/null
+From 2f2765fa320f450509254a5a630287b7bda0d7f2 Mon Sep 17 00:00:00 2001
+From: Michal Marek <mmarek@suse.cz>
+Date: Mon, 6 Dec 2010 02:39:12 +0000
+Subject: l2tp: Fix modalias of l2tp_ip
+
+
+From: Michal Marek <mmarek@suse.cz>
+
+[ Upstream commit 3e5653f0bc5150a2cc67b707130344ce05fb440e ]
+
+Using the SOCK_DGRAM enum results in
+"net-pf-2-proto-SOCK_DGRAM-type-115", so use the numeric value like it
+is done in net/dccp.
+
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/l2tp/l2tp_ip.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -676,4 +676,8 @@ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
+ MODULE_DESCRIPTION("L2TP over IP");
+ MODULE_VERSION("1.0");
+-MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, SOCK_DGRAM, IPPROTO_L2TP);
++
++/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
++ * enums
++ */
++MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
--- /dev/null
+From 1f61298146dfba86e2bfc915ed4a55268fe8fb9c Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segooon@gmail.com>
+Date: Wed, 10 Nov 2010 10:14:33 -0800
+Subject: net: ax25: fix information leak to userland
+
+
+From: Vasiliy Kulikov <segooon@gmail.com>
+
+[ Upstream commit fe10ae53384e48c51996941b7720ee16995cbcb7 ]
+
+Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater
+field of fsa struct, also the struct has padding bytes between
+sax25_call and sax25_ndigis fields. This structure is then copied to
+userland. It leads to leaking of contents of kernel stack memory.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ax25/af_ax25.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -1392,6 +1392,7 @@ static int ax25_getname(struct socket *s
+ ax25_cb *ax25;
+ int err = 0;
+
++ memset(fsa, 0, sizeof(fsa));
+ lock_sock(sk);
+ ax25 = ax25_sk(sk);
+
+@@ -1403,7 +1404,6 @@ static int ax25_getname(struct socket *s
+
+ fsa->fsa_ax25.sax25_family = AF_AX25;
+ fsa->fsa_ax25.sax25_call = ax25->dest_addr;
+- fsa->fsa_ax25.sax25_ndigis = 0;
+
+ if (ax25->digipeat != NULL) {
+ ndigi = ax25->digipeat->ndigi;
--- /dev/null
+From cda994f8dd99aeedd618ac316dcecee653f9a09f Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 9 Nov 2010 11:46:33 -0800
+Subject: net/dst: dst_dev_event() called after other notifiers
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 332dd96f7ac15e937088fe11f15cfe0210e8edd1 ]
+
+Followup of commit ef885afbf8a37689 (net: use rcu_barrier() in
+rollback_registered_many)
+
+dst_dev_event() scans a garbage dst list that might be feeded by various
+network notifiers at device dismantle time.
+
+Its important to call dst_dev_event() after other notifiers, or we might
+enter the infamous msleep(250) in netdev_wait_allrefs(), and wait one
+second before calling again call_netdevice_notifiers(NETDEV_UNREGISTER,
+dev) to properly remove last device references.
+
+Use priority -10 to let dst_dev_notifier be called after other network
+notifiers (they have the default 0 priority)
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Reported-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reported-by: Octavian Purdila <opurdila@ixiacom.com>
+Reported-by: Benjamin LaHaise <bcrl@kvack.org>
+Tested-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/dst.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -343,6 +343,7 @@ static int dst_dev_event(struct notifier
+
+ static struct notifier_block dst_dev_notifier = {
+ .notifier_call = dst_dev_event,
++ .priority = -10, /* must be called after other network notifiers */
+ };
+
+ void __init dst_init(void)
--- /dev/null
+From 0ea6875ae44c16d0d60c78b907a629bfd0469fc5 Mon Sep 17 00:00:00 2001
+From: Mariusz Kozlowski <mk@lab.zgora.pl>
+Date: Mon, 8 Nov 2010 11:58:45 +0000
+Subject: net: Fix header size check for GSO case in recvmsg (af_packet)
+
+
+From: Mariusz Kozlowski <mk@lab.zgora.pl>
+
+[ Upstream commit 54dd76848bf67b9fa40ac0340e5ee9c2876d5393 ]
+
+Parameter 'len' is size_t type so it will never get negative.
+
+Signed-off-by: Mariusz Kozlowski <mk@lab.zgora.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/packet/af_packet.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1610,9 +1610,11 @@ static int packet_recvmsg(struct kiocb *
+
+ err = -EINVAL;
+ vnet_hdr_len = sizeof(vnet_hdr);
+- if ((len -= vnet_hdr_len) < 0)
++ if (len < vnet_hdr_len)
+ goto out_free;
+
++ len -= vnet_hdr_len;
++
+ if (skb_is_gso(skb)) {
+ struct skb_shared_info *sinfo = skb_shinfo(skb);
+
--- /dev/null
+From a73552715830986b525c4483245eae628ed56f03 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sun, 5 Dec 2010 18:50:32 +0000
+Subject: net: fix skb_defer_rx_timestamp()
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit a19faf0250e09b16cac169354126404bc8aa342b ]
+
+After commit c1f19b51d1d8 (net: support time stamping in phy devices.),
+kernel might crash if CONFIG_NETWORK_PHY_TIMESTAMPING=y and
+skb_defer_rx_timestamp() handles a packet without an ethernet header.
+
+Fixes kernel bugzilla #24102
+
+Reference: https://bugzilla.kernel.org/show_bug.cgi?id=24102
+Reported-and-tested-by: Andrew Watts <akwatts@ymail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/timestamping.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/core/timestamping.c
++++ b/net/core/timestamping.c
+@@ -96,11 +96,13 @@ bool skb_defer_rx_timestamp(struct sk_bu
+ struct phy_device *phydev;
+ unsigned int type;
+
+- skb_push(skb, ETH_HLEN);
++ if (skb_headroom(skb) < ETH_HLEN)
++ return false;
++ __skb_push(skb, ETH_HLEN);
+
+ type = classify(skb);
+
+- skb_pull(skb, ETH_HLEN);
++ __skb_pull(skb, ETH_HLEN);
+
+ switch (type) {
+ case PTP_CLASS_V1_IPV4:
--- /dev/null
+From a2f962f45a112ae310caf82ba78c773cc4c4bcfe Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segooon@gmail.com>
+Date: Wed, 10 Nov 2010 12:09:10 -0800
+Subject: net: packet: fix information leak to userland
+
+
+From: Vasiliy Kulikov <segooon@gmail.com>
+
+[ Upstream commit 67286640f638f5ad41a946b9a3dc75327950248f ]
+
+packet_getname_spkt() doesn't initialize all members of sa_data field of
+sockaddr struct if strlen(dev->name) < 13. This structure is then copied
+to userland. It leads to leaking of contents of kernel stack memory.
+We have to fully fill sa_data with strncpy() instead of strlcpy().
+
+The same with packet_getname(): it doesn't initialize sll_pkttype field of
+sockaddr_ll. Set it to zero.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/packet/af_packet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1721,7 +1721,7 @@ static int packet_getname_spkt(struct so
+ rcu_read_lock();
+ dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
+ if (dev)
+- strlcpy(uaddr->sa_data, dev->name, 15);
++ strncpy(uaddr->sa_data, dev->name, 14);
+ else
+ memset(uaddr->sa_data, 0, 14);
+ rcu_read_unlock();
+@@ -1744,6 +1744,7 @@ static int packet_getname(struct socket
+ sll->sll_family = AF_PACKET;
+ sll->sll_ifindex = po->ifindex;
+ sll->sll_protocol = po->num;
++ sll->sll_pkttype = 0;
+ rcu_read_lock();
+ dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex);
+ if (dev) {
--- /dev/null
+From 821fbf5a13a45e3aa9a7a2f0a1ca330adb3778ab Mon Sep 17 00:00:00 2001
+From: Andrej Ota <andrej@ota.si>
+Date: Sun, 12 Dec 2010 15:06:16 -0800
+Subject: pppoe.c: Fix kernel panic caused by __pppoe_xmit
+
+
+From: Andrej Ota <andrej@ota.si>
+
+[ Upstream commit 2a27a03d3a891e87ca33d27a858b4db734a4cbab ]
+
+__pppoe_xmit function return value was invalid resulting in
+additional call to kfree_skb on already freed skb. This resulted in
+memory corruption and consequent kernel panic after PPPoE peer
+terminated the link.
