diff options
| -rw-r--r-- | 2.6.32/0000_README | 2 | ||||
| -rw-r--r-- | 2.6.32/4420_grsecurity-2.9-2.6.32.59-201206042134.patch (renamed from 2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch) | 34 | ||||
| -rw-r--r-- | 3.2.18/1016_linux-3.2.17.patch | 5695 | ||||
| -rw-r--r-- | 3.2.18/1017_linux-3.2.18.patch | 1791 | ||||
| -rw-r--r-- | 3.2.19/0000_README (renamed from 3.2.18/0000_README) | 2 | ||||
| -rw-r--r-- | 3.2.19/4420_grsecurity-2.9-3.2.19-201206042135.patch (renamed from 3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch) | 800 | ||||
| -rw-r--r-- | 3.2.19/4430_grsec-remove-localversion-grsec.patch (renamed from 3.2.18/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.2.19/4435_grsec-mute-warnings.patch (renamed from 3.2.18/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.2.19/4440_grsec-remove-protected-paths.patch (renamed from 3.2.18/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.2.19/4445_grsec-pax-without-grsec.patch (renamed from 3.2.18/4445_grsec-pax-without-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.2.19/4450_grsec-kconfig-default-gids.patch (renamed from 3.2.18/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.2.19/4455_grsec-kconfig-gentoo.patch (renamed from 3.2.18/4455_grsec-kconfig-gentoo.patch) | 0 | ||||
| -rw-r--r-- | 3.2.19/4460-grsec-kconfig-proc-user.patch (renamed from 3.2.18/4460-grsec-kconfig-proc-user.patch) | 0 | ||||
| -rw-r--r-- | 3.2.19/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.2.18/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.2.19/4470_disable-compat_vdso.patch (renamed from 3.2.18/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/0000_README (renamed from 3.3.7/0000_README) | 2 | ||||
| -rw-r--r-- | 3.3.8/4420_grsecurity-2.9-3.3.8-201206042136.patch (renamed from 3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch) | 612 | ||||
| -rw-r--r-- | 3.3.8/4430_grsec-remove-localversion-grsec.patch (renamed from 3.3.7/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/4435_grsec-mute-warnings.patch (renamed from 3.3.7/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/4440_grsec-remove-protected-paths.patch (renamed from 3.3.7/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/4445_grsec-pax-without-grsec.patch (renamed from 3.3.7/4445_grsec-pax-without-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/4450_grsec-kconfig-default-gids.patch (renamed from 3.3.7/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/4455_grsec-kconfig-gentoo.patch (renamed from 3.3.7/4455_grsec-kconfig-gentoo.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/4460-grsec-kconfig-proc-user.patch (renamed from 3.3.7/4460-grsec-kconfig-proc-user.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.3.7/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.3.8/4470_disable-compat_vdso.patch (renamed from 3.3.7/4470_disable-compat_vdso.patch) | 0 |
26 files changed, 678 insertions, 8260 deletions
diff --git a/2.6.32/0000_README b/2.6.32/0000_README index 4b5c6dc..1e75c22 100644 --- a/2.6.32/0000_README +++ b/2.6.32/0000_README @@ -30,7 +30,7 @@ Patch: 1058_linux-2.6.32.59.patch From: http://www.kernel.org Desc: Linux 2.6.32.59 -Patch: 4420_grsecurity-2.9-2.6.32.59-201206011934.patch +Patch: 4420_grsecurity-2.9-2.6.32.59-201206042134.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206042134.patch index d2b4115..9d85b0d 100644 --- a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch +++ b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206042134.patch @@ -26798,7 +26798,7 @@ index f46c3407..f7e72b0 100644 } if (mm->get_unmapped_area == arch_get_unmapped_area) diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 73ffd55..e2f0e1d 100644 +index 73ffd55..2cb04d8 100644 --- a/arch/x86/mm/init.c +++ b/arch/x86/mm/init.c @@ -13,6 +13,7 @@ @@ -26864,7 +26864,7 @@ index 73ffd55..e2f0e1d 100644 if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) return 0; if (!page_is_ram(pagenr)) -@@ -377,8 +396,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) +@@ -377,8 +396,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) #endif } @@ -26899,14 +26899,13 @@ index 73ffd55..e2f0e1d 100644 + unsigned long addr, limit; + struct desc_struct d; + int cpu; -+#endif -+#endif -+#ifndef CONFIG_X86_PAE ++#else + pgd_t *pgd; + pud_t *pud; + pmd_t *pmd; + unsigned long addr, end; +#endif ++#endif + + gr_init_ebda(); + @@ -28968,7 +28967,7 @@ index 21e1aeb..2c0b3c4 100644 -} -__setup("vdso=", vdso_setup); diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 0087b00..eecb34f 100644 +index 0087b00..ec5c76f 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c @@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); @@ -28989,7 +28988,18 @@ index 0087b00..eecb34f 100644 end = start + __get_cpu_var(idt_desc).size + 1; xen_mc_flush(); -@@ -993,7 +991,7 @@ static const struct pv_apic_ops xen_apic_ops __initdata = { +@@ -945,7 +943,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = { + .wbinvd = native_wbinvd, + + .read_msr = native_read_msr_safe, ++ .rdmsr_regs = native_rdmsr_safe_regs, + .write_msr = xen_write_msr_safe, ++ .wrmsr_regs = native_wrmsr_safe_regs, ++ + .read_tsc = native_read_tsc, + .read_pmc = native_read_pmc, + +@@ -993,7 +994,7 @@ static const struct pv_apic_ops xen_apic_ops __initdata = { #endif }; @@ -28998,7 +29008,7 @@ index 0087b00..eecb34f 100644 { struct sched_shutdown r = { .reason = reason }; -@@ -1001,17 +999,17 @@ static void xen_reboot(int reason) +@@ -1001,17 +1002,17 @@ static void xen_reboot(int reason) BUG(); } @@ -29019,7 +29029,7 @@ index 0087b00..eecb34f 100644 { xen_reboot(SHUTDOWN_poweroff); } -@@ -1095,9 +1093,20 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1095,9 +1096,20 @@ asmlinkage void __init xen_start_kernel(void) */ __userpte_alloc_gfp &= ~__GFP_HIGHMEM; @@ -29042,7 +29052,7 @@ index 0087b00..eecb34f 100644 #endif xen_setup_features(); -@@ -1129,13 +1138,6 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1129,13 +1141,6 @@ asmlinkage void __init xen_start_kernel(void) machine_ops = xen_machine_ops; @@ -101423,14 +101433,14 @@ index f095659..537313b 100644 return -EFAULT; diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index ce1ce82..8825bcd 100644 +index ce1ce82..218d4fc 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5632,6 +5632,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, goto discard; if (th->syn) { -+ if (th->fin) ++ if (th->fin || th->urg || th->psh) + goto discard; if (icsk->icsk_af_ops->conn_request(sk, skb) < 0) return 1; diff --git a/3.2.18/1016_linux-3.2.17.patch b/3.2.18/1016_linux-3.2.17.patch deleted file mode 100644 index 5aeed10..0000000 --- a/3.2.18/1016_linux-3.2.17.patch +++ /dev/null @@ -1,5695 +0,0 @@ -diff --git a/Makefile b/Makefile -index 3da29cb..4c4efa3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 2 --SUBLEVEL = 16 -+SUBLEVEL = 17 - EXTRAVERSION = - NAME = Saber-toothed Squirrel - -diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig -index ab3740e..ef642a0 100644 ---- a/arch/arm/Kconfig -+++ b/arch/arm/Kconfig -@@ -1155,6 +1155,15 @@ if !MMU - source "arch/arm/Kconfig-nommu" - endif - -+config ARM_ERRATA_326103 -+ bool "ARM errata: FSR write bit incorrect on a SWP to read-only memory" -+ depends on CPU_V6 -+ help -+ Executing a SWP instruction to read-only memory does not set bit 11 -+ of the FSR on the ARM 1136 prior to r1p0. This causes the kernel to -+ treat the access as a read, preventing a COW from occurring and -+ causing the faulting task to livelock. -+ - config ARM_ERRATA_411920 - bool "ARM errata: Invalidation of the Instruction Cache operation can fail" - depends on CPU_V6 || CPU_V6K -diff --git a/arch/arm/include/asm/tls.h b/arch/arm/include/asm/tls.h -index 60843eb..73409e6 100644 ---- a/arch/arm/include/asm/tls.h -+++ b/arch/arm/include/asm/tls.h -@@ -7,6 +7,8 @@ - - .macro set_tls_v6k, tp, tmp1, tmp2 - mcr p15, 0, \tp, c13, c0, 3 @ set TLS register -+ mov \tmp1, #0 -+ mcr p15, 0, \tmp1, c13, c0, 2 @ clear user r/w TLS register - .endm - - .macro set_tls_v6, tp, tmp1, tmp2 -@@ -15,6 +17,8 @@ - mov \tmp2, #0xffff0fff - tst \tmp1, #HWCAP_TLS @ hardware TLS available? - mcrne p15, 0, \tp, c13, c0, 3 @ yes, set TLS register -+ movne \tmp1, #0 -+ mcrne p15, 0, \tmp1, c13, c0, 2 @ clear user r/w TLS register - streq \tp, [\tmp2, #-15] @ set TLS value at 0xffff0ff0 - .endm - -diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c -index 3efd82c..87c8be5 100644 ---- a/arch/arm/kernel/irq.c -+++ b/arch/arm/kernel/irq.c -@@ -156,10 +156,10 @@ static bool migrate_one_irq(struct irq_desc *desc) - } - - c = irq_data_get_irq_chip(d); -- if (c->irq_set_affinity) -- c->irq_set_affinity(d, affinity, true); -- else -+ if (!c->irq_set_affinity) - pr_debug("IRQ%u: unable to set affinity\n", d->irq); -+ else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret) -+ cpumask_copy(d->affinity, affinity); - - return ret; - } -diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c -index ef5640b..e10e59a 100644 ---- a/arch/arm/kernel/smp.c -+++ b/arch/arm/kernel/smp.c -@@ -297,8 +297,6 @@ asmlinkage void __cpuinit secondary_start_kernel(void) - struct mm_struct *mm = &init_mm; - unsigned int cpu = smp_processor_id(); - -- printk("CPU%u: Booted secondary processor\n", cpu); -- - /* - * All kernel threads share the same mm context; grab a - * reference and switch to it. -@@ -310,6 +308,8 @@ asmlinkage void __cpuinit secondary_start_kernel(void) - enter_lazy_tlb(mm, current); - local_flush_tlb_all(); - -+ printk("CPU%u: Booted secondary processor\n", cpu); -+ - cpu_init(); - preempt_disable(); - trace_hardirqs_off(); -diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c -index d2b1779..76cbb05 100644 ---- a/arch/arm/kernel/sys_arm.c -+++ b/arch/arm/kernel/sys_arm.c -@@ -115,7 +115,7 @@ int kernel_execve(const char *filename, - "Ir" (THREAD_START_SP - sizeof(regs)), - "r" (®s), - "Ir" (sizeof(regs)) -- : "r0", "r1", "r2", "r3", "ip", "lr", "memory"); -+ : "r0", "r1", "r2", "r3", "r8", "r9", "ip", "lr", "memory"); - - out: - return ret; -diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c -index 6e90665..fb202af 100644 ---- a/arch/arm/mach-omap1/timer.c -+++ b/arch/arm/mach-omap1/timer.c -@@ -47,9 +47,9 @@ static int omap1_dm_timer_set_src(struct platform_device *pdev, - int n = (pdev->id - 1) << 1; - u32 l; - -- l = __raw_readl(MOD_CONF_CTRL_1) & ~(0x03 << n); -+ l = omap_readl(MOD_CONF_CTRL_1) & ~(0x03 << n); - l |= source << n; -- __raw_writel(l, MOD_CONF_CTRL_1); -+ omap_writel(l, MOD_CONF_CTRL_1); - - return 0; - } -diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S -index ff1f7cc..8074199 100644 ---- a/arch/arm/mm/abort-ev6.S -+++ b/arch/arm/mm/abort-ev6.S -@@ -26,18 +26,23 @@ ENTRY(v6_early_abort) - mrc p15, 0, r1, c5, c0, 0 @ get FSR - mrc p15, 0, r0, c6, c0, 0 @ get FAR - /* -- * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR (erratum 326103). -- * The test below covers all the write situations, including Java bytecodes -+ * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR. - */ -- bic r1, r1, #1 << 11 @ clear bit 11 of FSR -+#ifdef CONFIG_ARM_ERRATA_326103 -+ ldr ip, =0x4107b36 -+ mrc p15, 0, r3, c0, c0, 0 @ get processor id -+ teq ip, r3, lsr #4 @ r0 ARM1136? -+ bne do_DataAbort - tst r5, #PSR_J_BIT @ Java? -+ tsteq r5, #PSR_T_BIT @ Thumb? - bne do_DataAbort -- do_thumb_abort fsr=r1, pc=r4, psr=r5, tmp=r3 -- ldreq r3, [r4] @ read aborted ARM instruction -+ bic r1, r1, #1 << 11 @ clear bit 11 of FSR -+ ldr r3, [r4] @ read aborted ARM instruction - #ifdef CONFIG_CPU_ENDIAN_BE8 -- reveq r3, r3 -+ rev r3, r3 - #endif - do_ldrd_abort tmp=ip, insn=r3 - tst r3, #1 << 20 @ L = 0 -> write - orreq r1, r1, #1 << 11 @ yes. -+#endif - b do_DataAbort -diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c -index b1e192b..db7bcc0 100644 ---- a/arch/arm/mm/cache-l2x0.c -+++ b/arch/arm/mm/cache-l2x0.c -@@ -32,6 +32,7 @@ static void __iomem *l2x0_base; - static DEFINE_RAW_SPINLOCK(l2x0_lock); - static uint32_t l2x0_way_mask; /* Bitmask of active ways */ - static uint32_t l2x0_size; -+static unsigned long sync_reg_offset = L2X0_CACHE_SYNC; - - struct l2x0_regs l2x0_saved_regs; - -@@ -61,12 +62,7 @@ static inline void cache_sync(void) - { - void __iomem *base = l2x0_base; - --#ifdef CONFIG_PL310_ERRATA_753970 -- /* write to an unmmapped register */ -- writel_relaxed(0, base + L2X0_DUMMY_REG); --#else -- writel_relaxed(0, base + L2X0_CACHE_SYNC); --#endif -+ writel_relaxed(0, base + sync_reg_offset); - cache_wait(base + L2X0_CACHE_SYNC, 1); - } - -@@ -85,10 +81,13 @@ static inline void l2x0_inv_line(unsigned long addr) - } - - #if defined(CONFIG_PL310_ERRATA_588369) || defined(CONFIG_PL310_ERRATA_727915) -+static inline void debug_writel(unsigned long val) -+{ -+ if (outer_cache.set_debug) -+ outer_cache.set_debug(val); -+} - --#define debug_writel(val) outer_cache.set_debug(val) -- --static void l2x0_set_debug(unsigned long val) -+static void pl310_set_debug(unsigned long val) - { - writel_relaxed(val, l2x0_base + L2X0_DEBUG_CTRL); - } -@@ -98,7 +97,7 @@ static inline void debug_writel(unsigned long val) - { - } - --#define l2x0_set_debug NULL -+#define pl310_set_debug NULL - #endif - - #ifdef CONFIG_PL310_ERRATA_588369 -@@ -331,6 +330,11 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask) - else - ways = 8; - type = "L310"; -+#ifdef CONFIG_PL310_ERRATA_753970 -+ /* Unmapped register. */ -+ sync_reg_offset = L2X0_DUMMY_REG; -+#endif -+ outer_cache.set_debug = pl310_set_debug; - break; - case L2X0_CACHE_ID_PART_L210: - ways = (aux >> 13) & 0xf; -@@ -379,7 +383,6 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask) - outer_cache.flush_all = l2x0_flush_all; - outer_cache.inv_all = l2x0_inv_all; - outer_cache.disable = l2x0_disable; -- outer_cache.set_debug = l2x0_set_debug; - - printk(KERN_INFO "%s cache controller enabled\n", type); - printk(KERN_INFO "l2x0: %d ways, CACHE_ID 0x%08x, AUX_CTRL 0x%08x, Cache size: %d B\n", -diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c -index 89bbf4e..e77f4e4 100644 ---- a/arch/x86/boot/compressed/relocs.c -+++ b/arch/x86/boot/compressed/relocs.c -@@ -402,13 +402,11 @@ static void print_absolute_symbols(void) - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - char *sym_strtab; -- Elf32_Sym *sh_symtab; - int j; - - if (sec->shdr.sh_type != SHT_SYMTAB) { - continue; - } -- sh_symtab = sec->symtab; - sym_strtab = sec->link->strtab; - for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) { - Elf32_Sym *sym; -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index f98d84c..c4e3581 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -1577,9 +1577,11 @@ static int __init apic_verify(void) - mp_lapic_addr = APIC_DEFAULT_PHYS_BASE; - - /* The BIOS may have set up the APIC at some other address */ -- rdmsr(MSR_IA32_APICBASE, l, h); -- if (l & MSR_IA32_APICBASE_ENABLE) -- mp_lapic_addr = l & MSR_IA32_APICBASE_BASE; -+ if (boot_cpu_data.x86 >= 6) { -+ rdmsr(MSR_IA32_APICBASE, l, h); -+ if (l & MSR_IA32_APICBASE_ENABLE) -+ mp_lapic_addr = l & MSR_IA32_APICBASE_BASE; -+ } - - pr_info("Found and enabled local APIC!\n"); - return 0; -@@ -1597,13 +1599,15 @@ int __init apic_force_enable(unsigned long addr) - * MSR. This can only be done in software for Intel P6 or later - * and AMD K7 (Model > 1) or later. - */ -- rdmsr(MSR_IA32_APICBASE, l, h); -- if (!(l & MSR_IA32_APICBASE_ENABLE)) { -- pr_info("Local APIC disabled by BIOS -- reenabling.\n"); -- l &= ~MSR_IA32_APICBASE_BASE; -- l |= MSR_IA32_APICBASE_ENABLE | addr; -- wrmsr(MSR_IA32_APICBASE, l, h); -- enabled_via_apicbase = 1; -+ if (boot_cpu_data.x86 >= 6) { -+ rdmsr(MSR_IA32_APICBASE, l, h); -+ if (!(l & MSR_IA32_APICBASE_ENABLE)) { -+ pr_info("Local APIC disabled by BIOS -- reenabling.\n"); -+ l &= ~MSR_IA32_APICBASE_BASE; -+ l |= MSR_IA32_APICBASE_ENABLE | addr; -+ wrmsr(MSR_IA32_APICBASE, l, h); -+ enabled_via_apicbase = 1; -+ } - } - return apic_verify(); - } -@@ -2149,10 +2153,12 @@ static void lapic_resume(void) - * FIXME! This will be wrong if we ever support suspend on - * SMP! We'll need to do this as part of the CPU restore! - */ -- rdmsr(MSR_IA32_APICBASE, l, h); -- l &= ~MSR_IA32_APICBASE_BASE; -- l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr; -- wrmsr(MSR_IA32_APICBASE, l, h); -+ if (boot_cpu_data.x86 >= 6) { -+ rdmsr(MSR_IA32_APICBASE, l, h); -+ l &= ~MSR_IA32_APICBASE_BASE; -+ l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr; -+ wrmsr(MSR_IA32_APICBASE, l, h); -+ } - } - - maxlvt = lapic_get_maxlvt(); -diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c -index 9d46f5e..563a09d 100644 ---- a/arch/x86/kernel/microcode_core.c -+++ b/arch/x86/kernel/microcode_core.c -@@ -418,10 +418,8 @@ static int mc_sysdev_add(struct sys_device *sys_dev) - if (err) - return err; - -- if (microcode_init_cpu(cpu) == UCODE_ERROR) { -- sysfs_remove_group(&sys_dev->kobj, &mc_attr_group); -+ if (microcode_init_cpu(cpu) == UCODE_ERROR) - return -EINVAL; -- } - - return err; - } -diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c -index 71f4727..5a98aa2 100644 ---- a/arch/x86/kernel/setup_percpu.c -+++ b/arch/x86/kernel/setup_percpu.c -@@ -185,10 +185,22 @@ void __init setup_per_cpu_areas(void) - #endif - rc = -EINVAL; - if (pcpu_chosen_fc != PCPU_FC_PAGE) { -- const size_t atom_size = cpu_has_pse ? PMD_SIZE : PAGE_SIZE; - const size_t dyn_size = PERCPU_MODULE_RESERVE + - PERCPU_DYNAMIC_RESERVE - PERCPU_FIRST_CHUNK_RESERVE; -+ size_t atom_size; - -+ /* -+ * On 64bit, use PMD_SIZE for atom_size so that embedded -+ * percpu areas are aligned to PMD. This, in the future, -+ * can also allow using PMD mappings in vmalloc area. Use -+ * PAGE_SIZE on 32bit as vmalloc space is highly contended -+ * and large vmalloc area allocs can easily fail. -+ */ -+#ifdef CONFIG_X86_64 -+ atom_size = PMD_SIZE; -+#else -+ atom_size = PAGE_SIZE; -+#endif - rc = pcpu_embed_first_chunk(PERCPU_FIRST_CHUNK_RESERVE, - dyn_size, atom_size, - pcpu_cpu_distance, -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 1f92865..e7c920b 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -62,6 +62,7 @@ - #include <asm/reboot.h> - #include <asm/stackprotector.h> - #include <asm/hypervisor.h> -+#include <asm/pci_x86.h> - - #include "xen-ops.h" - #include "mmu.h" -@@ -1278,8 +1279,10 @@ asmlinkage void __init xen_start_kernel(void) - /* Make sure ACS will be enabled */ - pci_request_acs(); - } -- -- -+#ifdef CONFIG_PCI -+ /* PCI BIOS service won't work from a PV guest. */ -+ pci_probe &= ~PCI_PROBE_BIOS; -+#endif - xen_raw_console_write("about to get started...\n"); - - xen_setup_runstate_info(0); -diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c -index 87f6673..ec3d603 100644 ---- a/arch/x86/xen/mmu.c -+++ b/arch/x86/xen/mmu.c -@@ -353,8 +353,13 @@ static pteval_t pte_mfn_to_pfn(pteval_t val) - { - if (val & _PAGE_PRESENT) { - unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT; -+ unsigned long pfn = mfn_to_pfn(mfn); -+ - pteval_t flags = val & PTE_FLAGS_MASK; -- val = ((pteval_t)mfn_to_pfn(mfn) << PAGE_SHIFT) | flags; -+ if (unlikely(pfn == ~0)) -+ val = flags & ~_PAGE_PRESENT; -+ else -+ val = ((pteval_t)pfn << PAGE_SHIFT) | flags; - } - - return val; -diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c -index 041d4fe..9a23fff 100644 ---- a/arch/x86/xen/smp.c -+++ b/arch/x86/xen/smp.c -@@ -172,6 +172,7 @@ static void __init xen_fill_possible_map(void) - static void __init xen_filter_cpu_maps(void) - { - int i, rc; -+ unsigned int subtract = 0; - - if (!xen_initial_domain()) - return; -@@ -186,8 +187,22 @@ static void __init xen_filter_cpu_maps(void) - } else { - set_cpu_possible(i, false); - set_cpu_present(i, false); -+ subtract++; - } - } -+#ifdef CONFIG_HOTPLUG_CPU -+ /* This is akin to using 'nr_cpus' on the Linux command line. -+ * Which is OK as when we use 'dom0_max_vcpus=X' we can only -+ * have up to X, while nr_cpu_ids is greater than X. This -+ * normally is not a problem, except when CPU hotplugging -+ * is involved and then there might be more than X CPUs -+ * in the guest - which will not work as there is no -+ * hypercall to expand the max number of VCPUs an already -+ * running guest has. So cap it up to X. */ -+ if (subtract) -+ nr_cpu_ids = nr_cpu_ids - subtract; -+#endif -+ - } - - static void __init xen_smp_prepare_boot_cpu(void) -diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S -index 79d7362..3e45aa0 100644 ---- a/arch/x86/xen/xen-asm.S -+++ b/arch/x86/xen/xen-asm.S -@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct) - - /* check for unmasked and pending */ - cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending -- jz 1f -+ jnz 1f - 2: call check_events - 1: - ENDPATCH(xen_restore_fl_direct) -diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c -index 107f6f7..dd30f40 100644 ---- a/crypto/sha512_generic.c -+++ b/crypto/sha512_generic.c -@@ -174,7 +174,7 @@ sha512_update(struct shash_desc *desc, const u8 *data, unsigned int len) - index = sctx->count[0] & 0x7f; - - /* Update number of bytes */ -- if (!(sctx->count[0] += len)) -+ if ((sctx->count[0] += len) < len) - sctx->count[1]++; - - part_len = 128 - index; -diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c -index a9b2820..58db834 100644 ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -3500,7 +3500,8 @@ static int ata_count_probe_trials_cb(struct ata_ering_entry *ent, void *void_arg - u64 now = get_jiffies_64(); - int *trials = void_arg; - -- if (ent->timestamp < now - min(now, interval)) -+ if ((ent->eflags & ATA_EFLAG_OLD_ER) || -+ (ent->timestamp < now - min(now, interval))) - return -1; - - (*trials)++; -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index 003cd8d..99fefbd 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -73,6 +73,7 @@ static struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x0CF3, 0x3004) }, - { USB_DEVICE(0x0CF3, 0x311D) }, - { USB_DEVICE(0x13d3, 0x3375) }, -+ { USB_DEVICE(0x04CA, 0x3005) }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE02C) }, -@@ -91,6 +92,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, - - { } /* Terminating entry */ - }; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index db44ad5..e56da6a 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -129,6 +129,7 @@ static struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, -diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c -index a60adbf..79dcf6e 100644 ---- a/drivers/dma/at_hdmac.c -+++ b/drivers/dma/at_hdmac.c -@@ -239,10 +239,6 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first) - - vdbg_dump_regs(atchan); - -- /* clear any pending interrupt */ -- while (dma_readl(atdma, EBCISR)) -- cpu_relax(); -- - channel_writel(atchan, SADDR, 0); - channel_writel(atchan, DADDR, 0); - channel_writel(atchan, CTRLA, 0); -diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c -index b0a8117..0535c21 100644 ---- a/drivers/firmware/efivars.c -+++ b/drivers/firmware/efivars.c -@@ -191,6 +191,190 @@ utf16_strncmp(const efi_char16_t *a, const efi_char16_t *b, size_t len) - } - } - -+static bool -+validate_device_path(struct efi_variable *var, int match, u8 *buffer, -+ unsigned long len) -+{ -+ struct efi_generic_dev_path *node; -+ int offset = 0; -+ -+ node = (struct efi_generic_dev_path *)buffer; -+ -+ if (len < sizeof(*node)) -+ return false; -+ -+ while (offset <= len - sizeof(*node) && -+ node->length >= sizeof(*node) && -+ node->length <= len - offset) { -+ offset += node->length; -+ -+ if ((node->type == EFI_DEV_END_PATH || -+ node->type == EFI_DEV_END_PATH2) && -+ node->sub_type == EFI_DEV_END_ENTIRE) -+ return true; -+ -+ node = (struct efi_generic_dev_path *)(buffer + offset); -+ } -+ -+ /* -+ * If we're here then either node->length pointed past the end -+ * of the buffer or we reached the end of the buffer without -+ * finding a device path end node. -+ */ -+ return false; -+} -+ -+static bool -+validate_boot_order(struct efi_variable *var, int match, u8 *buffer, -+ unsigned long len) -+{ -+ /* An array of 16-bit integers */ -+ if ((len % 2) != 0) -+ return false; -+ -+ return true; -+} -+ -+static bool -+validate_load_option(struct efi_variable *var, int match, u8 *buffer, -+ unsigned long len) -+{ -+ u16 filepathlength; -+ int i, desclength = 0, namelen; -+ -+ namelen = utf16_strnlen(var->VariableName, sizeof(var->VariableName)); -+ -+ /* Either "Boot" or "Driver" followed by four digits of hex */ -+ for (i = match; i < match+4; i++) { -+ if (var->VariableName[i] > 127 || -+ hex_to_bin(var->VariableName[i] & 0xff) < 0) -+ return true; -+ } -+ -+ /* Reject it if there's 4 digits of hex and then further content */ -+ if (namelen > match + 4) -+ return false; -+ -+ /* A valid entry must be at least 8 bytes */ -+ if (len < 8) -+ return false; -+ -+ filepathlength = buffer[4] | buffer[5] << 8; -+ -+ /* -+ * There's no stored length for the description, so it has to be -+ * found by hand -+ */ -+ desclength = utf16_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2; -+ -+ /* Each boot entry must have a descriptor */ -+ if (!desclength) -+ return false; -+ -+ /* -+ * If the sum of the length of the description, the claimed filepath -+ * length and the original header are greater than the length of the -+ * variable, it's malformed -+ */ -+ if ((desclength + filepathlength + 6) > len) -+ return false; -+ -+ /* -+ * And, finally, check the filepath -+ */ -+ return validate_device_path(var, match, buffer + desclength + 6, -+ filepathlength); -+} -+ -+static bool -+validate_uint16(struct efi_variable *var, int match, u8 *buffer, -+ unsigned long len) -+{ -+ /* A single 16-bit integer */ -+ if (len != 2) -+ return false; -+ -+ return true; -+} -+ -+static bool -+validate_ascii_string(struct efi_variable *var, int match, u8 *buffer, -+ unsigned long len) -+{ -+ int i; -+ -+ for (i = 0; i < len; i++) { -+ if (buffer[i] > 127) -+ return false; -+ -+ if (buffer[i] == 0) -+ return true; -+ } -+ -+ return false; -+} -+ -+struct variable_validate { -+ char *name; -+ bool (*validate)(struct efi_variable *var, int match, u8 *data, -+ unsigned long len); -+}; -+ -+static const struct variable_validate variable_validate[] = { -+ { "BootNext", validate_uint16 }, -+ { "BootOrder", validate_boot_order }, -+ { "DriverOrder", validate_boot_order }, -+ { "Boot*", validate_load_option }, -+ { "Driver*", validate_load_option }, -+ { "ConIn", validate_device_path }, -+ { "ConInDev", validate_device_path }, -+ { "ConOut", validate_device_path }, -+ { "ConOutDev", validate_device_path }, -+ { "ErrOut", validate_device_path }, -+ { "ErrOutDev", validate_device_path }, -+ { "Timeout", validate_uint16 }, -+ { "Lang", validate_ascii_string }, -+ { "PlatformLang", validate_ascii_string }, -+ { "", NULL }, -+}; -+ -+static bool -+validate_var(struct efi_variable *var, u8 *data, unsigned long len) -+{ -+ int i; -+ u16 *unicode_name = var->VariableName; -+ -+ for (i = 0; variable_validate[i].validate != NULL; i++) { -+ const char *name = variable_validate[i].name; -+ int match; -+ -+ for (match = 0; ; match++) { -+ char c = name[match]; -+ u16 u = unicode_name[match]; -+ -+ /* All special variables are plain ascii */ -+ if (u > 127) -+ return true; -+ -+ /* Wildcard in the matching name means we've matched */ -+ if (c == '*') -+ return variable_validate[i].validate(var, -+ match, data, len); -+ -+ /* Case sensitive match */ -+ if (c != u) -+ break; -+ -+ /* Reached the end of the string while matching */ -+ if (!c) -+ return variable_validate[i].validate(var, -+ match, data, len); -+ } -+ } -+ -+ return true; -+} -+ - static efi_status_t - get_var_data_locked(struct efivars *efivars, struct efi_variable *var) - { -@@ -324,6 +508,12 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count) - return -EINVAL; - } - -+ if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 || -+ validate_var(new_var, new_var->Data, new_var->DataSize) == false) { -+ printk(KERN_ERR "efivars: Malformed variable content\n"); -+ return -EINVAL; -+ } -+ - spin_lock(&efivars->lock); - status = efivars->ops->set_variable(new_var->VariableName, - &new_var->VendorGuid, -@@ -624,6 +814,12 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj, - if (!capable(CAP_SYS_ADMIN)) - return -EACCES; - -+ if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 || -+ validate_var(new_var, new_var->Data, new_var->DataSize) == false) { -+ printk(KERN_ERR "efivars: Malformed variable content\n"); -+ return -EINVAL; -+ } -+ - spin_lock(&efivars->lock); - - /* -diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -index b9da890..a6c2f7a 100644 ---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c -+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -@@ -984,6 +984,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - struct intel_ring_buffer *ring; - u32 exec_start, exec_len; - u32 seqno; -+ u32 mask; - int ret, mode, i; - - if (!i915_gem_check_execbuffer(args)) { -@@ -1021,6 +1022,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - } - - mode = args->flags & I915_EXEC_CONSTANTS_MASK; -+ mask = I915_EXEC_CONSTANTS_MASK; - switch (mode) { - case I915_EXEC_CONSTANTS_REL_GENERAL: - case I915_EXEC_CONSTANTS_ABSOLUTE: -@@ -1034,18 +1036,9 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - mode == I915_EXEC_CONSTANTS_REL_SURFACE) - return -EINVAL; - -- ret = intel_ring_begin(ring, 4); -- if (ret) -- return ret; -- -- intel_ring_emit(ring, MI_NOOP); -- intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1)); -- intel_ring_emit(ring, INSTPM); -- intel_ring_emit(ring, -- I915_EXEC_CONSTANTS_MASK << 16 | mode); -- intel_ring_advance(ring); -- -- dev_priv->relative_constants_mode = mode; -+ /* The HW changed the meaning on this bit on gen6 */ -+ if (INTEL_INFO(dev)->gen >= 6) -+ mask &= ~I915_EXEC_CONSTANTS_REL_SURFACE; - } - break; - default: -@@ -1064,6 +1057,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - return -EINVAL; - } - -+ if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) { -+ DRM_DEBUG("execbuf with %u cliprects\n", -+ args->num_cliprects); -+ return -EINVAL; -+ } - cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects), - GFP_KERNEL); - if (cliprects == NULL) { -@@ -1176,6 +1174,21 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - } - } - -+ if (ring == &dev_priv->ring[RCS] && -+ mode != dev_priv->relative_constants_mode) { -+ ret = intel_ring_begin(ring, 4); -+ if (ret) -+ goto err; -+ -+ intel_ring_emit(ring, MI_NOOP); -+ intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1)); -+ intel_ring_emit(ring, INSTPM); -+ intel_ring_emit(ring, mask << 16 | mode); -+ intel_ring_advance(ring); -+ -+ dev_priv->relative_constants_mode = mode; -+ } -+ - trace_i915_gem_ring_dispatch(ring, seqno); - - exec_start = batch_obj->gtt_offset + args->batch_start_offset; -@@ -1314,7 +1327,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data, - struct drm_i915_gem_exec_object2 *exec2_list = NULL; - int ret; - -- if (args->buffer_count < 1) { -+ if (args->buffer_count < 1 || -+ args->buffer_count > UINT_MAX / sizeof(*exec2_list)) { - DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count); - return -EINVAL; - } -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index 2f99fd4..cbe5a88 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -442,6 +442,7 @@ - #define INSTPM_AGPBUSY_DIS (1<<11) /* gen3: when disabled, pending interrupts - will not assert AGPBUSY# and will only - be delivered when out of C3. */ -+#define INSTPM_FORCE_ORDERING (1<<7) /* GEN6+ */ - #define ACTHD 0x020c8 - #define FW_BLC 0x020d8 - #define FW_BLC2 0x020dc -@@ -522,6 +523,7 @@ - #define CM0_MASK_SHIFT 16 - #define CM0_IZ_OPT_DISABLE (1<<6) - #define CM0_ZR_OPT_DISABLE (1<<5) -+#define CM0_STC_EVICT_DISABLE_LRA_SNB (1<<5) - #define CM0_DEPTH_EVICT_DISABLE (1<<4) - #define CM0_COLOR_EVICT_DISABLE (1<<3) - #define CM0_DEPTH_WRITE_DISABLE (1<<1) -diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c -index 64541f7..9cd81ba 100644 ---- a/drivers/gpu/drm/i915/intel_hdmi.c -+++ b/drivers/gpu/drm/i915/intel_hdmi.c -@@ -136,7 +136,7 @@ static void i9xx_write_infoframe(struct drm_encoder *encoder, - - val &= ~VIDEO_DIP_SELECT_MASK; - -- I915_WRITE(VIDEO_DIP_CTL, val | port | flags); -+ I915_WRITE(VIDEO_DIP_CTL, VIDEO_DIP_ENABLE | val | port | flags); - - for (i = 0; i < len; i += 4) { - I915_WRITE(VIDEO_DIP_DATA, *data); -diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c -index 8673581..62f9ac5 100644 ---- a/drivers/gpu/drm/i915/intel_ringbuffer.c -+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c -@@ -414,6 +414,22 @@ static int init_render_ring(struct intel_ring_buffer *ring) - return ret; - } - -+ -+ if (IS_GEN6(dev)) { -+ /* From the Sandybridge PRM, volume 1 part 3, page 24: -+ * "If this bit is set, STCunit will have LRA as replacement -+ * policy. [...] This bit must be reset. LRA replacement -+ * policy is not supported." -+ */ -+ I915_WRITE(CACHE_MODE_0, -+ CM0_STC_EVICT_DISABLE_LRA_SNB << CM0_MASK_SHIFT); -+ } -+ -+ if (INTEL_INFO(dev)->gen >= 6) { -+ I915_WRITE(INSTPM, -+ INSTPM_FORCE_ORDERING << 16 | INSTPM_FORCE_ORDERING); -+ } -+ - return ret; - } - -diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c -index e334ec3..8eddcca 100644 ---- a/drivers/gpu/drm/i915/intel_sdvo.c -+++ b/drivers/gpu/drm/i915/intel_sdvo.c -@@ -731,6 +731,7 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd, - uint16_t width, height; - uint16_t h_blank_len, h_sync_len, v_blank_len, v_sync_len; - uint16_t h_sync_offset, v_sync_offset; -+ int mode_clock; - - width = mode->crtc_hdisplay; - height = mode->crtc_vdisplay; -@@ -745,7 +746,11 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd, - h_sync_offset = mode->crtc_hsync_start - mode->crtc_hblank_start; - v_sync_offset = mode->crtc_vsync_start - mode->crtc_vblank_start; - -- dtd->part1.clock = mode->clock / 10; -+ mode_clock = mode->clock; -+ mode_clock /= intel_mode_get_pixel_multiplier(mode) ?: 1; -+ mode_clock /= 10; -+ dtd->part1.clock = mode_clock; -+ - dtd->part1.h_active = width & 0xff; - dtd->part1.h_blank = h_blank_len & 0xff; - dtd->part1.h_high = (((width >> 8) & 0xf) << 4) | -@@ -997,7 +1002,7 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder, - struct intel_sdvo *intel_sdvo = to_intel_sdvo(encoder); - u32 sdvox; - struct intel_sdvo_in_out_map in_out; -- struct intel_sdvo_dtd input_dtd; -+ struct intel_sdvo_dtd input_dtd, output_dtd; - int pixel_multiplier = intel_mode_get_pixel_multiplier(adjusted_mode); - int rate; - -@@ -1022,20 +1027,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder, - intel_sdvo->attached_output)) - return; - -- /* We have tried to get input timing in mode_fixup, and filled into -- * adjusted_mode. -- */ -- if (intel_sdvo->is_tv || intel_sdvo->is_lvds) { -- input_dtd = intel_sdvo->input_dtd; -- } else { -- /* Set the output timing to the screen */ -- if (!intel_sdvo_set_target_output(intel_sdvo, -- intel_sdvo->attached_output)) -- return; -- -- intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode); -- (void) intel_sdvo_set_output_timing(intel_sdvo, &input_dtd); -- } -+ /* lvds has a special fixed output timing. */ -+ if (intel_sdvo->is_lvds) -+ intel_sdvo_get_dtd_from_mode(&output_dtd, -+ intel_sdvo->sdvo_lvds_fixed_mode); -+ else -+ intel_sdvo_get_dtd_from_mode(&output_dtd, mode); -+ (void) intel_sdvo_set_output_timing(intel_sdvo, &output_dtd); - - /* Set the input timing to the screen. Assume always input 0. */ - if (!intel_sdvo_set_target_input(intel_sdvo)) -@@ -1053,6 +1051,10 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder, - !intel_sdvo_set_tv_format(intel_sdvo)) - return; - -+ /* We have tried to get input timing in mode_fixup, and filled into -+ * adjusted_mode. -+ */ -+ intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode); - (void) intel_sdvo_set_input_timing(intel_sdvo, &input_dtd); - - switch (pixel_multiplier) { -@@ -1219,8 +1221,14 @@ static bool intel_sdvo_get_capabilities(struct intel_sdvo *intel_sdvo, struct in - - static int intel_sdvo_supports_hotplug(struct intel_sdvo *intel_sdvo) - { -+ struct drm_device *dev = intel_sdvo->base.base.dev; - u8 response[2]; - -+ /* HW Erratum: SDVO Hotplug is broken on all i945G chips, there's noise -+ * on the line. */ -+ if (IS_I945G(dev) || IS_I945GM(dev)) -+ return false; -+ - return intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT, - &response, 2) && response[0]; - } -diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c -index 525744d..3df56c7 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_acpi.c -+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c -@@ -245,7 +245,7 @@ static bool nouveau_dsm_detect(void) - struct acpi_buffer buffer = {sizeof(acpi_method_name), acpi_method_name}; - struct pci_dev *pdev = NULL; - int has_dsm = 0; -- int has_optimus; -+ int has_optimus = 0; - int vga_count = 0; - bool guid_valid; - int retval; -diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c -index b30081f..757c549 100644 ---- a/drivers/gpu/drm/radeon/atombios_crtc.c -+++ b/drivers/gpu/drm/radeon/atombios_crtc.c -@@ -917,8 +917,8 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode - break; - } - -- if (radeon_encoder->active_device & -- (ATOM_DEVICE_LCD_SUPPORT | ATOM_DEVICE_DFP_SUPPORT)) { -+ if ((radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT | ATOM_DEVICE_DFP_SUPPORT)) || -+ (radeon_encoder_get_dp_bridge_encoder_id(encoder) != ENCODER_OBJECT_ID_NONE)) { - struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv; - struct drm_connector *connector = - radeon_get_connector_for_encoder(encoder); -diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c -index 104b376..427468f 100644 ---- a/drivers/hwmon/coretemp.c -+++ b/drivers/hwmon/coretemp.c -@@ -51,7 +51,7 @@ module_param_named(tjmax, force_tjmax, int, 0444); - MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius"); - - #define BASE_SYSFS_ATTR_NO 2 /* Sysfs Base attr no for coretemp */ --#define NUM_REAL_CORES 16 /* Number of Real cores per cpu */ -+#define NUM_REAL_CORES 32 /* Number of Real cores per cpu */ - #define CORETEMP_NAME_LENGTH 17 /* String Length of attrs */ - #define MAX_CORE_ATTRS 4 /* Maximum no of basic attrs */ - #define TOTAL_ATTRS (MAX_CORE_ATTRS + 1) -@@ -705,6 +705,10 @@ static void __cpuinit put_core_offline(unsigned int cpu) - - indx = TO_ATTR_NO(cpu); - -+ /* The core id is too big, just return */ -+ if (indx > MAX_CORE_DATA - 1) -+ return; -+ - if (pdata->core_data[indx] && pdata->core_data[indx]->cpu == cpu) - coretemp_remove_core(pdata, &pdev->dev, indx); - -diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c -index 930370d..9a4c3ab 100644 ---- a/drivers/hwmon/fam15h_power.c -+++ b/drivers/hwmon/fam15h_power.c -@@ -122,6 +122,41 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4) - return true; - } - -+/* -+ * Newer BKDG versions have an updated recommendation on how to properly -+ * initialize the running average range (was: 0xE, now: 0x9). This avoids -+ * counter saturations resulting in bogus power readings. -+ * We correct this value ourselves to cope with older BIOSes. -+ */ -+static DEFINE_PCI_DEVICE_TABLE(affected_device) = { -+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) }, -+ { 0 } -+}; -+ -+static void __devinit tweak_runavg_range(struct pci_dev *pdev) -+{ -+ u32 val; -+ -+ /* -+ * let this quirk apply only to the current version of the -+ * northbridge, since future versions may change the behavior -+ */ -+ if (!pci_match_id(affected_device, pdev)) -+ return; -+ -+ pci_bus_read_config_dword(pdev->bus, -+ PCI_DEVFN(PCI_SLOT(pdev->devfn), 5), -+ REG_TDP_RUNNING_AVERAGE, &val); -+ if ((val & 0xf) != 0xe) -+ return; -+ -+ val &= ~0xf; -+ val |= 0x9; -+ pci_bus_write_config_dword(pdev->bus, -+ PCI_DEVFN(PCI_SLOT(pdev->devfn), 5), -+ REG_TDP_RUNNING_AVERAGE, val); -+} -+ - static void __devinit fam15h_power_init_data(struct pci_dev *f4, - struct fam15h_power_data *data) - { -@@ -155,6 +190,13 @@ static int __devinit fam15h_power_probe(struct pci_dev *pdev, - struct device *dev; - int err; - -+ /* -+ * though we ignore every other northbridge, we still have to -+ * do the tweaking on _each_ node in MCM processors as the counters -+ * are working hand-in-hand -+ */ -+ tweak_runavg_range(pdev); -+ - if (!fam15h_power_is_internal_node0(pdev)) { - err = -ENODEV; - goto exit; -diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c -index 04be9f8..eb8ad53 100644 ---- a/drivers/i2c/busses/i2c-pnx.c -+++ b/drivers/i2c/busses/i2c-pnx.c -@@ -546,8 +546,7 @@ static int i2c_pnx_controller_suspend(struct platform_device *pdev, - { - struct i2c_pnx_algo_data *alg_data = platform_get_drvdata(pdev); - -- /* FIXME: shouldn't this be clk_disable? */ -- clk_enable(alg_data->clk); -+ clk_disable(alg_data->clk); - - return 0; - } -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 6f37aa4..065ab4f 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -8100,7 +8100,8 @@ static int md_notify_reboot(struct notifier_block *this, - - for_each_mddev(mddev, tmp) { - if (mddev_trylock(mddev)) { -- __md_stop_writes(mddev); -+ if (mddev->pers) -+ __md_stop_writes(mddev); - mddev->safemode = 2; - mddev_unlock(mddev); - } -diff --git a/drivers/media/dvb/frontends/drxk_hard.c b/drivers/media/dvb/frontends/drxk_hard.c -index f6431ef..a1f5e3d 100644 ---- a/drivers/media/dvb/frontends/drxk_hard.c -+++ b/drivers/media/dvb/frontends/drxk_hard.c -@@ -1523,8 +1523,10 @@ static int scu_command(struct drxk_state *state, - dprintk(1, "\n"); - - if ((cmd == 0) || ((parameterLen > 0) && (parameter == NULL)) || -- ((resultLen > 0) && (result == NULL))) -- goto error; -+ ((resultLen > 0) && (result == NULL))) { -+ printk(KERN_ERR "drxk: Error %d on %s\n", status, __func__); -+ return status; -+ } - - mutex_lock(&state->mutex); - -diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c -index 13f54b5..a7e7d6f 100644 ---- a/drivers/media/rc/winbond-cir.c -+++ b/drivers/media/rc/winbond-cir.c -@@ -1046,6 +1046,7 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id) - goto exit_unregister_led; - } - -+ data->dev->driver_type = RC_DRIVER_IR_RAW; - data->dev->driver_name = WBCIR_NAME; - data->dev->input_name = WBCIR_NAME; - data->dev->input_phys = "wbcir/cir0"; -diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index e15e47d..34416d4 100644 ---- a/drivers/mmc/card/block.c -+++ b/drivers/mmc/card/block.c -@@ -799,7 +799,7 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq, - { - struct mmc_blk_data *md = mq->data; - struct mmc_card *card = md->queue.card; -- unsigned int from, nr, arg; -+ unsigned int from, nr, arg, trim_arg, erase_arg; - int err = 0, type = MMC_BLK_SECDISCARD; - - if (!