+
+This fixes commit 55c95e738da85373965cb03b4f975d0fd559865b.
+
+Reported-by: Gorik Van Steenberge <gvs@zemos.net>
+Reported-by: Daniel Kenzelmann <kernel.bugzilla@kenzelmann.dyndns.info>
+Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
+Reported-by: Pawel Staszewski <pstaszewski@artcom.pl>
+Diagnosed-by: Andrej Ota <andrej@ota.si>
+Diagnosed-by: Eric Dumazet <eric.dumazet@gmail.com>
+Tested-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
+Tested-by: Pawel Staszewski <pstaszewski@artcom.pl>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: Andrej Ota <andrej@ota.si>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/pppoe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/pppoe.c
++++ b/drivers/net/pppoe.c
+@@ -948,7 +948,7 @@ static int __pppoe_xmit(struct sock *sk,
+
+ abort:
+ kfree_skb(skb);
+- return 0;
++ return 1;
+ }
+
+ /************************************************************************
--- /dev/null
+From 38ee10ad3fe93cb40985376fbf7ae0a30b48fa41 Mon Sep 17 00:00:00 2001
+From: françois romieu <romieu@fr.zoreil.com>
+Date: Mon, 8 Nov 2010 13:23:58 +0000
+Subject: r8169: fix sleeping while holding spinlock.
+
+From: françois romieu <romieu@fr.zoreil.com>
+
+[ Upstream commit ea80907ff066edd1dd43c5fe90ae6677d15e6384 ]
+
+As device_set_wakeup_enable can now sleep, move the call to outside
+the critical section.
+
+Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: Andrew Hendry <andrew.hendry@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/r8169.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -855,10 +855,10 @@ static int rtl8169_set_wol(struct net_de
+ else
+ tp->features &= ~RTL_FEATURE_WOL;
+ __rtl8169_set_wol(tp, wol->wolopts);
+- device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts);
+-
+ spin_unlock_irq(&tp->lock);
+
++ device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts);
++
+ return 0;
+ }
+
ath9k_hw-fix-endian-issues-with-ctls-on-ar9003.patch
ath9k-fix-bug-in-tx-power.patch
mac80211-fix-bug-in-pskb_expand_head-when-transmitting-shared-skbs.patch
+sparc-leon-removed-constant-timer-initialization-as-if-hz-100-now-it-reflects-the-value-of-hz.patch
+sparc64-delete-prom_puts-unused.patch
+sparc-remove-prom_pathtoinode.patch
+sparc-kill-prom-devops_-32-64-.c.patch
+sparc64-unexport-prom_service_exists.patch
+sparc64-delete-prom_setcallback.patch
+sparc-do-not-export-prom_nb-get-put-char.patch
+sparc-pass-buffer-pointer-all-the-way-down-to-prom_-get-put-char.patch
+sparc-delete-prom_-getchar.patch
+sparc-write-to-prom-console-using-indirect-buffer.patch
+tcp-don-t-change-unlocked-socket-state-in-tcp_v4_err.patch
+tcp-increase-tcp_maxseg-socket-option-minimum.patch
+tcp-make-tcp_maxseg-minimum-more-correct.patch
+tcp-bug-fix-in-initialization-of-receive-window.patch
+tcp-avoid-a-possible-divide-by-zero.patch
+tcp-protect-sysctl_tcp_cookie_size-reads.patch
+8139cp-fix-checksum-broken.patch
+r8169-fix-sleeping-while-holding-spinlock.patch
+af_unix-limit-unix_tot_inflight.patch
+af_unix-limit-recursion-level.patch
+net-ax25-fix-information-leak-to-userland.patch
+driver-net-benet-fix-be_cmd_multicast_set-memcpy-bug.patch
+bonding-fix-slave-selection-bug.patch
+bridge-fix-ipv6-queries-for-bridge-multicast-snooping.patch
+cls_cgroup-fix-crash-on-module-unload.patch
+filter-fix-sk_filter-rcu-handling.patch
+econet-do-the-correct-cleanup-after-an-unprivileged-siocsifaddr.patch
+econet-fix-crash-in-aun_incoming.patch
+ifb-goto-resched-directly-if-error-happens-and-dp-tq-isn-t-empty.patch
+l2tp-fix-modalias-of-l2tp_ip.patch
+x25-decrement-netdev-reference-counts-on-unload.patch
+tehuti-firmware-filename-is-tehuti-bdx.bin.patch
+net-dst-dst_dev_event-called-after-other-notifiers.patch
+net-fix-header-size-check-for-gso-case-in-recvmsg-af_packet.patch
+net-fix-skb_defer_rx_timestamp.patch
+net-packet-fix-information-leak-to-userland.patch
+pppoe.c-fix-kernel-panic-caused-by-__pppoe_xmit.patch
--- /dev/null
+From 771babb4c614ecc81ee901527fbbfe61d45d3570 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 30 Nov 2010 14:53:05 -0800
+Subject: sparc: Delete prom_*getchar().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 12c7a35ee6a1c605e740733f2cbd5b5079f09f0f ]
+
+Completely unused.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/include/asm/oplib_32.h | 5 ----
+ arch/sparc/include/asm/oplib_64.h | 5 ----
+ arch/sparc/prom/console_32.c | 41 --------------------------------------
+ arch/sparc/prom/console_64.c | 32 -----------------------------
+ 4 files changed, 83 deletions(-)
+
+--- a/arch/sparc/include/asm/oplib_32.h
++++ b/arch/sparc/include/asm/oplib_32.h
+@@ -102,11 +102,6 @@ extern int prom_getrev(void);
+ /* Get the prom firmware revision. */
+ extern int prom_getprev(void);
+
+-/* Character operations to/from the console.... */
+-
+-/* Blocking get character from console. */
+-extern void prom_getchar(char *buf);
+-
+ /* Blocking put character to console. */
+ extern void prom_putchar(const char *buf);
+
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -94,11 +94,6 @@ extern void prom_halt_power_off(void) __
+ */
+ extern unsigned char prom_get_idprom(char *idp_buffer, int idpbuf_size);
+
+-/* Character operations to/from the console.... */
+-
+-/* Blocking get character from console. */
+-extern void prom_getchar(char *buf);
+-
+ /* Blocking put character to console. */
+ extern void prom_putchar(const char *buf);
+
+--- a/arch/sparc/prom/console_32.c
++++ b/arch/sparc/prom/console_32.c
+@@ -16,37 +16,6 @@
+
+ extern void restore_current(void);
+
+-/* Non blocking get character from console input device, returns -1
+- * if no input was taken. This can be used for polling.
+- */
+-static int prom_nbgetchar(char *buf)
+-{
+- unsigned long flags;
+- int i = -1;
+-
+- spin_lock_irqsave(&prom_lock, flags);
+- switch(prom_vers) {
+- case PROM_V0:
+- i = (*(romvec->pv_nbgetchar))();
+- if (i != -1) {
+- *buf = i;
+- i = 0;
+- }
+- break;
+- case PROM_V2:
+- case PROM_V3:
+- if ((*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin,
+- buf, 0x1) == 1)
+- i = 0;
+- break;
+- default:
+- break;
+- };
+- restore_current();
+- spin_unlock_irqrestore(&prom_lock, flags);
+- return i; /* Ugh, we could spin forever on unsupported proms ;( */
+-}
+-
+ /* Non blocking put character to console device, returns -1 if
+ * unsuccessful.
+ */
+@@ -74,16 +43,6 @@ static int prom_nbputchar(const char *bu
+ return i; /* Ugh, we could spin forever on unsupported proms ;( */
+ }
+
+-/* Blocking version of get character routine above. */
+-void prom_getchar(char *buf)
+-{
+- while (1) {
+- int err = prom_nbgetchar(buf);
+- if (!err)
+- break;
+- }
+-}
+-
+ /* Blocking version of put character routine above. */
+ void prom_putchar(const char *buf)
+ {
+--- a/arch/sparc/prom/console_64.c
++++ b/arch/sparc/prom/console_64.c
+@@ -15,28 +15,6 @@
+
+ extern int prom_stdin, prom_stdout;
+
+-/* Non blocking get character from console input device, returns -1
+- * if no input was taken. This can be used for polling.
+- */
+-static int prom_nbgetchar(char *buf)
+-{
+- unsigned long args[7];
+-
+- args[0] = (unsigned long) "read";
+- args[1] = 3;
+- args[2] = 1;
+- args[3] = (unsigned int) prom_stdin;
+- args[4] = (unsigned long) buf;
+- args[5] = 1;
+- args[6] = (unsigned long) -1;
+-
+- p1275_cmd_direct(args);
+-
+- if (args[6] == 1)
+- return 0;
+- return -1;
+-}
+-
+ /* Non blocking put character to console device, returns -1 if
+ * unsuccessful.
+ */
+@@ -60,16 +38,6 @@ static int prom_nbputchar(const char *bu
+ return -1;
+ }
+
+-/* Blocking version of get character routine above. */
+-void prom_getchar(char *buf)
+-{
+- while (1) {
+- int err = prom_nbgetchar(buf);
+- if (!err)
+- break;
+- }
+-}
+-
+ /* Blocking version of put character routine above. */
+ void prom_putchar(const char *buf)
+ {
--- /dev/null
+From d775633c84060f48f0136a69d15249a806ad407e Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 17 Nov 2010 10:22:56 -0800
+Subject: sparc: Do not export prom_nb{get,put}char().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 91921fef7c658b12de53376b312d071d757f7770 ]
+
+Never used outside of console_{32,64}.c
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/include/asm/oplib_32.h | 6 ------
+ arch/sparc/include/asm/oplib_64.h | 6 ------
+ arch/sparc/prom/console_32.c | 6 ++----
+ arch/sparc/prom/console_64.c | 6 ++----
+ 4 files changed, 4 insertions(+), 20 deletions(-)
+
+--- a/arch/sparc/include/asm/oplib_32.h
++++ b/arch/sparc/include/asm/oplib_32.h
+@@ -104,12 +104,6 @@ extern int prom_getprev(void);
+
+ /* Character operations to/from the console.... */
+
+-/* Non-blocking get character from console. */
+-extern int prom_nbgetchar(void);
+-
+-/* Non-blocking put character to console. */
+-extern int prom_nbputchar(char character);
+-
+ /* Blocking get character from console. */
+ extern char prom_getchar(void);
+
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -96,12 +96,6 @@ extern unsigned char prom_get_idprom(cha
+
+ /* Character operations to/from the console.... */
+
+-/* Non-blocking get character from console. */
+-extern int prom_nbgetchar(void);
+-
+-/* Non-blocking put character to console. */
+-extern int prom_nbputchar(char character);
+-
+ /* Blocking get character from console. */
+ extern char prom_getchar(void);
+
+--- a/arch/sparc/prom/console_32.c
++++ b/arch/sparc/prom/console_32.c
+@@ -19,8 +19,7 @@ extern void restore_current(void);
+ /* Non blocking get character from console input device, returns -1
+ * if no input was taken. This can be used for polling.
+ */
+-int
+-prom_nbgetchar(void)
++static int prom_nbgetchar(void)
+ {
+ static char inc;
+ int i = -1;
+@@ -51,8 +50,7 @@ prom_nbgetchar(void)
+ /* Non blocking put character to console device, returns -1 if
+ * unsuccessful.
+ */
+-int
+-prom_nbputchar(char c)
++static int prom_nbputchar(char c)
+ {
+ static char outc;
+ unsigned long flags;
+--- a/arch/sparc/prom/console_64.c
++++ b/arch/sparc/prom/console_64.c
+@@ -18,8 +18,7 @@ extern int prom_stdin, prom_stdout;
+ /* Non blocking get character from console input device, returns -1
+ * if no input was taken. This can be used for polling.
+ */
+-inline int
+-prom_nbgetchar(void)
++static int prom_nbgetchar(void)
+ {
+ unsigned long args[7];
+ char inc;
+@@ -42,8 +41,7 @@ prom_nbgetchar(void)
+ /* Non blocking put character to console device, returns -1 if
+ * unsuccessful.
+ */
+-inline int
+-prom_nbputchar(char c)
++static int prom_nbputchar(char c)
+ {
+ unsigned long args[7];
+ char outc;
--- /dev/null
+From 731e466bd3f80a9601e848fe0262e65c9ef0b377 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 16 Nov 2010 12:23:20 -0800
+Subject: sparc: Kill prom devops_{32,64}.c
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit b148246912bea92bde2a0cba125ca94f1f776b12 ]
+
+Completely unused.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/include/asm/oplib_32.h | 19 --------
+ arch/sparc/include/asm/oplib_64.h | 21 ---------
+ arch/sparc/prom/Makefile | 1
+ arch/sparc/prom/devops_32.c | 87 --------------------------------------
+ arch/sparc/prom/devops_64.c | 67 -----------------------------
+ 5 files changed, 195 deletions(-)
+ delete mode 100644 arch/sparc/prom/devops_32.c
+ delete mode 100644 arch/sparc/prom/devops_64.c
+
+--- a/arch/sparc/include/asm/oplib_32.h
++++ b/arch/sparc/include/asm/oplib_32.h
+@@ -60,25 +60,6 @@ extern char *prom_getbootargs(void);
+ extern char *prom_mapio(char *virt_hint, int io_space, unsigned int phys_addr, unsigned int num_bytes);
+ extern void prom_unmapio(char *virt_addr, unsigned int num_bytes);
+
+-/* Device operations. */
+-
+-/* Open the device described by the passed string. Note, that the format
+- * of the string is different on V0 vs. V2->higher proms. The caller must
+- * know what he/she is doing! Returns the device descriptor, an int.
+- */
+-extern int prom_devopen(char *device_string);
+-
+-/* Close a previously opened device described by the passed integer
+- * descriptor.
+- */
+-extern int prom_devclose(int device_handle);
+-
+-/* Do a seek operation on the device described by the passed integer
+- * descriptor.
+- */
+-extern void prom_seek(int device_handle, unsigned int seek_hival,
+- unsigned int seek_lowval);
+-
+ /* Miscellaneous routines, don't really fit in any category per se. */
+
+ /* Reboot the machine with the command line passed. */
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -67,27 +67,6 @@ extern void prom_init(void *cif_handler,
+ /* Boot argument acquisition, returns the boot command line string. */
+ extern char *prom_getbootargs(void);
+
+-/* Device utilities. */
+-
+-/* Device operations. */
+-
+-/* Open the device described by the passed string. Note, that the format
+- * of the string is different on V0 vs. V2->higher proms. The caller must
+- * know what he/she is doing! Returns the device descriptor, an int.
+- */
+-extern int prom_devopen(const char *device_string);
+-
+-/* Close a previously opened device described by the passed integer
+- * descriptor.
+- */
+-extern int prom_devclose(int device_handle);
+-
+-/* Do a seek operation on the device described by the passed integer
+- * descriptor.