(mmc_can_secure_erase_trim(card) || mmc_can_sanitize(card))) { -@@ -807,20 +807,26 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq, - goto out; - } - -+ from = blk_rq_pos(req); -+ nr = blk_rq_sectors(req); -+ - /* The sanitize operation is supported at v4.5 only */ - if (mmc_can_sanitize(card)) { -- err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, -- EXT_CSD_SANITIZE_START, 1, 0); -- goto out; -+ erase_arg = MMC_ERASE_ARG; -+ trim_arg = MMC_TRIM_ARG; -+ } else { -+ erase_arg = MMC_SECURE_ERASE_ARG; -+ trim_arg = MMC_SECURE_TRIM1_ARG; - } - -- from = blk_rq_pos(req); -- nr = blk_rq_sectors(req); -- -- if (mmc_can_trim(card) && !mmc_erase_group_aligned(card, from, nr)) -- arg = MMC_SECURE_TRIM1_ARG; -- else -- arg = MMC_SECURE_ERASE_ARG; -+ if (mmc_erase_group_aligned(card, from, nr)) -+ arg = erase_arg; -+ else if (mmc_can_trim(card)) -+ arg = trim_arg; -+ else { -+ err = -EINVAL; -+ goto out; -+ } - retry: - if (card->quirks & MMC_QUIRK_INAND_CMD38) { - err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, -@@ -830,25 +836,41 @@ retry: - INAND_CMD38_ARG_SECERASE, - 0); - if (err) -- goto out; -+ goto out_retry; - } -+ - err = mmc_erase(card, from, nr, arg); -- if (!err && arg == MMC_SECURE_TRIM1_ARG) { -+ if (err == -EIO) -+ goto out_retry; -+ if (err) -+ goto out; -+ -+ if (arg == MMC_SECURE_TRIM1_ARG) { - if (card->quirks & MMC_QUIRK_INAND_CMD38) { - err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, - INAND_CMD38_ARG_EXT_CSD, - INAND_CMD38_ARG_SECTRIM2, - 0); - if (err) -- goto out; -+ goto out_retry; - } -+ - err = mmc_erase(card, from, nr, MMC_SECURE_TRIM2_ARG); -+ if (err == -EIO) -+ goto out_retry; -+ if (err) -+ goto out; - } --out: -- if (err == -EIO && !mmc_blk_reset(md, card->host, type)) -+ -+ if (mmc_can_sanitize(card)) -+ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, -+ EXT_CSD_SANITIZE_START, 1, 0); -+out_retry: -+ if (err && !mmc_blk_reset(md, card->host, type)) - goto retry; - if (!err) - mmc_blk_reset_success(md, type); -+out: - spin_lock_irq(&md->lock); - __blk_end_request(req, err, blk_rq_bytes(req)); - spin_unlock_irq(&md->lock); -diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c -index dcad59c..78690f2 100644 ---- a/drivers/mmc/card/queue.c -+++ b/drivers/mmc/card/queue.c -@@ -134,7 +134,7 @@ static void mmc_queue_setup_discard(struct request_queue *q, - - queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q); - q->limits.max_discard_sectors = max_discard; -- if (card->erased_byte == 0) -+ if (card->erased_byte == 0 && !mmc_can_discard(card)) - q->limits.discard_zeroes_data = 1; - q->limits.discard_granularity = card->pref_erase << 9; - /* granularity must not be greater than max. discard */ -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index 950b97d..411a994 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -1516,7 +1516,10 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card, - { - unsigned int erase_timeout; - -- if (card->ext_csd.erase_group_def & 1) { -+ if (arg == MMC_DISCARD_ARG || -+ (arg == MMC_TRIM_ARG && card->ext_csd.rev >= 6)) { -+ erase_timeout = card->ext_csd.trim_timeout; -+ } else if (card->ext_csd.erase_group_def & 1) { - /* High Capacity Erase Group Size uses HC timeouts */ - if (arg == MMC_TRIM_ARG) - erase_timeout = card->ext_csd.trim_timeout; -@@ -1788,8 +1791,6 @@ int mmc_can_trim(struct mmc_card *card) - { - if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_GB_CL_EN) - return 1; -- if (mmc_can_discard(card)) -- return 1; - return 0; - } - EXPORT_SYMBOL(mmc_can_trim); -@@ -1808,6 +1809,8 @@ EXPORT_SYMBOL(mmc_can_discard); - - int mmc_can_sanitize(struct mmc_card *card) - { -+ if (!mmc_can_trim(card) && !mmc_can_erase(card)) -+ return 0; - if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_SANITIZE) - return 1; - return 0; -diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c -index 4540e37..1b47937 100644 ---- a/drivers/mmc/host/sdhci-esdhc-imx.c -+++ b/drivers/mmc/host/sdhci-esdhc-imx.c -@@ -467,8 +467,7 @@ static int __devinit sdhci_esdhc_imx_probe(struct platform_device *pdev) - clk_enable(clk); - pltfm_host->clk = clk; - -- if (!is_imx25_esdhc(imx_data)) -- host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; -+ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; - - if (is_imx25_esdhc(imx_data) || is_imx35_esdhc(imx_data)) - /* Fix errata ENGcm07207 present on i.MX25 and i.MX35 */ -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index e58aa2b..f65e0b9 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2982,7 +2982,11 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks) - trans_start + delta_in_ticks)) || - bond->curr_active_slave != slave) { - slave->link = BOND_LINK_UP; -- bond->current_arp_slave = NULL; -+ if (bond->current_arp_slave) { -+ bond_set_slave_inactive_flags( -+ bond->current_arp_slave); -+ bond->current_arp_slave = NULL; -+ } - - pr_info("%s: link status definitely up for interface %s.\n", - bond->dev->name, slave->dev->name); -diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c -index a7c5e88..eeac9ca 100644 ---- a/drivers/net/dummy.c -+++ b/drivers/net/dummy.c -@@ -106,14 +106,14 @@ static int dummy_dev_init(struct net_device *dev) - return 0; - } - --static void dummy_dev_free(struct net_device *dev) -+static void dummy_dev_uninit(struct net_device *dev) - { - free_percpu(dev->dstats); -- free_netdev(dev); - } - - static const struct net_device_ops dummy_netdev_ops = { - .ndo_init = dummy_dev_init, -+ .ndo_uninit = dummy_dev_uninit, - .ndo_start_xmit = dummy_xmit, - .ndo_validate_addr = eth_validate_addr, - .ndo_set_rx_mode = set_multicast_list, -@@ -127,7 +127,7 @@ static void dummy_setup(struct net_device *dev) - - /* Initialize the device structure. */ - dev->netdev_ops = &dummy_netdev_ops; -- dev->destructor = dummy_dev_free; -+ dev->destructor = free_netdev; - - /* Fill in device structure with ethernet-generic values. */ - dev->tx_queue_len = 0; -diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c -index 33a4e35..ee532e1 100644 ---- a/drivers/net/ethernet/atheros/atlx/atl1.c -+++ b/drivers/net/ethernet/atheros/atlx/atl1.c -@@ -2473,7 +2473,7 @@ static irqreturn_t atl1_intr(int irq, void *data) - "pcie phy link down %x\n", status); - if (netif_running(adapter->netdev)) { /* reset MAC */ - iowrite32(0, adapter->hw.hw_addr + REG_IMR); -- schedule_work(&adapter->pcie_dma_to_rst_task); -+ schedule_work(&adapter->reset_dev_task); - return IRQ_HANDLED; - } - } -@@ -2485,7 +2485,7 @@ static irqreturn_t atl1_intr(int irq, void *data) - "pcie DMA r/w error (status = 0x%x)\n", - status); - iowrite32(0, adapter->hw.hw_addr + REG_IMR); -- schedule_work(&adapter->pcie_dma_to_rst_task); -+ schedule_work(&adapter->reset_dev_task); - return IRQ_HANDLED; - } - -@@ -2630,10 +2630,10 @@ static void atl1_down(struct atl1_adapter *adapter) - atl1_clean_rx_ring(adapter); - } - --static void atl1_tx_timeout_task(struct work_struct *work) -+static void atl1_reset_dev_task(struct work_struct *work) - { - struct atl1_adapter *adapter = -- container_of(work, struct atl1_adapter, tx_timeout_task); -+ container_of(work, struct atl1_adapter, reset_dev_task); - struct net_device *netdev = adapter->netdev; - - netif_device_detach(netdev); -@@ -3032,12 +3032,10 @@ static int __devinit atl1_probe(struct pci_dev *pdev, - (unsigned long)adapter); - adapter->phy_timer_pending = false; - -- INIT_WORK(&adapter->tx_timeout_task, atl1_tx_timeout_task); -+ INIT_WORK(&adapter->reset_dev_task, atl1_reset_dev_task); - - INIT_WORK(&adapter->link_chg_task, atlx_link_chg_task); - -- INIT_WORK(&adapter->pcie_dma_to_rst_task, atl1_tx_timeout_task); -- - err = register_netdev(netdev); - if (err) - goto err_common; -diff --git a/drivers/net/ethernet/atheros/atlx/atl1.h b/drivers/net/ethernet/atheros/atlx/atl1.h -index 109d6da..e04bf4d 100644 ---- a/drivers/net/ethernet/atheros/atlx/atl1.h -+++ b/drivers/net/ethernet/atheros/atlx/atl1.h -@@ -758,9 +758,8 @@ struct atl1_adapter { - u16 link_speed; - u16 link_duplex; - spinlock_t lock; -- struct work_struct tx_timeout_task; -+ struct work_struct reset_dev_task; - struct work_struct link_chg_task; -- struct work_struct pcie_dma_to_rst_task; - - struct timer_list phy_config_timer; - bool phy_timer_pending; -diff --git a/drivers/net/ethernet/atheros/atlx/atlx.c b/drivers/net/ethernet/atheros/atlx/atlx.c -index aabcf4b..41c6d83 100644 ---- a/drivers/net/ethernet/atheros/atlx/atlx.c -+++ b/drivers/net/ethernet/atheros/atlx/atlx.c -@@ -193,7 +193,7 @@ static void atlx_tx_timeout(struct net_device *netdev) - { - struct atlx_adapter *adapter = netdev_priv(netdev); - /* Do the reset outside of interrupt context */ -- schedule_work(&adapter->tx_timeout_task); -+ schedule_work(&adapter->reset_dev_task); - } - - /* -diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c -index d19c849..77241b6 100644 ---- a/drivers/net/ethernet/micrel/ks8851_mll.c -+++ b/drivers/net/ethernet/micrel/ks8851_mll.c -@@ -40,7 +40,7 @@ - #define DRV_NAME "ks8851_mll" - - static u8 KS_DEFAULT_MAC_ADDRESS[] = { 0x00, 0x10, 0xA1, 0x86, 0x95, 0x11 }; --#define MAX_RECV_FRAMES 32 -+#define MAX_RECV_FRAMES 255 - #define MAX_BUF_SIZE 2048 - #define TX_BUF_SIZE 2000 - #define RX_BUF_SIZE 2000 -diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c -index 7ece990..4b9f4bd 100644 ---- a/drivers/net/ethernet/micrel/ksz884x.c -+++ b/drivers/net/ethernet/micrel/ksz884x.c -@@ -5679,7 +5679,7 @@ static int netdev_set_mac_address(struct net_device *dev, void *addr) - memcpy(hw->override_addr, mac->sa_data, MAC_ADDR_LEN); - } - -- memcpy(dev->dev_addr, mac->sa_data, MAX_ADDR_LEN); -+ memcpy(dev->dev_addr, mac->sa_data, ETH_ALEN); - - interrupt = hw_block_intr(hw); - -diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c -index aba4f67..8f47907 100644 ---- a/drivers/net/ethernet/realtek/8139cp.c -+++ b/drivers/net/ethernet/realtek/8139cp.c -@@ -961,6 +961,11 @@ static inline void cp_start_hw (struct cp_private *cp) - cpw8(Cmd, RxOn | TxOn); - } - -+static void cp_enable_irq(struct cp_private *cp) -+{ -+ cpw16_f(IntrMask, cp_intr_mask); -+} -+ - static void cp_init_hw (struct cp_private *cp) - { - struct net_device *dev = cp->dev; -@@ -1000,8 +1005,6 @@ static void cp_init_hw (struct cp_private *cp) - - cpw16(MultiIntr, 0); - -- cpw16_f(IntrMask, cp_intr_mask); -- - cpw8_f(Cfg9346, Cfg9346_Lock); - } - -@@ -1133,6 +1136,8 @@ static int cp_open (struct net_device *dev) - if (rc) - goto err_out_hw; - -+ cp_enable_irq(cp); -+ - netif_carrier_off(dev); - mii_check_media(&cp->mii_if, netif_msg_link(cp), true); - netif_start_queue(dev); -@@ -2034,6 +2039,7 @@ static int cp_resume (struct pci_dev *pdev) - /* FIXME: sh*t may happen if the Rx ring buffer is depleted */ - cp_init_rings_index (cp); - cp_init_hw (cp); -+ cp_enable_irq(cp); - netif_start_queue (dev); - - spin_lock_irqsave (&cp->lock, flags); -diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c -index 8843071..8c7dd21 100644 ---- a/drivers/net/ethernet/smsc/smsc911x.c -+++ b/drivers/net/ethernet/smsc/smsc911x.c -@@ -1089,10 +1089,8 @@ smsc911x_rx_counterrors(struct net_device *dev, unsigned int rxstat) - - /* Quickly dumps bad packets */ - static void --smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes) -+smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktwords) - { -- unsigned int pktwords = (pktbytes + NET_IP_ALIGN + 3) >> 2; -- - if (likely(pktwords >= 4)) { - unsigned int timeout = 500; - unsigned int val; -@@ -1156,7 +1154,7 @@ static int smsc911x_poll(struct napi_struct *napi, int budget) - continue; - } - -- skb = netdev_alloc_skb(dev, pktlength + NET_IP_ALIGN); -+ skb = netdev_alloc_skb(dev, pktwords << 2); - if (unlikely(!skb)) { - SMSC_WARN(pdata, rx_err, - "Unable to allocate skb for rx packet"); -@@ -1166,14 +1164,12 @@ static int smsc911x_poll(struct napi_struct *napi, int budget) - break; - } - -- skb->data = skb->head; -- skb_reset_tail_pointer(skb); -+ pdata->ops->rx_readfifo(pdata, -+ (unsigned int *)skb->data, pktwords); - - /* Align IP on 16B boundary */ - skb_reserve(skb, NET_IP_ALIGN); - skb_put(skb, pktlength - 4); -- pdata->ops->rx_readfifo(pdata, -- (unsigned int *)skb->head, pktwords); - skb->protocol = eth_type_trans(skb, dev); - skb_checksum_none_assert(skb); - netif_receive_skb(skb); -@@ -1396,7 +1392,7 @@ static int smsc911x_open(struct net_device *dev) - smsc911x_reg_write(pdata, FIFO_INT, temp); - - /* set RX Data offset to 2 bytes for alignment */ -- smsc911x_reg_write(pdata, RX_CFG, (2 << 8)); -+ smsc911x_reg_write(pdata, RX_CFG, (NET_IP_ALIGN << 8)); - - /* enable NAPI polling before enabling RX interrupts */ - napi_enable(&pdata->napi); -diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c -index 7615040..f470ab6 100644 ---- a/drivers/net/ethernet/ti/davinci_mdio.c -+++ b/drivers/net/ethernet/ti/davinci_mdio.c -@@ -181,6 +181,11 @@ static inline int wait_for_user_access(struct davinci_mdio_data *data) - __davinci_mdio_reset(data); - return -EAGAIN; - } -+ -+ reg = __raw_readl(®s->user[0].access); -+ if ((reg & USERACCESS_GO) == 0) -+ return 0; -+ - dev_err(data->dev, "timed out waiting for user access\n"); - return -ETIMEDOUT; - } -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index 486b404..3ed983c 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -968,7 +968,6 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev) - proto = npindex_to_proto[npi]; - put_unaligned_be16(proto, pp); - -- netif_stop_queue(dev); - skb_queue_tail(&ppp->file.xq, skb); - ppp_xmit_process(ppp); - return NETDEV_TX_OK; -@@ -1063,6 +1062,8 @@ ppp_xmit_process(struct ppp *ppp) - code that we can accept some more. */ - if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq)) - netif_wake_queue(ppp->dev); -+ else -+ netif_stop_queue(ppp->dev); - } - ppp_xmit_unlock(ppp); - } -diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c -index a5b9b12..7bd219b 100644 ---- a/drivers/net/usb/smsc75xx.c -+++ b/drivers/net/usb/smsc75xx.c -@@ -1050,6 +1050,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) - dev->net->ethtool_ops = &smsc75xx_ethtool_ops; - dev->net->flags |= IFF_MULTICAST; - dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD; -+ dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; - return 0; - } - -diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c -index eff6767..55b3218 100644 ---- a/drivers/net/usb/smsc95xx.c -+++ b/drivers/net/usb/smsc95xx.c -@@ -1190,7 +1190,7 @@ static const struct driver_info smsc95xx_info = { - .rx_fixup = smsc95xx_rx_fixup, - .tx_fixup = smsc95xx_tx_fixup, - .status = smsc95xx_status, -- .flags = FLAG_ETHER | FLAG_SEND_ZLP, -+ .flags = FLAG_ETHER | FLAG_SEND_ZLP | FLAG_LINK_INTR, - }; - - static const struct usb_device_id products[] = { -diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c -index 64a1106..4697cf3 100644 ---- a/drivers/net/wimax/i2400m/netdev.c -+++ b/drivers/net/wimax/i2400m/netdev.c -@@ -607,7 +607,8 @@ static void i2400m_get_drvinfo(struct net_device *net_dev, - struct i2400m *i2400m = net_dev_to_i2400m(net_dev); - - strncpy(info->driver, KBUILD_MODNAME, sizeof(info->driver) - 1); -- strncpy(info->fw_version, i2400m->fw_name, sizeof(info->fw_version) - 1); -+ strncpy(info->fw_version, -+ i2400m->fw_name ? : "", sizeof(info->fw_version) - 1); - if (net_dev->dev.parent) - strncpy(info->bus_info, dev_name(net_dev->dev.parent), - sizeof(info->bus_info) - 1); -diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c -index 5634d9a..680709c 100644 ---- a/drivers/net/wireless/b43/main.c -+++ b/drivers/net/wireless/b43/main.c -@@ -4820,8 +4820,14 @@ static int b43_op_start(struct ieee80211_hw *hw) - out_mutex_unlock: - mutex_unlock(&wl->mutex); - -- /* reload configuration */ -- b43_op_config(hw, ~0); -+ /* -+ * Configuration may have been overwritten during initialization. -+ * Reload the configuration, but only if initialization was -+ * successful. Reloading the configuration after a failed init -+ * may hang the system. -+ */ -+ if (!err) -+ b43_op_config(hw, ~0); - - return err; - } -diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c -index 453f58e..f98becc 100644 ---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c -+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c -@@ -7865,6 +7865,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh, - { - int len_mpdu; - struct ieee80211_rx_status rx_status; -+ struct ieee80211_hdr *hdr; - - memset(&rx_status, 0, sizeof(rx_status)); - prep_mac80211_status(wlc, rxh, p, &rx_status); -@@ -7874,6 +7875,13 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh, - skb_pull(p, D11_PHY_HDR_LEN); - __skb_trim(p, len_mpdu); - -+ /* unmute transmit */ -+ if (wlc->hw->suspended_fifos) { -+ hdr = (struct ieee80211_hdr *)p->data; -+ if (ieee80211_is_beacon(hdr->frame_control)) -+ brcms_b_mute(wlc->hw, false); -+ } -+ - memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status)); - ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p); - } -diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c -index 99a710d..827889b 100644 ---- a/drivers/net/wireless/ipw2x00/ipw2200.c -+++ b/drivers/net/wireless/ipw2x00/ipw2200.c -@@ -2183,6 +2183,7 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd) - { - int rc = 0; - unsigned long flags; -+ unsigned long now, end; - - spin_lock_irqsave(&priv->lock, flags); - if (priv->status & STATUS_HCMD_ACTIVE) { -@@ -2224,10 +2225,20 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd) - } - spin_unlock_irqrestore(&priv->lock, flags); - -+ now = jiffies; -+ end = now + HOST_COMPLETE_TIMEOUT; -+again: - rc = wait_event_interruptible_timeout(priv->wait_command_queue, - !(priv-> - status & STATUS_HCMD_ACTIVE), -- HOST_COMPLETE_TIMEOUT); -+ end - now); -+ if (rc < 0) { -+ now = jiffies; -+ if (time_before(now, end)) -+ goto again; -+ rc = 0; -+ } -+ - if (rc == 0) { - spin_lock_irqsave(&priv->lock, flags); - if (priv->status & STATUS_HCMD_ACTIVE) { -diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c -index dd008b0..1e6c8cc 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-1000.c -+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c -@@ -45,8 +45,8 @@ - #include "iwl-cfg.h" - - /* Highest firmware API version supported */ --#define IWL1000_UCODE_API_MAX 6 --#define IWL100_UCODE_API_MAX 6 -+#define IWL1000_UCODE_API_MAX 5 -+#define IWL100_UCODE_API_MAX 5 - - /* Oldest version we won't warn about */ - #define IWL1000_UCODE_API_OK 5 -@@ -244,5 +244,5 @@ struct iwl_cfg iwl100_bg_cfg = { - IWL_DEVICE_100, - }; - --MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX)); --MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_MAX)); -+MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_OK)); -diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c -index 7943197..9823e41 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-2000.c -+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c -@@ -51,10 +51,10 @@ - #define IWL135_UCODE_API_MAX 6 - - /* Oldest version we won't warn about */ --#define IWL2030_UCODE_API_OK 5 --#define IWL2000_UCODE_API_OK 5 --#define IWL105_UCODE_API_OK 5 --#define IWL135_UCODE_API_OK 5 -+#define IWL2030_UCODE_API_OK 6 -+#define IWL2000_UCODE_API_OK 6 -+#define IWL105_UCODE_API_OK 6 -+#define IWL135_UCODE_API_OK 6 - - /* Lowest firmware API version supported */ - #define IWL2030_UCODE_API_MIN 5 -@@ -372,7 +372,7 @@ struct iwl_cfg iwl135_bgn_cfg = { - .ht_params = &iwl2000_ht_params, - }; - --MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_MAX)); --MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_MAX)); --MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_MAX)); --MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_MAX)); -+MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_OK)); -diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c -index f55fb2d..606213f 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-5000.c -+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c -@@ -50,6 +50,10 @@ - #define IWL5000_UCODE_API_MAX 5 - #define IWL5150_UCODE_API_MAX 2 - -+/* Oldest version we won't warn about */ -+#define IWL5000_UCODE_API_OK 5 -+#define IWL5150_UCODE_API_OK 2 -+ - /* Lowest firmware API version supported */ - #define IWL5000_UCODE_API_MIN 1 - #define IWL5150_UCODE_API_MIN 1 -@@ -373,6 +377,7 @@ static struct iwl_ht_params iwl5000_ht_params = { - #define IWL_DEVICE_5000 \ - .fw_name_pre = IWL5000_FW_PRE, \ - .ucode_api_max = IWL5000_UCODE_API_MAX, \ -+ .ucode_api_ok = IWL5000_UCODE_API_OK, \ - .ucode_api_min = IWL5000_UCODE_API_MIN, \ - .eeprom_ver = EEPROM_5000_EEPROM_VERSION, \ - .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION, \ -@@ -416,6 +421,7 @@ struct iwl_cfg iwl5350_agn_cfg = { - .name = "Intel(R) WiMAX/WiFi Link 5350 AGN", - .fw_name_pre = IWL5000_FW_PRE, - .ucode_api_max = IWL5000_UCODE_API_MAX, -+ .ucode_api_ok = IWL5000_UCODE_API_OK, - .ucode_api_min = IWL5000_UCODE_API_MIN, - .eeprom_ver = EEPROM_5050_EEPROM_VERSION, - .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION, -@@ -429,6 +435,7 @@ struct iwl_cfg iwl5350_agn_cfg = { - #define IWL_DEVICE_5150 \ - .fw_name_pre = IWL5150_FW_PRE, \ - .ucode_api_max = IWL5150_UCODE_API_MAX, \ -+ .ucode_api_ok = IWL5150_UCODE_API_OK, \ - .ucode_api_min = IWL5150_UCODE_API_MIN, \ - .eeprom_ver = EEPROM_5050_EEPROM_VERSION, \ - .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION, \ -@@ -450,5 +457,5 @@ struct iwl_cfg iwl5150_abg_cfg = { - IWL_DEVICE_5150, - }; - --MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX)); --MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX)); -+MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_OK)); -diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c -index c840c78..b4f809c 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-6000.c -+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c -@@ -46,12 +46,15 @@ - #include "iwl-cfg.h" - - /* Highest firmware API version supported */ --#define IWL6000_UCODE_API_MAX 4 -+#define IWL6000_UCODE_API_MAX 6 - #define IWL6050_UCODE_API_MAX 5 - #define IWL6000G2_UCODE_API_MAX 6 - - /* Oldest version we won't warn about */ -+#define IWL6000_UCODE_API_OK 4 - #define IWL6000G2_UCODE_API_OK 5 -+#define IWL6050_UCODE_API_OK 5 -+#define IWL6000G2B_UCODE_API_OK 6 - - /* Lowest firmware API version supported */ - #define IWL6000_UCODE_API_MIN 4 -@@ -399,7 +402,7 @@ struct iwl_cfg iwl6005_2agn_d_cfg = { - #define IWL_DEVICE_6030 \ - .fw_name_pre = IWL6030_FW_PRE, \ - .ucode_api_max = IWL6000G2_UCODE_API_MAX, \ -- .ucode_api_ok = IWL6000G2_UCODE_API_OK, \ -+ .ucode_api_ok = IWL6000G2B_UCODE_API_OK, \ - .ucode_api_min = IWL6000G2_UCODE_API_MIN, \ - .eeprom_ver = EEPROM_6030_EEPROM_VERSION, \ - .eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION, \ -@@ -479,6 +482,7 @@ struct iwl_cfg iwl130_bg_cfg = { - #define IWL_DEVICE_6000i \ - .fw_name_pre = IWL6000_FW_PRE, \ - .ucode_api_max = IWL6000_UCODE_API_MAX, \ -+ .ucode_api_ok = IWL6000_UCODE_API_OK, \ - .ucode_api_min = IWL6000_UCODE_API_MIN, \ - .valid_tx_ant = ANT_BC, /* .cfg overwrite */ \ - .valid_rx_ant = ANT_BC, /* .cfg overwrite */ \ -@@ -559,6 +563,7 @@ struct iwl_cfg iwl6000_3agn_cfg = { - .name = "Intel(R) Centrino(R) Ultimate-N 6300 AGN", - .fw_name_pre = IWL6000_FW_PRE, - .ucode_api_max = IWL6000_UCODE_API_MAX, -+ .ucode_api_ok = IWL6000_UCODE_API_OK, - .ucode_api_min = IWL6000_UCODE_API_MIN, - .eeprom_ver = EEPROM_6000_EEPROM_VERSION, - .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION, -@@ -569,7 +574,7 @@ struct iwl_cfg iwl6000_3agn_cfg = { - .led_mode = IWL_LED_BLINK, - }; - --MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX)); --MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX)); --MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX)); --MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX)); -+MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2B_UCODE_API_OK)); -diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c -index e0e9a3d..d7d2512 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-agn.c -+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c -@@ -1504,7 +1504,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work) - - static void iwlagn_prepare_restart(struct iwl_priv *priv) - { -- struct iwl_rxon_context *ctx; - bool bt_full_concurrent; - u8 bt_ci_compliance; - u8 bt_load; -@@ -1513,8 +1512,6 @@ static void iwlagn_prepare_restart(struct iwl_priv *priv) - - lockdep_assert_held(&priv->shrd->mutex); - -- for_each_context(priv, ctx) -- ctx->vif = NULL; - priv->is_open = 0; - - /* -diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c -index 3d75d4c..832ec4d 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-core.c -+++ b/drivers/net/wireless/iwlwifi/iwl-core.c -@@ -1228,6 +1228,7 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw, - struct iwl_rxon_context *tmp, *ctx = NULL; - int err; - enum nl80211_iftype viftype = ieee80211_vif_type_p2p(vif); -+ bool reset = false; - - IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n", - viftype, vif->addr); -@@ -1249,6 +1250,13 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw, - tmp->interface_modes | tmp->exclusive_interface_modes; - - if (tmp->vif) { -+ /* On reset we need to add the same interface again */ -+ if (tmp->vif == vif) { -+ reset = true; -+ ctx = tmp; -+ break; -+ } -+ - /* check if this busy context is exclusive */ - if (tmp->exclusive_interface_modes & - BIT(tmp->vif->type)) { -@@ -1275,7 +1283,7 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw, - ctx->vif = vif; - - err = iwl_setup_interface(priv, ctx); -- if (!err) -+ if (!err || reset) - goto out; - - ctx->vif = NULL; -diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h -index 5bede9d..aae992a 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-fh.h -+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h -@@ -104,15 +104,29 @@ - * (see struct iwl_tfd_frame). These 16 pointer registers are offset by 0x04 - * bytes from one another. Each TFD circular buffer in DRAM must be 256-byte - * aligned (address bits 0-7 must be 0). -+ * Later devices have 20 (5000 series) or 30 (higher) queues, but the registers -+ * for them are in different places. - * - * Bit fields in each pointer register: - * 27-0: TFD CB physical base address [35:8], must be 256-byte aligned - */ --#define FH_MEM_CBBC_LOWER_BOUND (FH_MEM_LOWER_BOUND + 0x9D0) --#define FH_MEM_CBBC_UPPER_BOUND (FH_MEM_LOWER_BOUND + 0xA10) -- --/* Find TFD CB base pointer for given queue (range 0-15). */ --#define FH_MEM_CBBC_QUEUE(x) (FH_MEM_CBBC_LOWER_BOUND + (x) * 0x4) -+#define FH_MEM_CBBC_0_15_LOWER_BOUND (FH_MEM_LOWER_BOUND + 0x9D0) -+#define FH_MEM_CBBC_0_15_UPPER_BOUND (FH_MEM_LOWER_BOUND + 0xA10) -+#define FH_MEM_CBBC_16_19_LOWER_BOUND (FH_MEM_LOWER_BOUND + 0xBF0) -+#define FH_MEM_CBBC_16_19_UPPER_BOUND (FH_MEM_LOWER_BOUND + 0xC00) -+#define FH_MEM_CBBC_20_31_LOWER_BOUND (FH_MEM_LOWER_BOUND + 0xB20) -+#define FH_MEM_CBBC_20_31_UPPER_BOUND (FH_MEM_LOWER_BOUND + 0xB80) -+ -+/* Find TFD CB base pointer for given queue */ -+static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl) -+{ -+ if (chnl < 16) -+ return FH_MEM_CBBC_0_15_LOWER_BOUND + 4 * chnl; -+ if (chnl < 20) -+ return FH_MEM_CBBC_16_19_LOWER_BOUND + 4 * (chnl - 16); -+ WARN_ON_ONCE(chnl >= 32); -+ return FH_MEM_CBBC_20_31_LOWER_BOUND + 4 * (chnl - 20); -+} - - - /** -diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h -index bebdd82..d9b089e 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-prph.h -+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h -@@ -227,12 +227,33 @@ - #define SCD_AIT (SCD_BASE + 0x0c) - #define SCD_TXFACT (SCD_BASE + 0x10) - #define SCD_ACTIVE (SCD_BASE + 0x14) --#define SCD_QUEUE_WRPTR(x) (SCD_BASE + 0x18 + (x) * 4) --#define SCD_QUEUE_RDPTR(x) (SCD_BASE + 0x68 + (x) * 4) - #define SCD_QUEUECHAIN_SEL (SCD_BASE + 0xe8) - #define SCD_AGGR_SEL (SCD_BASE + 0x248) - #define SCD_INTERRUPT_MASK (SCD_BASE + 0x108) --#define SCD_QUEUE_STATUS_BITS(x) (SCD_BASE + 0x10c + (x) * 4) -+ -+static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl) -+{ -+ if (chnl < 20) -+ return SCD_BASE + 0x18 + chnl * 4; -+ WARN_ON_ONCE(chnl >= 32); -+ return SCD_BASE + 0x284 + (chnl - 20) * 4; -+} -+ -+static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl) -+{ -+ if (chnl < 20) -+ return SCD_BASE + 0x68 + chnl * 4; -+ WARN_ON_ONCE(chnl >= 32); -+ return SCD_BASE + 0x2B4 + (chnl - 20) * 4; -+} -+ -+static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl) -+{ -+ if (chnl < 20) -+ return SCD_BASE + 0x10c + chnl * 4; -+ WARN_ON_ONCE(chnl >= 32); -+ return SCD_BASE + 0x384 + (chnl - 20) * 4; -+} - - /*********************** END TX SCHEDULER *************************************/ - -diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h -index 445ff21..2f218f9 100644 ---- a/drivers/net/wireless/mwifiex/pcie.h -+++ b/drivers/net/wireless/mwifiex/pcie.h -@@ -48,15 +48,15 @@ - #define PCIE_HOST_INT_STATUS_MASK 0xC3C - #define PCIE_SCRATCH_2_REG 0xC40 - #define PCIE_SCRATCH_3_REG 0xC44 --#define PCIE_SCRATCH_4_REG 0xCC0 --#define PCIE_SCRATCH_5_REG 0xCC4 --#define PCIE_SCRATCH_6_REG 0xCC8 --#define PCIE_SCRATCH_7_REG 0xCCC --#define PCIE_SCRATCH_8_REG 0xCD0 --#define PCIE_SCRATCH_9_REG 0xCD4 --#define PCIE_SCRATCH_10_REG 0xCD8 --#define PCIE_SCRATCH_11_REG 0xCDC --#define PCIE_SCRATCH_12_REG 0xCE0 -+#define PCIE_SCRATCH_4_REG 0xCD0 -+#define PCIE_SCRATCH_5_REG 0xCD4 -+#define PCIE_SCRATCH_6_REG 0xCD8 -+#define PCIE_SCRATCH_7_REG 0xCDC -+#define PCIE_SCRATCH_8_REG 0xCE0 -+#define PCIE_SCRATCH_9_REG 0xCE4 -+#define PCIE_SCRATCH_10_REG 0xCE8 -+#define PCIE_SCRATCH_11_REG 0xCEC -+#define PCIE_SCRATCH_12_REG 0xCF0 - - #define CPU_INTR_DNLD_RDY BIT(0) - #define CPU_INTR_DOOR_BELL BIT(1) -diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c -index cb71e88..0ffa111 100644 ---- a/drivers/net/wireless/rt2x00/rt2800usb.c -+++ b/drivers/net/wireless/rt2x00/rt2800usb.c -@@ -914,12 +914,14 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x050d, 0x8053) }, - { USB_DEVICE(0x050d, 0x805c) }, - { USB_DEVICE(0x050d, 0x815c) }, -+ { USB_DEVICE(0x050d, 0x825a) }, - { USB_DEVICE(0x050d, 0x825b) }, - { USB_DEVICE(0x050d, 0x935a) }, - { USB_DEVICE(0x050d, 0x935b) }, - /* Buffalo */ - { USB_DEVICE(0x0411, 0x00e8) }, - { USB_DEVICE(0x0411, 0x0158) }, -+ { USB_DEVICE(0x0411, 0x015d) }, - { USB_DEVICE(0x0411, 0x016f) }, - { USB_DEVICE(0x0411, 0x01a2) }, - /* Corega */ -@@ -934,6 +936,8 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x07d1, 0x3c0e) }, - { USB_DEVICE(0x07d1, 0x3c0f) }, - { USB_DEVICE(0x07d1, 0x3c11) }, -+ { USB_DEVICE(0x07d1, 0x3c13) }, -+ { USB_DEVICE(0x07d1, 0x3c15) }, - { USB_DEVICE(0x07d1, 0x3c16) }, - { USB_DEVICE(0x2001, 0x3c1b) }, - /* Draytek */ -@@ -944,6 +948,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x7392, 0x7711) }, - { USB_DEVICE(0x7392, 0x7717) }, - { USB_DEVICE(0x7392, 0x7718) }, -+ { USB_DEVICE(0x7392, 0x7722) }, - /* Encore */ - { USB_DEVICE(0x203d, 0x1480) }, - { USB_DEVICE(0x203d, 0x14a9) }, -@@ -978,6 +983,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x1737, 0x0070) }, - { USB_DEVICE(0x1737, 0x0071) }, - { USB_DEVICE(0x1737, 0x0077) }, -+ { USB_DEVICE(0x1737, 0x0078) }, - /* Logitec */ - { USB_DEVICE(0x0789, 0x0162) }, - { USB_DEVICE(0x0789, 0x0163) }, -@@ -1001,9 +1007,13 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x0db0, 0x871b) }, - { USB_DEVICE(0x0db0, 0x871c) }, - { USB_DEVICE(0x0db0, 0x899a) }, -+ /* Ovislink */ -+ { USB_DEVICE(0x1b75, 0x3071) }, -+ { USB_DEVICE(0x1b75, 0x3072) }, - /* Para */ - { USB_DEVICE(0x20b8, 0x8888) }, - /* Pegatron */ -+ { USB_DEVICE(0x1d4d, 0x0002) }, - { USB_DEVICE(0x1d4d, 0x000c) }, - { USB_DEVICE(0x1d4d, 0x000e) }, - { USB_DEVICE(0x1d4d, 0x0011) }, -@@ -1056,7 +1066,9 @@ static struct usb_device_id rt2800usb_device_table[] = { - /* Sparklan */ - { USB_DEVICE(0x15a9, 0x0006) }, - /* Sweex */ -+ { USB_DEVICE(0x177f, 0x0153) }, - { USB_DEVICE(0x177f, 0x0302) }, -+ { USB_DEVICE(0x177f, 0x0313) }, - /* U-Media */ - { USB_DEVICE(0x157e, 0x300e) }, - { USB_DEVICE(0x157e, 0x3013) }, -@@ -1140,27 +1152,24 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x13d3, 0x3322) }, - /* Belkin */ - { USB_DEVICE(0x050d, 0x1003) }, -- { USB_DEVICE(0x050d, 0x825a) }, - /* Buffalo */ - { USB_DEVICE(0x0411, 0x012e) }, - { USB_DEVICE(0x0411, 0x0148) }, - { USB_DEVICE(0x0411, 0x0150) }, -- { USB_DEVICE(0x0411, 0x015d) }, - /* Corega */ - { USB_DEVICE(0x07aa, 0x0041) }, - { USB_DEVICE(0x07aa, 0x0042) }, - { USB_DEVICE(0x18c5, 0x0008) }, - /* D-Link */ - { USB_DEVICE(0x07d1, 0x3c0b) }, -- { USB_DEVICE(0x07d1, 0x3c13) }, -- { USB_DEVICE(0x07d1, 0x3c15) }, - { USB_DEVICE(0x07d1, 0x3c17) }, - { USB_DEVICE(0x2001, 0x3c17) }, - /* Edimax */ - { USB_DEVICE(0x7392, 0x4085) }, -- { USB_DEVICE(0x7392, 0x7722) }, - /* Encore */ - { USB_DEVICE(0x203d, 0x14a1) }, -+ /* Fujitsu Stylistic 550 */ -+ { USB_DEVICE(0x1690, 0x0761) }, - /* Gemtek */ - { USB_DEVICE(0x15a9, 0x0010) }, - /* Gigabyte */ -@@ -1172,19 +1181,13 @@ static struct usb_device_id rt2800usb_device_table[] = { - /* LevelOne */ - { USB_DEVICE(0x1740, 0x0605) }, - { USB_DEVICE(0x1740, 0x0615) }, -- /* Linksys */ -- { USB_DEVICE(0x1737, 0x0078) }, - /* Logitec */ - { USB_DEVICE(0x0789, 0x0168) }, - { USB_DEVICE(0x0789, 0x0169) }, - /* Motorola */ - { USB_DEVICE(0x100d, 0x9032) }, -- /* Ovislink */ -- { USB_DEVICE(0x1b75, 0x3071) }, -- { USB_DEVICE(0x1b75, 0x3072) }, - /* Pegatron */ - { USB_DEVICE(0x05a6, 0x0101) }, -- { USB_DEVICE(0x1d4d, 0x0002) }, - { USB_DEVICE(0x1d4d, 0x0010) }, - /* Planex */ - { USB_DEVICE(0x2019, 0x5201) }, -@@ -1203,9 +1206,6 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x083a, 0xc522) }, - { USB_DEVICE(0x083a, 0xd522) }, - { USB_DEVICE(0x083a, 0xf511) }, -- /* Sweex */ -- { USB_DEVICE(0x177f, 0x0153) }, -- { USB_DEVICE(0x177f, 0x0313) }, - /* Zyxel */ - { USB_DEVICE(0x0586, 0x341a) }, - #endif -diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c -index d44d398..47ba0f7 100644 ---- a/drivers/net/wireless/rtlwifi/pci.c -+++ b/drivers/net/wireless/rtlwifi/pci.c -@@ -1961,6 +1961,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev) - rtl_deinit_deferred_work(hw); - rtlpriv->intf_ops->adapter_stop(hw); - } -+ rtlpriv->cfg->ops->disable_interrupt(hw); - - /*deinit rfkill */ - rtl_deinit_rfkill(hw); -diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c -index ba3268e..40c1574 100644 ---- a/drivers/net/wireless/wl1251/main.c -+++ b/drivers/net/wireless/wl1251/main.c -@@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw) - cancel_work_sync(&wl->irq_work); - cancel_work_sync(&wl->tx_work); - cancel_work_sync(&wl->filter_work); -+ cancel_delayed_work_sync(&wl->elp_work); - - mutex_lock(&wl->mutex); - -diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/wl1251/sdio.c -index f786942..1b851f6 100644 ---- a/drivers/net/wireless/wl1251/sdio.c -+++ b/drivers/net/wireless/wl1251/sdio.c -@@ -315,8 +315,8 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func) - - if (wl->irq) - free_irq(wl->irq, wl); -- kfree(wl_sdio); - wl1251_free_hw(wl); -+ kfree(wl_sdio); - - sdio_claim_host(func); - sdio_release_irq(func); -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 6476547..78fda9c 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -2906,6 +2906,40 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f8, quirk_intel_mc_errata); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata); - -+/* -+ * Some BIOS implementations leave the Intel GPU interrupts enabled, -+ * even though no one is handling them (f.e. i915 driver is never loaded). -+ * Additionally the interrupt destination is not set up properly -+ * and the interrupt ends up -somewhere-. -+ * -+ * These spurious interrupts are "sticky" and the kernel disables -+ * the (shared) interrupt line after 100.000+ generated interrupts. -+ * -+ * Fix it by disabling the still enabled interrupts. -+ * This resolves crashes often seen on monitor unplug. -+ */ -+#define I915_DEIER_REG 0x4400c -+static void __devinit disable_igfx_irq(struct pci_dev *dev) -+{ -+ void __iomem *regs = pci_iomap(dev, 0, 0); -+ if (regs == NULL) { -+ dev_warn(&dev->dev, "igfx quirk: Can't iomap PCI device\n"); -+ return; -+ } -+ -+ /* Check if any interrupt line is still enabled */ -+ if (readl(regs + I915_DEIER_REG) != 0) { -+ dev_warn(&dev->dev, "BIOS left Intel GPU interrupts enabled; " -+ "disabling\n"); -+ -+ writel(0, regs + I915_DEIER_REG); -+ } -+ -+ pci_iounmap(dev, regs); -+} -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq); -+ - static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f, - struct pci_fixup *end) - { -diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c -index d93e962..1d3bcce 100644 ---- a/drivers/platform/x86/dell-laptop.c -+++ b/drivers/platform/x86/dell-laptop.c -@@ -184,6 +184,34 @@ static struct dmi_system_id __devinitdata dell_quirks[] = { - }, - .driver_data = &quirk_dell_vostro_v130, - }, -+ { -+ .callback = dmi_matched, -+ .ident = "Dell Vostro 3555", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3555"), -+ }, -+ .driver_data = &quirk_dell_vostro_v130, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "Dell Inspiron N311z", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron N311z"), -+ }, -+ .driver_data = &quirk_dell_vostro_v130, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "Dell Inspiron M5110", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron M5110"), -+ }, -+ .driver_data = &quirk_dell_vostro_v130, -+ }, -+ { } - }; - - static struct calling_interface_buffer *buffer; -@@ -615,6 +643,7 @@ static void touchpad_led_set(struct led_classdev *led_cdev, - static struct led_classdev touchpad_led = { - .name = "dell-laptop::touchpad", - .brightness_set = touchpad_led_set, -+ .flags = LED_CORE_SUSPENDRESUME, - }; - - static int __devinit touchpad_led_init(struct device *dev) -diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c -index 1b831c5..e48ba4b 100644 ---- a/drivers/scsi/libsas/sas_expander.c -+++ b/drivers/scsi/libsas/sas_expander.c -@@ -192,7 +192,14 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, - phy->attached_sata_ps = dr->attached_sata_ps; - phy->attached_iproto = dr->iproto << 1; - phy->attached_tproto = dr->tproto << 1; -- memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE); -+ /* help some expanders that fail to zero sas_address in the 'no -+ * device' case -+ */ -+ if (phy->attached_dev_type == NO_DEVICE || -+ phy->linkrate < SAS_LINK_RATE_1_5_GBPS) -+ memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE); -+ else -+ memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE); - phy->attached_phy_id = dr->attached_phy_id; - phy->phy_change_count = dr->change_count; - phy->routing_attr = dr->routing_attr; -@@ -1643,9 +1650,17 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id, - int phy_change_count = 0; - - res = sas_get_phy_change_count(dev, i, &phy_change_count); -- if (res) -- goto out; -- else if (phy_change_count != ex->ex_phy[i].phy_change_count) { -+ switch (res) { -+ case SMP_RESP_PHY_VACANT: -+ case SMP_RESP_NO_PHY: -+ continue; -+ case SMP_RESP_FUNC_ACC: -+ break; -+ default: -+ return res; -+ } -+ -+ if (phy_change_count != ex->ex_phy[i].phy_change_count) { - if (update) - ex->ex_phy[i].phy_change_count = - phy_change_count; -@@ -1653,8 +1668,7 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id, - return 0; - } - } --out: -- return res; -+ return 0; - } - - static int sas_get_ex_change_count(struct domain_device *dev, int *ecc) -diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c -index 24cacff..5f748c0 100644 ---- a/drivers/spi/spi-fsl-spi.c -+++ b/drivers/spi/spi-fsl-spi.c -@@ -139,10 +139,12 @@ static void fsl_spi_change_mode(struct spi_device *spi) - static void fsl_spi_chipselect(struct spi_device *spi, int value) - { - struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master); -- struct fsl_spi_platform_data *pdata = spi->dev.parent->platform_data; -+ struct fsl_spi_platform_data *pdata; - bool pol = spi->mode & SPI_CS_HIGH; - struct spi_mpc8xxx_cs *cs = spi->controller_state; - -+ pdata = spi->dev.parent->parent->platform_data; -+ - if (value == BITBANG_CS_INACTIVE) { - if (pdata->cs_control) - pdata->cs_control(spi, !pol); -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index 77eae99..b2ccdea 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -319,7 +319,7 @@ struct spi_device *spi_alloc_device(struct spi_master *master) - } - - spi->master = master; -- spi->dev.parent = dev; -+ spi->dev.parent = &master->dev; - spi->dev.bus = &spi_bus_type; - spi->dev.release = spidev_release; - device_initialize(&spi->dev); -diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c -index fb11743..4bb2797 100644 ---- a/drivers/staging/rtl8712/os_intfs.c -+++ b/drivers/staging/rtl8712/os_intfs.c -@@ -476,9 +476,6 @@ static int netdev_close(struct net_device *pnetdev) - r8712_free_assoc_resources(padapter); - /*s2-4.