+- */
+-extern void prom_seek(int device_handle, unsigned int seek_hival,
+- unsigned int seek_lowval);
+-
+ /* Miscellaneous routines, don't really fit in any category per se. */
+
+ /* Reboot the machine with the command line passed. */
+--- a/arch/sparc/prom/Makefile
++++ b/arch/sparc/prom/Makefile
+@@ -6,7 +6,6 @@ ccflags := -Werror
+
+ lib-y := bootstr_$(BITS).o
+ lib-$(CONFIG_SPARC32) += devmap.o
+-lib-y += devops_$(BITS).o
+ lib-y += init_$(BITS).o
+ lib-$(CONFIG_SPARC32) += memory.o
+ lib-y += misc_$(BITS).o
+--- a/arch/sparc/prom/devops_32.c
++++ /dev/null
+@@ -1,87 +0,0 @@
+-/*
+- * devops.c: Device operations using the PROM.
+- *
+- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
+- */
+-#include <linux/types.h>
+-#include <linux/kernel.h>
+-#include <linux/sched.h>
+-
+-#include <asm/openprom.h>
+-#include <asm/oplib.h>
+-
+-extern void restore_current(void);
+-
+-/* Open the device described by the string 'dstr'. Returns the handle
+- * to that device used for subsequent operations on that device.
+- * Returns -1 on failure.
+- */
+-int
+-prom_devopen(char *dstr)
+-{
+- int handle;
+- unsigned long flags;
+- spin_lock_irqsave(&prom_lock, flags);
+- switch(prom_vers) {
+- case PROM_V0:
+- handle = (*(romvec->pv_v0devops.v0_devopen))(dstr);
+- if(handle == 0) handle = -1;
+- break;
+- case PROM_V2:
+- case PROM_V3:
+- handle = (*(romvec->pv_v2devops.v2_dev_open))(dstr);
+- break;
+- default:
+- handle = -1;
+- break;
+- };
+- restore_current();
+- spin_unlock_irqrestore(&prom_lock, flags);
+-
+- return handle;
+-}
+-
+-/* Close the device described by device handle 'dhandle'. */
+-int
+-prom_devclose(int dhandle)
+-{
+- unsigned long flags;
+- spin_lock_irqsave(&prom_lock, flags);
+- switch(prom_vers) {
+- case PROM_V0:
+- (*(romvec->pv_v0devops.v0_devclose))(dhandle);
+- break;
+- case PROM_V2:
+- case PROM_V3:
+- (*(romvec->pv_v2devops.v2_dev_close))(dhandle);
+- break;
+- default:
+- break;
+- };
+- restore_current();
+- spin_unlock_irqrestore(&prom_lock, flags);
+- return 0;
+-}
+-
+-/* Seek to specified location described by 'seekhi' and 'seeklo'
+- * for device 'dhandle'.
+- */
+-void
+-prom_seek(int dhandle, unsigned int seekhi, unsigned int seeklo)
+-{
+- unsigned long flags;
+- spin_lock_irqsave(&prom_lock, flags);
+- switch(prom_vers) {
+- case PROM_V0:
+- (*(romvec->pv_v0devops.v0_seekdev))(dhandle, seekhi, seeklo);
+- break;
+- case PROM_V2:
+- case PROM_V3:
+- (*(romvec->pv_v2devops.v2_dev_seek))(dhandle, seekhi, seeklo);
+- break;
+- default:
+- break;
+- };
+- restore_current();
+- spin_unlock_irqrestore(&prom_lock, flags);
+-}
+--- a/arch/sparc/prom/devops_64.c
++++ /dev/null
+@@ -1,67 +0,0 @@
+-/*
+- * devops.c: Device operations using the PROM.
+- *
+- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
+- * Copyright (C) 1996,1997 Jakub Jelinek (jj@sunsite.mff.cuni.cz)
+- */
+-#include <linux/types.h>
+-#include <linux/kernel.h>
+-#include <linux/sched.h>
+-
+-#include <asm/openprom.h>
+-#include <asm/oplib.h>
+-
+-/* Open the device described by the string 'dstr'. Returns the handle
+- * to that device used for subsequent operations on that device.
+- * Returns 0 on failure.
+- */
+-int
+-prom_devopen(const char *dstr)
+-{
+- unsigned long args[5];
+-
+- args[0] = (unsigned long) "open";
+- args[1] = 1;
+- args[2] = 1;
+- args[3] = (unsigned long) dstr;
+- args[4] = (unsigned long) -1;
+-
+- p1275_cmd_direct(args);
+-
+- return (int) args[4];
+-}
+-
+-/* Close the device described by device handle 'dhandle'. */
+-int
+-prom_devclose(int dhandle)
+-{
+- unsigned long args[4];
+-
+- args[0] = (unsigned long) "close";
+- args[1] = 1;
+- args[2] = 0;
+- args[3] = (unsigned int) dhandle;
+-
+- p1275_cmd_direct(args);
+-
+- return 0;
+-}
+-
+-/* Seek to specified location described by 'seekhi' and 'seeklo'
+- * for device 'dhandle'.
+- */
+-void
+-prom_seek(int dhandle, unsigned int seekhi, unsigned int seeklo)
+-{
+- unsigned long args[7];
+-
+- args[0] = (unsigned long) "seek";
+- args[1] = 3;
+- args[2] = 1;
+- args[3] = (unsigned int) dhandle;
+- args[4] = seekhi;
+- args[5] = seeklo;
+- args[6] = (unsigned long) -1;
+-
+- p1275_cmd_direct(args);
+-}
--- /dev/null
+From b203e3cc8ab98a0e6a0d1bef65dbabc0d2ebad0e Mon Sep 17 00:00:00 2001
+From: Daniel Hellstrom <daniel@gaisler.com>
+Date: Fri, 29 Oct 2010 13:25:24 -0700
+Subject: SPARC/LEON: removed constant timer initialization as if HZ=100, now it reflects the value of HZ
+
+
+From: Daniel Hellstrom <daniel@gaisler.com>
+
+[ Upstream commit b690c425fe07c725e7f1f7d40303588416cba67f ]
+
+Signed-off-by: Daniel Hellstrom <daniel@gaisler.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/leon_kernel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/leon_kernel.c
++++ b/arch/sparc/kernel/leon_kernel.c
+@@ -114,7 +114,7 @@ void __init leon_init_timers(irq_handler
+ if (leon3_gptimer_regs && leon3_irqctrl_regs) {
+ LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].val, 0);
+ LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].rld,
+- (((1000000 / 100) - 1)));
++ (((1000000 / HZ) - 1)));
+ LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].ctrl, 0);
+
+ #ifdef CONFIG_SMP
+@@ -128,7 +128,7 @@ void __init leon_init_timers(irq_handler
+ }
+
+ LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].val, 0);
+- LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].rld, (((1000000/100) - 1)));
++ LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].rld, (((1000000/HZ) - 1)));
+ LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].ctrl, 0);
+ # endif
+
--- /dev/null
+From 859fb9bffac2f3fb2e32766a2ce57f1789e33064 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 30 Nov 2010 14:33:29 -0800
+Subject: sparc: Pass buffer pointer all the way down to prom_{get,put}char().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit e62cac1fd035b4cde707285008499dbe71955a86 ]
+
+This gets us closer to being able to eliminate the use
+of dynamic and stack based buffers, so that we can adhere
+to the "no buffer addresses above 4GB" rule for PROM calls.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/include/asm/openprom.h | 2 -
+ arch/sparc/include/asm/oplib_32.h | 4 +--
+ arch/sparc/include/asm/oplib_64.h | 4 +--
+ arch/sparc/prom/console_32.c | 50 +++++++++++++++++++-------------------
+ arch/sparc/prom/console_64.c | 34 ++++++++++++-------------
+ arch/sparc/prom/printf.c | 15 ++++++-----
+ 6 files changed, 55 insertions(+), 54 deletions(-)
+
+--- a/arch/sparc/include/asm/openprom.h
++++ b/arch/sparc/include/asm/openprom.h
+@@ -37,7 +37,7 @@ struct linux_dev_v2_funcs {
+ int (*v2_dev_open)(char *devpath);
+ void (*v2_dev_close)(int d);
+ int (*v2_dev_read)(int d, char *buf, int nbytes);
+- int (*v2_dev_write)(int d, char *buf, int nbytes);
++ int (*v2_dev_write)(int d, const char *buf, int nbytes);
+ int (*v2_dev_seek)(int d, int hi, int lo);
+
+ /* Never issued (multistage load support) */
+--- a/arch/sparc/include/asm/oplib_32.h
++++ b/arch/sparc/include/asm/oplib_32.h
+@@ -105,10 +105,10 @@ extern int prom_getprev(void);
+ /* Character operations to/from the console.... */
+
+ /* Blocking get character from console. */
+-extern char prom_getchar(void);
++extern void prom_getchar(char *buf);
+
+ /* Blocking put character to console. */
+-extern void prom_putchar(char character);
++extern void prom_putchar(const char *buf);
+
+ /* Prom's internal routines, don't use in kernel/boot code. */
+ extern void prom_printf(const char *fmt, ...);
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -97,10 +97,10 @@ extern unsigned char prom_get_idprom(cha
+ /* Character operations to/from the console.... */
+
+ /* Blocking get character from console. */
+-extern char prom_getchar(void);
++extern void prom_getchar(char *buf);
+
+ /* Blocking put character to console. */
+-extern void prom_putchar(char character);
++extern void prom_putchar(const char *buf);
+
+ /* Prom's internal routines, don't use in kernel/boot code. */
+ extern void prom_printf(const char *fmt, ...);
+--- a/arch/sparc/prom/console_32.c
++++ b/arch/sparc/prom/console_32.c
+@@ -19,27 +19,27 @@ extern void restore_current(void);
+ /* Non blocking get character from console input device, returns -1
+ * if no input was taken. This can be used for polling.
+ */
+-static int prom_nbgetchar(void)
++static int prom_nbgetchar(char *buf)
+ {
+- static char inc;
+- int i = -1;
+ unsigned long flags;
++ int i = -1;
+
+ spin_lock_irqsave(&prom_lock, flags);
+ switch(prom_vers) {
+ case PROM_V0:
+ i = (*(romvec->pv_nbgetchar))();
++ if (i != -1) {
++ *buf = i;
++ i = 0;
++ }
+ break;
+ case PROM_V2:
+ case PROM_V3:
+- if( (*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin , &inc, 0x1) == 1) {
+- i = inc;
+- } else {
+- i = -1;
+- }
++ if ((*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin,
++ buf, 0x1) == 1)
++ i = 0;
+ break;
+ default:
+- i = -1;
+ break;
+ };
+ restore_current();
+@@ -50,27 +50,23 @@ static int prom_nbgetchar(void)
+ /* Non blocking put character to console device, returns -1 if
+ * unsuccessful.
+ */
+-static int prom_nbputchar(char c)
++static int prom_nbputchar(const char *buf)
+ {
+- static char outc;
+ unsigned long flags;
+ int i = -1;
+
+ spin_lock_irqsave(&prom_lock, flags);
+ switch(prom_vers) {
+ case PROM_V0:
+- i = (*(romvec->pv_nbputchar))(c);
++ i = (*(romvec->pv_nbputchar))(*buf);
+ break;
+ case PROM_V2:
+ case PROM_V3:
+- outc = c;
+- if( (*(romvec->pv_v2devops).v2_dev_write)(*romvec->pv_v2bootargs.fd_stdout, &outc, 0x1) == 1)
++ if ((*(romvec->pv_v2devops).v2_dev_write)(*romvec->pv_v2bootargs.fd_stdout,
++ buf, 0x1) == 1)
+ i = 0;
+- else
+- i = -1;
+ break;
+ default:
+- i = -1;
+ break;
+ };
+ restore_current();
+@@ -79,17 +75,21 @@ static int prom_nbputchar(char c)
+ }
+
+ /* Blocking version of get character routine above. */
+-char
+-prom_getchar(void)
++void prom_getchar(char *buf)
+ {
+- int character;
+- while((character = prom_nbgetchar()) == -1) ;
+- return (char) character;
++ while (1) {
++ int err = prom_nbgetchar(buf);
++ if (!err)
++ break;
++ }
+ }
+
+ /* Blocking version of put character routine above. */
+-void
+-prom_putchar(char c)
++void prom_putchar(const char *buf)
+ {
+- while(prom_nbputchar(c) == -1) ;
++ while (1) {
++ int err = prom_nbputchar(buf);
++ if (!err)
++ break;
++ }
+ }
+--- a/arch/sparc/prom/console_64.c
++++ b/arch/sparc/prom/console_64.c
+@@ -18,41 +18,37 @@ extern int prom_stdin, prom_stdout;
+ /* Non blocking get character from console input device, returns -1
+ * if no input was taken. This can be used for polling.
+ */
+-static int prom_nbgetchar(void)
++static int prom_nbgetchar(char *buf)
+ {
+ unsigned long args[7];
+- char inc;
+
+ args[0] = (unsigned long) "read";
+ args[1] = 3;
+ args[2] = 1;
+ args[3] = (unsigned int) prom_stdin;
+- args[4] = (unsigned long) &inc;
++ args[4] = (unsigned long) buf;
+ args[5] = 1;
+ args[6] = (unsigned long) -1;
+
+ p1275_cmd_direct(args);
+
+ if (args[6] == 1)
+- return inc;
++ return 0;
+ return -1;
+ }
+
+ /* Non blocking put character to console device, returns -1 if
+ * unsuccessful.