*/ - r8712_free_network_queue(padapter); -- release_firmware(padapter->fw); -- /* never exit with a firmware callback pending */ -- wait_for_completion(&padapter->rtl8712_fw_ready); - return 0; - } - -diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c -index 9bade18..ec41d38 100644 ---- a/drivers/staging/rtl8712/usb_intf.c -+++ b/drivers/staging/rtl8712/usb_intf.c -@@ -30,6 +30,7 @@ - - #include <linux/usb.h> - #include <linux/module.h> -+#include <linux/firmware.h> - - #include "osdep_service.h" - #include "drv_types.h" -@@ -621,6 +622,10 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf) - struct _adapter *padapter = netdev_priv(pnetdev); - struct usb_device *udev = interface_to_usbdev(pusb_intf); - -+ if (padapter->fw_found) -+ release_firmware(padapter->fw); -+ /* never exit with a firmware callback pending */ -+ wait_for_completion(&padapter->rtl8712_fw_ready); - usb_set_intfdata(pusb_intf, NULL); - if (padapter) { - if (drvpriv.drv_registered == true) -diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c -index b84c834..8daf073 100644 ---- a/drivers/tty/amiserial.c -+++ b/drivers/tty/amiserial.c -@@ -1113,8 +1113,10 @@ static int set_serial_info(struct async_struct * info, - (new_serial.close_delay != state->close_delay) || - (new_serial.xmit_fifo_size != state->xmit_fifo_size) || - ((new_serial.flags & ~ASYNC_USR_MASK) != -- (state->flags & ~ASYNC_USR_MASK))) -+ (state->flags & ~ASYNC_USR_MASK))) { -+ tty_unlock(); - return -EPERM; -+ } - state->flags = ((state->flags & ~ASYNC_USR_MASK) | - (new_serial.flags & ASYNC_USR_MASK)); - info->flags = ((info->flags & ~ASYNC_USR_MASK) | -diff --git a/drivers/tty/serial/clps711x.c b/drivers/tty/serial/clps711x.c -index e6c3dbd..836fe273 100644 ---- a/drivers/tty/serial/clps711x.c -+++ b/drivers/tty/serial/clps711x.c -@@ -154,10 +154,9 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id) - port->x_char = 0; - return IRQ_HANDLED; - } -- if (uart_circ_empty(xmit) || uart_tx_stopped(port)) { -- clps711xuart_stop_tx(port); -- return IRQ_HANDLED; -- } -+ -+ if (uart_circ_empty(xmit) || uart_tx_stopped(port)) -+ goto disable_tx_irq; - - count = port->fifosize >> 1; - do { -@@ -171,8 +170,11 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id) - if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) - uart_write_wakeup(port); - -- if (uart_circ_empty(xmit)) -- clps711xuart_stop_tx(port); -+ if (uart_circ_empty(xmit)) { -+ disable_tx_irq: -+ disable_irq_nosync(TX_IRQ(port)); -+ tx_enabled(port) = 0; -+ } - - return IRQ_HANDLED; - } -diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c -index da776a0..a4b192d 100644 ---- a/drivers/tty/serial/pch_uart.c -+++ b/drivers/tty/serial/pch_uart.c -@@ -1356,9 +1356,11 @@ static int pch_uart_verify_port(struct uart_port *port, - __func__); - return -EOPNOTSUPP; - #endif -- priv->use_dma = 1; - priv->use_dma_flag = 1; - dev_info(priv->port.dev, "PCH UART : Use DMA Mode\n"); -+ if (!priv->use_dma) -+ pch_request_dma(port); -+ priv->use_dma = 1; - } - - return 0; -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index 9eb71d8..2db0327 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -108,8 +108,9 @@ static void wdm_out_callback(struct urb *urb) - spin_lock(&desc->iuspin); - desc->werr = urb->status; - spin_unlock(&desc->iuspin); -- clear_bit(WDM_IN_USE, &desc->flags); - kfree(desc->outbuf); -+ desc->outbuf = NULL; -+ clear_bit(WDM_IN_USE, &desc->flags); - wake_up(&desc->wait); - } - -@@ -312,7 +313,7 @@ static ssize_t wdm_write - if (we < 0) - return -EIO; - -- desc->outbuf = buf = kmalloc(count, GFP_KERNEL); -+ buf = kmalloc(count, GFP_KERNEL); - if (!buf) { - rv = -ENOMEM; - goto outnl; -@@ -376,10 +377,12 @@ static ssize_t wdm_write - req->wIndex = desc->inum; - req->wLength = cpu_to_le16(count); - set_bit(WDM_IN_USE, &desc->flags); -+ desc->outbuf = buf; - - rv = usb_submit_urb(desc->command, GFP_KERNEL); - if (rv < 0) { - kfree(buf); -+ desc->outbuf = NULL; - clear_bit(WDM_IN_USE, &desc->flags); - dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv); - } else { -diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c -index 61d08dd..5f1404a 100644 ---- a/drivers/usb/core/hcd-pci.c -+++ b/drivers/usb/core/hcd-pci.c -@@ -495,6 +495,15 @@ static int hcd_pci_suspend_noirq(struct device *dev) - - pci_save_state(pci_dev); - -+ /* -+ * Some systems crash if an EHCI controller is in D3 during -+ * a sleep transition. We have to leave such controllers in D0. -+ */ -+ if (hcd->broken_pci_sleep) { -+ dev_dbg(dev, "Staying in PCI D0\n"); -+ return retval; -+ } -+ - /* If the root hub is dead rather than suspended, disallow remote - * wakeup. usb_hc_died() should ensure that both hosts are marked as - * dying, so we only need to check the primary roothub. -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index e238b3b..2b0a341 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1644,7 +1644,6 @@ void usb_disconnect(struct usb_device **pdev) - { - struct usb_device *udev = *pdev; - int i; -- struct usb_hcd *hcd = bus_to_hcd(udev->bus); - - /* mark the device as inactive, so any further urb submissions for - * this device (and any of its children) will fail immediately. -@@ -1667,9 +1666,7 @@ void usb_disconnect(struct usb_device **pdev) - * so that the hardware is now fully quiesced. - */ - dev_dbg (&udev->dev, "unregistering device\n"); -- mutex_lock(hcd->bandwidth_mutex); - usb_disable_device(udev, 0); -- mutex_unlock(hcd->bandwidth_mutex); - usb_hcd_synchronize_unlinks(udev); - - usb_remove_ep_devs(&udev->ep0); -diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c -index aed3e07..ca717da 100644 ---- a/drivers/usb/core/message.c -+++ b/drivers/usb/core/message.c -@@ -1136,8 +1136,6 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf, - * Deallocates hcd/hardware state for the endpoints (nuking all or most - * pending urbs) and usbcore state for the interfaces, so that usbcore - * must usb_set_configuration() before any interfaces could be used. -- * -- * Must be called with hcd->bandwidth_mutex held. - */ - void usb_disable_device(struct usb_device *dev, int skip_ep0) - { -@@ -1190,7 +1188,9 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0) - usb_disable_endpoint(dev, i + USB_DIR_IN, false); - } - /* Remove endpoints from the host controller internal state */ -+ mutex_lock(hcd->bandwidth_mutex); - usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL); -+ mutex_unlock(hcd->bandwidth_mutex); - /* Second pass: remove endpoint pointers */ - } - for (i = skip_ep0; i < 16; ++i) { -@@ -1750,7 +1750,6 @@ free_interfaces: - /* if it's already configured, clear out old state first. - * getting rid of old interfaces means unbinding their drivers. - */ -- mutex_lock(hcd->bandwidth_mutex); - if (dev->state != USB_STATE_ADDRESS) - usb_disable_device(dev, 1); /* Skip ep0 */ - -@@ -1763,6 +1762,7 @@ free_interfaces: - * host controller will not allow submissions to dropped endpoints. If - * this call fails, the device state is unchanged. - */ -+ mutex_lock(hcd->bandwidth_mutex); - ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL); - if (ret < 0) { - mutex_unlock(hcd->bandwidth_mutex); -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 27bd50a..c0dcf69 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -572,9 +572,10 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, - dwc->ep0_bounced = false; - } else { - transferred = ur->length - trb.length; -- ur->actual += transferred; - } - -+ ur->actual += transferred; -+ - if ((epnum & 1) && ur->actual < ur->length) { - /* for some reason we did not get everything out */ - -diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c -index ab8f1b4..527736e 100644 ---- a/drivers/usb/gadget/dummy_hcd.c -+++ b/drivers/usb/gadget/dummy_hcd.c -@@ -925,7 +925,6 @@ static int dummy_udc_stop(struct usb_gadget *g, - - dum->driver = NULL; - -- dummy_pullup(&dum->gadget, 0); - return 0; - } - -diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c -index acb3800..0e641a1 100644 ---- a/drivers/usb/gadget/f_fs.c -+++ b/drivers/usb/gadget/f_fs.c -@@ -712,7 +712,7 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value) - if (code == FUNCTIONFS_INTERFACE_REVMAP) { - struct ffs_function *func = ffs->func; - ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV; -- } else if (gadget->ops->ioctl) { -+ } else if (gadget && gadget->ops->ioctl) { - ret = gadget->ops->ioctl(gadget, code, value); - } else { - ret = -ENOTTY; -diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c -index 1a6f415..a5570b6 100644 ---- a/drivers/usb/gadget/f_mass_storage.c -+++ b/drivers/usb/gadget/f_mass_storage.c -@@ -2182,7 +2182,7 @@ unknown_cmnd: - common->data_size_from_cmnd = 0; - sprintf(unknown, "Unknown x%02x", common->cmnd[0]); - reply = check_command(common, common->cmnd_size, -- DATA_DIR_UNKNOWN, 0xff, 0, unknown); -+ DATA_DIR_UNKNOWN, ~0, 0, unknown); - if (reply == 0) { - common->curlun->sense_data = SS_INVALID_COMMAND; - reply = -EINVAL; -diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c -index 11b5196..db2d607 100644 ---- a/drivers/usb/gadget/file_storage.c -+++ b/drivers/usb/gadget/file_storage.c -@@ -2569,7 +2569,7 @@ static int do_scsi_command(struct fsg_dev *fsg) - fsg->data_size_from_cmnd = 0; - sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]); - if ((reply = check_command(fsg, fsg->cmnd_size, -- DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) { -+ DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) { - fsg->curlun->sense_data = SS_INVALID_COMMAND; - reply = -EINVAL; - } -diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c -index 6939e17..901924a 100644 ---- a/drivers/usb/gadget/udc-core.c -+++ b/drivers/usb/gadget/udc-core.c -@@ -211,9 +211,9 @@ static void usb_gadget_remove_driver(struct usb_udc *udc) - - if (udc_is_newstyle(udc)) { - udc->driver->disconnect(udc->gadget); -+ usb_gadget_disconnect(udc->gadget); - udc->driver->unbind(udc->gadget); - usb_gadget_udc_stop(udc->gadget, udc->driver); -- usb_gadget_disconnect(udc->gadget); - } else { - usb_gadget_stop(udc->gadget, udc->driver); - } -@@ -359,9 +359,13 @@ static ssize_t usb_udc_softconn_store(struct device *dev, - struct usb_udc *udc = container_of(dev, struct usb_udc, dev); - - if (sysfs_streq(buf, "connect")) { -+ if (udc_is_newstyle(udc)) -+ usb_gadget_udc_start(udc->gadget, udc->driver); - usb_gadget_connect(udc->gadget); - } else if (sysfs_streq(buf, "disconnect")) { - usb_gadget_disconnect(udc->gadget); -+ if (udc_is_newstyle(udc)) -+ usb_gadget_udc_stop(udc->gadget, udc->driver); - } else { - dev_err(dev, "unsupported command '%s'\n", buf); - return -EINVAL; -diff --git a/drivers/usb/gadget/uvc.h b/drivers/usb/gadget/uvc.h -index bc78c60..ca4e03a 100644 ---- a/drivers/usb/gadget/uvc.h -+++ b/drivers/usb/gadget/uvc.h -@@ -28,7 +28,7 @@ - - struct uvc_request_data - { -- unsigned int length; -+ __s32 length; - __u8 data[60]; - }; - -diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c -index f6e083b..54d7ca5 100644 ---- a/drivers/usb/gadget/uvc_v4l2.c -+++ b/drivers/usb/gadget/uvc_v4l2.c -@@ -39,7 +39,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data) - if (data->length < 0) - return usb_ep_set_halt(cdev->gadget->ep0); - -- req->length = min(uvc->event_length, data->length); -+ req->length = min_t(unsigned int, uvc->event_length, data->length); - req->zero = data->length < uvc->event_length; - req->dma = DMA_ADDR_INVALID; - -diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c -index 3ff9f82..da2f711 100644 ---- a/drivers/usb/host/ehci-hcd.c -+++ b/drivers/usb/host/ehci-hcd.c -@@ -815,8 +815,13 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) - goto dead; - } - -+ /* -+ * We don't use STS_FLR, but some controllers don't like it to -+ * remain on, so mask it out along with the other status bits. -+ */ -+ masked_status = status & (INTR_MASK | STS_FLR); -+ - /* Shared IRQ? */ -- masked_status = status & INTR_MASK; - if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) { - spin_unlock(&ehci->lock); - return IRQ_NONE; -@@ -867,7 +872,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) - pcd_status = status; - - /* resume root hub? */ -- if (!(cmd & CMD_RUN)) -+ if (ehci->rh_state == EHCI_RH_SUSPENDED) - usb_hcd_resume_root_hub(hcd); - - /* get per-port change detect bits */ -diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c -index f4b627d..971d312 100644 ---- a/drivers/usb/host/ehci-pci.c -+++ b/drivers/usb/host/ehci-pci.c -@@ -144,6 +144,14 @@ static int ehci_pci_setup(struct usb_hcd *hcd) - hcd->has_tt = 1; - tdi_reset(ehci); - } -+ if (pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK) { -+ /* EHCI #1 or #2 on 6 Series/C200 Series chipset */ -+ if (pdev->device == 0x1c26 || pdev->device == 0x1c2d) { -+ ehci_info(ehci, "broken D3 during system sleep on ASUS\n"); -+ hcd->broken_pci_sleep = 1; -+ device_set_wakeup_capable(&pdev->dev, false); -+ } -+ } - break; - case PCI_VENDOR_ID_TDI: - if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) { -diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c -index ac5bfd6..2504694 100644 ---- a/drivers/usb/misc/yurex.c -+++ b/drivers/usb/misc/yurex.c -@@ -99,9 +99,7 @@ static void yurex_delete(struct kref *kref) - usb_put_dev(dev->udev); - if (dev->cntl_urb) { - usb_kill_urb(dev->cntl_urb); -- if (dev->cntl_req) -- usb_free_coherent(dev->udev, YUREX_BUF_SIZE, -- dev->cntl_req, dev->cntl_urb->setup_dma); -+ kfree(dev->cntl_req); - if (dev->cntl_buffer) - usb_free_coherent(dev->udev, YUREX_BUF_SIZE, - dev->cntl_buffer, dev->cntl_urb->transfer_dma); -@@ -234,9 +232,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_ - } - - /* allocate buffer for control req */ -- dev->cntl_req = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE, -- GFP_KERNEL, -- &dev->cntl_urb->setup_dma); -+ dev->cntl_req = kmalloc(YUREX_BUF_SIZE, GFP_KERNEL); - if (!dev->cntl_req) { - err("Could not allocate cntl_req"); - goto error; -@@ -286,7 +282,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_ - usb_rcvintpipe(dev->udev, dev->int_in_endpointAddr), - dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt, - dev, 1); -- dev->cntl_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; -+ dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; - if (usb_submit_urb(dev->urb, GFP_KERNEL)) { - retval = -EIO; - err("Could not submitting URB"); -diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c -index ba85f27..a8f0c09 100644 ---- a/drivers/usb/musb/omap2430.c -+++ b/drivers/usb/musb/omap2430.c -@@ -282,7 +282,8 @@ static int musb_otg_notifications(struct notifier_block *nb, - - static int omap2430_musb_init(struct musb *musb) - { -- u32 l, status = 0; -+ u32 l; -+ int status = 0; - struct device *dev = musb->controller; - struct musb_hdrc_platform_data *plat = dev->platform_data; - struct omap_musb_board_data *data = plat->board_data; -@@ -299,7 +300,7 @@ static int omap2430_musb_init(struct musb *musb) - - status = pm_runtime_get_sync(dev); - if (status < 0) { -- dev_err(dev, "pm_runtime_get_sync FAILED"); -+ dev_err(dev, "pm_runtime_get_sync FAILED %d\n", status); - goto err1; - } - -@@ -451,14 +452,14 @@ static int __init omap2430_probe(struct platform_device *pdev) - goto err2; - } - -+ pm_runtime_enable(&pdev->dev); -+ - ret = platform_device_add(musb); - if (ret) { - dev_err(&pdev->dev, "failed to register musb device\n"); - goto err2; - } - -- pm_runtime_enable(&pdev->dev); -- - return 0; - - err2: -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 4c12404..f2c57e0 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -285,7 +285,8 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request, - /* Issue the request, attempting to read 'size' bytes */ - result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), - request, REQTYPE_DEVICE_TO_HOST, 0x0000, -- port_priv->bInterfaceNumber, buf, size, 300); -+ port_priv->bInterfaceNumber, buf, size, -+ USB_CTRL_GET_TIMEOUT); - - /* Convert data into an array of integers */ - for (i = 0; i < length; i++) -@@ -335,12 +336,14 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request, - result = usb_control_msg(serial->dev, - usb_sndctrlpipe(serial->dev, 0), - request, REQTYPE_HOST_TO_DEVICE, 0x0000, -- port_priv->bInterfaceNumber, buf, size, 300); -+ port_priv->bInterfaceNumber, buf, size, -+ USB_CTRL_SET_TIMEOUT); - } else { - result = usb_control_msg(serial->dev, - usb_sndctrlpipe(serial->dev, 0), - request, REQTYPE_HOST_TO_DEVICE, data[0], -- port_priv->bInterfaceNumber, NULL, 0, 300); -+ port_priv->bInterfaceNumber, NULL, 0, -+ USB_CTRL_SET_TIMEOUT); - } - - kfree(buf); -diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c -index 7c3ec9e..e093585 100644 ---- a/drivers/usb/serial/sierra.c -+++ b/drivers/usb/serial/sierra.c -@@ -221,7 +221,7 @@ static const struct sierra_iface_info typeB_interface_list = { - }; - - /* 'blacklist' of interfaces not served by this driver */ --static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11 }; -+static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11, 19, 20 }; - static const struct sierra_iface_info direct_ip_interface_blacklist = { - .infolen = ARRAY_SIZE(direct_ip_non_serial_ifaces), - .ifaceinfo = direct_ip_non_serial_ifaces, -@@ -289,7 +289,6 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1199, 0x6856) }, /* Sierra Wireless AirCard 881 U */ - { USB_DEVICE(0x1199, 0x6859) }, /* Sierra Wireless AirCard 885 E */ - { USB_DEVICE(0x1199, 0x685A) }, /* Sierra Wireless AirCard 885 E */ -- { USB_DEVICE(0x1199, 0x68A2) }, /* Sierra Wireless MC7710 */ - /* Sierra Wireless C885 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6880, 0xFF, 0xFF, 0xFF)}, - /* Sierra Wireless C888, Air Card 501, USB 303, USB 304 */ -@@ -299,6 +298,9 @@ static const struct usb_device_id id_table[] = { - /* Sierra Wireless HSPA Non-Composite Device */ - { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)}, - { USB_DEVICE(0x1199, 0x6893) }, /* Sierra Wireless Device */ -+ { USB_DEVICE(0x1199, 0x68A2), /* Sierra Wireless MC77xx in QMI mode */ -+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist -+ }, - { USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */ - .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist - }, -diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c -index 2babcd4..86685e9 100644 ---- a/drivers/uwb/hwa-rc.c -+++ b/drivers/uwb/hwa-rc.c -@@ -645,7 +645,8 @@ void hwarc_neep_cb(struct urb *urb) - dev_err(dev, "NEEP: URB error %d\n", urb->status); - } - result = usb_submit_urb(urb, GFP_ATOMIC); -- if (result < 0) { -+ if (result < 0 && result != -ENODEV && result != -EPERM) { -+ /* ignoring unrecoverable errors */ - dev_err(dev, "NEEP: Can't resubmit URB (%d) resetting device\n", - result); - goto error; -diff --git a/drivers/uwb/neh.c b/drivers/uwb/neh.c -index a269937..8cb71bb 100644 ---- a/drivers/uwb/neh.c -+++ b/drivers/uwb/neh.c -@@ -107,6 +107,7 @@ struct uwb_rc_neh { - u8 evt_type; - __le16 evt; - u8 context; -+ u8 completed; - uwb_rc_cmd_cb_f cb; - void *arg; - -@@ -409,6 +410,7 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size - struct device *dev = &rc->uwb_dev.dev; - struct uwb_rc_neh *neh; - struct uwb_rceb *notif; -+ unsigned long flags; - - if (rceb->bEventContext == 0) { - notif = kmalloc(size, GFP_ATOMIC); -@@ -422,7 +424,11 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size - } else { - neh = uwb_rc_neh_lookup(rc, rceb); - if (neh) { -- del_timer_sync(&neh->timer); -+ spin_lock_irqsave(&rc->neh_lock, flags); -+ /* to guard against a timeout */ -+ neh->completed = 1; -+ del_timer(&neh->timer); -+ spin_unlock_irqrestore(&rc->neh_lock, flags); - uwb_rc_neh_cb(neh, rceb, size); - } else - dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n", -@@ -568,6 +574,10 @@ static void uwb_rc_neh_timer(unsigned long arg) - unsigned long flags; - - spin_lock_irqsave(&rc->neh_lock, flags); -+ if (neh->completed) { -+ spin_unlock_irqrestore(&rc->neh_lock, flags); -+ return; -+ } - if (neh->context) - __uwb_rc_neh_rm(rc, neh); - else -diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c -index afca14d..625890c 100644 ---- a/drivers/xen/gntdev.c -+++ b/drivers/xen/gntdev.c -@@ -692,7 +692,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) - vma->vm_flags |= VM_RESERVED|VM_DONTEXPAND; - - if (use_ptemod) -- vma->vm_flags |= VM_DONTCOPY|VM_PFNMAP; -+ vma->vm_flags |= VM_DONTCOPY; - - vma->vm_private_data = map; - -diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c -index 2f73195..2ce95c0 100644 ---- a/drivers/xen/xenbus/xenbus_probe_frontend.c -+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c -@@ -129,7 +129,7 @@ static int read_backend_details(struct xenbus_device *xendev) - return xenbus_read_otherend_details(xendev, "backend-id", "backend"); - } - --static int is_device_connecting(struct device *dev, void *data) -+static int is_device_connecting(struct device *dev, void *data, bool ignore_nonessential) - { - struct xenbus_device *xendev = to_xenbus_device(dev); - struct device_driver *drv = data; -@@ -146,16 +146,41 @@ static int is_device_connecting(struct device *dev, void *data) - if (drv && (dev->driver != drv)) - return 0; - -+ if (ignore_nonessential) { -+ /* With older QEMU, for PVonHVM guests the guest config files -+ * could contain: vfb = [ 'vnc=1, vnclisten=0.0.0.0'] -+ * which is nonsensical as there is no PV FB (there can be -+ * a PVKB) running as HVM guest. */ -+ -+ if ((strncmp(xendev->nodename, "device/vkbd", 11) == 0)) -+ return 0; -+ -+ if ((strncmp(xendev->nodename, "device/vfb", 10) == 0)) -+ return 0; -+ } - xendrv = to_xenbus_driver(dev->driver); - return (xendev->state < XenbusStateConnected || - (xendev->state == XenbusStateConnected && - xendrv->is_ready && !xendrv->is_ready(xendev))); - } -+static int essential_device_connecting(struct device *dev, void *data) -+{ -+ return is_device_connecting(dev, data, true /* ignore PV[KBB+FB] */); -+} -+static int non_essential_device_connecting(struct device *dev, void *data) -+{ -+ return is_device_connecting(dev, data, false); -+} - --static int exists_connecting_device(struct device_driver *drv) -+static int exists_essential_connecting_device(struct device_driver *drv) - { - return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv, -- is_device_connecting); -+ essential_device_connecting); -+} -+static int exists_non_essential_connecting_device(struct device_driver *drv) -+{ -+ return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv, -+ non_essential_device_connecting); - } - - static int print_device_status(struct device *dev, void *data) -@@ -186,6 +211,23 @@ static int print_device_status(struct device *dev, void *data) - /* We only wait for device setup after most initcalls have run. */ - static int ready_to_wait_for_devices; - -+static bool wait_loop(unsigned long start, unsigned int max_delay, -+ unsigned int *seconds_waited) -+{ -+ if (time_after(jiffies, start + (*seconds_waited+5)*HZ)) { -+ if (!*seconds_waited) -+ printk(KERN_WARNING "XENBUS: Waiting for " -+ "devices to initialise: "); -+ *seconds_waited += 5; -+ printk("%us...", max_delay - *seconds_waited); -+ if (*seconds_waited == max_delay) -+ return true; -+ } -+ -+ schedule_timeout_interruptible(HZ/10); -+ -+ return false; -+} - /* - * On a 5-minute timeout, wait for all devices currently configured. We need - * to do this to guarantee that the filesystems and / or network devices -@@ -209,19 +251,14 @@ static void wait_for_devices(struct xenbus_driver *xendrv) - if (!ready_to_wait_for_devices || !xen_domain()) - return; - -- while (exists_connecting_device(drv)) { -- if (time_after(jiffies, start + (seconds_waited+5)*HZ)) { -- if (!seconds_waited) -- printk(KERN_WARNING "XENBUS: Waiting for " -- "devices to initialise: "); -- seconds_waited += 5; -- printk("%us...", 300 - seconds_waited); -- if (seconds_waited == 300) -- break; -- } -- -- schedule_timeout_interruptible(HZ/10); -- } -+ while (exists_non_essential_connecting_device(drv)) -+ if (wait_loop(start, 30, &seconds_waited)) -+ break; -+ -+ /* Skips PVKB and PVFB check.*/ -+ while (exists_essential_connecting_device(drv)) -+ if (wait_loop(start, 270, &seconds_waited)) -+ break; - - if (seconds_waited) - printk("\n"); -diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h -index 308a98b..650d520 100644 ---- a/fs/autofs4/autofs_i.h -+++ b/fs/autofs4/autofs_i.h -@@ -110,7 +110,6 @@ struct autofs_sb_info { - int sub_version; - int min_proto; - int max_proto; -- int compat_daemon; - unsigned long exp_timeout; - unsigned int type; - int reghost_enabled; -@@ -269,6 +268,17 @@ int autofs4_fill_super(struct super_block *, void *, int); - struct autofs_info *autofs4_new_ino(struct autofs_sb_info *); - void autofs4_clean_ino(struct autofs_info *); - -+static inline int autofs_prepare_pipe(struct file *pipe) -+{ -+ if (!pipe->f_op || !pipe->f_op->write) -+ return -EINVAL; -+ if (!S_ISFIFO(pipe->f_dentry->d_inode->i_mode)) -+ return -EINVAL; -+ /* We want a packet pipe */ -+ pipe->f_flags |= O_DIRECT; -+ return 0; -+} -+ - /* Queue management functions */ - - int autofs4_wait(struct autofs_sb_info *,struct dentry *, enum autofs_notify); -diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c -index 56bac70..de54271 100644 ---- a/fs/autofs4/dev-ioctl.c -+++ b/fs/autofs4/dev-ioctl.c -@@ -376,7 +376,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp, - err = -EBADF; - goto out; - } -- if (!pipe->f_op || !pipe->f_op->write) { -+ if (autofs_prepare_pipe(pipe) < 0) { - err = -EPIPE; - fput(pipe); - goto out; -@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp, - sbi->pipefd = pipefd; - sbi->pipe = pipe; - sbi->catatonic = 0; -- sbi->compat_daemon = is_compat_task(); - } - out: - mutex_unlock(&sbi->wq_mutex); -diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c -index 98a5695..7b5293e 100644 ---- a/fs/autofs4/inode.c -+++ b/fs/autofs4/inode.c -@@ -19,7 +19,6 @@ - #include <linux/parser.h> - #include <linux/bitops.h> - #include <linux/magic.h> --#include <linux/compat.h> - #include "autofs_i.h" - #include <linux/module.h> - -@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent) - set_autofs_type_indirect(&sbi->type); - sbi->min_proto = 0; - sbi->max_proto = 0; -- sbi->compat_daemon = is_compat_task(); - mutex_init(&sbi->wq_mutex); - spin_lock_init(&sbi->fs_lock); - sbi->queues = NULL; -@@ -294,7 +292,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent) - printk("autofs: could not open pipe file descriptor\n"); - goto fail_dput; - } -- if (!pipe->f_op || !pipe->f_op->write) -+ if (autofs_prepare_pipe(pipe) < 0) - goto fail_fput; - sbi->pipe = pipe; - sbi->pipefd = pipefd; -diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c -index 6861f61..e1fbdee 100644 ---- a/fs/autofs4/waitq.c -+++ b/fs/autofs4/waitq.c -@@ -90,24 +90,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes) - - return (bytes > 0); - } -- --/* -- * The autofs_v5 packet was misdesigned. -- * -- * The packets are identical on x86-32 and x86-64, but have different -- * alignment. Which means that 'sizeof()' will give different results. -- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel. -- */ --static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi) --{ -- size_t pktsz = sizeof(struct autofs_v5_packet); --#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT) -- if (sbi->compat_daemon > 0) -- pktsz -= 4; --#endif -- return pktsz; --} -- -+ - static void autofs4_notify_daemon(struct autofs_sb_info *sbi, - struct autofs_wait_queue *wq, - int type) -@@ -164,7 +147,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, - { - struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet; - -- pktsz = autofs_v5_packet_size(sbi); -+ pktsz = sizeof(*packet); -+ - packet->wait_queue_token = wq->wait_queue_token; - packet->len = wq->name.len; - memcpy(packet->name, wq->name.name, wq->name.len); -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index 6738503..83a871f 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -2025,7 +2025,7 @@ BTRFS_SETGET_STACK_FUNCS(root_last_snapshot, struct btrfs_root_item, - - static inline bool btrfs_root_readonly(struct btrfs_root *root) - { -- return root->root_item.flags & BTRFS_ROOT_SUBVOL_RDONLY; -+ return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0; - } - - /* struct btrfs_root_backup */ -diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c -index 0e6adac..e89803b 100644 ---- a/fs/cifs/cifssmb.c -+++ b/fs/cifs/cifssmb.c -@@ -4826,8 +4826,12 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr, - max_len = data_end - temp; - node->node_name = cifs_strndup_from_ucs(temp, max_len, - is_unicode, nls_codepage); -- if (!node->node_name) -+ if (!node->node_name) { - rc = -ENOMEM; -+ goto parse_DFS_referrals_exit; -+ } -+ -+ ref++; - } - - parse_DFS_referrals_exit: -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index ea54cde..4d9d3a4 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -988,6 +988,10 @@ static int path_count[PATH_ARR_SIZE]; - - static int path_count_inc(int nests) - { -+ /* Allow an arbitrary number of depth 1 paths */ -+ if (nests == 0) -+ return 0; -+ - if (++path_count[nests] > path_limits[nests]) - return -1; - return 0; -diff --git a/fs/exec.c b/fs/exec.c -index 3625464..160cd2f 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -973,6 +973,9 @@ static int de_thread(struct task_struct *tsk) - sig->notify_count = 0; - - no_thread_group: -+ /* we have changed execution domain */ -+ tsk->exit_signal = SIGCHLD; -+ - if (current->mm) - setmax_mm_hiwater_rss(&sig->maxrss, current->mm); - -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index c2a2012..54f2bdc 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -2812,7 +2812,7 @@ static int ext4_split_extent_at(handle_t *handle, - if (err) - goto fix_extent_len; - /* update the extent length and mark as initialized */ -- ex->ee_len = cpu_to_le32(ee_len); -+ ex->ee_len = cpu_to_le16(ee_len); - ext4_ext_try_to_merge(inode, path, ex); - err = ext4_ext_dirty(handle, inode, path + depth); - goto out; -diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c -index 4dfbfec..ec2a9c2 100644 ---- a/fs/hfsplus/catalog.c -+++ b/fs/hfsplus/catalog.c -@@ -366,6 +366,10 @@ int hfsplus_rename_cat(u32 cnid, - err = hfs_brec_find(&src_fd); - if (err) - goto out; -+ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) { -+ err = -EIO; -+ goto out; -+ } - - hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset, - src_fd.entrylength); -diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c -index 4536cd3..5adb740 100644 ---- a/fs/hfsplus/dir.c -+++ b/fs/hfsplus/dir.c -@@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir) - filp->f_pos++; - /* fall through */ - case 1: -+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { -+ err = -EIO; -+ goto out; -+ } -+ - hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, - fd.entrylength); - if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) { -@@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir) - err = -EIO; - goto out; - } -+ -+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { -+ err = -EIO; -+ goto out; -+ } -+ - hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, - fd.entrylength); - type = be16_to_cpu(entry.type); -diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c -index 68d704d..d751f04 100644 ---- a/fs/jbd2/commit.c -+++ b/fs/jbd2/commit.c -@@ -683,7 +683,7 @@ start_journal_io: - if (commit_transaction->t_need_data_flush && - (journal->j_fs_dev != journal->j_dev) && - (journal->j_flags & JBD2_BARRIER)) -- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); -+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); - - /* Done it all: now write the commit record asynchronously. */ - if (JBD2_HAS_INCOMPAT_FEATURE(journal, -@@ -819,7 +819,7 @@ wait_for_iobuf: - if (JBD2_HAS_INCOMPAT_FEATURE(journal, - JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) && - journal->j_flags & JBD2_BARRIER) { -- blkdev_issue_flush(journal->j_dev, GFP_KERNEL, NULL); -+ blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL); - } - - if (err) -diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c -index f848b52..046bb77 100644 ---- a/fs/lockd/clnt4xdr.c -+++ b/fs/lockd/clnt4xdr.c -@@ -241,7 +241,7 @@ static int decode_nlm4_stat(struct xdr_stream *xdr, __be32 *stat) - p = xdr_inline_decode(xdr, 4); - if (unlikely(p == NULL)) - goto out_overflow; -- if (unlikely(*p > nlm4_failed)) -+ if (unlikely(ntohl(*p) > ntohl(nlm4_failed))) - goto out_bad_xdr; - *stat = *p; - return 0; -diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c -index 180ac34..36057ce 100644 ---- a/fs/lockd/clntxdr.c -+++ b/fs/lockd/clntxdr.c -@@ -236,7 +236,7 @@ static int decode_nlm_stat(struct xdr_stream *xdr, - p = xdr_inline_decode(xdr, 4); - if (unlikely(p == NULL)) - goto out_overflow; -- if (unlikely(*p > nlm_lck_denied_grace_period)) -+ if (unlikely(ntohl(*p) > ntohl(nlm_lck_denied_grace_period))) - goto out_enum; - *stat = *p; - return 0; -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 757293b..51f6a40 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -4453,7 +4453,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f - static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request) - { - struct nfs_server *server = NFS_SERVER(state->inode); -- struct nfs4_exception exception = { }; -+ struct nfs4_exception exception = { -+ .inode = state->inode, -+ }; - int err; - - do { -@@ -4471,7 +4473,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request - static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request) - { - struct nfs_server *server = NFS_SERVER(state->inode); -- struct nfs4_exception exception = { }; -+ struct nfs4_exception exception = { -+ .inode = state->inode, -+ }; - int err; - - err = nfs4_set_lock_state(state, request); -@@ -4551,6 +4555,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock * - { - struct nfs4_exception exception = { - .state = state, -+ .inode = state->inode, - }; - int err; - -@@ -4596,6 +4601,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request) - - if (state == NULL) - return -ENOLCK; -+ /* -+ * Don't rely on the VFS having checked the file open mode, -+ * since it won't do this for flock() locks. -+ */ -+ switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) { -+ case F_RDLCK: -+ if (!(filp->f_mode & FMODE_READ)) -+ return -EBADF; -+ break; -+ case F_WRLCK: -+ if (!