+ */
+-static int prom_nbputchar(char c)
++static int prom_nbputchar(const char *buf)
+ {
+ unsigned long args[7];
+- char outc;
+-
+- outc = c;
+
+ args[0] = (unsigned long) "write";
+ args[1] = 3;
+ args[2] = 1;
+ args[3] = (unsigned int) prom_stdout;
+- args[4] = (unsigned long) &outc;
++ args[4] = (unsigned long) buf;
+ args[5] = 1;
+ args[6] = (unsigned long) -1;
+
+@@ -65,17 +61,21 @@ static int prom_nbputchar(char c)
+ }
+
+ /* Blocking version of get character routine above. */
+-char
+-prom_getchar(void)
++void prom_getchar(char *buf)
+ {
+- int character;
+- while((character = prom_nbgetchar()) == -1) ;
+- return (char) character;
++ while (1) {
++ int err = prom_nbgetchar(buf);
++ if (!err)
++ break;
++ }
+ }
+
+ /* Blocking version of put character routine above. */
+-void
+-prom_putchar(char c)
++void prom_putchar(const char *buf)
+ {
+- prom_nbputchar(c);
++ while (1) {
++ int err = prom_nbputchar(buf);
++ if (!err)
++ break;
++ }
+ }
+--- a/arch/sparc/prom/printf.c
++++ b/arch/sparc/prom/printf.c
+@@ -23,13 +23,14 @@ static char ppbuf[1024];
+
+ void notrace prom_write(const char *buf, unsigned int n)
+ {
+- char ch;
+-
+- while (n != 0) {
+- --n;
+- if ((ch = *buf++) == '\n')
+- prom_putchar('\r');
+- prom_putchar(ch);
++ while (n-- != 0) {
++ char ch = *buf;
++ if (ch == '\n') {
++ char tmp = '\r';
++ prom_putchar(&tmp);
++ }
++ prom_putchar(buf);
++ buf++;
+ }
+ }
+
--- /dev/null
+From 4948cb473bbe934273498daec57176dddf188c65 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 16 Nov 2010 12:11:15 -0800
+Subject: sparc: Remove prom_pathtoinode()
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 17d70d6df0c4ea7a203b444001572a91ad9c2bef ]
+
+Unused.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/include/asm/oplib_32.h | 1 -
+ arch/sparc/include/asm/oplib_64.h | 1 -
+ arch/sparc/prom/tree_32.c | 15 ---------------
+ arch/sparc/prom/tree_64.c | 18 ------------------
+ 4 files changed, 35 deletions(-)
+
+--- a/arch/sparc/include/asm/oplib_32.h
++++ b/arch/sparc/include/asm/oplib_32.h
+@@ -238,7 +238,6 @@ extern int prom_node_has_property(int no
+ extern int prom_setprop(int node, const char *prop_name, char *prop_value,
+ int value_size);
+
+-extern int prom_pathtoinode(char *path);
+ extern int prom_inst2pkg(int);
+
+ /* Dorking with Bus ranges... */
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -278,7 +278,6 @@ extern int prom_finddevice(const char *n
+ extern int prom_setprop(int node, const char *prop_name, char *prop_value,
+ int value_size);
+
+-extern int prom_pathtoinode(const char *path);
+ extern int prom_inst2pkg(int);
+ extern int prom_service_exists(const char *service_name);
+ extern void prom_sun4v_guest_soft_state(void);
+--- a/arch/sparc/prom/tree_32.c
++++ b/arch/sparc/prom/tree_32.c
+@@ -341,18 +341,3 @@ int prom_inst2pkg(int inst)
+ if (node == -1) return 0;
+ return node;
+ }
+-
+-/* Return 'node' assigned to a particular prom 'path'
+- * FIXME: Should work for v0 as well
+- */
+-int prom_pathtoinode(char *path)
+-{
+- int node, inst;
+-
+- inst = prom_devopen (path);
+- if (inst == -1) return 0;
+- node = prom_inst2pkg (inst);
+- prom_devclose (inst);
+- if (node == -1) return 0;
+- return node;
+-}
+--- a/arch/sparc/prom/tree_64.c
++++ b/arch/sparc/prom/tree_64.c
+@@ -374,24 +374,6 @@ inline int prom_inst2pkg(int inst)
+ return node;
+ }
+
+-/* Return 'node' assigned to a particular prom 'path'
+- * FIXME: Should work for v0 as well
+- */
+-int
+-prom_pathtoinode(const char *path)
+-{
+- int node, inst;
+-
+- inst = prom_devopen (path);
+- if (inst == 0)
+- return 0;
+- node = prom_inst2pkg(inst);
+- prom_devclose(inst);
+- if (node == -1)
+- return 0;
+- return node;
+-}
+-
+ int prom_ihandle2path(int handle, char *buffer, int bufsize)
+ {
+ unsigned long args[7];
--- /dev/null
+From 699a02e295c0ee4826731598611556935e0f2457 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 30 Nov 2010 20:15:58 -0800
+Subject: sparc: Write to prom console using indirect buffer.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 595a251c0740785fd3c0d2156d78578c7479811e ]
+
+sparc64 systems have a restriction in that passing in buffer
+addressses above 4GB to prom calls is not reliable.
+
+We end up violating this when we do prom console writes, because we
+use an on-stack buffer to translate '\n' into '\r\n'.
+
+So instead, do this translation into an intermediate buffer, which is
+in the kernel image and thus below 4GB, then pass that to the PROM
+console write calls.
+
+On the 32-bit side we don't have to deal with any of these issues, so
+the new prom_console_write_buf() uses the existing prom_nbputchar()
+implementation. However we can now mark those routines static.
+
+Since the 64-bit side completely uses new code we can delete the
+putchar bits as they are now completely unused.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/include/asm/oplib_32.h | 4 ++--
+ arch/sparc/include/asm/oplib_64.h | 4 ++--
+ arch/sparc/prom/console_32.c | 14 ++++++++------
+ arch/sparc/prom/console_64.c | 27 +++++++++++++--------------
+ arch/sparc/prom/printf.c | 32 +++++++++++++++++++++++++++-----
+ 5 files changed, 52 insertions(+), 29 deletions(-)
+
+--- a/arch/sparc/include/asm/oplib_32.h
++++ b/arch/sparc/include/asm/oplib_32.h
+@@ -102,8 +102,8 @@ extern int prom_getrev(void);
+ /* Get the prom firmware revision. */
+ extern int prom_getprev(void);
+
+-/* Blocking put character to console. */
+-extern void prom_putchar(const char *buf);
++/* Write a buffer of characters to the console. */
++extern void prom_console_write_buf(const char *buf, int len);
+
+ /* Prom's internal routines, don't use in kernel/boot code. */
+ extern void prom_printf(const char *fmt, ...);
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -94,8 +94,8 @@ extern void prom_halt_power_off(void) __
+ */
+ extern unsigned char prom_get_idprom(char *idp_buffer, int idpbuf_size);
+
+-/* Blocking put character to console. */
+-extern void prom_putchar(const char *buf);
++/* Write a buffer of characters to the console. */
++extern void prom_console_write_buf(const char *buf, int len);
+
+ /* Prom's internal routines, don't use in kernel/boot code. */
+ extern void prom_printf(const char *fmt, ...);
+--- a/arch/sparc/prom/console_32.c
++++ b/arch/sparc/prom/console_32.c
+@@ -43,12 +43,14 @@ static int prom_nbputchar(const char *bu
+ return i; /* Ugh, we could spin forever on unsupported proms ;( */
+ }
+
+-/* Blocking version of put character routine above. */
+-void prom_putchar(const char *buf)
++void prom_console_write_buf(const char *buf, int len)
+ {
+- while (1) {
+- int err = prom_nbputchar(buf);
+- if (!err)
+- break;
++ while (len) {
++ int n = prom_nbputchar(buf);
++ if (n)
++ continue;
++ len--;
++ buf++;
+ }
+ }
++
+--- a/arch/sparc/prom/console_64.c
++++ b/arch/sparc/prom/console_64.c
+@@ -15,35 +15,34 @@
+
+ extern int prom_stdin, prom_stdout;
+
+-/* Non blocking put character to console device, returns -1 if
+- * unsuccessful.
+- */
+-static int prom_nbputchar(const char *buf)
++static int __prom_console_write_buf(const char *buf, int len)
+ {
+ unsigned long args[7];
++ int ret;
+
+ args[0] = (unsigned long) "write";
+ args[1] = 3;
+ args[2] = 1;
+ args[3] = (unsigned int) prom_stdout;
+ args[4] = (unsigned long) buf;
+- args[5] = 1;
++ args[5] = (unsigned int) len;
+ args[6] = (unsigned long) -1;
+
+ p1275_cmd_direct(args);
+
+- if (args[6] == 1)
+- return 0;
+- else
++ ret = (int) args[6];
++ if (ret < 0)
+ return -1;
++ return ret;
+ }
+
+-/* Blocking version of put character routine above. */
+-void prom_putchar(const char *buf)
++void prom_console_write_buf(const char *buf, int len)
+ {
+- while (1) {
+- int err = prom_nbputchar(buf);
+- if (!err)
+- break;
++ while (len) {
++ int n = __prom_console_write_buf(buf, len);
++ if (n < 0)
++ continue;
++ len -= n;
++ buf += len;
+ }
+ }
+--- a/arch/sparc/prom/printf.c
++++ b/arch/sparc/prom/printf.c
+@@ -15,23 +15,45 @@
+
+ #include <linux/kernel.h>
+ #include <linux/compiler.h>
++#include <linux/spinlock.h>
+
+ #include <asm/openprom.h>
+ #include <asm/oplib.h>
+
++#define CONSOLE_WRITE_BUF_SIZE 1024
++
+ static char ppbuf[1024];
++static char console_write_buf[CONSOLE_WRITE_BUF_SIZE];
++static DEFINE_RAW_SPINLOCK(console_write_lock);
+
+ void notrace prom_write(const char *buf, unsigned int n)
+ {
++ unsigned int dest_len;
++ unsigned long flags;
++ char *dest;
++
++ dest = console_write_buf;
++ raw_spin_lock_irqsave(&console_write_lock, flags);
++
++ dest_len = 0;
+ while (n-- != 0) {
+- char ch = *buf;
++ char ch = *buf++;
+ if (ch == '\n') {
+- char tmp = '\r';
+- prom_putchar(&tmp);
++ *dest++ = '\r';
++ dest_len++;
++ }
++ *dest++ = ch;
++ dest_len++;
++ if (dest_len >= CONSOLE_WRITE_BUF_SIZE - 1) {
++ prom_console_write_buf(console_write_buf, dest_len);
++ dest = console_write_buf;
++ dest_len = 0;
+ }
+- prom_putchar(buf);
+- buf++;
+ }
++ if (dest_len)
++ prom_console_write_buf(console_write_buf, dest_len);
++
++ raw_spin_unlock_irqrestore(&console_write_lock, flags);
+ }
+
+ void notrace prom_printf(const char *fmt, ...)
--- /dev/null
+From bc389c4be6cfaf636103b4e4dfdeabb6e8adbe32 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 16 Nov 2010 12:08:23 -0800
+Subject: sparc64: Delete prom_puts() unused.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit ce05a94efaf71d562eeefd30d6bbc2ab42b06bac ]
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/prom/console_64.c | 16 ----------------
+ 1 file changed, 16 deletions(-)
+
+--- a/arch/sparc/prom/console_64.c
++++ b/arch/sparc/prom/console_64.c
+@@ -81,19 +81,3 @@ prom_putchar(char c)
+ {
+ prom_nbputchar(c);
+ }
+-
+-void
+-prom_puts(const char *s, int len)
+-{
+- unsigned long args[7];
+-
+- args[0] = (unsigned long) "write";
+- args[1] = 3;
+- args[2] = 1;
+- args[3] = (unsigned int) prom_stdout;
+- args[4] = (unsigned long) s;
+- args[5] = len;
+- args[6] = (unsigned long) -1;
+-
+- p1275_cmd_direct(args);
+-}
--- /dev/null
+From 1bcb53777cfdf5f1148e5aab9a4742789b4c52a4 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 16 Nov 2010 12:50:19 -0800
+Subject: sparc64: Delete prom_setcallback().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c540ee70e49b573535c7ddfd0e9a0fc9d549c8b7 ]
+
+Unused.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/include/asm/oplib_64.h | 8 --------
+ arch/sparc/prom/misc_64.c | 14 --------------
+ 2 files changed, 22 deletions(-)
+
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -88,14 +88,6 @@ extern void prom_halt(void) __attribute_
+ /* Halt and power-off the machine. */
+ extern void prom_halt_power_off(void) __attribute__ ((noreturn));
+
+-/* Set the PROM 'sync' callback function to the passed function pointer.
+- * When the user gives the 'sync' command at the prom prompt while the
+- * kernel is still active, the prom will call this routine.
+- *
+- */
+-typedef int (*callback_func_t)(long *cmd);
+-extern void prom_setcallback(callback_func_t func_ptr);
+-
+ /* Acquire the IDPROM of the root node in the prom device tree. This
+ * gets passed a buffer where you would like it stuffed. The return value
+ * is the format type of this idprom or 0xff on error.
+--- a/arch/sparc/prom/misc_64.c
++++ b/arch/sparc/prom/misc_64.c
+@@ -150,20 +150,6 @@ void prom_halt_power_off(void)
+ prom_halt();
+ }
+
+-/* Set prom sync handler to call function 'funcp'. */
+-void prom_setcallback(callback_func_t funcp)
+-{
+- unsigned long args[5];
+- if (!funcp)
+- return;
+- args[0] = (unsigned long) "set-callback";
+- args[1] = 1;
+- args[2] = 1;
+- args[3] = (unsigned long) funcp;
+- args[4] = (unsigned long) -1;
+- p1275_cmd_direct(args);
+-}
+-
+ /* Get the idprom and stuff it into buffer 'idbuf'. Returns the
+ * format type. 'num_bytes' is the number of bytes that your idbuf
+ * has space for. Returns 0xff on error.
--- /dev/null
+From b3596383d350eeb552954eee4aaeee64efcdc443 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 16 Nov 2010 12:24:16 -0800
+Subject: sparc64: Unexport prom_service_exists().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit f7b5f55ac1623dfde24ef5319ad77c1746645f3f ]
+
+Only used by functions in misc_64.c so make it private
+to that file.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/include/asm/oplib_64.h | 1 -
+ arch/sparc/prom/misc_64.c | 2 +-
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -258,7 +258,6 @@ extern int prom_setprop(int node, const
+ int value_size);
+
+ extern int prom_inst2pkg(int);
+-extern int prom_service_exists(const char *service_name);
+ extern void prom_sun4v_guest_soft_state(void);
+
+ extern int prom_ihandle2path(int handle, char *buffer, int bufsize);
+--- a/arch/sparc/prom/misc_64.c
++++ b/arch/sparc/prom/misc_64.c
+@@ -18,7 +18,7 @@
+ #include <asm/system.h>
+ #include <asm/ldc.h>
+
+-int prom_service_exists(const char *service_name)
++static int prom_service_exists(const char *service_name)
+ {
+ unsigned long args[5];
+
--- /dev/null
+From b6bd33114e63d96f424c8e2baf46b3a58745077b Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 7 Dec 2010 12:03:55 +0000
+Subject: tcp: avoid a possible divide by zero
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit ad9f4f50fe9288bbe65b7dfd76d8820afac6a24c ]
+
+sysctl_tcp_tso_win_divisor might be set to zero while one cpu runs in
+tcp_tso_should_defer(). Make sure we dont allow a divide by zero by
+reading sysctl_tcp_tso_win_divisor exactly once.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_output.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1518,6 +1518,7 @@ static int tcp_tso_should_defer(struct s
+ struct tcp_sock *tp = tcp_sk(sk);
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+ u32 send_win, cong_win, limit, in_flight;
++ int win_divisor;
+
+ if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN)
+ goto send_now;
+@@ -1549,13 +1550,14 @@ static int tcp_tso_should_defer(struct s
+ if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
+ goto send_now;
+
+- if (sysctl_tcp_tso_win_divisor) {
++ win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
++ if (win_divisor) {
+ u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
+
+ /* If at least some fraction of a window is available,
+ * just use it.
+ */
+- chunk /= sysctl_tcp_tso_win_divisor;
++ chunk /= win_divisor;
+ if (limit >= chunk)
+ goto send_now;
+ } else {
--- /dev/null
+From 18ab4520fd46404b67d415045ee5d9c4535eaacb Mon Sep 17 00:00:00 2001
+From: Nandita Dukkipati <nanditad@google.com>
+Date: Fri, 3 Dec 2010 13:33:44 +0000
+Subject: tcp: Bug fix in initialization of receive window.
+
+
+From: Nandita Dukkipati <nanditad@google.com>
+
+[ Upstream commit b1afde60f2b9ee8444fba4e012dc99a3b28d224d ]
+
+The bug has to do with boundary checks on the initial receive window.
+If the initial receive window falls between init_cwnd and the
+receive window specified by the user, the initial window is incorrectly
+brought down to init_cwnd. The correct behavior is to allow it to
+remain unchanged.
+
+Signed-off-by: Nandita Dukkipati <nanditad@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_output.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -237,11 +237,10 @@ void tcp_select_initial_window(int __spa
+ /* when initializing use the value from init_rcv_wnd
+ * rather than the default from above
+ */
+- if (init_rcv_wnd &&
+- (*rcv_wnd > init_rcv_wnd * mss))
+- *rcv_wnd = init_rcv_wnd * mss;
+- else if (*rcv_wnd > init_cwnd * mss)
+- *rcv_wnd = init_cwnd * mss;
++ if (init_rcv_wnd)
++ *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
++ else
++ *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
+ }
+
+ /* Set the clamp no higher than max representable value */
--- /dev/null
+From 34eef919139f6a7558b43576b12b40731f12f7d7 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Fri, 12 Nov 2010 13:35:00 -0800
+Subject: tcp: Don't change unlocked socket state in tcp_v4_err().