(filp->f_mode & FMODE_WRITE)) -+ return -EBADF; -+ } -+ - do { - status = nfs4_proc_setlk(state, cmd, request); - if ((status != -EAGAIN) || IS_SETLK(cmd)) -diff --git a/fs/nfs/read.c b/fs/nfs/read.c -index cfa175c..41bae32 100644 ---- a/fs/nfs/read.c -+++ b/fs/nfs/read.c -@@ -324,7 +324,7 @@ out_bad: - while (!list_empty(res)) { - data = list_entry(res->next, struct nfs_read_data, list); - list_del(&data->list); -- nfs_readdata_free(data); -+ nfs_readdata_release(data); - } - nfs_readpage_release(req); - return -ENOMEM; -diff --git a/fs/nfs/super.c b/fs/nfs/super.c -index 3ada13c..376cd65 100644 ---- a/fs/nfs/super.c -+++ b/fs/nfs/super.c -@@ -2708,11 +2708,15 @@ static struct vfsmount *nfs_do_root_mount(struct file_system_type *fs_type, - char *root_devname; - size_t len; - -- len = strlen(hostname) + 3; -+ len = strlen(hostname) + 5; - root_devname = kmalloc(len, GFP_KERNEL); - if (root_devname == NULL) - return ERR_PTR(-ENOMEM); -- snprintf(root_devname, len, "%s:/", hostname); -+ /* Does hostname needs to be enclosed in brackets? */ -+ if (strchr(hostname, ':')) -+ snprintf(root_devname, len, "[%s]:/", hostname); -+ else -+ snprintf(root_devname, len, "%s:/", hostname); - root_mnt = vfs_kern_mount(fs_type, flags, root_devname, data); - kfree(root_devname); - return root_mnt; -diff --git a/fs/nfs/write.c b/fs/nfs/write.c -index 1dda78d..4efd421 100644 ---- a/fs/nfs/write.c -+++ b/fs/nfs/write.c -@@ -974,7 +974,7 @@ out_bad: - while (!list_empty(res)) { - data = list_entry(res->next, struct nfs_write_data, list); - list_del(&data->list); -- nfs_writedata_free(data); -+ nfs_writedata_release(data); - } - nfs_redirty_request(req); - return -ENOMEM; -diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c -index 08c6e36..43f46cd 100644 ---- a/fs/nfsd/nfs3xdr.c -+++ b/fs/nfsd/nfs3xdr.c -@@ -803,13 +803,13 @@ encode_entry_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name, - return p; - } - --static int -+static __be32 - compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp, - const char *name, int namlen) - { - struct svc_export *exp; - struct dentry *dparent, *dchild; -- int rv = 0; -+ __be32 rv = nfserr_noent; - - dparent = cd->fh.fh_dentry; - exp = cd->fh.fh_export; -@@ -817,26 +817,20 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp, - if (isdotent(name, namlen)) { - if (namlen == 2) { - dchild = dget_parent(dparent); -- if (dchild == dparent) { -- /* filesystem root - cannot return filehandle for ".." */ -- dput(dchild); -- return -ENOENT; -- } -+ /* filesystem root - cannot return filehandle for ".." */ -+ if (dchild == dparent) -+ goto out; - } else - dchild = dget(dparent); - } else - dchild = lookup_one_len(name, dparent, namlen); - if (IS_ERR(dchild)) -- return -ENOENT; -- rv = -ENOENT; -+ return rv; - if (d_mountpoint(dchild)) - goto out; -- rv = fh_compose(fhp, exp, dchild, &cd->fh); -- if (rv) -- goto out; - if (!dchild->d_inode) - goto out; -- rv = 0; -+ rv = fh_compose(fhp, exp, dchild, &cd->fh); - out: - dput(dchild); - return rv; -@@ -845,7 +839,7 @@ out: - static __be32 *encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name, int namlen) - { - struct svc_fh fh; -- int err; -+ __be32 err; - - fh_init(&fh, NFS3_FHSIZE); - err = compose_entry_fh(cd, &fh, name, namlen); -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index fa38336..b8c5538 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -231,17 +231,17 @@ do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_o - */ - if (open->op_createmode == NFS4_CREATE_EXCLUSIVE && status == 0) - open->op_bmval[1] = (FATTR4_WORD1_TIME_ACCESS | -- FATTR4_WORD1_TIME_MODIFY); -+ FATTR4_WORD1_TIME_MODIFY); - } else { - status = nfsd_lookup(rqstp, current_fh, - open->op_fname.data, open->op_fname.len, &resfh); - fh_unlock(current_fh); -- if (status) -- goto out; -- status = nfsd_check_obj_isreg(&resfh); - } - if (status) - goto out; -+ status = nfsd_check_obj_isreg(&resfh); -+ if (status) -+ goto out; - - if (is_create_with_attrs(open) && open->op_acl != NULL) - do_set_nfs4_acl(rqstp, &resfh, open->op_acl, open->op_bmval); -@@ -827,6 +827,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - struct nfsd4_setattr *setattr) - { - __be32 status = nfs_ok; -+ int err; - - if (setattr->sa_iattr.ia_valid & ATTR_SIZE) { - nfs4_lock_state(); -@@ -838,9 +839,9 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - return status; - } - } -- status = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt); -- if (status) -- return status; -+ err = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt); -+ if (err) -+ return nfserrno(err); - status = nfs_ok; - - status = check_attr_support(rqstp, cstate, setattr->sa_bmval, -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 5abced7..4cfe260 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -4080,16 +4080,14 @@ out: - * vfs_test_lock. (Arguably perhaps test_lock should be done with an - * inode operation.) - */ --static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock) -+static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock) - { - struct file *file; -- int err; -- -- err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file); -- if (err) -- return err; -- err = vfs_test_lock(file, lock); -- nfsd_close(file); -+ __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file); -+ if (!err) { -+ err = nfserrno(vfs_test_lock(file, lock)); -+ nfsd_close(file); -+ } - return err; - } - -@@ -4103,7 +4101,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - struct inode *inode; - struct file_lock file_lock; - struct nfs4_lockowner *lo; -- int error; - __be32 status; - - if (locks_in_grace()) -@@ -4149,12 +4146,10 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - - nfs4_transform_lock_offset(&file_lock); - -- status = nfs_ok; -- error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock); -- if (error) { -- status = nfserrno(error); -+ status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock); -+ if (status) - goto out; -- } -+ - if (file_lock.fl_type != F_UNLCK) { - status = nfserr_denied; - nfs4_set_lock_denied(&file_lock, &lockt->lt_denied); -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index b6fa792..9cfa60a 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -3411,7 +3411,7 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, int nfserr, - nfsd4_decode_stateid(argp, &si); - valid = nfs4_validate_stateid(cl, &si); - RESERVE_SPACE(4); -- *p++ = htonl(valid); -+ *p++ = valid; - resp->p = p; - } - nfs4_unlock_state(); -diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c -index 7a2e442..5c3cd82 100644 ---- a/fs/nfsd/vfs.c -+++ b/fs/nfsd/vfs.c -@@ -1439,7 +1439,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, - switch (createmode) { - case NFS3_CREATE_UNCHECKED: - if (! S_ISREG(dchild->d_inode->i_mode)) -- err = nfserr_exist; -+ goto out; - else if (truncp) { - /* in nfsv4, we need to treat this case a little - * differently. we don't want to truncate the -diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c -index 3165aeb..31b9463 100644 ---- a/fs/ocfs2/alloc.c -+++ b/fs/ocfs2/alloc.c -@@ -1134,7 +1134,7 @@ static int ocfs2_adjust_rightmost_branch(handle_t *handle, - } - - el = path_leaf_el(path); -- rec = &el->l_recs[le32_to_cpu(el->l_next_free_rec) - 1]; -+ rec = &el->l_recs[le16_to_cpu(el->l_next_free_rec) - 1]; - - ocfs2_adjust_rightmost_records(handle, et, path, rec); - -diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c -index cf78233..9f32d7c 100644 ---- a/fs/ocfs2/refcounttree.c -+++ b/fs/ocfs2/refcounttree.c -@@ -1036,14 +1036,14 @@ static int ocfs2_get_refcount_cpos_end(struct ocfs2_caching_info *ci, - - tmp_el = left_path->p_node[subtree_root].el; - blkno = left_path->p_node[subtree_root+1].bh->b_blocknr; -- for (i = 0; i < le32_to_cpu(tmp_el->l_next_free_rec); i++) { -+ for (i = 0; i < le16_to_cpu(tmp_el->l_next_free_rec); i++) { - if (le64_to_cpu(tmp_el->l_recs[i].e_blkno) == blkno) { - *cpos_end = le32_to_cpu(tmp_el->l_recs[i+1].e_cpos); - break; - } - } - -- BUG_ON(i == le32_to_cpu(tmp_el->l_next_free_rec)); -+ BUG_ON(i == le16_to_cpu(tmp_el->l_next_free_rec)); - - out: - ocfs2_free_path(left_path); -@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh, - - trace_ocfs2_divide_leaf_refcount_block( - (unsigned long long)ref_leaf_bh->b_blocknr, -- le32_to_cpu(rl->rl_count), le32_to_cpu(rl->rl_used)); -+ le16_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used)); - - /* - * XXX: Improvement later. -@@ -2411,7 +2411,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb, - rb = (struct ocfs2_refcount_block *) - prev_bh->b_data; - -- if (le64_to_cpu(rb->rf_records.rl_used) + -+ if (le16_to_cpu(rb->rf_records.rl_used) + - recs_add > - le16_to_cpu(rb->rf_records.rl_count)) - ref_blocks++; -@@ -2476,7 +2476,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb, - if (prev_bh) { - rb = (struct ocfs2_refcount_block *)prev_bh->b_data; - -- if (le64_to_cpu(rb->rf_records.rl_used) + recs_add > -+ if (le16_to_cpu(rb->rf_records.rl_used) + recs_add > - le16_to_cpu(rb->rf_records.rl_count)) - ref_blocks++; - -@@ -3629,7 +3629,7 @@ int ocfs2_refcounted_xattr_delete_need(struct inode *inode, - * one will split a refcount rec, so totally we need - * clusters * 2 new refcount rec. - */ -- if (le64_to_cpu(rb->rf_records.rl_used) + clusters * 2 > -+ if (le16_to_cpu(rb->rf_records.rl_used) + clusters * 2 > - le16_to_cpu(rb->rf_records.rl_count)) - ref_blocks++; - -diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c -index ba5d97e..f169da4 100644 ---- a/fs/ocfs2/suballoc.c -+++ b/fs/ocfs2/suballoc.c -@@ -600,7 +600,7 @@ static void ocfs2_bg_alloc_cleanup(handle_t *handle, - ret = ocfs2_free_clusters(handle, cluster_ac->ac_inode, - cluster_ac->ac_bh, - le64_to_cpu(rec->e_blkno), -- le32_to_cpu(rec->e_leaf_clusters)); -+ le16_to_cpu(rec->e_leaf_clusters)); - if (ret) - mlog_errno(ret); - /* Try all the clusters to free */ -@@ -1628,7 +1628,7 @@ static int ocfs2_bg_discontig_fix_by_rec(struct ocfs2_suballoc_result *res, - { - unsigned int bpc = le16_to_cpu(cl->cl_bpc); - unsigned int bitoff = le32_to_cpu(rec->e_cpos) * bpc; -- unsigned int bitcount = le32_to_cpu(rec->e_leaf_clusters) * bpc; -+ unsigned int bitcount = le16_to_cpu(rec->e_leaf_clusters) * bpc; - - if (res->sr_bit_offset < bitoff) - return 0; -diff --git a/fs/pipe.c b/fs/pipe.c -index 4065f07..05ed5ca 100644 ---- a/fs/pipe.c -+++ b/fs/pipe.c -@@ -345,6 +345,16 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = { - .get = generic_pipe_buf_get, - }; - -+static const struct pipe_buf_operations packet_pipe_buf_ops = { -+ .can_merge = 0, -+ .map = generic_pipe_buf_map, -+ .unmap = generic_pipe_buf_unmap, -+ .confirm = generic_pipe_buf_confirm, -+ .release = anon_pipe_buf_release, -+ .steal = generic_pipe_buf_steal, -+ .get = generic_pipe_buf_get, -+}; -+ - static ssize_t - pipe_read(struct kiocb *iocb, const struct iovec *_iov, - unsigned long nr_segs, loff_t pos) -@@ -406,6 +416,13 @@ redo: - ret += chars; - buf->offset += chars; - buf->len -= chars; -+ -+ /* Was it a packet buffer? Clean up and exit */ -+ if (buf->flags & PIPE_BUF_FLAG_PACKET) { -+ total_len = chars; -+ buf->len = 0; -+ } -+ - if (!buf->len) { - buf->ops = NULL; - ops->release(pipe, buf); -@@ -458,6 +475,11 @@ redo: - return ret; - } - -+static inline int is_packetized(struct file *file) -+{ -+ return (file->f_flags & O_DIRECT) != 0; -+} -+ - static ssize_t - pipe_write(struct kiocb *iocb, const struct iovec *_iov, - unsigned long nr_segs, loff_t ppos) -@@ -592,6 +614,11 @@ redo2: - buf->ops = &anon_pipe_buf_ops; - buf->offset = 0; - buf->len = chars; -+ buf->flags = 0; -+ if (is_packetized(filp)) { -+ buf->ops = &packet_pipe_buf_ops; -+ buf->flags = PIPE_BUF_FLAG_PACKET; -+ } - pipe->nrbufs = ++bufs; - pipe->tmp_page = NULL; - -@@ -1012,7 +1039,7 @@ struct file *create_write_pipe(int flags) - goto err_dentry; - f->f_mapping = inode->i_mapping; - -- f->f_flags = O_WRONLY | (flags & O_NONBLOCK); -+ f->f_flags = O_WRONLY | (flags & (O_NONBLOCK | O_DIRECT)); - f->f_version = 0; - - return f; -@@ -1056,7 +1083,7 @@ int do_pipe_flags(int *fd, int flags) - int error; - int fdw, fdr; - -- if (flags & ~(O_CLOEXEC | O_NONBLOCK)) -+ if (flags & ~(O_CLOEXEC | O_NONBLOCK | O_DIRECT)) - return -EINVAL; - - fw = create_write_pipe(flags); -diff --git a/fs/splice.c b/fs/splice.c -index fa2defa..6d0dfb8 100644 ---- a/fs/splice.c -+++ b/fs/splice.c -@@ -31,6 +31,7 @@ - #include <linux/uio.h> - #include <linux/security.h> - #include <linux/gfp.h> -+#include <linux/socket.h> - - /* - * Attempt to steal a page from a pipe buffer. This should perhaps go into -@@ -691,7 +692,9 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe, - if (!likely(file->f_op && file->f_op->sendpage)) - return -EINVAL; - -- more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len; -+ more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0; -+ if (sd->len < sd->total_len) -+ more |= MSG_SENDPAGE_NOTLAST; - return file->f_op->sendpage(file, buf->page, buf->offset, - sd->len, &pos, more); - } -diff --git a/include/asm-generic/statfs.h b/include/asm-generic/statfs.h -index 0fd28e0..c749af9 100644 ---- a/include/asm-generic/statfs.h -+++ b/include/asm-generic/statfs.h -@@ -15,7 +15,7 @@ typedef __kernel_fsid_t fsid_t; - * with a 10' pole. - */ - #ifndef __statfs_word --#if BITS_PER_LONG == 64 -+#if __BITS_PER_LONG == 64 - #define __statfs_word long - #else - #define __statfs_word __u32 -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 2362a0b..1328d8c 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -383,7 +383,18 @@ extern int __init efi_setup_pcdp_console(char *); - #define EFI_VARIABLE_NON_VOLATILE 0x0000000000000001 - #define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x0000000000000002 - #define EFI_VARIABLE_RUNTIME_ACCESS 0x0000000000000004 -- -+#define EFI_VARIABLE_HARDWARE_ERROR_RECORD 0x0000000000000008 -+#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS 0x0000000000000010 -+#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x0000000000000020 -+#define EFI_VARIABLE_APPEND_WRITE 0x0000000000000040 -+ -+#define EFI_VARIABLE_MASK (EFI_VARIABLE_NON_VOLATILE | \ -+ EFI_VARIABLE_BOOTSERVICE_ACCESS | \ -+ EFI_VARIABLE_RUNTIME_ACCESS | \ -+ EFI_VARIABLE_HARDWARE_ERROR_RECORD | \ -+ EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | \ -+ EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \ -+ EFI_VARIABLE_APPEND_WRITE) - /* - * EFI Device Path information - */ -diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h -index d526231..35410ef 100644 ---- a/include/linux/kvm_host.h -+++ b/include/linux/kvm_host.h -@@ -562,6 +562,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id); - - #ifdef CONFIG_IOMMU_API - int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot); -+void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot); - int kvm_iommu_map_guest(struct kvm *kvm); - int kvm_iommu_unmap_guest(struct kvm *kvm); - int kvm_assign_device(struct kvm *kvm, -@@ -575,6 +576,11 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm, - return 0; - } - -+static inline void kvm_iommu_unmap_pages(struct kvm *kvm, -+ struct kvm_memory_slot *slot) -+{ -+} -+ - static inline int kvm_iommu_map_guest(struct kvm *kvm) - { - return -ENODEV; -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index a82ad4d..cbeb586 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -2536,8 +2536,6 @@ extern void net_disable_timestamp(void); - extern void *dev_seq_start(struct seq_file *seq, loff_t *pos); - extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos); - extern void dev_seq_stop(struct seq_file *seq, void *v); --extern int dev_seq_open_ops(struct inode *inode, struct file *file, -- const struct seq_operations *ops); - #endif - - extern int netdev_class_create_file(struct class_attribute *class_attr); -diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h -index 77257c9..0072a53 100644 ---- a/include/linux/pipe_fs_i.h -+++ b/include/linux/pipe_fs_i.h -@@ -8,6 +8,7 @@ - #define PIPE_BUF_FLAG_LRU 0x01 /* page is on the LRU */ - #define PIPE_BUF_FLAG_ATOMIC 0x02 /* was atomically mapped */ - #define PIPE_BUF_FLAG_GIFT 0x04 /* page is a gift */ -+#define PIPE_BUF_FLAG_PACKET 0x08 /* read() as a packet */ - - /** - * struct pipe_buffer - a linux kernel pipe buffer -diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h -index c6db9fb..bb1fac5 100644 ---- a/include/linux/seqlock.h -+++ b/include/linux/seqlock.h -@@ -141,7 +141,7 @@ static inline unsigned __read_seqcount_begin(const seqcount_t *s) - unsigned ret; - - repeat: -- ret = s->sequence; -+ ret = ACCESS_ONCE(s->sequence); - if (unlikely(ret & 1)) { - cpu_relax(); - goto repeat; -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 6cf8b53..e689b47 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -458,6 +458,7 @@ struct sk_buff { - union { - __u32 mark; - __u32 dropcount; -+ __u32 avail_size; - }; - - __u16 vlan_tci; -@@ -1326,6 +1327,18 @@ static inline int skb_tailroom(const struct sk_buff *skb) - } - - /** -+ * skb_availroom - bytes at buffer end -+ * @skb: buffer to check -+ * -+ * Return the number of bytes of free space at the tail of an sk_buff -+ * allocated by sk_stream_alloc() -+ */ -+static inline int skb_availroom(const struct sk_buff *skb) -+{ -+ return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len; -+} -+ -+/** - * skb_reserve - adjust headroom - * @skb: buffer to alter - * @len: bytes to move -diff --git a/include/linux/socket.h b/include/linux/socket.h -index d0e77f6..ad919e0 100644 ---- a/include/linux/socket.h -+++ b/include/linux/socket.h -@@ -265,7 +265,7 @@ struct ucred { - #define MSG_NOSIGNAL 0x4000 /* Do not generate SIGPIPE */ - #define MSG_MORE 0x8000 /* Sender will send more */ - #define MSG_WAITFORONE 0x10000 /* recvmmsg(): block until 1+ packets avail */ -- -+#define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */ - #define MSG_EOF MSG_FIN - - #define MSG_CMSG_CLOEXEC 0x40000000 /* Set close_on_exit for file -diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h -index 03354d5..64cec8d 100644 ---- a/include/linux/usb/hcd.h -+++ b/include/linux/usb/hcd.h -@@ -128,6 +128,8 @@ struct usb_hcd { - unsigned wireless:1; /* Wireless USB HCD */ - unsigned authorized_default:1; - unsigned has_tt:1; /* Integrated TT in root hub */ -+ unsigned broken_pci_sleep:1; /* Don't put the -+ controller in PCI-D3 for system sleep */ - - int irq; /* irq allocated */ - void __iomem *regs; /* device memory/io */ -diff --git a/kernel/exit.c b/kernel/exit.c -index e6e01b9..5a8a66e 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -819,25 +819,6 @@ static void exit_notify(struct task_struct *tsk, int group_dead) - if (group_dead) - kill_orphaned_pgrp(tsk->group_leader, NULL); - -- /* Let father know we died -- * -- * Thread signals are configurable, but you aren't going to use -- * that to send signals to arbitrary processes. -- * That stops right now. -- * -- * If the parent exec id doesn't match the exec id we saved -- * when we started then we know the parent has changed security -- * domain. -- * -- * If our self_exec id doesn't match our parent_exec_id then -- * we have changed execution domain as these two values started -- * the same after a fork. -- */ -- if (thread_group_leader(tsk) && tsk->exit_signal != SIGCHLD && -- (tsk->parent_exec_id != tsk->real_parent->self_exec_id || -- tsk->self_exec_id != tsk->parent_exec_id)) -- tsk->exit_signal = SIGCHLD; -- - if (unlikely(tsk->ptrace)) { - int sig = thread_group_leader(tsk) && - thread_group_empty(tsk) && -diff --git a/kernel/power/swap.c b/kernel/power/swap.c -index 11a594c..b313086 100644 ---- a/kernel/power/swap.c -+++ b/kernel/power/swap.c -@@ -52,6 +52,23 @@ - - #define MAP_PAGE_ENTRIES (PAGE_SIZE / sizeof(sector_t) - 1) - -+/* -+ * Number of free pages that are not high. -+ */ -+static inline unsigned long low_free_pages(void) -+{ -+ return nr_free_pages() - nr_free_highpages(); -+} -+ -+/* -+ * Number of pages required to be kept free while writing the image. Always -+ * half of all available low pages before the writing starts. -+ */ -+static inline unsigned long reqd_free_pages(void) -+{ -+ return low_free_pages() / 2; -+} -+ - struct swap_map_page { - sector_t entries[MAP_PAGE_ENTRIES]; - sector_t next_swap; -@@ -73,7 +90,7 @@ struct swap_map_handle { - sector_t cur_swap; - sector_t first_sector; - unsigned int k; -- unsigned long nr_free_pages, written; -+ unsigned long reqd_free_pages; - u32 crc32; - }; - -@@ -317,8 +334,7 @@ static int get_swap_writer(struct swap_map_handle *handle) - goto err_rel; - } - handle->k = 0; -- handle->nr_free_pages = nr_free_pages() >> 1; -- handle->written = 0; -+ handle->reqd_free_pages = reqd_free_pages(); - handle->first_sector = handle->cur_swap; - return 0; - err_rel: -@@ -353,11 +369,11 @@ static int swap_write_page(struct swap_map_handle *handle, void *buf, - handle->cur_swap = offset; - handle->k = 0; - } -- if (bio_chain && ++handle->written > handle->nr_free_pages) { -+ if (bio_chain && low_free_pages() <= handle->reqd_free_pages) { - error = hib_wait_on_bio_chain(bio_chain); - if (error) - goto out; -- handle->written = 0; -+ handle->reqd_free_pages = reqd_free_pages(); - } - out: - return error; -@@ -619,7 +635,7 @@ static int save_image_lzo(struct swap_map_handle *handle, - * Adjust number of free pages after all allocations have been done. - * We don't want to run out of pages when writing. - */ -- handle->nr_free_pages = nr_free_pages() >> 1; -+ handle->reqd_free_pages = reqd_free_pages(); - - /* - * Start the CRC32 thread. -diff --git a/kernel/sched.c b/kernel/sched.c -index d6b149c..299f55c 100644 ---- a/kernel/sched.c -+++ b/kernel/sched.c -@@ -3538,13 +3538,10 @@ calc_load_n(unsigned long load, unsigned long exp, - * Once we've updated the global active value, we need to apply the exponential - * weights adjusted to the number of cycles missed. - */ --static void calc_global_nohz(unsigned long ticks) -+static void calc_global_nohz(void) - { - long delta, active, n; - -- if (time_before(jiffies, calc_load_update)) -- return; -- - /* - * If we crossed a calc_load_update boundary, make sure to fold - * any pending idle changes, the respective CPUs might have -@@ -3556,31 +3553,25 @@ static void calc_global_nohz(unsigned long ticks) - atomic_long_add(delta, &calc_load_tasks); - - /* -- * If we were idle for multiple load cycles, apply them. -+ * It could be the one fold was all it took, we done! - */ -- if (ticks >= LOAD_FREQ) { -- n = ticks / LOAD_FREQ; -+ if (time_before(jiffies, calc_load_update + 10)) -+ return; - -- active = atomic_long_read(&calc_load_tasks); -- active = active > 0 ? active * FIXED_1 : 0; -+ /* -+ * Catch-up, fold however many we are behind still -+ */ -+ delta = jiffies - calc_load_update - 10; -+ n = 1 + (delta / LOAD_FREQ); - -- avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n); -- avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n); -- avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n); -+ active = atomic_long_read(&calc_load_tasks); -+ active = active > 0 ? active * FIXED_1 : 0; - -- calc_load_update += n * LOAD_FREQ; -- } -+ avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n); -+ avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n); -+ avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n); - -- /* -- * Its possible the remainder of the above division also crosses -- * a LOAD_FREQ period, the regular check in calc_global_load() -- * which comes after this will take care of that. -- * -- * Consider us being 11 ticks before a cycle completion, and us -- * sleeping for 4*LOAD_FREQ + 22 ticks, then the above code will -- * age us 4 cycles, and the test in calc_global_load() will -- * pick up the final one. -- */ -+ calc_load_update += n * LOAD_FREQ; - } - #else - static void calc_load_account_idle(struct rq *this_rq) -@@ -3592,7 +3583,7 @@ static inline long calc_load_fold_idle(void) - return 0; - } - --static void calc_global_nohz(unsigned long ticks) -+static void calc_global_nohz(void) - { - } - #endif -@@ -3620,8 +3611,6 @@ void calc_global_load(unsigned long ticks) - { - long active; - -- calc_global_nohz(ticks); -- - if (time_before(jiffies, calc_load_update + 10)) - return; - -@@ -3633,6 +3622,16 @@ void calc_global_load(unsigned long ticks) - avenrun[2] = calc_load(avenrun[2], EXP_15, active); - - calc_load_update += LOAD_FREQ; -+ -+ /* -+ * Account one period with whatever state we found before -+ * folding in the nohz state and ageing the entire idle period. -+ * -+ * This avoids loosing a sample when we go idle between -+ * calc_load_account_active() (10 ticks ago) and now and thus -+ * under-accounting. -+ */ -+ calc_global_nohz(); - } - - /* -@@ -7605,16 +7604,26 @@ static void __sdt_free(const struct cpumask *cpu_map) - struct sd_data *sdd = &tl->data; - - for_each_cpu(j, cpu_map) { -- struct sched_domain *sd = *per_cpu_ptr(sdd->sd, j); -- if (sd && (sd->flags & SD_OVERLAP)) -- free_sched_groups(sd->groups, 0); -- kfree(*per_cpu_ptr(sdd->sd, j)); -- kfree(*per_cpu_ptr(sdd->sg, j)); -- kfree(*per_cpu_ptr(sdd->sgp, j)); -+ struct sched_domain *sd; -+ -+ if (sdd->sd) { -+ sd = *per_cpu_ptr(sdd->sd, j); -+ if (sd && (sd->flags & SD_OVERLAP)) -+ free_sched_groups(sd->groups, 0); -+ kfree(*per_cpu_ptr(sdd->sd, j)); -+ } -+ -+ if (sdd->sg) -+ kfree(*per_cpu_ptr(sdd->sg, j)); -+ if (sdd->sgp) -+ kfree(*per_cpu_ptr(sdd->sgp, j)); - } - free_percpu(sdd->sd); -+ sdd->sd = NULL; - free_percpu(sdd->sg); -+ sdd->sg = NULL; - free_percpu(sdd->sgp); -+ sdd->sgp = NULL; - } - } - -diff --git a/kernel/signal.c b/kernel/signal.c -index 2065515..08e0b97 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -1610,6 +1610,15 @@ bool do_notify_parent(struct task_struct *tsk, int sig) - BUG_ON(!tsk->ptrace && - (tsk->group_leader != tsk || !thread_group_empty(tsk))); - -+ if (sig != SIGCHLD) { -+ /* -+ * This is only possible if parent == real_parent. -+ * Check if it has changed security domain. -+ */ -+ if (tsk->parent_exec_id != tsk->parent->self_exec_id) -+ sig = SIGCHLD; -+ } -+ - info.si_signo = sig; - info.si_errno = 0; - /* -diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c -index 5199930..1dcf253 100644 ---- a/kernel/trace/trace_output.c -+++ b/kernel/trace/trace_output.c -@@ -638,6 +638,8 @@ int trace_print_lat_context(struct trace_iterator *iter) - { - u64 next_ts; - int ret; -+ /* trace_find_next_entry will reset ent_size */ -+ int ent_size = iter->ent_size; - struct trace_seq *s = &iter->seq; - struct trace_entry *entry = iter->ent, - *next_entry = trace_find_next_entry(iter, NULL, -@@ -646,6 +648,9 @@ int trace_print_lat_context(struct trace_iterator *iter) - unsigned long abs_usecs = ns2usecs(iter->ts - iter->tr->time_start); - unsigned long rel_usecs; - -+ /* Restore the original ent_size */ -+ iter->ent_size = ent_size; -+ - if (!next_entry) - next_ts = iter->ts; - rel_usecs = ns2usecs(next_ts - iter->ts); -diff --git a/mm/swap_state.c b/mm/swap_state.c -index 78cc4d1..7704d9c 100644 ---- a/mm/swap_state.c -+++ b/mm/swap_state.c -@@ -27,7 +27,7 @@ - */ - static const struct address_space_operations swap_aops = { - .writepage = swap_writepage, -- .set_page_dirty = __set_page_dirty_nobuffers, -+ .set_page_dirty = __set_page_dirty_no_writeback, - .migratepage = migrate_page, - }; - -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index e7c69f4..b04a6ef 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -2006,16 +2006,17 @@ static void __exit ax25_exit(void) - proc_net_remove(&init_net, "ax25_route"); - proc_net_remove(&init_net, "ax25"); - proc_net_remove(&init_net, "ax25_calls"); -- ax25_rt_free(); -- ax25_uid_free(); -- ax25_dev_free(); - -- ax25_unregister_sysctl(); - unregister_netdevice_notifier(&ax25_dev_notifier); -+ ax25_unregister_sysctl(); - - dev_remove_pack(&ax25_packet_type); - - sock_unregister(PF_AX25); - proto_unregister(&ax25_proto); -+ -+ ax25_rt_free(); -+ ax25_uid_free(); -+ ax25_dev_free(); - } - module_exit(ax25_exit); -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index 8eb6b15..5ac1811 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data) - hlist_del_rcu(&mp->hlist[mdb->ver]); - mdb->size--; - -- del_timer(&mp->query_timer); - call_rcu_bh(&mp->rcu, br_multicast_free_group); - - out: -@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br, - rcu_assign_pointer(*pp, p->next); - hlist_del_init(&p->mglist); - del_timer(&p->timer); -- del_timer(&p->query_timer); - call_rcu_bh(&p->rcu, br_multicast_free_pg); - - if (!mp->ports && !mp->mglist && -@@ -507,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br, - return NULL; - } - --static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp) --{ -- struct net_bridge *br = mp->br; -- struct sk_buff *skb; -- -- skb = br_multicast_alloc_query(br, &mp->addr); -- if (!skb) -- goto timer; -- -- netif_rx(skb); -- --timer: -- if (++mp->queries_sent < br->multicast_last_member_count) -- mod_timer(&mp->query_timer, -- jiffies + br->multicast_last_member_interval); --} -- --static void br_multicast_group_query_expired(unsigned long data) --{ -- struct net_bridge_mdb_entry *mp = (void *)data; -- struct net_bridge *br = mp->br; -- -- spin_lock(&br->multicast_lock); -- if (!netif_running(br->dev) || !mp->mglist || -- mp->queries_sent >= br->multicast_last_member_count) -- goto out; -- -- br_multicast_send_group_query(mp); -- --out: -- spin_unlock(&br->multicast_lock); --} -- --static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg) --{ -- struct net_bridge_port *port = pg->port; -- struct net_bridge *br = port->br; -- struct sk_buff *skb; -- -- skb = br_multicast_alloc_query(br, &pg->addr); -- if (!skb) -- goto timer; -- -- br_deliver(port, skb); -- --timer: -- if (++pg->queries_sent < br->multicast_last_member_count) -- mod_timer(&pg->query_timer, -- jiffies + br->multicast_last_member_interval); --} -- --static void br_multicast_port_group_query_expired(unsigned long data) --{ -- struct net_bridge_port_group *pg = (void *)data; -- struct net_bridge_port *port = pg->port; -- struct net_bridge *br = port->br; -- -- spin_lock(&br->multicast_lock); -- if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) || -- pg->queries_sent >= br->multicast_last_member_count) -- goto out; -- -- br_multicast_send_port_group_query(pg); -- --out: -- spin_unlock(&br->multicast_lock); --} -- - static struct net_bridge_mdb_entry *br_multicast_get_group( - struct net_bridge *br, struct net_bridge_port *port, - struct br_ip *group, int hash) -@@ -690,8 +620,6 @@ rehash: - mp->addr = *group; - setup_timer(&mp->timer, br_multicast_group_expired, - (unsigned long)mp); -- setup_timer(&mp->query_timer, br_multicast_group_query_expired, -- (unsigned long)mp); - - hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]); - mdb->size++; -@@ -746,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br, - hlist_add_head(&p->mglist, &port->mglist); - setup_timer(&p->timer, br_multicast_port_group_expired, - (unsigned long)p); -- setup_timer(&p->query_timer, br_multicast_port_group_query_expired, -- (unsigned long)p); - - rcu_assign_pointer(*pp, p); - -@@ -1291,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br, - time_after(mp->timer.expires, time) : - try_to_del_timer_sync(&mp->timer) >= 0)) { - mod_timer(&mp->timer, time); -- -- mp->queries_sent = 0; -- mod_timer(&mp->query_timer, now); - } - - goto out; -@@ -1310,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br, - time_after(p->timer.expires, time) : - try_to_del_timer_sync(&p->timer) >= 0)) { - mod_timer(&p->timer, time); -- -- p->queries_sent = 0; -- mod_timer(&p->query_timer, now); - } - - break; -@@ -1680,7 +1600,6 @@ void br_multicast_stop(struct net_bridge *br) - hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i], - hlist[ver]) { - del_timer(&mp->timer); -- del_timer(&mp->query_timer); - call_rcu_bh(&mp->rcu, br_multicast_free_group); - } - } -diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h -index d7d6fb0..93264df 100644 ---- a/net/bridge/br_private.h -+++ b/net/bridge/br_private.h -@@ -82,9 +82,7 @@ struct net_bridge_port_group { - struct hlist_node mglist; - struct rcu_head rcu; - struct timer_list timer; -- struct timer_list query_timer; - struct br_ip addr; -- u32 queries_sent; - }; - - struct net_bridge_mdb_entry -@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry - struct net_bridge_port_group __rcu *ports; - struct rcu_head rcu; - struct timer_list timer; -- struct timer_list query_timer; - struct br_ip addr; - bool mglist; -- u32 queries_sent; - }; - - struct net_bridge_mdb_htable -diff --git a/net/core/dev.c b/net/core/dev.c -index 55cd370..cd5050e 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -4102,54 +4102,41 @@ static int dev_ifconf(struct net *net, char __user *arg) - - #ifdef CONFIG_PROC_FS - --#define BUCKET_SPACE (32 - NETDEV_HASHBITS) -- --struct dev_iter_state { -- struct seq_net_private p; -- unsigned int pos; /* bucket << BUCKET_SPACE + offset */ --}; -+#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1) - - #define get_bucket(x) ((x) >> BUCKET_SPACE) - #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1)) - #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o)) - --static inline struct net_device *dev_from_same_bucket(struct seq_file *seq) -+static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos) - { -- struct dev_iter_state *state = seq->private; - struct net *net = seq_file_net(seq); - struct net_device *dev; - struct hlist_node *p; - struct hlist_head *h; -- unsigned int count, bucket, offset; -+ unsigned int count = 0, offset = get_offset(*pos); - -- bucket = get_bucket(state->pos); -- offset = get_offset(state->pos); -- h = &net->dev_name_head[bucket]; -- count = 0; -+ h = &net->dev_name_head[get_bucket(*pos)]; - hlist_for_each_entry_rcu(dev, p, h, name_hlist) { -- if (count++ == offset) { -- state->pos = set_bucket_offset(bucket, count); -+ if (++count == offset) - return dev; -- } - } - - return NULL; - } - --static inline struct net_device *dev_from_new_bucket(struct seq_file *seq) -+static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos) - { -- struct dev_iter_state *state = seq->private; - struct net_device *dev; - unsigned int bucket; - -- bucket = get_bucket(state->pos); - do { -- dev = dev_from_same_bucket(seq); -+ dev = dev_from_same_bucket(seq, pos); - if (dev) - return dev; - -- bucket++; -- state->pos = set_bucket_offset(bucket, 0); -+ bucket = get_bucket(*pos) + 1; -+ *pos = set_bucket_offset(bucket, 1); - } while (bucket < NETDEV_HASHENTRIES); - - return NULL; -@@ -4162,33 +4149,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq) - void *dev_seq_start(struct seq_file *seq, loff_t *pos) - __acquires(RCU) - { -- struct dev_iter_state *state = seq->private; -- - rcu_read_lock(); - if (!*pos) - return SEQ_START_TOKEN; - -- /* check for end of the hash */ -- if (state->pos == 0 && *pos > 1) -+ if (get_bucket(*pos) >= NETDEV_HASHENTRIES) - return NULL; - -- return dev_from_new_bucket(seq); -+ return dev_from_bucket(seq, pos); - } - - void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos) - { -- struct net_device *dev; -- - ++*pos; -- -- if (v == SEQ_START_TOKEN) -- return dev_from_new_bucket(seq); -- -- dev = dev_from_same_bucket(seq); -- if (dev) -- return dev; -- -- return dev_from_new_bucket(seq); -+ return dev_from_bucket(seq, pos); - } - - void dev_seq_stop(struct seq_file *seq, void *v) -@@ -4287,13 +4261,7 @@ static const struct seq_operations dev_seq_ops = { - static int dev_seq_open(struct inode *inode, struct file *file) - { - return seq_open_net(inode, file, &dev_seq_ops, -- sizeof(struct dev_iter_state)); --} -- --int dev_seq_open_ops(struct inode *inode, struct file *file, -- const struct seq_operations *ops) --{ -- return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state)); -+ sizeof(struct seq_net_private)); - } - - static const struct file_operations dev_seq_fops = { -diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c -index febba51..277faef 100644 ---- a/net/core/dev_addr_lists.c -+++ b/net/core/dev_addr_lists.c -@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = { - - static int dev_mc_seq_open(struct inode *inode, struct file *file) - { -- return dev_seq_open_ops(inode, file, &dev_mc_seq_ops); -+ return seq_open_net(inode, file, &dev_mc_seq_ops, -+ sizeof(struct seq_net_private)); - } - - static const struct file_operations dev_mc_seq_fops = { -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index 0e950fd..31a5ae5 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -83,21 +83,29 @@ assign: - - static int ops_init(const struct pernet_operations *ops, struct net *net) - { -- int err; -+ int err = -ENOMEM; -+ void *data = NULL; -+ - if (ops->id && ops->size) { -- void *data = kzalloc(ops->size, GFP_KERNEL); -+ data = kzalloc(ops->size, GFP_KERNEL); - if (!data) -- return -ENOMEM; -+ goto out; - - err = net_assign_generic(net, *ops->id, data); -- if (err) { -- kfree(data); -- return err; -- } -+ if (err) -+ goto cleanup; - } -+ err = 0; - if (ops->init) -- return ops->init(net); -- return 0; -+ err = ops->init(net); -+ if (!err) -+ return 0; -+ -+cleanup: -+ kfree(data); -+ -+out: -+ return err; - } - - static void ops_free(const struct pernet_operations *ops, struct net *net) -@@ -448,12 +456,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops) - static int __register_pernet_operations(struct list_head *list, - struct pernet_operations *ops) - { -- int err = 0; -- err = ops_init(ops, &init_net); -- if (err) -- ops_free(ops, &init_net); -- return err; -- -+ return ops_init(ops, &init_net); - } - - static void __unregister_pernet_operations(struct pernet_operations *ops) -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 3c30ee4..2ec200de 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -903,9 +903,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, - goto adjust_others; - } - -- data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask); -+ data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)), -+ gfp_mask); - if (!data) - goto nodata; -+ size = SKB_WITH_OVERHEAD(ksize(data)); - - /* Copy only real data... and, alas, header. This should be - * optimized for the cases when header is void. -@@ -3111,6 +3113,8 @@ static void sock_rmem_free(struct sk_buff *skb) - */ - int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb) - { -+ int len = skb->len; -+ - if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >= - (unsigned)sk->sk_rcvbuf) - return -ENOMEM; -@@ -3125,7 +3129,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb) - - skb_queue_tail(&sk->sk_error_queue, skb); - if (!sock_flag(sk, SOCK_DEAD)) -- sk->sk_data_ready(sk, skb->len); -+ sk->sk_data_ready(sk, len); - return 0; - } - EXPORT_SYMBOL(sock_queue_err_skb); -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 34f5db1..7904db4 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp) - skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp); - if (skb) { - if (sk_wmem_schedule(sk, skb->truesize)) { -+ skb_reserve(skb, sk->sk_prot->max_header); - /* - * Make sure that we have exactly size bytes - * available to the caller, no more, no less. - */ -- skb_reserve(skb, skb_tailroom(skb) - size); -+ skb->avail_size = size; - return skb; - } - __kfree_skb(skb); -@@ -860,7 +861,7 @@ wait_for_memory: - } - - out: -- if (copied) -+ if (copied && !(flags & MSG_SENDPAGE_NOTLAST)) - tcp_push(sk, flags, mss_now, tp->nonagle); - return copied; - -@@ -995,10 +996,9 @@ new_segment: - copy = seglen; - - /* Where to copy to? */ -- if (skb_tailroom(skb) > 0) { -+ if (skb_availroom(skb) > 0) { - /* We have some space in skb head. Superb! */ -- if (copy > skb_tailroom(skb)) -- copy = skb_tailroom(skb); -+ copy = min_t(int, copy, skb_availroom(skb)); - err = skb_add_data_nocache(sk, skb, from, copy); - if (err) - goto do_fault; -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index e4d1e4a..daedc07 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -334,6 +334,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb) - incr = __tcp_grow_window(sk, skb); - - if (incr) { -+ incr = max_t(int, incr, 2 * skb->len); - tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr, - tp->window_clamp); - inet_csk(sk)->icsk_ack.quick |= 1; -@@ -473,8 +474,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep) - if (!win_dep) { - m -= (new_sample >> 3); - new_sample += m; -- } else if (m < new_sample) -- new_sample = m << 3; -+ } else { -+ m <<= 3; -+ if (m < new_sample) -+ new_sample = m; -+ } - } else { - /* No previous measure. */ - new_sample = m << 3; -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 097e0c7..c51dd5b 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1093,6 +1093,14 @@ static void __pskb_trim_head(struct sk_buff *skb, int len) - { - int i, k, eat; - -+ eat = min_t(int, len, skb_headlen(skb)); -+ if (eat) { -+ __skb_pull(skb, eat); -+ skb->avail_size -= eat; -+ len -= eat; -+ if (!len) -+ return; -+ } - eat = len; - k = 0; - for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) { -@@ -1124,11 +1132,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len) - if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) - return -ENOMEM; - -- /* If len == headlen, we avoid __skb_pull to preserve alignment. */ -- if (unlikely(len < skb_headlen(skb))) -- __skb_pull(skb, len); -- else -- __pskb_trim_head(skb, len - skb_headlen(skb)); -+ __pskb_trim_head(skb, len); - - TCP_SKB_CB(skb)->seq += len; - skb->ip_summed = CHECKSUM_PARTIAL; -@@ -2057,7 +2061,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to, - /* Punt if not enough space exists in the first SKB for - * the data in the second - */ -- if (skb->len > skb_tailroom(to)) -+ if (skb->len > skb_availroom(to)) - break; - - if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp))) -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index 2257366..f2d74ea 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -2054,7 +2054,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca, - if (!delta) - pmc->mca_sfcount[sfmode]--; - for (j=0; j<i; j++) -- (void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]); -+ ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]); - } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) { - struct ip6_sf_list *psf; - -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index b859e4a..4a56574 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1494,6 +1494,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb, - tcp_mtup_init(newsk); - tcp_sync_mss(newsk, dst_mtu(dst)); - newtp->advmss = dst_metric_advmss(dst); -+ if (tcp_sk(sk)->rx_opt.user_mss && -+ tcp_sk(sk)->rx_opt.user_mss < newtp->advmss) -+ newtp->advmss = tcp_sk(sk)->rx_opt.user_mss; -+ - tcp_initialize_rcv_mss(newsk); - if (tcp_rsk(req)->snt_synack) - tcp_valid_rtt_meas(newsk, -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index eff1f4e..4ff35bf 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -1121,7 +1121,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata, - tx->sta = rcu_dereference(sdata->u.vlan.sta); - if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr) - return TX_DROP; -- } else if (info->flags & IEEE80211_TX_CTL_INJECTED) { -+ } else if (info->flags & IEEE80211_TX_CTL_INJECTED || -+ tx->sdata->control_port_protocol == tx->skb->protocol) { - tx->sta = sta_info_get_bss(sdata, hdr->addr1); - } - if (!tx->sta) -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 1201b6d..a99fb41 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -830,12 +830,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, - return 0; - } - --int netlink_sendskb(struct sock *sk, struct sk_buff *skb) -+static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb) - { - int len = skb->len; - - skb_queue_tail(&sk->sk_receive_queue, skb); - sk->sk_data_ready(sk, len); -+ return len; -+} -+ -+int netlink_sendskb(struct sock *sk, struct sk_buff *skb) -+{ -+ int len = __netlink_sendskb(sk, skb); -+ - sock_put(sk); - return len; - } -@@ -960,8 +967,7 @@ static inline int netlink_broadcast_deliver(struct sock *sk, - if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && - !test_bit(0, &nlk->state)) { - skb_set_owner_r(skb, sk); -- skb_queue_tail(&sk->sk_receive_queue, skb); -- sk->sk_data_ready(sk, skb->len); -+ __netlink_sendskb(sk, skb); - return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf; - } - return -1; -@@ -1684,10 +1690,8 @@ static int netlink_dump(struct sock *sk) - - if (sk_filter(sk, skb)) - kfree_skb(skb); -- else { -- skb_queue_tail(&sk->sk_receive_queue, skb); -- sk->sk_data_ready(sk, skb->len); -- } -+ else -+ __netlink_sendskb(sk, skb); - return 0; - } - -@@ -1701,10 +1705,8 @@ static int netlink_dump(struct sock *sk) - - if (sk_filter(sk, skb)) - kfree_skb(skb); -- else { -- skb_queue_tail(&sk->sk_receive_queue, skb); -- sk->sk_data_ready(sk, skb->len); -- } -+ else -+ __netlink_sendskb(sk, skb); - - if (cb->done) - cb->done(cb); -diff --git a/net/phonet/pep.c b/net/phonet/pep.c -index 2ba6e9f..007546d 100644 ---- a/net/phonet/pep.c -+++ b/net/phonet/pep.c -@@ -1046,6 +1046,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk, - int flags = msg->msg_flags; - int err, done; - -+ if (len > USHRT_MAX) -+ return -EMSGSIZE; -+ - if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL| - MSG_CMSG_COMPAT)) || - !(msg->msg_flags & MSG_EOR)) -diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c -index 6cd8ddf..e1afe0c 100644 ---- a/net/sched/sch_gred.c -+++ b/net/sched/sch_gred.c -@@ -544,11 +544,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb) - opt.packets = q->packetsin; - opt.bytesin = q->bytesin; - -- if (gred_wred_mode(table)) { -- q->parms.qidlestart = -- table->tab[table->def]->parms.qidlestart; -- q->parms.qavg = table->tab[table->def]->parms.qavg; -- } -+ if (gred_wred_mode(table)) -+ gred_load_wred_set(table, q); - - opt.qave = red_calc_qavg(&q->parms, q->parms.qavg); - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 54a7cd2..0075554 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4133,9 +4133,10 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len, - static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval, - int __user *optlen) - { -- if (len < sizeof(struct sctp_event_subscribe)) -+ if (len <= 0) - return -EINVAL; -- len = sizeof(struct sctp_event_subscribe); -+ if (len > sizeof(struct sctp_event_subscribe)) -+ len = sizeof(struct sctp_event_subscribe); - if (put_user(len, optlen)) - return -EFAULT; - if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len)) -diff --git a/net/socket.c b/net/socket.c -index 2dce67a..273cbce 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -791,9 +791,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page, - - sock = file->private_data; - -- flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT; -- if (more) -- flags |= MSG_MORE; -+ flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0; -+ /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */ -+ flags |= more; - - return kernel_sendpage(sock, page, offset, size, flags); - } -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index ffafda5..c06c365 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -1258,6 +1258,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) - goto bad_res; - } - -+ if (!netif_running(netdev)) { -+ result = -ENETDOWN; -+ goto bad_res; -+ } -+ - nla_for_each_nested(nl_txq_params, - info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], - rem_txq_params) { -@@ -5944,7 +5949,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_get_key, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -5976,7 +5981,7 @@ static struct genl_ops nl80211_ops[] = { - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, - .doit = nl80211_addset_beacon, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -5984,7 +5989,7 @@ static struct genl_ops nl80211_ops[] = { - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, - .doit = nl80211_addset_beacon, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6008,7 +6013,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_set_station, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6024,7 +6029,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_del_station, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6057,7 +6062,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_del_mpath, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6065,7 +6070,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_set_bss, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6091,7 +6096,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_get_mesh_config, - .policy = nl80211_policy, - /* can be retrieved by unprivileged users */ -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6224,7 +6229,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_setdel_pmksa, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6232,7 +6237,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_setdel_pmksa, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6240,7 +6245,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_flush_pmksa, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -@@ -6328,7 +6333,7 @@ static struct genl_ops nl80211_ops[] = { - .doit = nl80211_set_wds_peer, - .policy = nl80211_policy, - .flags = GENL_ADMIN_PERM, -- .internal_flags = NL80211_FLAG_NEED_NETDEV | -+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, - }, - { -diff --git a/net/wireless/util.c b/net/wireless/util.c -index 4dde429..8bf8902 100644 ---- a/net/wireless/util.c -+++ b/net/wireless/util.c -@@ -996,7 +996,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev, - if (rdev->wiphy.software_iftypes & BIT(iftype)) - continue; - for (j = 0; j < c->n_limits; j++) { -- if (!(limits[j].types & iftype)) -+ if (!(limits[j].types & BIT(iftype))) - continue; - if (limits[j].max < num[iftype]) - goto cont; -diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c -index f936d1f..d1d0ae8 100644 ---- a/scripts/mod/file2alias.c -+++ b/scripts/mod/file2alias.c -@@ -926,6 +926,10 @@ void handle_moddevtable(struct module *mod, struct elf_info *info, - if (!sym->st_shndx || get_secindex(info, sym) >= info->num_sections) - return; - -+ /* We're looking for an object */ -+ if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT) -+ return; -+ - /* Handle all-NULL symbols allocated into .bss */ - if (info->sechdrs[get_secindex(info, sym)].sh_type & SHT_NOBITS) { - zeros = calloc(1, sym->st_size); -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index ae94929..51a1afc 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -4003,9 +4003,14 @@ static void cx_auto_init_output(struct hda_codec *codec) - int i; - - mute_outputs(codec, spec->multiout.num_dacs, spec->multiout.dac_nids); -- for (i = 0; i < cfg->hp_outs; i++) -+ for (i = 0; i < cfg->hp_outs; i++) { -+ unsigned int val = PIN_OUT; -+ if (snd_hda_query_pin_caps(codec, cfg->hp_pins[i]) & -+ AC_PINCAP_HP_DRV) -+ val |= AC_PINCTL_HP_EN; - snd_hda_codec_write(codec, cfg->hp_pins[i], 0, -- AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP); -+ AC_VERB_SET_PIN_WIDGET_CONTROL, val); -+ } - mute_outputs(codec, cfg->hp_outs, cfg->hp_pins); - mute_outputs(codec, cfg->line_outs, cfg->line_out_pins); - mute_outputs(codec, cfg->speaker_outs, cfg->speaker_pins); -@@ -4408,8 +4413,10 @@ static void apply_pin_fixup(struct hda_codec *codec, - - enum { - CXT_PINCFG_LENOVO_X200, -+ CXT_PINCFG_LENOVO_TP410, - }; - -+/* ThinkPad X200 & co with cxt5051 */ - static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = { - { 0x16, 0x042140ff }, /* HP (seq# overridden) */ - { 0x17, 0x21a11000 }, /* dock-mic */ -@@ -4417,15 +4424,33 @@ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = { - {} - }; - -+/* ThinkPad 410/420/510/520, X201 & co with cxt5066 */ -+static const struct cxt_pincfg cxt_pincfg_lenovo_tp410[] = { -+ { 0x19, 0x042110ff }, /* HP (seq# overridden) */ -+ { 0x1a, 0x21a190f0 }, /* dock-mic */ -+ { 0x1c, 0x212140ff }, /* dock-HP */ -+ {} -+}; -+ - static const struct cxt_pincfg *cxt_pincfg_tbl[] = { - [CXT_PINCFG_LENOVO_X200] = cxt_pincfg_lenovo_x200, -+ [CXT_PINCFG_LENOVO_TP410] = cxt_pincfg_lenovo_tp410, - }; - --static const struct snd_pci_quirk cxt_fixups[] = { -+static const struct snd_pci_quirk cxt5051_fixups[] = { - SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200), - {} - }; - -+static const struct snd_pci_quirk cxt5066_fixups[] = { -+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), -+ SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410), -+ SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410), -+ SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410), -+ SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410), -+ {} -+}; -+ - /* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches - * can be created (bko#42825) - */ -@@ -4462,11 +4487,13 @@ static int patch_conexant_auto(struct hda_codec *codec) - break; - case 0x14f15051: - add_cx5051_fake_mutes(codec); -+ apply_pin_fixup(codec, cxt5051_fixups, cxt_pincfg_tbl); -+ break; -+ default: -+ apply_pin_fixup(codec, cxt5066_fixups, cxt_pincfg_tbl); - break; - } - -- apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl); -- - err = cx_auto_search_adcs(codec); - if (err < 0) - return err; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index dc8a6fc..0bc5a46 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5032,6 +5032,7 @@ static const struct alc_fixup alc269_fixups[] = { - }; - - static const struct snd_pci_quirk alc269_fixup_tbl[] = { -+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_DMIC), - SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), - SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), -diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c -index 336de8f..0e7e26e 100644 ---- a/sound/soc/codecs/tlv320aic23.c -+++ b/sound/soc/codecs/tlv320aic23.c -@@ -473,7 +473,7 @@ static int tlv320aic23_set_dai_sysclk(struct snd_soc_dai *codec_dai, - static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec, - enum snd_soc_bias_level level) - { -- u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0xff7f; -+ u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0x17f; - - switch (level) { - case SND_SOC_BIAS_ON: -@@ -492,7 +492,7 @@ static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec, - case SND_SOC_BIAS_OFF: - /* everything off, dac mute, inactive */ - snd_soc_write(codec, TLV320AIC23_ACTIVE, 0x0); -- snd_soc_write(codec, TLV320AIC23_PWR, 0xffff); -+ snd_soc_write(codec, TLV320AIC23_PWR, 0x1ff); - break; - } - codec->dapm.bias_level = level; -diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c -index 2f1f5f8..7806301 100644 ---- a/sound/soc/codecs/wm8994.c -+++ b/sound/soc/codecs/wm8994.c -@@ -883,61 +883,170 @@ static void wm8994_update_class_w(struct snd_soc_codec *codec) - } - } - --static int late_enable_ev(struct snd_soc_dapm_widget *w, -- struct snd_kcontrol *kcontrol, int event) -+static int aif1clk_ev(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) - { - struct snd_soc_codec *codec = w->codec; -- struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); -+ struct wm8994 *control = codec->control_data; -+ int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA; -+ int dac; -+ int adc; -+ int val; -+ -+ switch (control->type) { -+ case WM8994: -+ case WM8958: -+ mask |= WM8994_AIF1DAC2L_ENA | WM8994_AIF1DAC2R_ENA; -+ break; -+ default: -+ break; -+ } - - switch (event) { - case SND_SOC_DAPM_PRE_PMU: -- if (wm8994->aif1clk_enable) { -- snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1, -- WM8994_AIF1CLK_ENA_MASK, -- WM8994_AIF1CLK_ENA); -- wm8994->aif1clk_enable = 0; -- } -- if (wm8994->aif2clk_enable) { -- snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1, -- WM8994_AIF2CLK_ENA_MASK, -- WM8994_AIF2CLK_ENA); -- wm8994->aif2clk_enable = 0; -- } -+ val = snd_soc_read(codec, WM8994_AIF1_CONTROL_1); -+ if ((val & WM8994_AIF1ADCL_SRC) && -+ (val & WM8994_AIF1ADCR_SRC)) -+ adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA; -+ else if (!(val & WM8994_AIF1ADCL_SRC) && -+ !(val & WM8994_AIF1ADCR_SRC)) -+ adc = WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA; -+ else -+ adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA | -+ WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA; -+ -+ val = snd_soc_read(codec, WM8994_AIF1_CONTROL_2); -+ if ((val & WM8994_AIF1DACL_SRC) && -+ (val & WM8994_AIF1DACR_SRC)) -+ dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA; -+ else if (!(val & WM8994_AIF1DACL_SRC) && -+ !(val & WM8994_AIF1DACR_SRC)) -+ dac = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA; -+ else -+ dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA | -+ WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA; -+ -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, -+ mask, adc); -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, -+ mask, dac); -+ snd_soc_update_bits(codec, WM8994_CLOCKING_1, -+ WM8994_AIF1DSPCLK_ENA | -+ WM8994_SYSDSPCLK_ENA, -+ WM8994_AIF1DSPCLK_ENA | -+ WM8994_SYSDSPCLK_ENA); -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, mask, -+ WM8994_AIF1ADC1R_ENA | -+ WM8994_AIF1ADC1L_ENA | -+ WM8994_AIF1ADC2R_ENA | -+ WM8994_AIF1ADC2L_ENA); -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, mask, -+ WM8994_AIF1DAC1R_ENA | -+ WM8994_AIF1DAC1L_ENA | -+ WM8994_AIF1DAC2R_ENA | -+ WM8994_AIF1DAC2L_ENA); -+ break; -+ -+ case SND_SOC_DAPM_PRE_PMD: -+ case SND_SOC_DAPM_POST_PMD: -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, -+ mask, 0); -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, -+ mask, 0); -+ -+ val = snd_soc_read(codec, WM8994_CLOCKING_1); -+ if (val & WM8994_AIF2DSPCLK_ENA) -+ val = WM8994_SYSDSPCLK_ENA; -+ else -+ val = 0; -+ snd_soc_update_bits(codec, WM8994_CLOCKING_1, -+ WM8994_SYSDSPCLK_ENA | -+ WM8994_AIF1DSPCLK_ENA, val); - break; - } - -- /* We may also have postponed startup of DSP, handle that. */ -- wm8958_aif_ev(w, kcontrol, event); -- - return 0; - } - --static int late_disable_ev(struct snd_soc_dapm_widget *w, -- struct snd_kcontrol *kcontrol, int event) -+static int aif2clk_ev(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) - { - struct snd_soc_codec *codec = w->codec; -- struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); -+ int dac; -+ int adc; -+ int val; - - switch (event) { -+ case SND_SOC_DAPM_PRE_PMU: -+ val = snd_soc_read(codec, WM8994_AIF2_CONTROL_1); -+ if ((val & WM8994_AIF2ADCL_SRC) && -+ (val & WM8994_AIF2ADCR_SRC)) -+ adc = WM8994_AIF2ADCR_ENA; -+ else if (!(val & WM8994_AIF2ADCL_SRC) && -+ !(val & WM8994_AIF2ADCR_SRC)) -+ adc = WM8994_AIF2ADCL_ENA; -+ else -+ adc = WM8994_AIF2ADCL_ENA | WM8994_AIF2ADCR_ENA; -+ -+ -+ val = snd_soc_read(codec, WM8994_AIF2_CONTROL_2); -+ if ((val & WM8994_AIF2DACL_SRC) && -+ (val & WM8994_AIF2DACR_SRC)) -+ dac = WM8994_AIF2DACR_ENA; -+ else if (!(val & WM8994_AIF2DACL_SRC) && -+ !(val & WM8994_AIF2DACR_SRC)) -+ dac = WM8994_AIF2DACL_ENA; -+ else -+ dac = WM8994_AIF2DACL_ENA | WM8994_AIF2DACR_ENA; -+ -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, -+ WM8994_AIF2ADCL_ENA | -+ WM8994_AIF2ADCR_ENA, adc); -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, -+ WM8994_AIF2DACL_ENA | -+ WM8994_AIF2DACR_ENA, dac); -+ snd_soc_update_bits(codec, WM8994_CLOCKING_1, -+ WM8994_AIF2DSPCLK_ENA | -+ WM8994_SYSDSPCLK_ENA, -+ WM8994_AIF2DSPCLK_ENA | -+ WM8994_SYSDSPCLK_ENA); -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, -+ WM8994_AIF2ADCL_ENA | -+ WM8994_AIF2ADCR_ENA, -+ WM8994_AIF2ADCL_ENA | -+ WM8994_AIF2ADCR_ENA); -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, -+ WM8994_AIF2DACL_ENA | -+ WM8994_AIF2DACR_ENA, -+ WM8994_AIF2DACL_ENA | -+ WM8994_AIF2DACR_ENA); -+ break; -+ -+ case SND_SOC_DAPM_PRE_PMD: - case SND_SOC_DAPM_POST_PMD: -- if (wm8994->aif1clk_disable) { -- snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1, -- WM8994_AIF1CLK_ENA_MASK, 0); -- wm8994->aif1clk_disable = 0; -- } -- if (wm8994->aif2clk_disable) { -- snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1, -- WM8994_AIF2CLK_ENA_MASK, 0); -- wm8994->aif2clk_disable = 0; -- } -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, -+ WM8994_AIF2DACL_ENA | -+ WM8994_AIF2DACR_ENA, 0); -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, -+ WM8994_AIF2ADCL_ENA | -+ WM8994_AIF2ADCR_ENA, 0); -+ -+ val = snd_soc_read(codec, WM8994_CLOCKING_1); -+ if (val & WM8994_AIF1DSPCLK_ENA) -+ val = WM8994_SYSDSPCLK_ENA; -+ else -+ val = 0; -+ snd_soc_update_bits(codec, WM8994_CLOCKING_1, -+ WM8994_SYSDSPCLK_ENA | -+ WM8994_AIF2DSPCLK_ENA, val); - break; - } - - return 0; - } - --static int aif1clk_ev(struct snd_soc_dapm_widget *w, -- struct snd_kcontrol *kcontrol, int event) -+static int aif1clk_late_ev(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) - { - struct snd_soc_codec *codec = w->codec; - struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); -@@ -954,8 +1063,8 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w, - return 0; - } - --static int aif2clk_ev(struct snd_soc_dapm_widget *w, -- struct snd_kcontrol *kcontrol, int event) -+static int aif2clk_late_ev(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) - { - struct snd_soc_codec *codec = w->codec; - struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); -@@ -972,6 +1081,63 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w, - return 0; - } - -+static int late_enable_ev(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) -+{ -+ struct snd_soc_codec *codec = w->codec; -+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); -+ -+ switch (event) { -+ case SND_SOC_DAPM_PRE_PMU: -+ if (wm8994->aif1clk_enable) { -+ aif1clk_ev(w, kcontrol, event); -+ snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1, -+ WM8994_AIF1CLK_ENA_MASK, -+ WM8994_AIF1CLK_ENA); -+ wm8994->aif1clk_enable = 0; -+ } -+ if (wm8994->aif2clk_enable) { -+ aif2clk_ev(w, kcontrol, event); -+ snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1, -+ WM8994_AIF2CLK_ENA_MASK, -+ WM8994_AIF2CLK_ENA); -+ wm8994->aif2clk_enable = 0; -+ } -+ break; -+ } -+ -+ /* We may also have postponed startup of DSP, handle that. */ -+ wm8958_aif_ev(w, kcontrol, event); -+ -+ return 0; -+} -+ -+static int late_disable_ev(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) -+{ -+ struct snd_soc_codec *codec = w->codec; -+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); -+ -+ switch (event) { -+ case SND_SOC_DAPM_POST_PMD: -+ if (wm8994->aif1clk_disable) { -+ snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1, -+ WM8994_AIF1CLK_ENA_MASK, 0); -+ aif1clk_ev(w, kcontrol, event); -+ wm8994->aif1clk_disable = 0; -+ } -+ if (wm8994->aif2clk_disable) { -+ snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1, -+ WM8994_AIF2CLK_ENA_MASK, 0); -+ aif2clk_ev(w, kcontrol, event); -+ wm8994->aif2clk_disable = 0; -+ } -+ break; -+ } -+ -+ return 0; -+} -+ - static int adc_mux_ev(struct snd_soc_dapm_widget *w, - struct snd_kcontrol *kcontrol, int event) - { -@@ -1268,9 +1434,9 @@ static const struct snd_kcontrol_new aif2dacr_src_mux = - SOC_DAPM_ENUM("AIF2DACR Mux", aif2dacr_src_enum); - - static const struct snd_soc_dapm_widget wm8994_lateclk_revd_widgets[] = { --SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_ev, -+SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_late_ev, - SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), --SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_ev, -+SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_late_ev, - SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), - - SND_SOC_DAPM_PGA_E("Late DAC1L Enable PGA", SND_SOC_NOPM, 0, 0, NULL, 0, -@@ -1299,8 +1465,10 @@ SND_SOC_DAPM_POST("Late Disable PGA", late_disable_ev) - }; - - static const struct snd_soc_dapm_widget wm8994_lateclk_widgets[] = { --SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0), --SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0), -+SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, aif1clk_ev, -+ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD), -+SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, aif2clk_ev, -+ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD), - SND_SOC_DAPM_PGA("Direct Voice", SND_SOC_NOPM, 0, 0, NULL, 0), - SND_SOC_DAPM_MIXER("SPKL", WM8994_POWER_MANAGEMENT_3, 8, 0, - left_speaker_mixer, ARRAY_SIZE(left_speaker_mixer)), -@@ -1353,30 +1521,30 @@ SND_SOC_DAPM_SUPPLY("VMID", SND_SOC_NOPM, 0, 0, vmid_event, - SND_SOC_DAPM_SUPPLY("CLK_SYS", SND_SOC_NOPM, 0, 0, clk_sys_event, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), - --SND_SOC_DAPM_SUPPLY("DSP1CLK", WM8994_CLOCKING_1, 3, 0, NULL, 0), --SND_SOC_DAPM_SUPPLY("DSP2CLK", WM8994_CLOCKING_1, 2, 0, NULL, 0), --SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_CLOCKING_1, 1, 0, NULL, 0), -+SND_SOC_DAPM_SUPPLY("DSP1CLK", SND_SOC_NOPM, 3, 0, NULL, 0), -+SND_SOC_DAPM_SUPPLY("DSP2CLK", SND_SOC_NOPM, 2, 0, NULL, 0), -+SND_SOC_DAPM_SUPPLY("DSPINTCLK", SND_SOC_NOPM, 1, 0, NULL, 0), - - SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL, -- 0, WM8994_POWER_MANAGEMENT_4, 9, 0), -+ 0, SND_SOC_NOPM, 9, 0), - SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL, -- 0, WM8994_POWER_MANAGEMENT_4, 8, 0), -+ 0, SND_SOC_NOPM, 8, 0), - SND_SOC_DAPM_AIF_IN_E("AIF1DAC1L", NULL, 0, -- WM8994_POWER_MANAGEMENT_5, 9, 0, wm8958_aif_ev, -+ SND_SOC_NOPM, 9, 0, wm8958_aif_ev, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD), - SND_SOC_DAPM_AIF_IN_E("AIF1DAC1R", NULL, 0, -- WM8994_POWER_MANAGEMENT_5, 8, 0, wm8958_aif_ev, -+ SND_SOC_NOPM, 8, 0, wm8958_aif_ev, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD), - - SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL, -- 0, WM8994_POWER_MANAGEMENT_4, 11, 0), -+ 0, SND_SOC_NOPM, 11, 0), - SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL, -- 0, WM8994_POWER_MANAGEMENT_4, 10, 0), -+ 0, SND_SOC_NOPM, 10, 0), - SND_SOC_DAPM_AIF_IN_E("AIF1DAC2L", NULL, 0, -- WM8994_POWER_MANAGEMENT_5, 11, 0, wm8958_aif_ev, -+ SND_SOC_NOPM, 11, 0, wm8958_aif_ev, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD), - SND_SOC_DAPM_AIF_IN_E("AIF1DAC2R", NULL, 0, -- WM8994_POWER_MANAGEMENT_5, 10, 0, wm8958_aif_ev, -+ SND_SOC_NOPM, 10, 0, wm8958_aif_ev, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD), - - SND_SOC_DAPM_MIXER("AIF1ADC1L Mixer", SND_SOC_NOPM, 0, 0, -@@ -1403,14 +1571,14 @@ SND_SOC_DAPM_MIXER("DAC1R Mixer", SND_SOC_NOPM, 0, 0, - dac1r_mix, ARRAY_SIZE(dac1r_mix)), - - SND_SOC_DAPM_AIF_OUT("AIF2ADCL", NULL, 0, -- WM8994_POWER_MANAGEMENT_4, 13, 0), -+ SND_SOC_NOPM, 13, 0), - SND_SOC_DAPM_AIF_OUT("AIF2ADCR", NULL, 0, -- WM8994_POWER_MANAGEMENT_4, 12, 0), -+ SND_SOC_NOPM, 12, 0), - SND_SOC_DAPM_AIF_IN_E("AIF2DACL", NULL, 0, -- WM8994_POWER_MANAGEMENT_5, 13, 0, wm8958_aif_ev, -+ SND_SOC_NOPM, 13, 0, wm8958_aif_ev, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), - SND_SOC_DAPM_AIF_IN_E("AIF2DACR", NULL, 0, -- WM8994_POWER_MANAGEMENT_5, 12, 0, wm8958_aif_ev, -+ SND_SOC_NOPM, 12, 0, wm8958_aif_ev, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), - - SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0), -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index ea909c5..90e93bf 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -69,6 +69,7 @@ static int dapm_up_seq[] = { - [snd_soc_dapm_out_drv] = 10, - [snd_soc_dapm_hp] = 10, - [snd_soc_dapm_spk] = 10, -+ [snd_soc_dapm_line] = 10, - [snd_soc_dapm_post] = 11, - }; - -@@ -77,6 +78,7 @@ static int dapm_down_seq[] = { - [snd_soc_dapm_adc] = 1, - [snd_soc_dapm_hp] = 2, - [snd_soc_dapm_spk] = 2, -+ [snd_soc_dapm_line] = 2, - [snd_soc_dapm_out_drv] = 2, - [snd_soc_dapm_pga] = 4, - [snd_soc_dapm_mixer_named_ctl] = 5, -diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c -index adb372d..e0a0970 100644 ---- a/tools/perf/util/hist.c -+++ b/tools/perf/util/hist.c -@@ -237,8 +237,8 @@ struct hist_entry *__hists__add_entry(struct hists *hists, - * mis-adjust symbol addresses when computing - * the history counter to increment. - */ -- if (he->ms.map != entry->ms.map) { -- he->ms.map = entry->ms.map; -+ if (he->ms.map != entry.ms.map) { -+ he->ms.map = entry.ms.map; - if (he->ms.map) - he->ms.map->referenced = true; - } -diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c -index a195c07..fd817a2 100644 ---- a/virt/kvm/iommu.c -+++ b/virt/kvm/iommu.c -@@ -309,6 +309,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm, - } - } - -+void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot) -+{ -+ kvm_iommu_put_pages(kvm, slot->base_gfn, slot->npages); -+} -+ - static int kvm_iommu_unmap_memslots(struct kvm *kvm) - { - int i, idx; -@@ -317,10 +322,9 @@ static int kvm_iommu_unmap_memslots(struct kvm *kvm) - idx = srcu_read_lock(&kvm->srcu); - slots = kvm_memslots(kvm); - -- for (i = 0; i < slots->nmemslots; i++) { -- kvm_iommu_put_pages(kvm, slots->memslots[i].base_gfn, -- slots->memslots[i].npages); -- } -+ for (i = 0; i < slots->nmemslots; i++) -+ kvm_iommu_unmap_pages(kvm, &slots->memslots[i]); -+ - srcu_read_unlock(&kvm->srcu, idx); - - return 0; -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index d9cfb78..e401c1b 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -802,12 +802,13 @@ skip_lpage: - if (r) - goto out_free; - -- /* map the pages in iommu page table */ -+ /* map/unmap the pages in iommu page table */ - if (npages) { - r = kvm_iommu_map_pages(kvm, &new); - if (r) - goto out_free; -- } -+ } else -+ kvm_iommu_unmap_pages(kvm, &old); - - r = -ENOMEM; - slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL); diff --git a/3.2.18/1017_linux-3.2.18.patch b/3.2.18/1017_linux-3.2.18.patch deleted file mode 100644 index 7a64c07..0000000 --- a/3.2.18/1017_linux-3.2.18.patch +++ /dev/null @@ -1,1791 +0,0 @@ -diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt -index 589f2da..a4399f5 100644 ---- a/Documentation/networking/ip-sysctl.txt -+++ b/Documentation/networking/ip-sysctl.txt -@@ -137,7 +137,7 @@ tcp_adv_win_scale - INTEGER - (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale), - if it is <= 0. - Possible values are [-31, 31], inclusive. -- Default: 2 -+ Default: 1 - - tcp_allowed_congestion_control - STRING - Show/set the congestion control choices available to non-privileged -@@ -397,7 +397,7 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max - net.core.rmem_max. Calling setsockopt() with SO_RCVBUF disables - automatic tuning of that socket's receive buffer size, in which - case this value is ignored. -- Default: between 87380B and 4MB, depending on RAM size. -+ Default: between 87380B and 6MB, depending on RAM size. - - tcp_sack - BOOLEAN - Enable select acknowledgments (SACKS). -diff --git a/Makefile b/Makefile -index 4c4efa3..add68f1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 2 --SUBLEVEL = 17 -+SUBLEVEL = 18 - EXTRAVERSION = - NAME = Saber-toothed Squirrel - -diff --git a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h -index 1e2d332..c88420d 100644 ---- a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h -+++ b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h -@@ -941,10 +941,10 @@ - #define OMAP4_DSI2_LANEENABLE_MASK (0x7 << 29) - #define OMAP4_DSI1_LANEENABLE_SHIFT 24 - #define OMAP4_DSI1_LANEENABLE_MASK (0x1f << 24) --#define OMAP4_DSI2_PIPD_SHIFT 19 --#define OMAP4_DSI2_PIPD_MASK (0x1f << 19) --#define OMAP4_DSI1_PIPD_SHIFT 14 --#define OMAP4_DSI1_PIPD_MASK (0x1f << 14) -+#define OMAP4_DSI1_PIPD_SHIFT 19 -+#define OMAP4_DSI1_PIPD_MASK (0x1f << 19) -+#define OMAP4_DSI2_PIPD_SHIFT 14 -+#define OMAP4_DSI2_PIPD_MASK (0x1f << 14) - - /* CONTROL_MCBSPLP */ - #define OMAP4_ALBCTRLRX_FSX_SHIFT 31 -diff --git a/arch/arm/mach-orion5x/mpp.h b/arch/arm/mach-orion5x/mpp.h -index eac6897..db70e79 100644 ---- a/arch/arm/mach-orion5x/mpp.h -+++ b/arch/arm/mach-orion5x/mpp.h -@@ -65,8 +65,8 @@ - #define MPP8_GIGE MPP(8, 0x1, 0, 0, 1, 1, 1) - - #define MPP9_UNUSED MPP(9, 0x0, 0, 0, 1, 1, 1) --#define MPP9_GPIO MPP(9, 0x0, 0, 0, 1, 1, 1) --#define MPP9_GIGE MPP(9, 0x1, 1, 1, 1, 1, 1) -+#define MPP9_GPIO MPP(9, 0x0, 1, 1, 1, 1, 1) -+#define MPP9_GIGE MPP(9, 0x1, 0, 0, 1, 1, 1) - - #define MPP10_UNUSED MPP(10, 0x0, 0, 0, 1, 1, 1) - #define MPP10_GPIO MPP(10, 0x0, 1, 1, 1, 1, 1) -diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c -index aa33949..4b0bc37 100644 ---- a/arch/arm/mm/fault.c -+++ b/arch/arm/mm/fault.c -@@ -267,7 +267,9 @@ good_area: - return fault; - - check_stack: -- if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr)) -+ /* Don't allow expansion below FIRST_USER_ADDRESS */ -+ if (vma->vm_flags & VM_GROWSDOWN && -+ addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr)) - goto good_area; - out: - return fault; -diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c -index 8f3ccdd..8ea07e4 100644 ---- a/arch/arm/vfp/vfpmodule.c -+++ b/arch/arm/vfp/vfpmodule.c -@@ -11,6 +11,7 @@ - #include <linux/types.h> - #include <linux/cpu.h> - #include <linux/cpu_pm.h> -+#include <linux/hardirq.h> - #include <linux/kernel.h> - #include <linux/notifier.h> - #include <linux/signal.h> -@@ -428,7 +429,10 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs) - - static void vfp_enable(void *unused) - { -- u32 access = get_copro_access(); -+ u32 access; -+ -+ BUG_ON(preemptible()); -+ access = get_copro_access(); - - /* - * Enable full access to VFP (cp10 and cp11) -@@ -556,7 +560,7 @@ static int __init vfp_init(void) - unsigned int cpu_arch = cpu_architecture(); - - if (cpu_arch >= CPU_ARCH_ARMv6) -- vfp_enable(NULL); -+ on_each_cpu(vfp_enable, NULL, 1); - - /* - * First check that there is a VFP that we can use. -@@ -577,8 +581,6 @@ static int __init vfp_init(void) - } else { - hotcpu_notifier(vfp_hotplug, 0); - -- smp_call_function(vfp_enable, NULL, 1); -- - VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT; /* Extract the architecture version */ - printk("implementor %02x architecture %d part %02x variant %x rev %x\n", - (vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT, -diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h -index 7617248..7a3bd25 100644 ---- a/arch/ia64/include/asm/unistd.h -+++ b/arch/ia64/include/asm/unistd.h -@@ -323,11 +323,12 @@ - #define __NR_sendmmsg 1331 - #define __NR_process_vm_readv 1332 - #define __NR_process_vm_writev 1333 -+#define __NR_accept4 1334 - - #ifdef __KERNEL__ - - --#define NR_syscalls 310 /* length of syscall table */ -+#define NR_syscalls 311 /* length of syscall table */ - - /* - * The following defines stop scripts/checksyscalls.sh from complaining about -diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S -index 5b31d46..1ccbe12 100644 ---- a/arch/ia64/kernel/entry.S -+++ b/arch/ia64/kernel/entry.S -@@ -1779,6 +1779,7 @@ sys_call_table: - data8 sys_sendmmsg - data8 sys_process_vm_readv - data8 sys_process_vm_writev -+ data8 sys_accept4 - - .org sys_call_table + 8*NR_syscalls // guard against failures to increase NR_syscalls - #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */ -diff --git a/arch/sparc/kernel/central.c b/arch/sparc/kernel/central.c -index 38d48a5..9708851 100644 ---- a/arch/sparc/kernel/central.c -+++ b/arch/sparc/kernel/central.c -@@ -269,4 +269,4 @@ static int __init sunfire_init(void) - return 0; - } - --subsys_initcall(sunfire_init); -+fs_initcall(sunfire_init); -diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S -index b57a594..874162a 100644 ---- a/arch/sparc/mm/ultra.S -+++ b/arch/sparc/mm/ultra.S -@@ -495,11 +495,11 @@ xcall_fetch_glob_regs: - stx %o7, [%g1 + GR_SNAP_O7] - stx %i7, [%g1 + GR_SNAP_I7] - /* Don't try this at home kids... */ -- rdpr %cwp, %g2 -- sub %g2, 1, %g7 -+ rdpr %cwp, %g3 -+ sub %g3, 1, %g7 - wrpr %g7, %cwp - mov %i7, %g7 -- wrpr %g2, %cwp -+ wrpr %g3, %cwp - stx %g7, [%g1 + GR_SNAP_RPC] - sethi %hi(trap_block), %g7 - or %g7, %lo(trap_block), %g7 -diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c -index a7869ad..41459d8 100644 ---- a/arch/tile/kernel/compat_signal.c -+++ b/arch/tile/kernel/compat_signal.c -@@ -406,19 +406,17 @@ int compat_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, - * Set up registers for signal handler. - * Registers that we don't modify keep the value they had from - * user-space at the time we took the signal. -+ * We always pass siginfo and mcontext, regardless of SA_SIGINFO, -+ * since some things rely on this (e.g. glibc's debug/segfault.c). - */ - regs->pc = ptr_to_compat_reg(ka->sa.sa_handler); - regs->ex1 = PL_ICS_EX1(USER_PL, 1); /* set crit sec in handler */ - regs->sp = ptr_to_compat_reg(frame); - regs->lr = restorer; - regs->regs[0] = (unsigned long) usig; -- -- if (ka->sa.sa_flags & SA_SIGINFO) { -- /* Need extra arguments, so mark to restore caller-saves. */ -- regs->regs[1] = ptr_to_compat_reg(&frame->info); -- regs->regs[2] = ptr_to_compat_reg(&frame->uc); -- regs->flags |= PT_FLAGS_CALLER_SAVES; -- } -+ regs->regs[1] = ptr_to_compat_reg(&frame->info); -+ regs->regs[2] = ptr_to_compat_reg(&frame->uc); -+ regs->flags |= PT_FLAGS_CALLER_SAVES; - - /* - * Notify any tracer that was single-stepping it. -diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig -index 6d16b4b..7e3002b 100644 ---- a/drivers/crypto/Kconfig -+++ b/drivers/crypto/Kconfig -@@ -173,6 +173,7 @@ config CRYPTO_DEV_MV_CESA - select CRYPTO_ALGAPI - select CRYPTO_AES - select CRYPTO_BLKCIPHER2 -+ select CRYPTO_HASH - help - This driver allows you to utilize the Cryptographic Engines and - Security Accelerator (CESA) which can be found on the Marvell Orion -diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c -index 461958f..271fd49 100644 ---- a/drivers/gpio/gpio-ml-ioh.c -+++ b/drivers/gpio/gpio-ml-ioh.c -@@ -448,6 +448,7 @@ static int __devinit ioh_gpio_probe(struct pci_dev *pdev, - chip->reg = chip->base; - chip->ch = i; - mutex_init(&chip->lock); -+ spin_lock_init(&chip->spinlock); - ioh_gpio_setup(chip, num_ports[i]); - ret = gpiochip_add(&chip->gpio); - if (ret) { -diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c -index 801d92d..a417f94 100644 ---- a/drivers/md/dm-mpath.c -+++ b/drivers/md/dm-mpath.c -@@ -698,8 +698,8 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m) - return 0; - - m->hw_handler_name = kstrdup(dm_shift_arg(as), GFP_KERNEL); -- request_module("scsi_dh_%s", m->hw_handler_name); -- if (scsi_dh_handler_exist(m->hw_handler_name) == 0) { -+ if (!try_then_request_module(scsi_dh_handler_exist(m->hw_handler_name), -+ "scsi_dh_%s", m->hw_handler_name)) { - ti->error = "unknown hardware handler type"; - ret = -EINVAL; - goto fail; -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 065ab4f..adcd850 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -392,6 +392,8 @@ void mddev_suspend(struct mddev *mddev) - synchronize_rcu(); - wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0); - mddev->pers->quiesce(mddev, 1); -+ -+ del_timer_sync(&mddev->safemode_timer); - } - EXPORT_SYMBOL_GPL(mddev_suspend); - -diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c -index cf10ecf..ed77c6d 100644 ---- a/drivers/media/rc/ene_ir.c -+++ b/drivers/media/rc/ene_ir.c -@@ -1018,22 +1018,6 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id) - - spin_lock_init(&dev->hw_lock); - -- /* claim the resources */ -- error = -EBUSY; -- dev->hw_io = pnp_port_start(pnp_dev, 0); -- if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) { -- dev->hw_io = -1; -- dev->irq = -1; -- goto error; -- } -- -- dev->irq = pnp_irq(pnp_dev, 0); -- if (request_irq(dev->irq, ene_isr, -- IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) { -- dev->irq = -1; -- goto error; -- } -- - pnp_set_drvdata(pnp_dev, dev); - dev->pnp_dev = pnp_dev; - -@@ -1086,6 +1070,22 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id) - device_set_wakeup_capable(&pnp_dev->dev, true); - device_set_wakeup_enable(&pnp_dev->dev, true); - -+ /* claim the resources */ -+ error = -EBUSY; -+ dev->hw_io = pnp_port_start(pnp_dev, 0); -+ if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) { -+ dev->hw_io = -1; -+ dev->irq = -1; -+ goto error; -+ } -+ -+ dev->irq = pnp_irq(pnp_dev, 0); -+ if (request_irq(dev->irq, ene_isr, -+ IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) { -+ dev->irq = -1; -+ goto error; -+ } -+ - error = rc_register_device(rdev); - if (error < 0) - goto error; -diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c -index 7f7079b..4218f73 100644 ---- a/drivers/media/rc/fintek-cir.c -+++ b/drivers/media/rc/fintek-cir.c -@@ -504,16 +504,6 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id - - spin_lock_init(&fintek->fintek_lock); - -- ret = -EBUSY; -- /* now claim resources */ -- if (!request_region(fintek->cir_addr, -- fintek->cir_port_len, FINTEK_DRIVER_NAME)) -- goto failure; -- -- if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED, -- FINTEK_DRIVER_NAME, (void *)fintek)) -- goto failure; -- - pnp_set_drvdata(pdev, fintek); - fintek->pdev = pdev; - -@@ -548,6 +538,16 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id - /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */ - rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD); - -+ ret = -EBUSY; -+ /* now claim resources */ -+ if (!request_region(fintek->cir_addr, -+ fintek->cir_port_len, FINTEK_DRIVER_NAME)) -+ goto failure; -+ -+ if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED, -+ FINTEK_DRIVER_NAME, (void *)fintek)) -+ goto failure; -+ - ret = rc_register_device(rdev); - if (ret) - goto failure; -diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c -index 682009d..0e49c99 100644 ---- a/drivers/media/rc/ite-cir.c -+++ b/drivers/media/rc/ite-cir.c -@@ -1515,16 +1515,6 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id - /* initialize raw event */ - init_ir_raw_event(&itdev->rawir); - -- ret = -EBUSY; -- /* now claim resources */ -- if (!request_region(itdev->cir_addr, -- dev_desc->io_region_size, ITE_DRIVER_NAME)) -- goto failure; -- -- if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED, -- ITE_DRIVER_NAME, (void *)itdev)) -- goto failure; -- - /* set driver data into the pnp device */ - pnp_set_drvdata(pdev, itdev); - itdev->pdev = pdev; -@@ -1600,6 +1590,16 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id - rdev->driver_name = ITE_DRIVER_NAME; - rdev->map_name = RC_MAP_RC6_MCE; - -+ ret = -EBUSY; -+ /* now claim resources */ -+ if (!request_region(itdev->cir_addr, -+ dev_desc->io_region_size, ITE_DRIVER_NAME)) -+ goto failure; -+ -+ if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED, -+ ITE_DRIVER_NAME, (void *)itdev)) -+ goto failure; -+ - ret = rc_register_device(rdev); - if (ret) - goto failure; -diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c -index 144f3f5..8b2c071 100644 ---- a/drivers/media/rc/nuvoton-cir.c -+++ b/drivers/media/rc/nuvoton-cir.c -@@ -1021,24 +1021,6 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) - spin_lock_init(&nvt->nvt_lock); - spin_lock_init(&nvt->tx.lock); - -- ret = -EBUSY; -- /* now claim resources */ -- if (!request_region(nvt->cir_addr, -- CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) -- goto failure; -- -- if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED, -- NVT_DRIVER_NAME, (void *)nvt)) -- goto failure; -- -- if (!request_region(nvt->cir_wake_addr, -- CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) -- goto failure; -- -- if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED, -- NVT_DRIVER_NAME, (void *)nvt)) -- goto failure; -- - pnp_set_drvdata(pdev, nvt); - nvt->pdev = pdev; - -@@ -1085,6 +1067,24 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) - rdev->tx_resolution = XYZ; - #endif - -+ ret = -EBUSY; -+ /* now claim resources */ -+ if (!request_region(nvt->cir_addr, -+ CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) -+ goto failure; -+ -+ if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED, -+ NVT_DRIVER_NAME, (void *)nvt)) -+ goto failure; -+ -+ if (!request_region(nvt->cir_wake_addr, -+ CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) -+ goto failure; -+ -+ if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED, -+ NVT_DRIVER_NAME, (void *)nvt)) -+ goto failure; -+ - ret = rc_register_device(rdev); - if (ret) - goto failure; -diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c -index a7e7d6f..4591770 100644 ---- a/drivers/media/rc/winbond-cir.c -+++ b/drivers/media/rc/winbond-cir.c -@@ -991,39 +991,10 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id) - "(w: 0x%lX, e: 0x%lX, s: 0x%lX, i: %u)\n", - data->wbase, data->ebase, data->sbase, data->irq); - -- if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) { -- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", -- data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1); -- err = -EBUSY; -- goto exit_free_data; -- } -- -- if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) { -- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", -- data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1); -- err = -EBUSY; -- goto exit_release_wbase; -- } -- -- if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) { -- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", -- data->sbase, data->sbase + SP_IOMEM_LEN - 1); -- err = -EBUSY; -- goto exit_release_ebase; -- } -- -- err = request_irq(data->irq, wbcir_irq_handler, -- IRQF_DISABLED, DRVNAME, device); -- if (err) { -- dev_err(dev, "Failed to claim IRQ %u\n", data->irq); -- err = -EBUSY; -- goto exit_release_sbase; -- } -- - led_trigger_register_simple("cir-tx", &data->txtrigger); - if (!data->txtrigger) { - err = -ENOMEM; -- goto exit_free_irq; -+ goto exit_free_data; - } - - led_trigger_register_simple("cir-rx", &data->rxtrigger); -@@ -1062,9 +1033,38 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id) - data->dev->priv = data; - data->dev->dev.parent = &device->dev; - -+ if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) { -+ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", -+ data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1); -+ err = -EBUSY; -+ goto exit_free_rc; -+ } -+ -+ if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) { -+ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", -+ data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1); -+ err = -EBUSY; -+ goto exit_release_wbase; -+ } -+ -+ if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) { -+ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", -+ data->sbase, data->sbase + SP_IOMEM_LEN - 1); -+ err = -EBUSY; -+ goto exit_release_ebase; -+ } -+ -+ err = request_irq(data->irq, wbcir_irq_handler, -+ IRQF_DISABLED, DRVNAME, device); -+ if (err) { -+ dev_err(dev, "Failed to claim IRQ %u\n", data->irq); -+ err = -EBUSY; -+ goto exit_release_sbase; -+ } -+ - err = rc_register_device(data->dev); - if (err) -- goto exit_free_rc; -+ goto exit_free_irq; - - device_init_wakeup(&device->dev, 1); - -@@ -1072,14 +1072,6 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id) - - return 0; - --exit_free_rc: -- rc_free_device(data->dev); --exit_unregister_led: -- led_classdev_unregister(&data->led); --exit_unregister_rxtrigger: -- led_trigger_unregister_simple(data->rxtrigger); --exit_unregister_txtrigger: -- led_trigger_unregister_simple(data->txtrigger); - exit_free_irq: - free_irq(data->irq, device); - exit_release_sbase: -@@ -1088,6 +1080,14 @@ exit_release_ebase: - release_region(data->ebase, EHFUNC_IOMEM_LEN); - exit_release_wbase: - release_region(data->wbase, WAKEUP_IOMEM_LEN); -+exit_free_rc: -+ rc_free_device(data->dev); -+exit_unregister_led: -+ led_classdev_unregister(&data->led); -+exit_unregister_rxtrigger: -+ led_trigger_unregister_simple(data->rxtrigger); -+exit_unregister_txtrigger: -+ led_trigger_unregister_simple(data->txtrigger); - exit_free_data: - kfree(data); - pnp_set_drvdata(device, NULL); -diff --git a/drivers/media/video/marvell-ccic/mmp-driver.c b/drivers/media/video/marvell-ccic/mmp-driver.c -index fb0b124..a6b7657 100644 ---- a/drivers/media/video/marvell-ccic/mmp-driver.c -+++ b/drivers/media/video/marvell-ccic/mmp-driver.c -@@ -175,7 +175,6 @@ static int mmpcam_probe(struct platform_device *pdev) - INIT_LIST_HEAD(&cam->devlist); - - mcam = &cam->mcam; -- mcam->platform = MHP_Armada610; - mcam->plat_power_up = mmpcam_power_up; - mcam->plat_power_down = mmpcam_power_down; - mcam->dev = &pdev->dev; -diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c -index 2cc3b91..327a81f 100644 ---- a/drivers/media/video/s5p-fimc/fimc-capture.c -+++ b/drivers/media/video/s5p-fimc/fimc-capture.c -@@ -1304,7 +1304,7 @@ static int fimc_subdev_set_crop(struct v4l2_subdev *sd, - fimc_capture_try_crop(ctx, r, crop->pad); - - if (crop->which == V4L2_SUBDEV_FORMAT_TRY) { -- mutex_lock(&fimc->lock); -+ mutex_unlock(&fimc->lock); - *v4l2_subdev_get_try_crop(fh, crop->pad) = *r; - return 0; - } -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 3d55883..2dcac28 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -879,8 +879,13 @@ static inline unsigned int tg3_has_work(struct tg3_napi *tnapi) - if (sblk->status & SD_STATUS_LINK_CHG) - work_exists = 1; - } -- /* check for RX/TX work to do */ -- if (sblk->idx[0].tx_consumer != tnapi->tx_cons || -+ -+ /* check for TX work to do */ -+ if (sblk->idx[0].tx_consumer != tnapi->tx_cons) -+ work_exists = 1; -+ -+ /* check for RX work to do */ -+ if (tnapi->rx_rcb_prod_idx && - *(tnapi->rx_rcb_prod_idx) != tnapi->rx_rcb_ptr) - work_exists = 1; - -@@ -5895,6 +5900,9 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget) - return work_done; - } - -+ if (!tnapi->rx_rcb_prod_idx) -+ return work_done; -+ - /* run RX thread, within the bounds set by NAPI. - * All RX "locking" is done by ensuring outside - * code synchronizes with tg3->napi.poll() -@@ -7448,6 +7456,12 @@ static int tg3_alloc_consistent(struct tg3 *tp) - */ - switch (i) { - default: -+ if (tg3_flag(tp, ENABLE_RSS)) { -+ tnapi->rx_rcb_prod_idx = NULL; -+ break; -+ } -+ /* Fall through */ -+ case 1: - tnapi->rx_rcb_prod_idx = &sblk->idx[0].rx_producer; - break; - case 2: -diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c -index cf480b5..de00805 100644 ---- a/drivers/net/ethernet/intel/e1000/e1000_main.