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 8f49c2703b33519aaaccc63f571b465b9d2b3a2d ]
+
+Alexey Kuznetsov noticed a regression introduced by
+commit f1ecd5d9e7366609d640ff4040304ea197fbc618
+("Revert Backoff [v3]: Revert RTO on ICMP destination unreachable")
+
+The RTO and timer modification code added to tcp_v4_err()
+doesn't check sock_owned_by_user(), which if true means we
+don't have exclusive access to the socket and therefore cannot
+modify it's critical state.
+
+Just skip this new code block if sock_owned_by_user() is true
+and eliminate the now superfluous sock_owned_by_user() code
+block contained within.
+
+Reported-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+CC: Damian Lukowski <damian@tvk.rwth-aachen.de>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_ipv4.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -415,6 +415,9 @@ void tcp_v4_err(struct sk_buff *icmp_skb
+ !icsk->icsk_backoff)
+ break;
+
++ if (sock_owned_by_user(sk))
++ break;
++
+ icsk->icsk_backoff--;
+ inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
+ icsk->icsk_backoff;
+@@ -429,11 +432,6 @@ void tcp_v4_err(struct sk_buff *icmp_skb
+ if (remaining) {
+ inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+ remaining, TCP_RTO_MAX);
+- } else if (sock_owned_by_user(sk)) {
+- /* RTO revert clocked out retransmission,
+- * but socket is locked. Will defer. */
+- inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+- HZ/20, TCP_RTO_MAX);
+ } else {
+ /* RTO revert clocked out retransmission.
+ * Will retransmit now */
--- /dev/null
+From 47a8c78fffc3bde1f828c9fce0aae5ae5320cfb3 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 10 Nov 2010 21:35:37 -0800
+Subject: tcp: Increase TCP_MAXSEG socket option minimum.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2 ]
+
+As noted by Steve Chen, since commit
+f5fff5dc8a7a3f395b0525c02ba92c95d42b7390 ("tcp: advertise MSS
+requested by user") we can end up with a situation where
+tcp_select_initial_window() does a divide by a zero (or
+even negative) mss value.
+
+The problem is that sometimes we effectively subtract
+TCPOLEN_TSTAMP_ALIGNED and/or TCPOLEN_MD5SIG_ALIGNED from the mss.
+
+Fix this by increasing the minimum from 8 to 64.
+
+Reported-by: Steve Chen <schen@mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock
+ /* Values greater than interface MTU won't take effect. However
+ * at the point when this call is done we typically don't yet
+ * know which interface is going to be used */
+- if (val < 8 || val > MAX_TCP_WINDOW) {
++ if (val < 64 || val > MAX_TCP_WINDOW) {
+ err = -EINVAL;
+ break;
+ }
--- /dev/null
+From 9f3ec7da60ef8443addc35828214f129590495f2 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 24 Nov 2010 11:47:22 -0800
+Subject: tcp: Make TCP_MAXSEG minimum more correct.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c39508d6f118308355468314ff414644115a07f3 ]
+
+Use TCP_MIN_MSS instead of constant 64.
+
+Reported-by: Min Zhang <mzhang@mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock
+ /* Values greater than interface MTU won't take effect. However
+ * at the point when this call is done we typically don't yet
+ * know which interface is going to be used */
+- if (val < 64 || val > MAX_TCP_WINDOW) {
++ if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) {
+ err = -EINVAL;
+ break;
+ }
--- /dev/null
+From e1e9ef4b173c9437d9966b2d953a2c624190d2c9 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 7 Dec 2010 12:20:47 +0000
+Subject: tcp: protect sysctl_tcp_cookie_size reads
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit f19872575ff7819a3723154657a497d9bca66b33 ]
+
+Make sure sysctl_tcp_cookie_size is read once in
+tcp_cookie_size_check(), or we might return an illegal value to caller
+if sysctl_tcp_cookie_size is changed by another cpu.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Ben Hutchings <bhutchings@solarflare.com>
+Cc: William Allen Simpson <william.allen.simpson@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_output.c | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -391,27 +391,30 @@ struct tcp_out_options {
+ */
+ static u8 tcp_cookie_size_check(u8 desired)
+ {
+- if (desired > 0) {
++ int cookie_size;
++
++ if (desired > 0)
+ /* previously specified */
+ return desired;
+- }
+- if (sysctl_tcp_cookie_size <= 0) {
++
++ cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
++ if (cookie_size <= 0)
+ /* no default specified */
+ return 0;
+- }
+- if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
++
++ if (cookie_size <= TCP_COOKIE_MIN)
+ /* value too small, specify minimum */
+ return TCP_COOKIE_MIN;
+- }
+- if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
++
++ if (cookie_size >= TCP_COOKIE_MAX)
+ /* value too large, specify maximum */
+ return TCP_COOKIE_MAX;
+- }
+- if (0x1 & sysctl_tcp_cookie_size) {
++
++ if (cookie_size & 1)
+ /* 8-bit multiple, illegal, fix it */
+- return (u8)(sysctl_tcp_cookie_size + 0x1);
+- }
+- return (u8)sysctl_tcp_cookie_size;
++ cookie_size++;
++
++ return (u8)cookie_size;
+ }
+
+ /* Write previously computed TCP options to the packet.
--- /dev/null
+From 9b350d25af41819ff669769beb8cd80e59dc3bfe Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Fri, 17 Dec 2010 10:16:23 -0800
+Subject: tehuti: Firmware filename is tehuti/bdx.bin
+
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit 46814e08d80f87449b5adb3d549a3cae6f9f8148 ]
+
+My conversion of tehuti to use request_firmware() was confused about
+the filename of the firmware blob. Change the driver to match the
+blob.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/tehuti.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/tehuti.c
++++ b/drivers/net/tehuti.c
+@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv *
+ ENTER;
+ master = READ_REG(priv, regINIT_SEMAPHORE);
+ if (!READ_REG(priv, regINIT_STATUS) && master) {
+- rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev);
++ rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev);
+ if (rc)
+ goto out;
+ bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size);
+@@ -2516,4 +2516,4 @@ module_exit(bdx_module_exit);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR(DRIVER_AUTHOR);
+ MODULE_DESCRIPTION(BDX_DRV_DESC);
+-MODULE_FIRMWARE("tehuti/firmware.bin");
++MODULE_FIRMWARE("tehuti/bdx.bin");
--- /dev/null
+From 388812334ba75bf32b76f6a364a34bc37f7d50c4 Mon Sep 17 00:00:00 2001
+From: Apollon Oikonomopoulos <apollon@noc.grnet.gr>
+Date: Tue, 7 Dec 2010 09:43:30 +0000
+Subject: x25: decrement netdev reference counts on unload
+
+
+From: Apollon Oikonomopoulos <apollon@noc.grnet.gr>
+
+[ Upstream commit 33ce2b3d81dca76f589641b7a675c28f0f6375b1 ]
+
+x25 does not decrement the network device reference counts on module unload.
+Thus unregistering any pre-existing interface after unloading the x25 module
+hangs and results in
+
+ unregister_netdevice: waiting for tap0 to become free. Usage count = 1
+
+This patch decrements the reference counts of all interfaces in x25_link_free,
+the way it is already done in x25_link_device_down for NETDEV_DOWN events.
+
+Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/x25/x25_link.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/x25/x25_link.c
++++ b/net/x25/x25_link.c
+@@ -394,6 +394,7 @@ void __exit x25_link_free(void)
+ list_for_each_safe(entry, tmp, &x25_neigh_list) {
+ nb = list_entry(entry, struct x25_neigh, node);
+ __x25_remove_neigh(nb);
++ dev_put(nb->dev);
+ }
+ write_unlock_bh(&x25_neigh_list_lock);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