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c -@@ -494,7 +494,11 @@ out: - static void e1000_down_and_stop(struct e1000_adapter *adapter) - { - set_bit(__E1000_DOWN, &adapter->flags); -- cancel_work_sync(&adapter->reset_task); -+ -+ /* Only kill reset task if adapter is not resetting */ -+ if (!test_bit(__E1000_RESETTING, &adapter->flags)) -+ cancel_work_sync(&adapter->reset_task); -+ - cancel_delayed_work_sync(&adapter->watchdog_task); - cancel_delayed_work_sync(&adapter->phy_info_task); - cancel_delayed_work_sync(&adapter->fifo_stall_task); -diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c -index 7eb8a00..65c51ff 100644 ---- a/drivers/net/ethernet/marvell/sky2.c -+++ b/drivers/net/ethernet/marvell/sky2.c -@@ -2475,8 +2475,13 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2, - skb_copy_from_linear_data(re->skb, skb->data, length); - skb->ip_summed = re->skb->ip_summed; - skb->csum = re->skb->csum; -+ skb->rxhash = re->skb->rxhash; -+ skb->vlan_tci = re->skb->vlan_tci; -+ - pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr, - length, PCI_DMA_FROMDEVICE); -+ re->skb->vlan_tci = 0; -+ re->skb->rxhash = 0; - re->skb->ip_summed = CHECKSUM_NONE; - skb_put(skb, length); - } -@@ -2561,9 +2566,6 @@ static struct sk_buff *sky2_receive(struct net_device *dev, - struct sk_buff *skb = NULL; - u16 count = (status & GMR_FS_LEN) >> 16; - -- if (status & GMR_FS_VLAN) -- count -= VLAN_HLEN; /* Account for vlan tag */ -- - netif_printk(sky2, rx_status, KERN_DEBUG, dev, - "rx slot %u status 0x%x len %d\n", - sky2->rx_next, status, length); -@@ -2571,6 +2573,9 @@ static struct sk_buff *sky2_receive(struct net_device *dev, - sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending; - prefetch(sky2->rx_ring + sky2->rx_next); - -+ if (vlan_tx_tag_present(re->skb)) -+ count -= VLAN_HLEN; /* Account for vlan tag */ -+ - /* This chip has hardware problems that generates bogus status. - * So do only marginal checking and expect higher level protocols - * to handle crap frames. -@@ -2628,11 +2633,8 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last) - } - - static inline void sky2_skb_rx(const struct sky2_port *sky2, -- u32 status, struct sk_buff *skb) -+ struct sk_buff *skb) - { -- if (status & GMR_FS_VLAN) -- __vlan_hwaccel_put_tag(skb, be16_to_cpu(sky2->rx_tag)); -- - if (skb->ip_summed == CHECKSUM_NONE) - netif_receive_skb(skb); - else -@@ -2686,6 +2688,14 @@ static void sky2_rx_checksum(struct sky2_port *sky2, u32 status) - } - } - -+static void sky2_rx_tag(struct sky2_port *sky2, u16 length) -+{ -+ struct sk_buff *skb; -+ -+ skb = sky2->rx_ring[sky2->rx_next].skb; -+ __vlan_hwaccel_put_tag(skb, be16_to_cpu(length)); -+} -+ - static void sky2_rx_hash(struct sky2_port *sky2, u32 status) - { - struct sk_buff *skb; -@@ -2744,8 +2754,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx) - } - - skb->protocol = eth_type_trans(skb, dev); -- -- sky2_skb_rx(sky2, status, skb); -+ sky2_skb_rx(sky2, skb); - - /* Stop after net poll weight */ - if (++work_done >= to_do) -@@ -2753,11 +2762,11 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx) - break; - - case OP_RXVLAN: -- sky2->rx_tag = length; -+ sky2_rx_tag(sky2, length); - break; - - case OP_RXCHKSVLAN: -- sky2->rx_tag = length; -+ sky2_rx_tag(sky2, length); - /* fall through */ - case OP_RXCHKS: - if (likely(dev->features & NETIF_F_RXCSUM)) -diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h -index ff6f58b..3c896ce 100644 ---- a/drivers/net/ethernet/marvell/sky2.h -+++ b/drivers/net/ethernet/marvell/sky2.h -@@ -2241,7 +2241,6 @@ struct sky2_port { - u16 rx_pending; - u16 rx_data_size; - u16 rx_nfrags; -- u16 rx_tag; - - struct { - unsigned long last; -diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c -index 41e6b33..c07cfe9 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c -@@ -22,6 +22,7 @@ - Author: Giuseppe Cavallaro <peppe.cavallaro@st.com> - *******************************************************************************/ - -+#include <linux/kernel.h> - #include <linux/io.h> - #include "mmc.h" - -diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c -index ceab215..c508d6a 100644 ---- a/drivers/net/ethernet/sun/sungem.c -+++ b/drivers/net/ethernet/sun/sungem.c -@@ -2340,7 +2340,7 @@ static int gem_suspend(struct pci_dev *pdev, pm_message_t state) - netif_device_detach(dev); - - /* Switch off chip, remember WOL setting */ -- gp->asleep_wol = gp->wake_on_lan; -+ gp->asleep_wol = !!gp->wake_on_lan; - gem_do_stop(dev, gp->asleep_wol); - - /* Unlock the network stack */ -diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c -index c81f136..b142300 100644 ---- a/drivers/net/phy/icplus.c -+++ b/drivers/net/phy/icplus.c -@@ -150,7 +150,8 @@ static int ip101a_config_init(struct phy_device *phydev) - /* Enable Auto Power Saving mode */ - c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS); - c |= IP101A_APS_ON; -- return c; -+ -+ return phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c); - } - - static int ip175c_read_status(struct phy_device *phydev) -diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c -index fda4be2..a9abee8 100644 ---- a/drivers/net/usb/asix.c -+++ b/drivers/net/usb/asix.c -@@ -403,7 +403,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb, - u32 packet_len; - u32 padbytes = 0xffff0000; - -- padlen = ((skb->len + 4) % 512) ? 0 : 4; -+ padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4; - - if ((!skb_cloned(skb)) && - ((headroom + tailroom) >= (4 + padlen))) { -@@ -425,7 +425,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb, - cpu_to_le32s(&packet_len); - skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len)); - -- if ((skb->len % 512) == 0) { -+ if (padlen) { - cpu_to_le32s(&padbytes); - memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes)); - skb_put(skb, sizeof(padbytes)); -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index 4fd4144..2ba40cf 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -83,6 +83,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) - struct cdc_state *info = (void *) &dev->data; - int status; - int rndis; -+ bool android_rndis_quirk = false; - struct usb_driver *driver = driver_of(intf); - struct usb_cdc_mdlm_desc *desc = NULL; - struct usb_cdc_mdlm_detail_desc *detail = NULL; -@@ -195,6 +196,11 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) - info->control, - info->u->bSlaveInterface0, - info->data); -+ /* fall back to hard-wiring for RNDIS */ -+ if (rndis) { -+ android_rndis_quirk = true; -+ goto next_desc; -+ } - goto bad_desc; - } - if (info->control != intf) { -@@ -271,11 +277,15 @@ next_desc: - /* Microsoft ActiveSync based and some regular RNDIS devices lack the - * CDC descriptors, so we'll hard-wire the interfaces and not check - * for descriptors. -+ * -+ * Some Android RNDIS devices have a CDC Union descriptor pointing -+ * to non-existing interfaces. Ignore that and attempt the same -+ * hard-wired 0 and 1 interfaces. - */ -- if (rndis && !info->u) { -+ if (rndis && (!info->u || android_rndis_quirk)) { - info->control = usb_ifnum_to_if(dev->udev, 0); - info->data = usb_ifnum_to_if(dev->udev, 1); -- if (!info->control || !info->data) { -+ if (!info->control || !info->data || info->control != intf) { - dev_dbg(&intf->dev, - "rndis: master #0/%p slave #1/%p\n", - info->control, -@@ -472,6 +482,7 @@ static const struct driver_info wwan_info = { - /*-------------------------------------------------------------------------*/ - - #define HUAWEI_VENDOR_ID 0x12D1 -+#define NOVATEL_VENDOR_ID 0x1410 - - static const struct usb_device_id products [] = { - /* -@@ -589,6 +600,21 @@ static const struct usb_device_id products [] = { - * because of bugs/quirks in a given product (like Zaurus, above). - */ - { -+ /* Novatel USB551L */ -+ /* This match must come *before* the generic CDC-ETHER match so that -+ * we get FLAG_WWAN set on the device, since it's descriptors are -+ * generic CDC-ETHER. -+ */ -+ .match_flags = USB_DEVICE_ID_MATCH_VENDOR -+ | USB_DEVICE_ID_MATCH_PRODUCT -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = NOVATEL_VENDOR_ID, -+ .idProduct = 0xB001, -+ .bInterfaceClass = USB_CLASS_COMM, -+ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, -+ .bInterfaceProtocol = USB_CDC_PROTO_NONE, -+ .driver_info = (unsigned long)&wwan_info, -+}, { - USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET, - USB_CDC_PROTO_NONE), - .driver_info = (unsigned long) &cdc_info, -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index 750e330..b873b5d 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -281,17 +281,32 @@ int usbnet_change_mtu (struct net_device *net, int new_mtu) - } - EXPORT_SYMBOL_GPL(usbnet_change_mtu); - -+/* The caller must hold list->lock */ -+static void __usbnet_queue_skb(struct sk_buff_head *list, -+ struct sk_buff *newsk, enum skb_state state) -+{ -+ struct skb_data *entry = (struct skb_data *) newsk->cb; -+ -+ __skb_queue_tail(list, newsk); -+ entry->state = state; -+} -+ - /*-------------------------------------------------------------------------*/ - - /* some LK 2.4 HCDs oopsed if we freed or resubmitted urbs from - * completion callbacks. 2.5 should have fixed those bugs... - */ - --static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_head *list) -+static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb, -+ struct sk_buff_head *list, enum skb_state state) - { - unsigned long flags; -+ enum skb_state old_state; -+ struct skb_data *entry = (struct skb_data *) skb->cb; - - spin_lock_irqsave(&list->lock, flags); -+ old_state = entry->state; -+ entry->state = state; - __skb_unlink(skb, list); - spin_unlock(&list->lock); - spin_lock(&dev->done.lock); -@@ -299,6 +314,7 @@ static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_hea - if (dev->done.qlen == 1) - tasklet_schedule(&dev->bh); - spin_unlock_irqrestore(&dev->done.lock, flags); -+ return old_state; - } - - /* some work can't be done in tasklets, so we use keventd -@@ -339,7 +355,6 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags) - entry = (struct skb_data *) skb->cb; - entry->urb = urb; - entry->dev = dev; -- entry->state = rx_start; - entry->length = 0; - - usb_fill_bulk_urb (urb, dev->udev, dev->in, -@@ -371,7 +386,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags) - tasklet_schedule (&dev->bh); - break; - case 0: -- __skb_queue_tail (&dev->rxq, skb); -+ __usbnet_queue_skb(&dev->rxq, skb, rx_start); - } - } else { - netif_dbg(dev, ifdown, dev->net, "rx: stopped\n"); -@@ -422,16 +437,17 @@ static void rx_complete (struct urb *urb) - struct skb_data *entry = (struct skb_data *) skb->cb; - struct usbnet *dev = entry->dev; - int urb_status = urb->status; -+ enum skb_state state; - - skb_put (skb, urb->actual_length); -- entry->state = rx_done; -+ state = rx_done; - entry->urb = NULL; - - switch (urb_status) { - /* success */ - case 0: - if (skb->len < dev->net->hard_header_len) { -- entry->state = rx_cleanup; -+ state = rx_cleanup; - dev->net->stats.rx_errors++; - dev->net->stats.rx_length_errors++; - netif_dbg(dev, rx_err, dev->net, -@@ -470,7 +486,7 @@ static void rx_complete (struct urb *urb) - "rx throttle %d\n", urb_status); - } - block: -- entry->state = rx_cleanup; -+ state = rx_cleanup; - entry->urb = urb; - urb = NULL; - break; -@@ -481,17 +497,18 @@ block: - // FALLTHROUGH - - default: -- entry->state = rx_cleanup; -+ state = rx_cleanup; - dev->net->stats.rx_errors++; - netif_dbg(dev, rx_err, dev->net, "rx status %d\n", urb_status); - break; - } - -- defer_bh(dev, skb, &dev->rxq); -+ state = defer_bh(dev, skb, &dev->rxq, state); - - if (urb) { - if (netif_running (dev->net) && -- !test_bit (EVENT_RX_HALT, &dev->flags)) { -+ !test_bit (EVENT_RX_HALT, &dev->flags) && -+ state != unlink_start) { - rx_submit (dev, urb, GFP_ATOMIC); - return; - } -@@ -577,16 +594,23 @@ EXPORT_SYMBOL_GPL(usbnet_purge_paused_rxq); - static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q) - { - unsigned long flags; -- struct sk_buff *skb, *skbnext; -+ struct sk_buff *skb; - int count = 0; - - spin_lock_irqsave (&q->lock, flags); -- skb_queue_walk_safe(q, skb, skbnext) { -+ while (!skb_queue_empty(q)) { - struct skb_data *entry; - struct urb *urb; - int retval; - -- entry = (struct skb_data *) skb->cb; -+ skb_queue_walk(q, skb) { -+ entry = (struct skb_data *) skb->cb; -+ if (entry->state != unlink_start) -+ goto found; -+ } -+ break; -+found: -+ entry->state = unlink_start; - urb = entry->urb; - - /* -@@ -1037,8 +1061,7 @@ static void tx_complete (struct urb *urb) - } - - usb_autopm_put_interface_async(dev->intf); -- entry->state = tx_done; -- defer_bh(dev, skb, &dev->txq); -+ (void) defer_bh(dev, skb, &dev->txq, tx_done); - } - - /*-------------------------------------------------------------------------*/ -@@ -1094,7 +1117,6 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb, - entry = (struct skb_data *) skb->cb; - entry->urb = urb; - entry->dev = dev; -- entry->state = tx_start; - entry->length = length; - - usb_fill_bulk_urb (urb, dev->udev, dev->out, -@@ -1153,7 +1175,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb, - break; - case 0: - net->trans_start = jiffies; -- __skb_queue_tail (&dev->txq, skb); -+ __usbnet_queue_skb(&dev->txq, skb, tx_start); - if (dev->txq.qlen >= TX_QLEN (dev)) - netif_stop_queue (net); - } -diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c -index 7f27dbd..0515862 100644 ---- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c -+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c -@@ -1053,17 +1053,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, - } - /* either retransmit or send bar if ack not recd */ - if (!ack_recd) { -- struct ieee80211_tx_rate *txrate = -- tx_info->status.rates; -- if (retry && (txrate[0].count < (int)retry_limit)) { -+ if (retry && (ini->txretry[index] < (int)retry_limit)) { - ini->txretry[index]++; - ini->tx_in_transit--; - /* - * Use high prededence for retransmit to - * give some punch - */ -- /* brcms_c_txq_enq(wlc, scb, p, -- * BRCMS_PRIO_TO_PREC(tid)); */ - brcms_c_txq_enq(wlc, scb, p, - BRCMS_PRIO_TO_HI_PREC(tid)); - } else { -diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c -index f98becc..833cbef 100644 ---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c -+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c -@@ -7879,7 +7879,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh, - if (wlc->hw->suspended_fifos) { - hdr = (struct ieee80211_hdr *)p->data; - if (ieee80211_is_beacon(hdr->frame_control)) -- brcms_b_mute(wlc->hw, false); -+ brcms_b_mute(wlc->hw, false, 0); - } - - memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status)); -diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c -index 6176129..8cba82d 100644 ---- a/drivers/regulator/max8997.c -+++ b/drivers/regulator/max8997.c -@@ -689,7 +689,7 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev, - } - - new_val++; -- } while (desc->min + desc->step + new_val <= desc->max); -+ } while (desc->min + desc->step * new_val <= desc->max); - - new_idx = tmp_idx; - new_val = tmp_val; -diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c -index 54b9d2e..1590dbd 100644 ---- a/drivers/spi/spi-topcliff-pch.c -+++ b/drivers/spi/spi-topcliff-pch.c -@@ -196,6 +196,7 @@ struct pch_spi_data { - struct pch_spi_dma_ctrl dma; - int use_dma; - u8 irq_reg_sts; -+ int save_total_len; - }; - - /** -@@ -823,11 +824,13 @@ static void pch_spi_copy_rx_data_for_dma(struct pch_spi_data *data, int bpw) - rx_dma_buf = data->dma.rx_buf_virt; - for (j = 0; j < data->bpw_len; j++) - *rx_buf++ = *rx_dma_buf++ & 0xFF; -+ data->cur_trans->rx_buf = rx_buf; - } else { - rx_sbuf = data->cur_trans->rx_buf; - rx_dma_sbuf = data->dma.rx_buf_virt; - for (j = 0; j < data->bpw_len; j++) - *rx_sbuf++ = *rx_dma_sbuf++; -+ data->cur_trans->rx_buf = rx_sbuf; - } - } - -@@ -853,6 +856,9 @@ static int pch_spi_start_transfer(struct pch_spi_data *data) - rtn = wait_event_interruptible_timeout(data->wait, - data->transfer_complete, - msecs_to_jiffies(2 * HZ)); -+ if (!rtn) -+ dev_err(&data->master->dev, -+ "%s wait-event timeout\n", __func__); - - dma_sync_sg_for_cpu(&data->master->dev, dma->sg_rx_p, dma->nent, - DMA_FROM_DEVICE); -@@ -924,7 +930,8 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw) - dma_cap_set(DMA_SLAVE, mask); - - /* Get DMA's dev information */ -- dma_dev = pci_get_bus_and_slot(2, PCI_DEVFN(12, 0)); -+ dma_dev = pci_get_bus_and_slot(data->board_dat->pdev->bus->number, -+ PCI_DEVFN(12, 0)); - - /* Set Tx DMA */ - param = &dma->param_tx; -@@ -988,6 +995,7 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw) - int i; - int size; - int rem; -+ int head; - unsigned long flags; - struct pch_spi_dma_ctrl *dma; - -@@ -1016,6 +1024,11 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw) - } - data->bpw_len = data->cur_trans->len / (*bpw / 8); - -+ if (data->bpw_len > PCH_BUF_SIZE) { -+ data->bpw_len = PCH_BUF_SIZE; -+ data->cur_trans->len -= PCH_BUF_SIZE; -+ } -+ - /* copy Tx Data */ - if (data->cur_trans->tx_buf != NULL) { - if (*bpw == 8) { -@@ -1030,10 +1043,17 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw) - *tx_dma_sbuf++ = *tx_sbuf++; - } - } -+ -+ /* Calculate Rx parameter for DMA transmitting */ - if (data->bpw_len > PCH_DMA_TRANS_SIZE) { -- num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1; -+ if (data->bpw_len % PCH_DMA_TRANS_SIZE) { -+ num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1; -+ rem = data->bpw_len % PCH_DMA_TRANS_SIZE; -+ } else { -+ num = data->bpw_len / PCH_DMA_TRANS_SIZE; -+ rem = PCH_DMA_TRANS_SIZE; -+ } - size = PCH_DMA_TRANS_SIZE; -- rem = data->bpw_len % PCH_DMA_TRANS_SIZE; - } else { - num = 1; - size = data->bpw_len; -@@ -1093,15 +1113,23 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw) - dma->nent = num; - dma->desc_rx = desc_rx; - -- /* TX */ -- if (data->bpw_len > PCH_DMA_TRANS_SIZE) { -- num = data->bpw_len / PCH_DMA_TRANS_SIZE; -+ /* Calculate Tx parameter for DMA transmitting */ -+ if (data->bpw_len > PCH_MAX_FIFO_DEPTH) { -+ head = PCH_MAX_FIFO_DEPTH - PCH_DMA_TRANS_SIZE; -+ if (data->bpw_len % PCH_DMA_TRANS_SIZE > 4) { -+ num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1; -+ rem = data->bpw_len % PCH_DMA_TRANS_SIZE - head; -+ } else { -+ num = data->bpw_len / PCH_DMA_TRANS_SIZE; -+ rem = data->bpw_len % PCH_DMA_TRANS_SIZE + -+ PCH_DMA_TRANS_SIZE - head; -+ } - size = PCH_DMA_TRANS_SIZE; -- rem = 16; - } else { - num = 1; - size = data->bpw_len; - rem = data->bpw_len; -+ head = 0; - } - - dma->sg_tx_p = kzalloc(sizeof(struct scatterlist)*num, GFP_ATOMIC); -@@ -1111,11 +1139,17 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw) - for (i = 0; i < num; i++, sg++) { - if (i == 0) { - sg->offset = 0; -+ sg_set_page(sg, virt_to_page(dma->tx_buf_virt), size + head, -+ sg->offset); -+ sg_dma_len(sg) = size + head; -+ } else if (i == (num - 1)) { -+ sg->offset = head + size * i; -+ sg->offset = sg->offset * (*bpw / 8); - sg_set_page(sg, virt_to_page(dma->tx_buf_virt), rem, - sg->offset); - sg_dma_len(sg) = rem; - } else { -- sg->offset = rem + size * (i - 1); -+ sg->offset = head + size * i; - sg->offset = sg->offset * (*bpw / 8); - sg_set_page(sg, virt_to_page(dma->tx_buf_virt), size, - sg->offset); -@@ -1203,6 +1237,7 @@ static void pch_spi_process_messages(struct work_struct *pwork) - data->current_msg->spi->bits_per_word); - pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL); - do { -+ int cnt; - /* If we are already processing a message get the next - transfer structure from the message otherwise retrieve - the 1st transfer request from the message. */ -@@ -1222,11 +1257,28 @@ static void pch_spi_process_messages(struct work_struct *pwork) - } - spin_unlock(&data->lock); - -+ if (!data->cur_trans->len) -+ goto out; -+ cnt = (data->cur_trans->len - 1) / PCH_BUF_SIZE + 1; -+ data->save_total_len = data->cur_trans->len; - if (data->use_dma) { -- pch_spi_handle_dma(data, &bpw); -- if (!pch_spi_start_transfer(data)) -- goto out; -- pch_spi_copy_rx_data_for_dma(data, bpw); -+ int i; -+ char *save_rx_buf = data->cur_trans->rx_buf; -+ for (i = 0; i < cnt; i ++) { -+ pch_spi_handle_dma(data, &bpw); -+ if (!pch_spi_start_transfer(data)) { -+ data->transfer_complete = true; -+ data->current_msg->status = -EIO; -+ data->current_msg->complete -+ (data->current_msg->context); -+ data->bcurrent_msg_processing = false; -+ data->current_msg = NULL; -+ data->cur_trans = NULL; -+ goto out; -+ } -+ pch_spi_copy_rx_data_for_dma(data, bpw); -+ } -+ data->cur_trans->rx_buf = save_rx_buf; - } else { - pch_spi_set_tx(data, &bpw); - pch_spi_set_ir(data); -@@ -1237,6 +1289,7 @@ static void pch_spi_process_messages(struct work_struct *pwork) - data->pkt_tx_buff = NULL; - } - /* increment message count */ -+ data->cur_trans->len = data->save_total_len; - data->current_msg->actual_length += data->cur_trans->len; - - dev_dbg(&data->master->dev, -@@ -1389,6 +1442,7 @@ static int __devinit pch_spi_pd_probe(struct platform_device *plat_dev) - master->num_chipselect = PCH_MAX_CS; - master->setup = pch_spi_setup; - master->transfer = pch_spi_transfer; -+ master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST; - - data->board_dat = board_dat; - data->plat_dev = plat_dev; -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index b4864fb..cad8b92 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -170,6 +170,7 @@ static struct se_device *fd_create_virtdevice( - inode = file->f_mapping->host; - if (S_ISBLK(inode->i_mode)) { - struct request_queue *q; -+ unsigned long long dev_size; - /* - * Setup the local scope queue_limits from struct request_queue->limits - * to pass into transport_add_device_to_core_hba() as struct se_dev_limits. -@@ -184,13 +185,12 @@ static struct se_device *fd_create_virtdevice( - * one (1) logical sector from underlying struct block_device - */ - fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev); -- fd_dev->fd_dev_size = (i_size_read(file->f_mapping->host) - -+ dev_size = (i_size_read(file->f_mapping->host) - - fd_dev->fd_block_size); - - pr_debug("FILEIO: Using size: %llu bytes from struct" - " block_device blocks: %llu logical_block_size: %d\n", -- fd_dev->fd_dev_size, -- div_u64(fd_dev->fd_dev_size, fd_dev->fd_block_size), -+ dev_size, div_u64(dev_size, fd_dev->fd_block_size), - fd_dev->fd_block_size); - } else { - if (!(fd_dev->fbd_flags & FBDF_HAS_SIZE)) { -@@ -606,10 +606,20 @@ static u32 fd_get_device_type(struct se_device *dev) - static sector_t fd_get_blocks(struct se_device *dev) - { - struct fd_dev *fd_dev = dev->dev_ptr; -- unsigned long long blocks_long = div_u64(fd_dev->fd_dev_size, -- dev->se_sub_dev->se_dev_attrib.block_size); -+ struct file *f = fd_dev->fd_file; -+ struct inode *i = f->f_mapping->host; -+ unsigned long long dev_size; -+ /* -+ * When using a file that references an underlying struct block_device, -+ * ensure dev_size is always based on the current inode size in order -+ * to handle underlying block_device resize operations. -+ */ -+ if (S_ISBLK(i->i_mode)) -+ dev_size = (i_size_read(i) - fd_dev->fd_block_size); -+ else -+ dev_size = fd_dev->fd_dev_size; - -- return blocks_long; -+ return div_u64(dev_size, dev->se_sub_dev->se_dev_attrib.block_size); - } - - static struct se_subsystem_api fileio_template = { -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index 6cf6ff4..b75bc92 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -223,6 +223,9 @@ int target_scsi2_reservation_release(struct se_task *task) - if (dev->dev_reserved_node_acl != sess->se_node_acl) - goto out_unlock; - -+ if (dev->dev_res_bin_isid != sess->sess_bin_isid) -+ goto out_unlock; -+ - dev->dev_reserved_node_acl = NULL; - dev->dev_flags &= ~DF_SPC2_RESERVATIONS; - if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) { -diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c -index 8ddd133..d91fe44 100644 ---- a/drivers/target/target_core_tpg.c -+++ b/drivers/target/target_core_tpg.c -@@ -63,7 +63,6 @@ static void core_clear_initiator_node_from_tpg( - int i; - struct se_dev_entry *deve; - struct se_lun *lun; -- struct se_lun_acl *acl, *acl_tmp; - - spin_lock_irq(&nacl->device_list_lock); - for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) { -@@ -84,28 +83,7 @@ static void core_clear_initiator_node_from_tpg( - core_update_device_list_for_node(lun, NULL, deve->mapped_lun, - TRANSPORT_LUNFLAGS_NO_ACCESS, nacl, tpg, 0); - -- spin_lock(&lun->lun_acl_lock); -- list_for_each_entry_safe(acl, acl_tmp, -- &lun->lun_acl_list, lacl_list) { -- if (!strcmp(acl->initiatorname, nacl->initiatorname) && -- (acl->mapped_lun == deve->mapped_lun)) -- break; -- } -- -- if (!acl) { -- pr_err("Unable to locate struct se_lun_acl for %s," -- " mapped_lun: %u\n", nacl->initiatorname, -- deve->mapped_lun); -- spin_unlock(&lun->lun_acl_lock); -- spin_lock_irq(&nacl->device_list_lock); -- continue; -- } -- -- list_del(&acl->lacl_list); -- spin_unlock(&lun->lun_acl_lock); -- - spin_lock_irq(&nacl->device_list_lock); -- kfree(acl); - } - spin_unlock_irq(&nacl->device_list_lock); - } -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index 93a00d8..4410ae7 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -487,18 +487,19 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode, - ext4_free_blocks(handle, inode, bh, 0, 1, - EXT4_FREE_BLOCKS_METADATA | - EXT4_FREE_BLOCKS_FORGET); -+ unlock_buffer(bh); - } else { - le32_add_cpu(&BHDR(bh)->h_refcount, -1); -+ if (ce) -+ mb_cache_entry_release(ce); -+ unlock_buffer(bh); - error = ext4_handle_dirty_metadata(handle, inode, bh); - if (IS_SYNC(inode)) - ext4_handle_sync(handle); - dquot_free_block(inode, 1); - ea_bdebug(bh, "refcount now=%d; releasing", - le32_to_cpu(BHDR(bh)->h_refcount)); -- if (ce) -- mb_cache_entry_release(ce); - } -- unlock_buffer(bh); - out: - ext4_std_error(inode->i_sb, error); - return; -diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c -index 31dce61..4bbd521 100644 ---- a/fs/jffs2/gc.c -+++ b/fs/jffs2/gc.c -@@ -225,8 +225,8 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c) - return 0; - - D1(printk(KERN_DEBUG "No progress from erasing blocks; doing GC anyway\n")); -- spin_lock(&c->erase_completion_lock); - mutex_lock(&c->alloc_sem); -+ spin_lock(&c->erase_completion_lock); - } - - /* First, work out which block we're garbage-collecting */ -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 51f6a40..bab7c58 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -1802,6 +1802,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, fmode_t fmode - nfs_setattr_update_inode(state->inode, sattr); - nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr); - } -+ nfs_revalidate_inode(server, state->inode); - nfs4_opendata_put(opendata); - nfs4_put_state_owner(sp); - *res = state; -diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h -index a9e6ba4..daad4e6 100644 ---- a/include/linux/mtd/map.h -+++ b/include/linux/mtd/map.h -@@ -26,7 +26,7 @@ - #include <linux/list.h> - #include <linux/string.h> - #include <linux/bug.h> -- -+#include <linux/kernel.h> - - #include <asm/unaligned.h> - #include <asm/system.h> -diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h -index 605b0aa..76f4396 100644 ---- a/include/linux/usb/usbnet.h -+++ b/include/linux/usb/usbnet.h -@@ -191,7 +191,8 @@ extern void usbnet_cdc_status(struct usbnet *, struct urb *); - enum skb_state { - illegal = 0, - tx_start, tx_done, -- rx_start, rx_done, rx_cleanup -+ rx_start, rx_done, rx_cleanup, -+ unlink_start - }; - - struct skb_data { /* skb->cb is one of these */ -diff --git a/kernel/fork.c b/kernel/fork.c -index 0acf42c0..26f1ab0 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -47,6 +47,7 @@ - #include <linux/audit.h> - #include <linux/memcontrol.h> - #include <linux/ftrace.h> -+#include <linux/proc_fs.h> - #include <linux/profile.h> - #include <linux/rmap.h> - #include <linux/ksm.h> -@@ -1387,6 +1388,8 @@ bad_fork_cleanup_io: - if (p->io_context) - exit_io_context(p); - bad_fork_cleanup_namespaces: -+ if (unlikely(clone_flags & CLONE_NEWPID)) -+ pid_ns_release_proc(p->nsproxy->pid_ns); - exit_task_namespaces(p); - bad_fork_cleanup_mm: - if (p->mm) -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index bd936ed..7120c2e 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2405,7 +2405,6 @@ retry_avoidcopy: - if (outside_reserve) { - BUG_ON(huge_pte_none(pte)); - if (unmap_ref_private(mm, vma, old_page, address)) { -- BUG_ON(page_count(old_page) != 1); - BUG_ON(huge_pte_none(pte)); - spin_lock(&mm->page_table_lock); - goto retry_avoidcopy; -diff --git a/mm/nobootmem.c b/mm/nobootmem.c -index 7fa41b4..07c08c4 100644 ---- a/mm/nobootmem.c -+++ b/mm/nobootmem.c -@@ -83,8 +83,7 @@ void __init free_bootmem_late(unsigned long addr, unsigned long size) - - static void __init __free_pages_memory(unsigned long start, unsigned long end) - { -- int i; -- unsigned long start_aligned, end_aligned; -+ unsigned long i, start_aligned, end_aligned; - int order = ilog2(BITS_PER_LONG); - - start_aligned = (start + (BITS_PER_LONG - 1)) & ~(BITS_PER_LONG - 1); -diff --git a/mm/percpu.c b/mm/percpu.c -index 716eb4a..5c29750 100644 ---- a/mm/percpu.c -+++ b/mm/percpu.c -@@ -1642,6 +1642,16 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size, - areas[group] = ptr; - - base = min(ptr, base); -+ } -+ -+ /* -+ * Copy data and free unused parts. This should happen after all -+ * allocations are complete; otherwise, we may end up with -+ * overlapping groups. -+ */ -+ for (group = 0; group < ai->nr_groups; group++) { -+ struct pcpu_group_info *gi = &ai->groups[group]; -+ void *ptr = areas[group]; - - for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) { - if (gi->cpu_map[i] == NR_CPUS) { -diff --git a/net/core/dev.c b/net/core/dev.c -index cd5050e..61a7baa 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1421,14 +1421,34 @@ EXPORT_SYMBOL(register_netdevice_notifier); - * register_netdevice_notifier(). The notifier is unlinked into the - * kernel structures and may then be reused. A negative errno code - * is returned on a failure. -+ * -+ * After unregistering unregister and down device events are synthesized -+ * for all devices on the device list to the removed notifier to remove -+ * the need for special case cleanup code. - */ - - int unregister_netdevice_notifier(struct notifier_block *nb) - { -+ struct net_device *dev; -+ struct net *net; - int err; - - rtnl_lock(); - err = raw_notifier_chain_unregister(&netdev_chain, nb); -+ if (err) -+ goto unlock; -+ -+ for_each_net(net) { -+ for_each_netdev(net, dev) { -+ if (dev->flags & IFF_UP) { -+ nb->notifier_call(nb, NETDEV_GOING_DOWN, dev); -+ nb->notifier_call(nb, NETDEV_DOWN, dev); -+ } -+ nb->notifier_call(nb, NETDEV_UNREGISTER, dev); -+ nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev); -+ } -+ } -+unlock: - rtnl_unlock(); - return err; - } -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index 0001c24..df878de 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -1932,7 +1932,7 @@ static int pktgen_device_event(struct notifier_block *unused, - { - struct net_device *dev = ptr; - -- if (!net_eq(dev_net(dev), &init_net)) -+ if (!net_eq(dev_net(dev), &init_net) || pktgen_exiting) - return NOTIFY_DONE; - - /* It is OK that we do not hold the group lock right now, -@@ -3758,12 +3758,18 @@ static void __exit pg_cleanup(void) - { - struct pktgen_thread *t; - struct list_head *q, *n; -+ LIST_HEAD(list); - - /* Stop all interfaces & threads */ - pktgen_exiting = true; - -- list_for_each_safe(q, n, &pktgen_threads) { -+ mutex_lock(&pktgen_thread_lock); -+ list_splice_init(&pktgen_threads, &list); -+ mutex_unlock(&pktgen_thread_lock); -+ -+ list_for_each_safe(q, n, &list) { - t = list_entry(q, struct pktgen_thread, th_list); -+ list_del(&t->th_list); - kthread_stop(t->tsk); - kfree(t); - } -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 7904db4..11ba922 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -851,8 +851,7 @@ new_segment: - wait_for_sndbuf: - set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); - wait_for_memory: -- if (copied) -- tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH); -+ tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH); - - if ((err = sk_stream_wait_memory(sk, &timeo)) != 0) - goto do_error; -@@ -3216,7 +3215,7 @@ void __init tcp_init(void) - { - struct sk_buff *skb = NULL; - unsigned long limit; -- int i, max_share, cnt; -+ int i, max_rshare, max_wshare, cnt; - unsigned long jiffy = jiffies; - - BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb)); -@@ -3280,15 +3279,16 @@ void __init tcp_init(void) - - /* Set per-socket limits to no more than 1/128 the pressure threshold */ - limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7); -- max_share = min(4UL*1024*1024, limit); -+ max_wshare = min(4UL*1024*1024, limit); -+ max_rshare = min(6UL*1024*1024, limit); - - sysctl_tcp_wmem[0] = SK_MEM_QUANTUM; - sysctl_tcp_wmem[1] = 16*1024; -- sysctl_tcp_wmem[2] = max(64*1024, max_share); -+ sysctl_tcp_wmem[2] = max(64*1024, max_wshare); - - sysctl_tcp_rmem[0] = SK_MEM_QUANTUM; - sysctl_tcp_rmem[1] = 87380; -- sysctl_tcp_rmem[2] = max(87380, max_share); -+ sysctl_tcp_rmem[2] = max(87380, max_rshare); - - printk(KERN_INFO "TCP: Hash tables configured " - "(established %u bind %u)\n", -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index daedc07..9726927 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -83,7 +83,7 @@ int sysctl_tcp_ecn __read_mostly = 2; - EXPORT_SYMBOL(sysctl_tcp_ecn); - int sysctl_tcp_dsack __read_mostly = 1; - int sysctl_tcp_app_win __read_mostly = 31; --int sysctl_tcp_adv_win_scale __read_mostly = 2; -+int sysctl_tcp_adv_win_scale __read_mostly = 1; - EXPORT_SYMBOL(sysctl_tcp_adv_win_scale); - - int sysctl_tcp_stdurg __read_mostly; -@@ -2868,11 +2868,14 @@ static inline void tcp_complete_cwr(struct sock *sk) - - /* Do not moderate cwnd if it's already undone in cwr or recovery. */ - if (tp->undo_marker) { -- if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) -+ if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) { - tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh); -- else /* PRR */ -+ tp->snd_cwnd_stamp = tcp_time_stamp; -+ } else if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH) { -+ /* PRR algorithm. */ - tp->snd_cwnd = tp->snd_ssthresh; -- tp->snd_cwnd_stamp = tcp_time_stamp; -+ tp->snd_cwnd_stamp = tcp_time_stamp; -+ } - } - tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR); - } -diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c -index 55670ec..2a2a3e7 100644 ---- a/net/l2tp/l2tp_ip.c -+++ b/net/l2tp/l2tp_ip.c -@@ -441,8 +441,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m - - daddr = lip->l2tp_addr.s_addr; - } else { -+ rc = -EDESTADDRREQ; - if (sk->sk_state != TCP_ESTABLISHED) -- return -EDESTADDRREQ; -+ goto out; - - daddr = inet->inet_daddr; - connected = 1; -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c -index 7801b15..a489d8b 100644 ---- a/net/sched/sch_netem.c -+++ b/net/sched/sch_netem.c -@@ -351,10 +351,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch) - if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) { - if (!(skb = skb_unshare(skb, GFP_ATOMIC)) || - (skb->ip_summed == CHECKSUM_PARTIAL && -- skb_checksum_help(skb))) { -- sch->qstats.drops++; -- return NET_XMIT_DROP; -- } -+ skb_checksum_help(skb))) -+ return qdisc_drop(skb, sch); - - skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8); - } -diff --git a/sound/pci/echoaudio/echoaudio_dsp.c b/sound/pci/echoaudio/echoaudio_dsp.c -index 64417a7..d8c670c 100644 ---- a/sound/pci/echoaudio/echoaudio_dsp.c -+++ b/sound/pci/echoaudio/echoaudio_dsp.c -@@ -475,7 +475,7 @@ static int load_firmware(struct echoaudio *chip) - const struct firmware *fw; - int box_type, err; - -- if (snd_BUG_ON(!chip->dsp_code_to_load || !chip->comm_page)) -+ if (snd_BUG_ON(!chip->comm_page)) - return -EPERM; - - /* See if the ASIC is present and working - only if the DSP is already loaded */ -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 192e6c0..53345bc 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -769,11 +769,13 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus, - { - struct azx *chip = bus->private_data; - unsigned long timeout; -+ unsigned long loopcounter; - int do_poll = 0; - - again: - timeout = jiffies + msecs_to_jiffies(1000); -- for (;;) { -+ -+ for (loopcounter = 0;; loopcounter++) { - if (chip->polling_mode || do_poll) { - spin_lock_irq(&chip->reg_lock); - azx_update_rirb(chip); -@@ -789,7 +791,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus, - } - if (time_after(jiffies, timeout)) - break; -- if (bus->needs_damn_long_delay) -+ if (bus->needs_damn_long_delay || loopcounter > 3000) - msleep(2); /* temporary workaround */ - else { - udelay(10); -diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c -index ed67698..7b7a516 100644 ---- a/sound/pci/hda/patch_sigmatel.c -+++ b/sound/pci/hda/patch_sigmatel.c -@@ -4484,9 +4484,9 @@ static int stac92xx_init(struct hda_codec *codec) - def_conf = get_defcfg_connect(def_conf); - /* skip any ports that don't have jacks since presence - * detection is useless */ -- if (def_conf != AC_JACK_PORT_COMPLEX) { -- if (def_conf != AC_JACK_PORT_NONE) -- stac_toggle_power_map(codec, nid, 1); -+ if (def_conf != AC_JACK_PORT_NONE && -+ !is_jack_detectable(codec, nid)) { -+ stac_toggle_power_map(codec, nid, 1); - continue; - } - if (enable_pin_detect(codec, nid, STAC_PWR_EVENT)) { -diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c -index 7806301..3e7aa22 100644 ---- a/sound/soc/codecs/wm8994.c -+++ b/sound/soc/codecs/wm8994.c -@@ -1027,7 +1027,7 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w, - snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, - WM8994_AIF2DACL_ENA | - WM8994_AIF2DACR_ENA, 0); -- snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, -+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, - WM8994_AIF2ADCL_ENA | - WM8994_AIF2ADCR_ENA, 0); - diff --git a/3.2.18/0000_README b/3.2.19/0000_README index 9daad3a..d244990 100644 --- a/3.2.18/0000_README +++ b/3.2.19/0000_README @@ -10,7 +10,7 @@ Patch: 1017_linux-3.2.18.patch From: http://www.kernel.org Desc: Linux 3.2.18 -Patch: 4420_grsecurity-2.9-3.2.18-201206011935.patch +Patch: 4420_grsecurity-2.9-3.2.19-201206042135.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch b/3.2.19/4420_grsecurity-2.9-3.2.19-201206042135.patch index e73e583..b4e3cb9 100644 --- a/3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch +++ b/3.2.19/4420_grsecurity-2.9-3.2.19-201206042135.patch @@ -195,7 +195,7 @@ index 81c287f..d456d02 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index add68f1..3fac8b3 100644 +index c291184..347a3de 100644 --- a/Makefile +++ b/Makefile @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -312,7 +312,7 @@ index add68f1..3fac8b3 100644 prepare: prepare0 # Generate some files -@@ -1086,6 +1139,8 @@ all: modules +@@ -1089,6 +1142,8 @@ all: modules # using awk while concatenating to the final file. PHONY += modules @@ -321,7 +321,7 @@ index add68f1..3fac8b3 100644 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order @$(kecho) ' Building modules, stage 2.'; -@@ -1101,7 +1156,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin) +@@ -1104,7 +1159,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin) # Target to prepare building external modules PHONY += modules_prepare @@ -330,7 +330,7 @@ index add68f1..3fac8b3 100644 # Target to install modules PHONY += modules_install -@@ -1198,6 +1253,7 @@ distclean: mrproper +@@ -1201,6 +1256,7 @@ distclean: mrproper \( -name '*.orig' -o -name '*.rej' -o -name '*~' \ -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \ -o -name '.*.rej' \ @@ -338,7 +338,7 @@ index add68f1..3fac8b3 100644 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \ -type f -print | xargs rm -f -@@ -1358,6 +1414,8 @@ PHONY += $(module-dirs) modules +@@ -1361,6 +1417,8 @@ PHONY += $(module-dirs) modules $(module-dirs): crmodverdir $(objtree)/Module.symvers $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) @@ -347,7 +347,7 @@ index add68f1..3fac8b3 100644 modules: $(module-dirs) @$(kecho) ' Building modules, stage 2.'; $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost -@@ -1484,17 +1542,21 @@ else +@@ -1487,17 +1545,21 @@ else target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@)) endif @@ -373,7 +373,7 @@ index add68f1..3fac8b3 100644 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.symtypes: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -@@ -1504,11 +1566,15 @@ endif +@@ -1507,11 +1569,15 @@ endif $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) @@ -1325,7 +1325,7 @@ index 75fe66b..2255c86 100644 /* * Memory returned by kmalloc() may be used for DMA, so we must make diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h -index d5d8d5c..ad92c96 100644 +index 1252a26..9dc17b5 100644 --- a/arch/arm/include/asm/cacheflush.h +++ b/arch/arm/include/asm/cacheflush.h @@ -108,7 +108,7 @@ struct cpu_cache_fns { @@ -1675,7 +1675,7 @@ index 8fc2c8f..064c150 100644 #endif diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c -index 99a5727..a3d5bb1 100644 +index 160cb16..c3261f6 100644 --- a/arch/arm/kernel/traps.c +++ b/arch/arm/kernel/traps.c @@ -259,6 +259,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt @@ -5053,7 +5053,7 @@ index afeb710..d1d1289 100644 bottomup: /* diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig -index f92602e..27060b2 100644 +index f210d51..87537e2 100644 --- a/arch/sparc/Kconfig +++ b/arch/sparc/Kconfig @@ -31,6 +31,7 @@ config SPARC @@ -7752,7 +7752,7 @@ index bf56e17..05f9891 100644 This option helps catch unintended modifications to loadable kernel module's text and read-only data. It also prevents execution diff --git a/arch/x86/Makefile b/arch/x86/Makefile -index b02e509..2631e48 100644 +index 03dbc7f5b..4d12eea 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -46,6 +46,7 @@ else @@ -7763,7 +7763,7 @@ index b02e509..2631e48 100644 KBUILD_AFLAGS += -m64 KBUILD_CFLAGS += -m64 -@@ -195,3 +196,12 @@ define archhelp +@@ -199,3 +200,12 @@ define archhelp echo ' FDARGS="..." arguments for the booted kernel' echo ' FDINITRD=file initrd for the booted kernel' endef @@ -7835,7 +7835,7 @@ index c7093bd..d4247ffe0 100644 return diff; } diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index 09664ef..edc5d03 100644 +index 77453c6..2c6cd1b 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small @@ -7924,201 +7924,6 @@ index 3a19d04..7c1d55a 100644 error("Wrong destination address"); #endif -diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c -index e77f4e4..17e511f 100644 ---- a/arch/x86/boot/compressed/relocs.c -+++ b/arch/x86/boot/compressed/relocs.c -@@ -13,8 +13,11 @@ - - static void die(char *fmt, ...); - -+#include "../../../../include/generated/autoconf.h" -+ - #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) - static Elf32_Ehdr ehdr; -+static Elf32_Phdr *phdr; - static unsigned long reloc_count, reloc_idx; - static unsigned long *relocs; - -@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp) - } - } - -+static void read_phdrs(FILE *fp) -+{ -+ unsigned int i; -+ -+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr)); -+ if (!phdr) { -+ die("Unable to allocate %d program headers\n", -+ ehdr.e_phnum); -+ } -+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) { -+ die("Seek to %d failed: %s\n", -+ ehdr.e_phoff, strerror(errno)); -+ } -+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) { -+ die("Cannot read ELF program headers: %s\n", -+ strerror(errno)); -+ } -+ for(i = 0; i < ehdr.e_phnum; i++) { -+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type); -+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset); -+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr); -+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr); -+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz); -+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz); -+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags); -+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align); -+ } -+ -+} -+ - static void read_shdrs(FILE *fp) - { -- int i; -+ unsigned int i; - Elf32_Shdr shdr; - - secs = calloc(ehdr.e_shnum, sizeof(struct section)); -@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp) - - static void read_strtabs(FILE *fp) - { -- int i; -+ unsigned int i; - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - if (sec->shdr.sh_type != SHT_STRTAB) { -@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp) - - static void read_symtabs(FILE *fp) - { -- int i,j; -+ unsigned int i,j; - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - if (sec->shdr.sh_type != SHT_SYMTAB) { -@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp) - - static void read_relocs(FILE *fp) - { -- int i,j; -+ unsigned int i,j; -+ uint32_t base; -+ - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - if (sec->shdr.sh_type != SHT_REL) { -@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp) - die("Cannot read symbol table: %s\n", - strerror(errno)); - } -+ base = 0; -+ for (j = 0; j < ehdr.e_phnum; j++) { -+ if (phdr[j].p_type != PT_LOAD ) -+ continue; -+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz) -+ continue; -+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr; -+ break; -+ } - for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) { - Elf32_Rel *rel = &sec->reltab[j]; -- rel->r_offset = elf32_to_cpu(rel->r_offset); -+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base; - rel->r_info = elf32_to_cpu(rel->r_info); - } - } -@@ -396,13 +440,13 @@ static void read_relocs(FILE *fp) - - static void print_absolute_symbols(void) - { -- int i; -+ unsigned int i; - printf("Absolute symbols\n"); - printf(" Num: Value Size Type Bind Visibility Name\n"); - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - char *sym_strtab; -- int j; -+ unsigned int j; - - if (sec->shdr.sh_type != SHT_SYMTAB) { - continue; -@@ -429,14 +473,14 @@ static void print_absolute_symbols(void) - - static void print_absolute_relocs(void) - { -- int i, printed = 0; -+ unsigned int i, printed = 0; - - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - struct section *sec_applies, *sec_symtab; - char *sym_strtab; - Elf32_Sym *sh_symtab; -- int j; -+ unsigned int j; - if (sec->shdr.sh_type != SHT_REL) { - continue; - } -@@ -497,13 +541,13 @@ static void print_absolute_relocs(void) - - static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym)) - { -- int i; -+ unsigned int i; - /* Walk through the relocations */ - for (i = 0; i < ehdr.e_shnum; i++) { - char *sym_strtab; - Elf32_Sym *sh_symtab; - struct section *sec_applies, *sec_symtab; -- int j; -+ unsigned int j; - struct section *sec = &secs[i]; - - if (sec->shdr.sh_type != SHT_REL) { -@@ -528,6 +572,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym)) - !is_rel_reloc(sym_name(sym_strtab, sym))) { - continue; - } -+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */ -+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load")) -+ continue; -+ -+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32) -+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */ -+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".init.text")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR")) -+ continue; -+#endif -+ - switch (r_type) { - case R_386_NONE: - case R_386_PC32: -@@ -569,7 +629,7 @@ static int cmp_relocs(const void *va, const void *vb) - - static void emit_relocs(int as_text) - { -- int i; -+ unsigned int i; - /* Count how many relocations I have and allocate space for them. */ - reloc_count = 0; - walk_relocs(count_reloc); -@@ -663,6 +723,7 @@ int main(int argc, char **argv) - fname, strerror(errno)); - } - read_ehdr(fp); -+ read_phdrs(fp); - read_shdrs(fp); - read_strtabs(fp); - read_symtabs(fp); diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c index 4d3ff03..e4972ff 100644 --- a/arch/x86/boot/cpucheck.c @@ -14351,7 +14156,7 @@ index 5231312..a78a987 100644 } #endif diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c -index 2af127d..8ff7ac0 100644 +index b0f1271..1158227 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -42,6 +42,7 @@ @@ -14402,7 +14207,7 @@ index 2af127d..8ff7ac0 100644 return; } /* First print corrected ones that are still unlogged */ -@@ -610,7 +611,7 @@ static int mce_timed_out(u64 *t) +@@ -618,7 +619,7 @@ static int mce_timed_out(u64 *t) * might have been modified by someone else. */ rmb(); @@ -14411,7 +14216,7 @@ index 2af127d..8ff7ac0 100644 wait_for_panic(); if (!monarch_timeout) goto out; -@@ -1398,7 +1399,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) +@@ -1406,7 +1407,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) } /* Call the installed machine check handler for this CPU setup. */ @@ -14420,7 +14225,7 @@ index 2af127d..8ff7ac0 100644 unexpected_machine_check; /* -@@ -1421,7 +1422,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) +@@ -1429,7 +1430,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) return; } @@ -14430,7 +14235,7 @@ index 2af127d..8ff7ac0 100644 __mcheck_cpu_init_generic(); __mcheck_cpu_init_vendor(c); -@@ -1435,7 +1438,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) +@@ -1443,7 +1446,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) */ static DEFINE_SPINLOCK(mce_chrdev_state_lock); @@ -14439,7 +14244,7 @@ index 2af127d..8ff7ac0 100644 static int mce_chrdev_open_exclu; /* already open exclusive? */ static int mce_chrdev_open(struct inode *inode, struct file *file) -@@ -1443,7 +1446,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) +@@ -1451,7 +1454,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) spin_lock(&mce_chrdev_state_lock); if (mce_chrdev_open_exclu || @@ -14448,7 +14253,7 @@ index 2af127d..8ff7ac0 100644 spin_unlock(&mce_chrdev_state_lock); return -EBUSY; -@@ -1451,7 +1454,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) +@@ -1459,7 +1462,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) if (file->f_flags & O_EXCL) mce_chrdev_open_exclu = 1; @@ -14457,7 +14262,7 @@ index 2af127d..8ff7ac0 100644 spin_unlock(&mce_chrdev_state_lock); -@@ -1462,7 +1465,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file) +@@ -1470,7 +1473,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file) { spin_lock(&mce_chrdev_state_lock); @@ -14466,7 +14271,7 @@ index 2af127d..8ff7ac0 100644 mce_chrdev_open_exclu = 0; spin_unlock(&mce_chrdev_state_lock); -@@ -2171,7 +2174,7 @@ struct dentry *mce_get_debugfs_dir(void) +@@ -2179,7 +2182,7 @@ struct dentry *mce_get_debugfs_dir(void) static void mce_reset(void) { cpu_missing = 0; @@ -20589,7 +20394,7 @@ index 94a4672..5c6b853 100644 local_irq_disable(); diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 4ea7678..b3a7084 100644 +index 7315488..187fb78 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -1305,7 +1305,11 @@ static void reload_tss(void) @@ -20627,7 +20432,7 @@ index 4ea7678..b3a7084 100644 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32); vmcs_write32(HOST_IA32_SYSENTER_CS, low32); -@@ -6169,6 +6176,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) +@@ -6171,6 +6178,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) "jmp .Lkvm_vmx_return \n\t" ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t" ".Lkvm_vmx_return: " @@ -20640,7 +20445,7 @@ index 4ea7678..b3a7084 100644 /* Save guest registers, load host registers, keep flags */ "mov %0, %c[wordsize](%%"R"sp) \n\t" "pop %0 \n\t" -@@ -6217,6 +6230,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) +@@ -6219,6 +6232,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) #endif [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)), [wordsize]"i"(sizeof(ulong)) @@ -20652,7 +20457,7 @@ index 4ea7678..b3a7084 100644 : "cc", "memory" , R"ax", R"bx", R"di", R"si" #ifdef CONFIG_X86_64 -@@ -6245,7 +6263,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) +@@ -6247,7 +6265,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) } } @@ -20671,7 +20476,7 @@ index 4ea7678..b3a7084 100644 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index e04cae1..b37d0dd 100644 +index 4fc5323..59b259b 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1345,8 +1345,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data) @@ -20750,7 +20555,7 @@ index e04cae1..b37d0dd 100644 return -EINVAL; if (irqchip_in_kernel(vcpu->kvm)) return -ENXIO; -@@ -5185,7 +5196,7 @@ static void kvm_set_mmio_spte_mask(void) +@@ -5188,7 +5199,7 @@ static void kvm_set_mmio_spte_mask(void) kvm_mmu_set_mmio_spte_mask(mask); } @@ -24733,7 +24538,7 @@ index f581a18..a269cab 100644 } if (mm->get_unmapped_area == arch_get_unmapped_area) diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 87488b9..f6222dc 100644 +index 87488b9..a06f559 100644 --- a/arch/x86/mm/init.c +++ b/arch/x86/mm/init.c @@ -15,6 +15,8 @@ @@ -24793,7 +24598,7 @@ index 87488b9..f6222dc 100644 if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) return 0; if (!page_is_ram(pagenr)) -@@ -370,8 +399,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) +@@ -370,8 +399,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) #endif } @@ -24828,14 +24633,13 @@ index 87488b9..f6222dc 100644 + unsigned long addr, limit; + struct desc_struct d; + int cpu; -+#endif -+#endif -+#ifndef CONFIG_X86_PAE ++#else + pgd_t *pgd; + pud_t *pud; + pmd_t *pmd; + unsigned long addr, end; +#endif ++#endif + + gr_init_ebda(); + @@ -26905,6 +26709,206 @@ index f10c0af..3ec1f95 100644 syscall_init(); /* This sets MSR_*STAR and related */ #endif +diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c +index e529730..dccc321 100644 +--- a/arch/x86/tools/relocs.c ++++ b/arch/x86/tools/relocs.c +@@ -13,8 +13,16 @@ + + static void die(char *fmt, ...); + ++#include "../../../include/generated/autoconf.h" ++#ifdef CONFIG_X86_32 ++#define __PAGE_OFFSET CONFIG_PAGE_OFFSET ++#else ++#define __PAGE_OFFSET 0 ++#endif ++ + #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) + static Elf32_Ehdr ehdr; ++static Elf32_Phdr *phdr; + static unsigned long reloc_count, reloc_idx; + static unsigned long *relocs; + static unsigned long reloc16_count, reloc16_idx; +@@ -322,9 +330,39 @@ static void read_ehdr(FILE *fp) + } + } + ++static void read_phdrs(FILE *fp) ++{ ++ unsigned int i; ++ ++ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr)); ++ if (!phdr) { ++ die("Unable to allocate %d program headers\n", ++ ehdr.e_phnum); ++ } ++ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) { ++ die("Seek to %d failed: %s\n", ++ ehdr.e_phoff, strerror(errno)); ++ } ++ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) { ++ die("Cannot read ELF program headers: %s\n", ++ strerror(errno)); ++ } ++ for(i = 0; i < ehdr.e_phnum; i++) { ++ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type); ++ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset); ++ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr); ++ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr); ++ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz); ++ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz); ++ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags); ++ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align); ++ } ++ ++} ++ + static void read_shdrs(FILE *fp) + { +- int i; ++ unsigned int i; + Elf32_Shdr shdr; + + secs = calloc(ehdr.e_shnum, sizeof(struct section)); +@@ -359,7 +397,7 @@ static void read_shdrs(FILE *fp) + + static void read_strtabs(FILE *fp) + { +- int i; ++ unsigned int i; + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + if (sec->shdr.sh_type != SHT_STRTAB) { +@@ -384,7 +422,7 @@ static void read_strtabs(FILE *fp) + + static void read_symtabs(FILE *fp) + { +- int i,j; ++ unsigned int i,j; + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + if (sec->shdr.sh_type != SHT_SYMTAB) { +@@ -417,7 +455,9 @@ static void read_symtabs(FILE *fp) + + static void read_relocs(FILE *fp) + { +- int i,j; ++ unsigned int i,j; ++ uint32_t base; ++ + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + if (sec->shdr.sh_type != SHT_REL) { +@@ -437,9 +477,18 @@ static void read_relocs(FILE *fp) + die("Cannot read symbol table: %s\n", + strerror(errno)); + } ++ base = 0; ++ for (j = 0; j < ehdr.e_phnum; j++) { ++ if (phdr[j].p_type != PT_LOAD ) ++ continue; ++ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz) ++ continue; ++ base = __PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr; ++ break; ++ } + for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) { + Elf32_Rel *rel = &sec->reltab[j]; +- rel->r_offset = elf32_to_cpu(rel->r_offset); ++ rel->r_offset = elf32_to_cpu(rel->r_offset) + base; + rel->r_info = elf32_to_cpu(rel->r_info); + } + } +@@ -448,13 +497,13 @@ static void read_relocs(FILE *fp) + + static void print_absolute_symbols(void) + { +- int i; ++ unsigned int i; + printf("Absolute symbols\n"); + printf(" Num: Value Size Type Bind Visibility Name\n"); + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + char *sym_strtab; +- int j; ++ unsigned int j; + + if (sec->shdr.sh_type != SHT_SYMTAB) { + continue; +@@ -481,14 +530,14 @@ static void print_absolute_symbols(void) + + static void print_absolute_relocs(void) + { +- int i, printed = 0; ++ unsigned int i, printed = 0; + + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + struct section *sec_applies, *sec_symtab; + char *sym_strtab; + Elf32_Sym *sh_symtab; +- int j; ++ unsigned int j; + if (sec->shdr.sh_type != SHT_REL) { + continue; + } +@@ -550,13 +599,13 @@ static void print_absolute_relocs(void) + static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym), + int use_real_mode) + { +- int i; ++ unsigned int i; + /* Walk through the relocations */ + for (i = 0; i < ehdr.e_shnum; i++) { + char *sym_strtab; + Elf32_Sym *sh_symtab; + struct section *sec_applies, *sec_symtab; +- int j; ++ unsigned int j; + struct section *sec = &secs[i]; + + if (sec->shdr.sh_type != SHT_REL) { +@@ -582,6 +631,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym), + + shn_abs = sym->st_shndx == SHN_ABS; + ++ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */ ++ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load")) ++ continue; ++ ++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32) ++ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */ ++ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".init.text")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".exit.text")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR")) ++ continue; ++#endif ++ + switch (r_type) { + case R_386_NONE: + case R_386_PC32: +@@ -676,7 +741,7 @@ static int write32(unsigned int v, FILE *f) + + static void emit_relocs(int as_text, int use_real_mode) + { +- int i; ++ unsigned int i; + /* Count how many relocations I have and allocate space for them. */ + reloc_count = 0; + walk_relocs(count_reloc, use_real_mode); +@@ -803,6 +868,7 @@ int main(int argc, char **argv) + fname, strerror(errno)); + } + read_ehdr(fp); ++ read_phdrs(fp); + read_shdrs(fp); + read_strtabs(fp); + read_symtabs(fp); diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile index 5d17950..2253fc9 100644 --- a/arch/x86/vdso/Makefile @@ -27078,7 +27082,7 @@ index 153407c..611cba9 100644 -} -__setup("vdso=", vdso_setup); diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index e7c920b..c9bdcf7 100644 +index e7c920b..4413fbf 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); @@ -27090,7 +27094,18 @@ index e7c920b..c9bdcf7 100644 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE); __read_mostly int xen_have_vector_callback; EXPORT_SYMBOL_GPL(xen_have_vector_callback); -@@ -1030,7 +1028,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = { +@@ -982,7 +980,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = { + .wbinvd = native_wbinvd, + + .read_msr = native_read_msr_safe, ++ .rdmsr_regs = native_rdmsr_safe_regs, + .write_msr = xen_write_msr_safe, ++ .wrmsr_regs = native_wrmsr_safe_regs, ++ + .read_tsc = native_read_tsc, + .read_pmc = native_read_pmc, + +@@ -1030,7 +1031,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = { #endif }; @@ -27099,7 +27114,7 @@ index e7c920b..c9bdcf7 100644 { struct sched_shutdown r = { .reason = reason }; -@@ -1038,17 +1036,17 @@ static void xen_reboot(int reason) +@@ -1038,17 +1039,17 @@ static void xen_reboot(int reason) BUG(); } @@ -27120,7 +27135,7 @@ index e7c920b..c9bdcf7 100644 { xen_reboot(SHUTDOWN_poweroff); } -@@ -1154,7 +1152,17 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1154,7 +1155,17 @@ asmlinkage void __init xen_start_kernel(void) __userpte_alloc_gfp &= ~__GFP_HIGHMEM; /* Work out if we support NX */ @@ -27139,7 +27154,7 @@ index e7c920b..c9bdcf7 100644 xen_setup_features(); -@@ -1185,13 +1193,6 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1185,13 +1196,6 @@ asmlinkage void __init xen_start_kernel(void) machine_ops = xen_machine_ops; @@ -30773,10 +30788,10 @@ index a6c2f7a..0eea25d 100644 for (i = 0; i < count; i++) { char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c -index d47a53b..61154c2 100644 +index d3820c2..23c575f 100644 --- a/drivers/gpu/drm/i915/i915_irq.c +++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS) +@@ -472,7 +472,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS) u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir; struct drm_i915_master_private *master_priv; @@ -30785,7 +30800,7 @@ index d47a53b..61154c2 100644 /* disable master interrupt before clearing iir */ de_ier = I915_READ(DEIER); -@@ -566,7 +566,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS) +@@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS) struct drm_i915_master_private *master_priv; u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT; @@ -30794,7 +30809,7 @@ index d47a53b..61154c2 100644 if (IS_GEN6(dev)) bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT; -@@ -1231,7 +1231,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS) +@@ -1228,7 +1228,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS) int ret = IRQ_NONE, pipe; bool blc_event = false; @@ -30803,7 +30818,7 @@ index d47a53b..61154c2 100644 iir = I915_READ(IIR); -@@ -1750,7 +1750,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev) +@@ -1747,7 +1747,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev) { drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; @@ -30812,7 +30827,7 @@ index d47a53b..61154c2 100644 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); INIT_WORK(&dev_priv->error_work, i915_error_work_func); -@@ -1938,7 +1938,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev) +@@ -1935,7 +1935,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev) drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; int pipe; @@ -30822,7 +30837,7 @@ index d47a53b..61154c2 100644 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); INIT_WORK(&dev_priv->error_work, i915_error_work_func); diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 390768f..172aa06 100644 +index 3ff980d..6efde22 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -2230,7 +2230,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y, @@ -33765,7 +33780,7 @@ index 4720f68..78d1df7 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index adcd850..e29654d 100644 +index 700ecae..2e5a31a 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -278,10 +278,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio); @@ -34189,7 +34204,7 @@ index 0564192..75b16f5 100644 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2), NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2), diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c -index 16a089f..ab1667d 100644 +index 16a089f..1661b11 100644 --- a/drivers/media/radio/radio-cadet.c +++ b/drivers/media/radio/radio-cadet.c @@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo @@ -34201,6 +34216,15 @@ index 16a089f..ab1667d 100644 mutex_lock(&dev->lock); if (dev->rdsstat == 0) { dev->rdsstat = 1; +@@ -347,7 +349,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo + readbuf[i++] = dev->rdsbuf[dev->rdsout++]; + mutex_unlock(&dev->lock); + +- if (copy_to_user(data, readbuf, i)) ++ if (i > sizeof(readbuf) || copy_to_user(data, readbuf, i)) + return -EFAULT; + return i; + } diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c index 61287fc..8b08712 100644 --- a/drivers/media/rc/redrat3.c @@ -35063,93 +35087,6 @@ index 4d01219..b58d26d 100644 { /* Sometime a Level-One switch card. */ "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII}, { "Winbond W89c840", CanHaveMII | HasBrokenTx}, -diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c -index b2dc2c8..2e09edb 100644 ---- a/drivers/net/ethernet/dlink/dl2k.c -+++ b/drivers/net/ethernet/dlink/dl2k.c -@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd) - { - int phy_addr; - struct netdev_private *np = netdev_priv(dev); -- struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru; -- -- struct netdev_desc *desc; -- int i; -+ struct mii_ioctl_data *miidata = if_mii(rq); - - phy_addr = np->phy_addr; - switch (cmd) { -- case SIOCDEVPRIVATE: -+ case SIOCGMIIPHY: -+ miidata->phy_id = phy_addr; - break; -- -- case SIOCDEVPRIVATE + 1: -- miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num); -+ case SIOCGMIIREG: -+ miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num); - break; -- case SIOCDEVPRIVATE + 2: -- mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value); -+ case SIOCSMIIREG: -+ if (!capable(CAP_NET_ADMIN)) -+ return -EPERM; -+ mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in); - break; -- case SIOCDEVPRIVATE + 3: -- break; -- case SIOCDEVPRIVATE + 4: -- break; -- case SIOCDEVPRIVATE + 5: -- netif_stop_queue (dev); -- break; -- case SIOCDEVPRIVATE + 6: -- netif_wake_queue (dev); -- break; -- case SIOCDEVPRIVATE + 7: -- printk -- ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n", -- netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx, -- np->old_rx); -- break; -- case SIOCDEVPRIVATE + 8: -- printk("TX ring:\n"); -- for (i = 0; i < TX_RING_SIZE; i++) { -- desc = &np->tx_ring[i]; -- printk -- ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x", -- i, -- (u32) (np->tx_ring_dma + i * sizeof (*desc)), -- (u32)le64_to_cpu(desc->next_desc), -- (u32)le64_to_cpu(desc->status), -- (u32)(le64_to_cpu(desc->fraginfo) >> 32), -- (u32)le64_to_cpu(desc->fraginfo)); -- printk ("\n"); -- } -- printk ("\n"); -- break; -- - default: - return -EOPNOTSUPP; - } -diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h -index ba0adca..30c2da3 100644 ---- a/drivers/net/ethernet/dlink/dl2k.h -+++ b/drivers/net/ethernet/dlink/dl2k.h -@@ -365,13 +365,6 @@ struct ioctl_data { - char *data; - }; - --struct mii_data { -- __u16 reserved; -- __u16 reg_num; -- __u16 in_value; -- __u16 out_value; --}; -- - /* The Rx and Tx buffer descriptors. */ - struct netdev_desc { - __le64 next_desc; diff --git a/drivers/net/ethernet/dlink/sundance.c b/drivers/net/ethernet/dlink/sundance.c index dcd7f7a..ecb7fb3 100644 --- a/drivers/net/ethernet/dlink/sundance.c @@ -36891,7 +36828,7 @@ index 351dc0b..951dc32 100644 /* These three are default values which can be overridden */ diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index 865d452..e9b7fa7 100644 +index b4d2c86..094a532 100644 --- a/drivers/scsi/hpsa.c +++ b/drivers/scsi/hpsa.c @@ -505,7 +505,7 @@ static inline u32 next_command(struct ctlr_info *h) @@ -36903,7 +36840,7 @@ index 865d452..e9b7fa7 100644 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) { a = *(h->reply_pool_head); /* Next cmd in ring buffer */ -@@ -2989,7 +2989,7 @@ static void start_io(struct ctlr_info *h) +@@ -2985,7 +2985,7 @@ static void start_io(struct ctlr_info *h) while (!list_empty(&h->reqQ)) { c = list_entry(h->reqQ.next, struct CommandList, list); /* can't do anything if fifo is full */ @@ -36912,7 +36849,7 @@ index 865d452..e9b7fa7 100644 dev_warn(&h->pdev->dev, "fifo full\n"); break; } -@@ -2999,7 +2999,7 @@ static void start_io(struct ctlr_info *h) +@@ -2995,7 +2995,7 @@ static void start_io(struct ctlr_info *h) h->Qdepth--; /* Tell the controller execute command */ @@ -36921,7 +36858,7 @@ index 865d452..e9b7fa7 100644 /* Put job onto the completed Q */ addQ(&h->cmpQ, c); -@@ -3008,17 +3008,17 @@ static void start_io(struct ctlr_info *h) +@@ -3004,17 +3004,17 @@ static void start_io(struct ctlr_info *h) static inline unsigned long get_next_completion(struct ctlr_info *h) { @@ -36942,7 +36879,7 @@ index 865d452..e9b7fa7 100644 (h->interrupts_enabled == 0); } -@@ -3917,7 +3917,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h) +@@ -3913,7 +3913,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h) if (prod_index < 0) return -ENODEV; h->product_name = products[prod_index].product_name; @@ -36951,7 +36888,7 @@ index 865d452..e9b7fa7 100644 if (hpsa_board_disabled(h->pdev)) { dev_warn(&h->pdev->dev, "controller appears to be disabled\n"); -@@ -4162,7 +4162,7 @@ static void controller_lockup_detected(struct ctlr_info *h) +@@ -4158,7 +4158,7 @@ static void controller_lockup_detected(struct ctlr_info *h) assert_spin_locked(&lockup_detector_lock); remove_ctlr_from_lockup_detector_list(h); @@ -36960,7 +36897,7 @@ index 865d452..e9b7fa7 100644 spin_lock_irqsave(&h->lock, flags); h->lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET); spin_unlock_irqrestore(&h->lock, flags); -@@ -4340,7 +4340,7 @@ reinit_after_soft_reset: +@@ -4336,7 +4336,7 @@ reinit_after_soft_reset: } /* make sure the board interrupts are off */ @@ -36969,7 +36906,7 @@ index 865d452..e9b7fa7 100644 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx)) goto clean2; -@@ -4374,7 +4374,7 @@ reinit_after_soft_reset: +@@ -4370,7 +4370,7 @@ reinit_after_soft_reset: * fake ones to scoop up any residual completions. */ spin_lock_irqsave(&h->lock, flags); @@ -36978,7 +36915,7 @@ index 865d452..e9b7fa7 100644 spin_unlock_irqrestore(&h->lock, flags); free_irq(h->intr[h->intr_mode], h); rc = hpsa_request_irq(h, hpsa_msix_discard_completions, -@@ -4393,9 +4393,9 @@ reinit_after_soft_reset: +@@ -4389,9 +4389,9 @@ reinit_after_soft_reset: dev_info(&h->pdev->dev, "Board READY.\n"); dev_info(&h->pdev->dev, "Waiting for stale completions to drain.\n"); @@ -36990,7 +36927,7 @@ index 865d452..e9b7fa7 100644 rc = controller_reset_failed(h->cfgtable); if (rc) -@@ -4416,7 +4416,7 @@ reinit_after_soft_reset: +@@ -4412,7 +4412,7 @@ reinit_after_soft_reset: } /* Turn the interrupts on so we can service requests */ @@ -36999,7 +36936,7 @@ index 865d452..e9b7fa7 100644 hpsa_hba_inquiry(h); hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */ -@@ -4468,7 +4468,7 @@ static void hpsa_shutdown(struct pci_dev *pdev) +@@ -4464,7 +4464,7 @@ static void hpsa_shutdown(struct pci_dev *pdev) * To write all data in the battery backed cache to disks */ hpsa_flush_cache(h); @@ -37008,7 +36945,7 @@ index 865d452..e9b7fa7 100644 free_irq(h->intr[h->intr_mode], h); #ifdef CONFIG_PCI_MSI if (h->msix_vector) -@@ -4632,7 +4632,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h, +@@ -4628,7 +4628,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h, return; } /* Change the access methods to the performant access methods */ @@ -42317,7 +42254,7 @@ index 79e2ca7..5828ad1 100644 A.out (Assembler.OUTput) is a set of formats for libraries and executables used in the earliest versions of UNIX. Linux used diff --git a/fs/aio.c b/fs/aio.c -index b9d64d8..86cb1d5 100644 +index 3b65ee7..aa6ec34 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx) @@ -42329,7 +42266,7 @@ index b9d64d8..86cb1d5 100644 return -EINVAL; nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event); -@@ -1461,22 +1461,27 @@ static ssize_t aio_fsync(struct kiocb *iocb) +@@ -1461,18 +1461,19 @@ static ssize_t aio_fsync(struct kiocb *iocb) static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat) { ssize_t ret; @@ -42351,11 +42288,15 @@ index b9d64d8..86cb1d5 100644 &kiocb->ki_iovec, 1); if (ret < 0) goto out; +@@ -1481,6 +1482,11 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat) + if (ret < 0) + goto out; + if (kiocb->ki_iovec == &iovstack) { + kiocb->ki_inline_vec = iovstack; + kiocb->ki_iovec = &kiocb->ki_inline_vec; + } ++ kiocb->ki_nr_segs = kiocb->ki_nbytes; kiocb->ki_cur_seg = 0; /* ki_nbytes/left now reflect bytes instead of segs */ @@ -43426,10 +43367,10 @@ index 1bffbe0..c8c283e 100644 goto err; } diff --git a/fs/bio.c b/fs/bio.c -index b1fe82c..08e2e2e 100644 +index 4fc4dbb..d3a5b93 100644 --- a/fs/bio.c +++ b/fs/bio.c -@@ -837,7 +837,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, +@@ -838,7 +838,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, /* * Overflow, abort */ @@ -43438,7 +43379,7 @@ index b1fe82c..08e2e2e 100644 return ERR_PTR(-EINVAL); nr_pages += end - start; -@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err) +@@ -1234,7 +1234,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err) const int read = bio_data_dir(bio) == READ; struct bio_map_data *bmd = bio->bi_private; int i; @@ -43448,7 +43389,7 @@ index b1fe82c..08e2e2e 100644 __bio_for_each_segment(bvec, bio, i, 0) { char *addr = page_address(bvec->bv_page); diff --git a/fs/block_dev.c b/fs/block_dev.c -index abe9b48..5df59e8 100644 +index 9b98987..fd211e3 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -681,7 +681,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole, @@ -43865,7 +43806,7 @@ index 84e8c07..6170d31 100644 } } diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c -index b4c2c99..50f8767 100644 +index b1451af..9a30647 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -989,7 +989,7 @@ cifs_init_request_bufs(void) @@ -47759,96 +47700,6 @@ index 50a15fa..ca113f9 100644 } void nfs_fattr_init(struct nfs_fattr *fattr) -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index bab7c58..38bd5f2 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -3582,19 +3582,23 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu - if (npages == 0) - npages = 1; - -+ /* Add an extra page to handle the bitmap returned */ -+ npages++; -+ - for (i = 0; i < npages; i++) { - pages[i] = alloc_page(GFP_KERNEL); - if (!pages[i]) - goto out_free; - } -- if (npages > 1) { -- /* for decoding across pages */ -- res.acl_scratch = alloc_page(GFP_KERNEL); -- if (!res.acl_scratch) -- goto out_free; -- } -+ -+ /* for decoding across pages */ -+ res.acl_scratch = alloc_page(GFP_KERNEL); -+ if (!res.acl_scratch) -+ goto out_free; -+ - args.acl_len = npages * PAGE_SIZE; - args.acl_pgbase = 0; -+ - /* Let decode_getfacl know not to fail if the ACL data is larger than - * the page we send as a guess */ - if (buf == NULL) -diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c -index 68adab4..d7e6f7b 100644 ---- a/fs/nfs/nfs4xdr.c -+++ b/fs/nfs/nfs4xdr.c -@@ -4965,11 +4965,19 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req, - bitmap[3] = {0}; - struct kvec *iov = req->rq_rcv_buf.head; - int status; -+ size_t page_len = xdr->buf->page_len; - - res->acl_len = 0; - if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0) - goto out; -+ - bm_p = xdr->p; -+ res->acl_data_offset = be32_to_cpup(bm_p) + 2; -+ res->acl_data_offset <<= 2; -+ /* Check if the acl data starts beyond the allocated buffer */ -+ if (res->acl_data_offset > page_len) -+ return -ERANGE; -+ - if ((status = decode_attr_bitmap(xdr, bitmap)) != 0) - goto out; - if ((status = decode_attr_length(xdr, &attrlen, &savep)) != 0) -@@ -4979,28 +4987,24 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req, - return -EIO; - if (likely(bitmap[0] & FATTR4_WORD0_ACL)) { - size_t hdrlen; -- u32 recvd; - - /* The bitmap (xdr len + bitmaps) and the attr xdr len words - * are stored with the acl data to handle the problem of - * variable length bitmaps.*/ - xdr->p = bm_p; -- res->acl_data_offset = be32_to_cpup(bm_p) + 2; -- res->acl_data_offset <<= 2; - - /* We ignore &savep and don't do consistency checks on - * the attr length. Let userspace figure it out.... */ - hdrlen = (u8 *)xdr->p - (u8 *)iov->iov_base; - attrlen += res->acl_data_offset; -- recvd = req->rq_rcv_buf.len - hdrlen; -- if (attrlen > recvd) { -+ if (attrlen > page_len) { - if (res->acl_flags & NFS4_ACL_LEN_REQUEST) { - /* getxattr interface called with a NULL buf */ - res->acl_len = attrlen; - goto out; - } -- dprintk("NFS: acl reply: attrlen %u > recvd %u\n", -- attrlen, recvd); -+ dprintk("NFS: acl reply: attrlen %zu > page_len %u\n", -+ attrlen, page_len); - return -EINVAL; - } - xdr_read_pages(xdr, attrlen); diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 5c3cd82..ed535e5 100644 --- a/fs/nfsd/vfs.c @@ -61356,7 +61207,7 @@ index 84ccf8e..2e9b14c 100644 }; diff --git a/include/linux/fs.h b/include/linux/fs.h -index 11f1951..e3c18da 100644 +index 43d36b7..e5575ee 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1614,7 +1614,8 @@ struct file_operations { @@ -61452,7 +61303,7 @@ index c3da42d..c70e0df 100644 int trace_set_clr_event(const char *system, const char *event, int set); diff --git a/include/linux/genhd.h b/include/linux/genhd.h -index c6f7f6a..aa0f7d3 100644 +index 4eec461..84c73cf 100644 --- a/include/linux/genhd.h +++ b/include/linux/genhd.h @@ -185,7 +185,7 @@ struct gendisk { @@ -62775,7 +62626,7 @@ index b16f653..eb908f4 100644 #define request_module_nowait(mod...) __request_module(false, mod) #define try_then_request_module(x, mod...) \ diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h -index 35410ef..9f98b23 100644 +index 6136821..b3ba6ba 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -308,7 +308,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu); @@ -65410,7 +65261,7 @@ index 43298f9..2f56c12 100644 Randomizing heap placement makes heap exploits harder, but it also breaks ancient binaries (including anything libc5 based). diff --git a/init/do_mounts.c b/init/do_mounts.c -index db6e5ee..7677ff7 100644 +index d6c229f..4746631 100644 --- a/init/do_mounts.c +++ b/init/do_mounts.c @@ -325,11 +325,11 @@ static void __init get_fs_names(char *page) @@ -65712,7 +65563,7 @@ index 2531811..040d4d4 100644 next_state = Reset; return 0; diff --git a/init/main.c b/init/main.c -index 217ed23..ec5406f 100644 +index cb08fea2..f5b850d 100644 --- a/init/main.c +++ b/init/main.c @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { } @@ -65774,7 +65625,7 @@ index 217ed23..ec5406f 100644 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, }; const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, }; static const char *panic_later, *panic_param; -@@ -681,6 +726,7 @@ int __init_or_module do_one_initcall(initcall_t fn) +@@ -678,6 +723,7 @@ int __init_or_module do_one_initcall(initcall_t fn) { int count = preempt_count(); int ret; @@ -65782,7 +65633,7 @@ index 217ed23..ec5406f 100644 if (initcall_debug) ret = do_one_initcall_debug(fn); -@@ -693,15 +739,15 @@ int __init_or_module do_one_initcall(initcall_t fn) +@@ -690,15 +736,15 @@ int __init_or_module do_one_initcall(initcall_t fn) sprintf(msgbuf, "error code %d ", ret); if (preempt_count() != count) { @@ -65802,7 +65653,7 @@ index 217ed23..ec5406f 100644 } return ret; -@@ -820,7 +866,7 @@ static int __init kernel_init(void * unused) +@@ -821,7 +867,7 @@ static int __init kernel_init(void * unused) do_basic_setup(); /* Open the /dev/console on the rootfs, this should never fail */ @@ -65811,7 +65662,7 @@ index 217ed23..ec5406f 100644 printk(KERN_WARNING "Warning: unable to open an initial console.\n"); (void) sys_dup(0); -@@ -833,11 +879,13 @@ static int __init kernel_init(void * unused) +@@ -834,11 +880,13 @@ static int __init kernel_init(void * unused) if (!ramdisk_execute_command) ramdisk_execute_command = "/init"; @@ -66160,7 +66011,7 @@ index b463871..fa3ea1f 100644 * nsown_capable - Check superior capability to one's own user_ns * @cap: The capability in question diff --git a/kernel/compat.c b/kernel/compat.c -index f346ced..aa2b1f4 100644 +index a6d0649..f44fb27 100644 --- a/kernel/compat.c +++ b/kernel/compat.c @@ -13,6 +13,7 @@ @@ -66198,18 +66049,7 @@ index f346ced..aa2b1f4 100644 set_fs(old_fs); if (ret == 0) ret = put_user(s, set); -@@ -332,8 +333,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set, - old_fs = get_fs(); - set_fs(KERNEL_DS); - ret = sys_sigprocmask(how, -- set ? (old_sigset_t __user *) &s : NULL, -- oset ? (old_sigset_t __user *) &s : NULL); -+ set ? (old_sigset_t __force_user *) &s : NULL, -+ oset ? (old_sigset_t __force_user *) &s : NULL); - set_fs(old_fs); - if (ret == 0) - if (oset) -@@ -370,7 +371,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource, +@@ -399,7 +400,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource, mm_segment_t old_fs = get_fs(); set_fs(KERNEL_DS); @@ -66218,7 +66058,7 @@ index f346ced..aa2b1f4 100644 set_fs(old_fs); if (!ret) { -@@ -442,7 +443,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru) +@@ -471,7 +472,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru) mm_segment_t old_fs = get_fs(); set_fs(KERNEL_DS); @@ -66227,7 +66067,7 @@ index f346ced..aa2b1f4 100644 set_fs(old_fs); if (ret) -@@ -469,8 +470,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options, +@@ -498,8 +499,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options, set_fs (KERNEL_DS); ret = sys_wait4(pid, (stat_addr ? @@ -66238,7 +66078,7 @@ index f346ced..aa2b1f4 100644 set_fs (old_fs); if (ret > 0) { -@@ -495,8 +496,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid, +@@ -524,8 +525,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid, memset(&info, 0, sizeof(info)); set_fs(KERNEL_DS); @@ -66249,7 +66089,7 @@ index f346ced..aa2b1f4 100644 set_fs(old_fs); if ((ret < 0) || (info.si_signo == 0)) -@@ -626,8 +627,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags, +@@ -655,8 +656,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags, oldfs = get_fs(); set_fs(KERNEL_DS); err = sys_timer_settime(timer_id, flags, @@ -66260,7 +66100,7 @@ index f346ced..aa2b1f4 100644 set_fs(oldfs); if (!err && old && put_compat_itimerspec(old, &oldts)) return -EFAULT; -@@ -644,7 +645,7 @@ long compat_sys_timer_gettime(timer_t timer_id, +@@ -673,7 +674,7 @@ long compat_sys_timer_gettime(timer_t timer_id, oldfs = get_fs(); set_fs(KERNEL_DS); err = sys_timer_gettime(timer_id, @@ -66269,7 +66109,7 @@ index f346ced..aa2b1f4 100644 set_fs(oldfs); if (!err && put_compat_itimerspec(setting, &ts)) return -EFAULT; -@@ -663,7 +664,7 @@ long compat_sys_clock_settime(clockid_t which_clock, +@@ -692,7 +693,7 @@ long compat_sys_clock_settime(clockid_t which_clock, oldfs = get_fs(); set_fs(KERNEL_DS); err = sys_clock_settime(which_clock, @@ -66278,7 +66118,7 @@ index f346ced..aa2b1f4 100644 set_fs(oldfs); return err; } -@@ -678,7 +679,7 @@ long compat_sys_clock_gettime(clockid_t which_clock, +@@ -707,7 +708,7 @@ long compat_sys_clock_gettime(clockid_t which_clock, oldfs = get_fs(); set_fs(KERNEL_DS); err = sys_clock_gettime(which_clock, @@ -66287,7 +66127,7 @@ index f346ced..aa2b1f4 100644 set_fs(oldfs); if (!err && put_compat_timespec(&ts, tp)) return -EFAULT; -@@ -698,7 +699,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock, +@@ -727,7 +728,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock, oldfs = get_fs(); set_fs(KERNEL_DS); @@ -66296,7 +66136,7 @@ index f346ced..aa2b1f4 100644 set_fs(oldfs); err = compat_put_timex(utp, &txc); -@@ -718,7 +719,7 @@ long compat_sys_clock_getres(clockid_t which_clock, +@@ -747,7 +748,7 @@ long compat_sys_clock_getres(clockid_t which_clock, oldfs = get_fs(); set_fs(KERNEL_DS); err = sys_clock_getres(which_clock, @@ -66305,7 +66145,7 @@ index f346ced..aa2b1f4 100644 set_fs(oldfs); if (!err && tp && put_compat_timespec(&ts, tp)) return -EFAULT; -@@ -730,9 +731,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart) +@@ -759,9 +760,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart) long err; mm_segment_t oldfs; struct timespec tu; @@ -66317,7 +66157,7 @@ index f346ced..aa2b1f4 100644 oldfs = get_fs(); set_fs(KERNEL_DS); err = clock_nanosleep_restart(restart); -@@ -764,8 +765,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags, +@@ -793,8 +794,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags, oldfs = get_fs(); set_fs(KERNEL_DS); err = sys_clock_nanosleep(which_clock, flags, @@ -75100,7 +74940,7 @@ index 55b266d..a532537 100644 } diff --git a/mm/swapfile.c b/mm/swapfile.c -index 2015a1e..8a602e9 100644 +index d3955f2..75db55c 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex); @@ -76711,14 +76551,14 @@ index 94cdbc5..0cb0063 100644 ts = peer->tcp_ts; tsage = get_seconds() - peer->tcp_ts_stamp; diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 9726927..32e6ca2 100644 +index 9726927..436489e 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5836,6 +5836,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, goto discard; if (th->syn) { -+ if (th->fin) ++ if (th->fin || th->urg || th->psh) + goto discard; if (icsk->icsk_af_ops->conn_request(sk, skb) < 0) return 1; @@ -97832,7 +97672,7 @@ index af0f22f..9a7d479 100644 break; } diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index e401c1b..8d4d5fa 100644 +index ec747dc..da361c4 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -75,7 +75,7 @@ LIST_HEAD(vm_list); @@ -97844,7 +97684,7 @@ index e401c1b..8d4d5fa 100644 struct kmem_cache *kvm_vcpu_cache; EXPORT_SYMBOL_GPL(kvm_vcpu_cache); -@@ -2269,7 +2269,7 @@ static void hardware_enable_nolock(void *junk) +@@ -2274,7 +2274,7 @@ static void hardware_enable_nolock(void *junk) if (r) { cpumask_clear_cpu(cpu, cpus_hardware_enabled); @@ -97853,7 +97693,7 @@ index e401c1b..8d4d5fa 100644 printk(KERN_INFO "kvm: enabling virtualization on " "CPU%d failed\n", cpu); } -@@ -2323,10 +2323,10 @@ static int hardware_enable_all(void) +@@ -2328,10 +2328,10 @@ static int hardware_enable_all(void) kvm_usage_count++; if (kvm_usage_count == 1) { @@ -97866,7 +97706,7 @@ index e401c1b..8d4d5fa 100644 hardware_disable_all_nolock(); r = -EBUSY; } -@@ -2677,7 +2677,7 @@ static void kvm_sched_out(struct preempt_notifier *pn, +@@ -2682,7 +2682,7 @@ static void kvm_sched_out(struct preempt_notifier *pn, kvm_arch_vcpu_put(vcpu); } @@ -97875,7 +97715,7 @@ index e401c1b..8d4d5fa 100644 struct module *module) { int r; -@@ -2740,7 +2740,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, +@@ -2745,7 +2745,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, if (!vcpu_align) vcpu_align = __alignof__(struct kvm_vcpu); kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, @@ -97884,7 +97724,7 @@ index e401c1b..8d4d5fa 100644 if (!kvm_vcpu_cache) { r = -ENOMEM; goto out_free_3; -@@ -2750,9 +2750,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, +@@ -2755,9 +2755,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, if (r) goto out_free; diff --git a/3.2.18/4430_grsec-remove-localversion-grsec.patch b/3.2.19/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.2.18/4430_grsec-remove-localversion-grsec.patch +++ b/3.2.19/4430_grsec-remove-localversion-grsec.patch diff --git a/3.2.18/4435_grsec-mute-warnings.patch b/3.2.19/4435_grsec-mute-warnings.patch index e85abd6..e85abd6 100644 --- a/3.2.18/4435_grsec-mute-warnings.patch +++ b/3.2.19/4435_grsec-mute-warnings.patch diff --git a/3.2.18/4440_grsec-remove-protected-paths.patch b/3.2.19/4440_grsec-remove-protected-paths.patch index 637934a..637934a 100644 --- a/3.2.18/4440_grsec-remove-protected-paths.patch +++ b/3.2.19/4440_grsec-remove-protected-paths.patch diff --git a/3.2.18/4445_grsec-pax-without-grsec.patch b/3.2.19/4445_grsec-pax-without-grsec.patch index 58301c0..58301c0 100644 --- a/3.2.18/4445_grsec-pax-without-grsec.patch +++ b/3.2.19/4445_grsec-pax-without-grsec.patch diff --git a/3.2.18/4450_grsec-kconfig-default-gids.patch b/3.2.19/4450_grsec-kconfig-default-gids.patch index 123f877..123f877 100644 --- a/3.2.18/4450_grsec-kconfig-default-gids.patch +++ b/3.2.19/4450_grsec-kconfig-default-gids.patch diff --git a/3.2.18/4455_grsec-kconfig-gentoo.patch b/3.2.19/4455_grsec-kconfig-gentoo.patch index 87b5454..87b5454 100644 --- a/3.2.18/4455_grsec-kconfig-gentoo.patch +++ b/3.2.19/4455_grsec-kconfig-gentoo.patch diff --git a/3.2.18/4460-grsec-kconfig-proc-user.patch b/3.2.19/4460-grsec-kconfig-proc-user.patch index b2b3188..b2b3188 100644 --- a/3.2.18/4460-grsec-kconfig-proc-user.patch +++ b/3.2.19/4460-grsec-kconfig-proc-user.patch diff --git a/3.2.18/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.19/4465_selinux-avc_audit-log-curr_ip.patch index 5a9d80c..5a9d80c 100644 --- a/3.2.18/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.2.19/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.2.18/4470_disable-compat_vdso.patch b/3.2.19/4470_disable-compat_vdso.patch index 4742d01..4742d01 100644 --- a/3.2.18/4470_disable-compat_vdso.patch +++ b/3.2.19/4470_disable-compat_vdso.patch diff --git a/3.3.7/0000_README b/3.3.8/0000_README index 4499d08..c4356e4 100644 --- a/3.3.7/0000_README +++ b/3.3.8/0000_README @@ -2,7 +2,7 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 4420_grsecurity-2.9-3.3.7-201206011935.patch +Patch: 4420_grsecurity-2.9-3.3.8-201206042136.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch b/3.3.8/4420_grsecurity-2.9-3.3.8-201206042136.patch index 8787b62..e7f177d 100644 --- a/3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch +++ b/3.3.8/4420_grsecurity-2.9-3.3.8-201206042136.patch @@ -195,7 +195,7 @@ index d99fd9c..8689fef 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index 073f74f..02aebe9 100644 +index db96149..f101728 100644 --- a/Makefile +++ b/Makefile @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -312,7 +312,7 @@ index 073f74f..02aebe9 100644 prepare: prepare0 # Generate some files -@@ -1089,6 +1142,8 @@ all: modules +@@ -1092,6 +1145,8 @@ all: modules # using awk while concatenating to the final file. PHONY += modules @@ -321,7 +321,7 @@ index 073f74f..02aebe9 100644 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order @$(kecho) ' Building modules, stage 2.'; -@@ -1104,7 +1159,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin) +@@ -1107,7 +1162,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin) # Target to prepare building external modules PHONY += modules_prepare @@ -330,7 +330,7 @@ index 073f74f..02aebe9 100644 # Target to install modules PHONY += modules_install -@@ -1201,6 +1256,7 @@ distclean: mrproper +@@ -1204,6 +1259,7 @@ distclean: mrproper \( -name '*.orig' -o -name '*.rej' -o -name '*~' \ -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \ -o -name '.*.rej' \ @@ -338,7 +338,7 @@ index 073f74f..02aebe9 100644 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \ -type f -print | xargs rm -f -@@ -1361,6 +1417,8 @@ PHONY += $(module-dirs) modules +@@ -1364,6 +1420,8 @@ PHONY += $(module-dirs) modules $(module-dirs): crmodverdir $(objtree)/Module.symvers $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) @@ -347,7 +347,7 @@ index 073f74f..02aebe9 100644 modules: $(module-dirs) @$(kecho) ' Building modules, stage 2.'; $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost -@@ -1487,17 +1545,21 @@ else +@@ -1490,17 +1548,21 @@ else target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@)) endif @@ -373,7 +373,7 @@ index 073f74f..02aebe9 100644 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.symtypes: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -@@ -1507,11 +1569,15 @@ endif +@@ -1510,11 +1572,15 @@ endif $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) @@ -1325,7 +1325,7 @@ index 75fe66b..2255c86 100644 /* * Memory returned by kmalloc() may be used for DMA, so we must make diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h -index d5d8d5c..ad92c96 100644 +index 1252a26..9dc17b5 100644 --- a/arch/arm/include/asm/cacheflush.h +++ b/arch/arm/include/asm/cacheflush.h @@ -108,7 +108,7 @@ struct cpu_cache_fns { @@ -1644,7 +1644,7 @@ index a255c39..4a19b25 100644 #endif diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c -index f84dfe6..13e94f7 100644 +index 504b28a..62f7a7d 100644 --- a/arch/arm/kernel/traps.c +++ b/arch/arm/kernel/traps.c @@ -259,6 +259,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt @@ -7706,7 +7706,7 @@ index e46c214..7c72b55 100644 This option helps catch unintended modifications to loadable kernel module's text and read-only data. It also prevents execution diff --git a/arch/x86/Makefile b/arch/x86/Makefile -index 209ba12..15140db 100644 +index 015f0c5..b405802 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -46,6 +46,7 @@ else @@ -7717,7 +7717,7 @@ index 209ba12..15140db 100644 KBUILD_AFLAGS += -m64 KBUILD_CFLAGS += -m64 -@@ -201,3 +202,12 @@ define archhelp +@@ -205,3 +206,12 @@ define archhelp echo ' FDARGS="..." arguments for the booted kernel' echo ' FDINITRD=file initrd for the booted kernel' endef @@ -7789,7 +7789,7 @@ index c7093bd..d4247ffe0 100644 return diff; } diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index fd55a2f..217b501 100644 +index e398bb5..3a382ca 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small @@ -7898,201 +7898,6 @@ index 7116dcb..d9ae1d7 100644 error("Wrong destination address"); #endif -diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c -index e77f4e4..17e511f 100644 ---- a/arch/x86/boot/compressed/relocs.c -+++ b/arch/x86/boot/compressed/relocs.c -@@ -13,8 +13,11 @@ - - static void die(char *fmt, ...); - -+#include "../../../../include/generated/autoconf.h" -+ - #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) - static Elf32_Ehdr ehdr; -+static Elf32_Phdr *phdr; - static unsigned long reloc_count, reloc_idx; - static unsigned long *relocs; - -@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp) - } - } - -+static void read_phdrs(FILE *fp) -+{ -+ unsigned int i; -+ -+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr)); -+ if (!phdr) { -+ die("Unable to allocate %d program headers\n", -+ ehdr.e_phnum); -+ } -+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) { -+ die("Seek to %d failed: %s\n", -+ ehdr.e_phoff, strerror(errno)); -+ } -+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) { -+ die("Cannot read ELF program headers: %s\n", -+ strerror(errno)); -+ } -+ for(i = 0; i < ehdr.e_phnum; i++) { -+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type); -+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset); -+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr); -+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr); -+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz); -+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz); -+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags); -+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align); -+ } -+ -+} -+ - static void read_shdrs(FILE *fp) - { -- int i; -+ unsigned int i; - Elf32_Shdr shdr; - - secs = calloc(ehdr.e_shnum, sizeof(struct section)); -@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp) - - static void read_strtabs(FILE *fp) - { -- int i; -+ unsigned int i; - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - if (sec->shdr.sh_type != SHT_STRTAB) { -@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp) - - static void read_symtabs(FILE *fp) - { -- int i,j; -+ unsigned int i,j; - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - if (sec->shdr.sh_type != SHT_SYMTAB) { -@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp) - - static void read_relocs(FILE *fp) - { -- int i,j; -+ unsigned int i,j; -+ uint32_t base; -+ - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - if (sec->shdr.sh_type != SHT_REL) { -@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp) - die("Cannot read symbol table: %s\n", - strerror(errno)); - } -+ base = 0; -+ for (j = 0; j < ehdr.e_phnum; j++) { -+ if (phdr[j].p_type != PT_LOAD ) -+ continue; -+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz) -+ continue; -+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr; -+ break; -+ } - for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) { - Elf32_Rel *rel = &sec->reltab[j]; -- rel->r_offset = elf32_to_cpu(rel->r_offset); -+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base; - rel->r_info = elf32_to_cpu(rel->r_info); - } - } -@@ -396,13 +440,13 @@ static void read_relocs(FILE *fp) - - static void print_absolute_symbols(void) - { -- int i; -+ unsigned int i; - printf("Absolute symbols\n"); - printf(" Num: Value Size Type Bind Visibility Name\n"); - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - char *sym_strtab; -- int j; -+ unsigned int j; - - if (sec->shdr.sh_type != SHT_SYMTAB) { - continue; -@@ -429,14 +473,14 @@ static void print_absolute_symbols(void) - - static void print_absolute_relocs(void) - { -- int i, printed = 0; -+ unsigned int i, printed = 0; - - for (i = 0; i < ehdr.e_shnum; i++) { - struct section *sec = &secs[i]; - struct section *sec_applies, *sec_symtab; - char *sym_strtab; - Elf32_Sym *sh_symtab; -- int j; -+ unsigned int j; - if (sec->shdr.sh_type != SHT_REL) { - continue; - } -@@ -497,13 +541,13 @@ static void print_absolute_relocs(void) - - static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym)) - { -- int i; -+ unsigned int i; - /* Walk through the relocations */ - for (i = 0; i < ehdr.e_shnum; i++) { - char *sym_strtab; - Elf32_Sym *sh_symtab; - struct section *sec_applies, *sec_symtab; -- int j; -+ unsigned int j; - struct section *sec = &secs[i]; - - if (sec->shdr.sh_type != SHT_REL) { -@@ -528,6 +572,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym)) - !is_rel_reloc(sym_name(sym_strtab, sym))) { - continue; - } -+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */ -+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load")) -+ continue; -+ -+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32) -+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */ -+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".init.text")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR")) -+ continue; -+#endif -+ - switch (r_type) { - case R_386_NONE: - case R_386_PC32: -@@ -569,7 +629,7 @@ static int cmp_relocs(const void *va, const void *vb) - - static void emit_relocs(int as_text) - { -- int i; -+ unsigned int i; - /* Count how many relocations I have and allocate space for them. */ - reloc_count = 0; - walk_relocs(count_reloc); -@@ -663,6 +723,7 @@ int main(int argc, char **argv) - fname, strerror(errno)); - } - read_ehdr(fp); -+ read_phdrs(fp); - read_shdrs(fp); - read_strtabs(fp); - read_symtabs(fp); diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c index 4d3ff03..e4972ff 100644 --- a/arch/x86/boot/cpucheck.c @@ -14346,7 +14151,7 @@ index 3e6ff6c..54b4992 100644 } #endif diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c -index 5a11ae2..a1a1c8a 100644 +index dee004f..327a57e 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -42,6 +42,7 @@ @@ -14397,7 +14202,7 @@ index 5a11ae2..a1a1c8a 100644 return; } /* First print corrected ones that are still unlogged */ -@@ -658,7 +659,7 @@ static int mce_timed_out(u64 *t) +@@ -666,7 +667,7 @@ static int mce_timed_out(u64 *t) * might have been modified by someone else. */ rmb(); @@ -14406,7 +14211,7 @@ index 5a11ae2..a1a1c8a 100644 wait_for_panic(); if (!monarch_timeout) goto out; -@@ -1446,7 +1447,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) +@@ -1454,7 +1455,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) } /* Call the installed machine check handler for this CPU setup. */ @@ -14415,7 +14220,7 @@ index 5a11ae2..a1a1c8a 100644 unexpected_machine_check; /* -@@ -1469,7 +1470,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) +@@ -1477,7 +1478,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) return; } @@ -14425,7 +14230,7 @@ index 5a11ae2..a1a1c8a 100644 __mcheck_cpu_init_generic(); __mcheck_cpu_init_vendor(c); -@@ -1483,7 +1486,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) +@@ -1491,7 +1494,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) */ static DEFINE_SPINLOCK(mce_chrdev_state_lock); @@ -14434,7 +14239,7 @@ index 5a11ae2..a1a1c8a 100644 static int mce_chrdev_open_exclu; /* already open exclusive? */ static int mce_chrdev_open(struct inode *inode, struct file *file) -@@ -1491,7 +1494,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) +@@ -1499,7 +1502,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) spin_lock(&mce_chrdev_state_lock); if (mce_chrdev_open_exclu || @@ -14443,7 +14248,7 @@ index 5a11ae2..a1a1c8a 100644 spin_unlock(&mce_chrdev_state_lock); return -EBUSY; -@@ -1499,7 +1502,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) +@@ -1507,7 +1510,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) if (file->f_flags & O_EXCL) mce_chrdev_open_exclu = 1; @@ -14452,7 +14257,7 @@ index 5a11ae2..a1a1c8a 100644 spin_unlock(&mce_chrdev_state_lock); -@@ -1510,7 +1513,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file) +@@ -1518,7 +1521,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file) { spin_lock(&mce_chrdev_state_lock); @@ -14461,7 +14266,7 @@ index 5a11ae2..a1a1c8a 100644 mce_chrdev_open_exclu = 0; spin_unlock(&mce_chrdev_state_lock); -@@ -2229,7 +2232,7 @@ struct dentry *mce_get_debugfs_dir(void) +@@ -2237,7 +2240,7 @@ struct dentry *mce_get_debugfs_dir(void) static void mce_reset(void) { cpu_missing = 0; @@ -24674,7 +24479,7 @@ index 8ecbb4b..a269cab 100644 } if (mm->get_unmapped_area == arch_get_unmapped_area) diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 6cabf65..9976a56 100644 +index 6cabf65..74565da 100644 --- a/arch/x86/mm/init.c +++ b/arch/x86/mm/init.c @@ -17,6 +17,8 @@ @@ -24734,7 +24539,7 @@ index 6cabf65..9976a56 100644 if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) return 0; if (!page_is_ram(pagenr)) -@@ -372,8 +401,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) +@@ -372,8 +401,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) #endif } @@ -24769,14 +24574,13 @@ index 6cabf65..9976a56 100644 + unsigned long addr, limit; + struct desc_struct d; + int cpu; -+#endif -+#endif -+#ifndef CONFIG_X86_PAE ++#else + pgd_t *pgd; + pud_t *pud; + pmd_t *pmd; + unsigned long addr, end; +#endif ++#endif + + gr_init_ebda(); + @@ -26846,6 +26650,206 @@ index f10c0af..3ec1f95 100644 syscall_init(); /* This sets MSR_*STAR and related */ #endif +diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c +index b685296..5cdc8ad 100644 +--- a/arch/x86/tools/relocs.c ++++ b/arch/x86/tools/relocs.c +@@ -14,8 +14,16 @@ + + static void die(char *fmt, ...); + ++#include "../../../include/generated/autoconf.h" ++#ifdef CONFIG_X86_32 ++#define __PAGE_OFFSET CONFIG_PAGE_OFFSET ++#else ++#define __PAGE_OFFSET 0 ++#endif ++ + #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) + static Elf32_Ehdr ehdr; ++static Elf32_Phdr *phdr; + static unsigned long reloc_count, reloc_idx; + static unsigned long *relocs; + static unsigned long reloc16_count, reloc16_idx; +@@ -323,9 +331,39 @@ static void read_ehdr(FILE *fp) + } + } + ++static void read_phdrs(FILE *fp) ++{ ++ unsigned int i; ++ ++ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr)); ++ if (!phdr) { ++ die("Unable to allocate %d program headers\n", ++ ehdr.e_phnum); ++ } ++ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) { ++ die("Seek to %d failed: %s\n", ++ ehdr.e_phoff, strerror(errno)); ++ } ++ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) { ++ die("Cannot read ELF program headers: %s\n", ++ strerror(errno)); ++ } ++ for(i = 0; i < ehdr.e_phnum; i++) { ++ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type); ++ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset); ++ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr); ++ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr); ++ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz); ++ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz); ++ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags); ++ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align); ++ } ++ ++} ++ + static void read_shdrs(FILE *fp) + { +- int i; ++ unsigned int i; + Elf32_Shdr shdr; + + secs = calloc(ehdr.e_shnum, sizeof(struct section)); +@@ -360,7 +398,7 @@ static void read_shdrs(FILE *fp) + + static void read_strtabs(FILE *fp) + { +- int i; ++ unsigned int i; + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + if (sec->shdr.sh_type != SHT_STRTAB) { +@@ -385,7 +423,7 @@ static void read_strtabs(FILE *fp) + + static void read_symtabs(FILE *fp) + { +- int i,j; ++ unsigned int i,j; + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + if (sec->shdr.sh_type != SHT_SYMTAB) { +@@ -418,7 +456,9 @@ static void read_symtabs(FILE *fp) + + static void read_relocs(FILE *fp) + { +- int i,j; ++ unsigned int i,j; ++ uint32_t base; ++ + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + if (sec->shdr.sh_type != SHT_REL) { +@@ -438,9 +478,18 @@ static void read_relocs(FILE *fp) + die("Cannot read symbol table: %s\n", + strerror(errno)); + } ++ base = 0; ++ for (j = 0; j < ehdr.e_phnum; j++) { ++ if (phdr[j].p_type != PT_LOAD ) ++ continue; ++ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz) ++ continue; ++ base = __PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr; ++ break; ++ } + for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) { + Elf32_Rel *rel = &sec->reltab[j]; +- rel->r_offset = elf32_to_cpu(rel->r_offset); ++ rel->r_offset = elf32_to_cpu(rel->r_offset) + base; + rel->r_info = elf32_to_cpu(rel->r_info); + } + } +@@ -449,13 +498,13 @@ static void read_relocs(FILE *fp) + + static void print_absolute_symbols(void) + { +- int i; ++ unsigned int i; + printf("Absolute symbols\n"); + printf(" Num: Value Size Type Bind Visibility Name\n"); + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + char *sym_strtab; +- int j; ++ unsigned int j; + + if (sec->shdr.sh_type != SHT_SYMTAB) { + continue; +@@ -482,14 +531,14 @@ static void print_absolute_symbols(void) + + static void print_absolute_relocs(void) + { +- int i, printed = 0; ++ unsigned int i, printed = 0; + + for (i = 0; i < ehdr.e_shnum; i++) { + struct section *sec = &secs[i]; + struct section *sec_applies, *sec_symtab; + char *sym_strtab; + Elf32_Sym *sh_symtab; +- int j; ++ unsigned int j; + if (sec->shdr.sh_type != SHT_REL) { + continue; + } +@@ -551,13 +600,13 @@ static void print_absolute_relocs(void) + static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym), + int use_real_mode) + { +- int i; ++ unsigned int i; + /* Walk through the relocations */ + for (i = 0; i < ehdr.e_shnum; i++) { + char *sym_strtab; + Elf32_Sym *sh_symtab; + struct section *sec_applies, *sec_symtab; +- int j; ++ unsigned int j; + struct section *sec = &secs[i]; + + if (sec->shdr.sh_type != SHT_REL) { +@@ -583,6 +632,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym), + + shn_abs = sym->st_shndx == SHN_ABS; + ++ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */ ++ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load")) ++ continue; ++ ++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32) ++ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */ ++ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".init.text")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".exit.text")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR")) ++ continue; ++#endif ++ + switch (r_type) { + case R_386_NONE: + case R_386_PC32: +@@ -674,7 +739,7 @@ static int write32(unsigned int v, FILE *f) + + static void emit_relocs(int as_text, int use_real_mode) + { +- int i; ++ unsigned int i; + /* Count how many relocations I have and allocate space for them. */ + reloc_count = 0; + walk_relocs(count_reloc, use_real_mode); +@@ -801,6 +866,7 @@ int main(int argc, char **argv) + fname, strerror(errno)); + } + read_ehdr(fp); ++ read_phdrs(fp); + read_shdrs(fp); + read_strtabs(fp); + read_symtabs(fp); diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile index 5d17950..2253fc9 100644 --- a/arch/x86/vdso/Makefile @@ -27019,7 +27023,7 @@ index 153407c..611cba9 100644 -} -__setup("vdso=", vdso_setup); diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 4e517d4..68a48f5 100644 +index 4e517d4..8426127 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); @@ -27031,7 +27035,18 @@ index 4e517d4..68a48f5 100644 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE); __read_mostly int xen_have_vector_callback; EXPORT_SYMBOL_GPL(xen_have_vector_callback); -@@ -1030,30 +1028,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = { +@@ -982,7 +980,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = { + .wbinvd = native_wbinvd, + + .read_msr = native_read_msr_safe, ++ .rdmsr_regs = native_rdmsr_safe_regs, + .write_msr = xen_write_msr_safe, ++ .wrmsr_regs = native_wrmsr_safe_regs, ++ + .read_tsc = native_read_tsc, + .read_pmc = native_read_pmc, + +@@ -1030,30 +1031,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = { #endif }; @@ -27069,7 +27084,7 @@ index 4e517d4..68a48f5 100644 { if (pm_power_off) pm_power_off(); -@@ -1156,7 +1154,17 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1156,7 +1157,17 @@ asmlinkage void __init xen_start_kernel(void) __userpte_alloc_gfp &= ~__GFP_HIGHMEM; /* Work out if we support NX */ @@ -27088,7 +27103,7 @@ index 4e517d4..68a48f5 100644 xen_setup_features(); -@@ -1187,13 +1195,6 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1187,13 +1198,6 @@ asmlinkage void __init xen_start_kernel(void) machine_ops = xen_machine_ops; @@ -30642,10 +30657,10 @@ index e159e33..cdcc663 100644 for (i = 0; i < count; i++) { char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c -index 5bd4361..0241a42 100644 +index 307c5e6..a1e4216 100644 --- a/drivers/gpu/drm/i915/i915_irq.c +++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS) +@@ -472,7 +472,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS) u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir; struct drm_i915_master_private *master_priv; @@ -30654,7 +30669,7 @@ index 5bd4361..0241a42 100644 /* disable master interrupt before clearing iir */ de_ier = I915_READ(DEIER); -@@ -566,7 +566,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS) +@@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS) struct drm_i915_master_private *master_priv; u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT; @@ -30663,7 +30678,7 @@ index 5bd4361..0241a42 100644 if (IS_GEN6(dev)) bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT; -@@ -1231,7 +1231,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS) +@@ -1228,7 +1228,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS) int ret = IRQ_NONE, pipe; bool blc_event = false; @@ -30672,7 +30687,7 @@ index 5bd4361..0241a42 100644 iir = I915_READ(IIR); -@@ -1743,7 +1743,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev) +@@ -1740,7 +1740,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev) { drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; @@ -30681,7 +30696,7 @@ index 5bd4361..0241a42 100644 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); INIT_WORK(&dev_priv->error_work, i915_error_work_func); -@@ -1932,7 +1932,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev) +@@ -1929,7 +1929,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev) drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; int pipe; @@ -30691,7 +30706,7 @@ index 5bd4361..0241a42 100644 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); INIT_WORK(&dev_priv->error_work, i915_error_work_func); diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 2163818..cede019 100644 +index 9ab9b16..e5b1b8d 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -2238,7 +2238,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y, @@ -31446,6 +31461,19 @@ index 75dbe34..f9204a8 100644 hid_debug_register(hdev, dev_name(&hdev->dev)); ret = device_add(&hdev->dev); +diff --git a/drivers/hid/hid-wiimote-debug.c b/drivers/hid/hid-wiimote-debug.c +index 17dabc1..bf248eb 100644 +--- a/drivers/hid/hid-wiimote-debug.c ++++ b/drivers/hid/hid-wiimote-debug.c +@@ -72,7 +72,7 @@ static ssize_t wiidebug_eeprom_read(struct file *f, char __user *u, size_t s, + else if (size == 0) + return -EIO; + +- if (copy_to_user(u, buf, size)) ++ if (size > sizeof(buf) || copy_to_user(u, buf, size)) + return -EFAULT; + + *off += size; diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c index b1ec0e2..c295a61 100644 --- a/drivers/hid/usbhid/hiddev.c @@ -33618,7 +33646,7 @@ index b89c548..2af3ce4 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index 363aaf4..d875264 100644 +index 1ae4327..4ecabb5 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -277,10 +277,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio); @@ -34028,7 +34056,7 @@ index 8418c02..8555013 100644 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2), NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2), diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c -index 16a089f..ab1667d 100644 +index 16a089f..1661b11 100644 --- a/drivers/media/radio/radio-cadet.c +++ b/drivers/media/radio/radio-cadet.c @@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo @@ -34040,6 +34068,15 @@ index 16a089f..ab1667d 100644 mutex_lock(&dev->lock); if (dev->rdsstat == 0) { dev->rdsstat = 1; +@@ -347,7 +349,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo + readbuf[i++] = dev->rdsbuf[dev->rdsout++]; + mutex_unlock(&dev->lock); + +- if (copy_to_user(data, readbuf, i)) ++ if (i > sizeof(readbuf) || copy_to_user(data, readbuf, i)) + return -EFAULT; + return i; + } diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h index 9cde353..8c6a1c3 100644 --- a/drivers/media/video/au0828/au0828.h @@ -36571,7 +36608,7 @@ index 351dc0b..951dc32 100644 /* These three are default values which can be overridden */ diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index b96962c..0c82ec2 100644 +index e640b73..2f68432 100644 --- a/drivers/scsi/hpsa.c +++ b/drivers/scsi/hpsa.c @@ -507,7 +507,7 @@ static inline u32 next_command(struct ctlr_info *h) @@ -36583,7 +36620,7 @@ index b96962c..0c82ec2 100644 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) { a = *(h->reply_pool_head); /* Next cmd in ring buffer */ -@@ -2991,7 +2991,7 @@ static void start_io(struct ctlr_info *h) +@@ -2987,7 +2987,7 @@ static void start_io(struct ctlr_info *h) while (!list_empty(&h->reqQ)) { c = list_entry(h->reqQ.next, struct CommandList, list); /* can't do anything if fifo is full */ @@ -36592,7 +36629,7 @@ index b96962c..0c82ec2 100644 dev_warn(&h->pdev->dev, "fifo full\n"); break; } -@@ -3001,7 +3001,7 @@ static void start_io(struct ctlr_info *h) +@@ -2997,7 +2997,7 @@ static void start_io(struct ctlr_info *h) h->Qdepth--; /* Tell the controller execute command */ @@ -36601,7 +36638,7 @@ index b96962c..0c82ec2 100644 /* Put job onto the completed Q */ addQ(&h->cmpQ, c); -@@ -3010,17 +3010,17 @@ static void start_io(struct ctlr_info *h) +@@ -3006,17 +3006,17 @@ static void start_io(struct ctlr_info *h) static inline unsigned long get_next_completion(struct ctlr_info *h) { @@ -36622,7 +36659,7 @@ index b96962c..0c82ec2 100644 (h->interrupts_enabled == 0); } -@@ -3919,7 +3919,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h) +@@ -3915,7 +3915,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h) if (prod_index < 0) return -ENODEV; h->product_name = products[prod_index].product_name; @@ -36631,7 +36668,7 @@ index b96962c..0c82ec2 100644 if (hpsa_board_disabled(h->pdev)) { dev_warn(&h->pdev->dev, "controller appears to be disabled\n"); -@@ -4164,7 +4164,7 @@ static void controller_lockup_detected(struct ctlr_info *h) +@@ -4160,7 +4160,7 @@ static void controller_lockup_detected(struct ctlr_info *h) assert_spin_locked(&lockup_detector_lock); remove_ctlr_from_lockup_detector_list(h); @@ -36640,7 +36677,7 @@ index b96962c..0c82ec2 100644 spin_lock_irqsave(&h->lock, flags); h->lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET); spin_unlock_irqrestore(&h->lock, flags); -@@ -4344,7 +4344,7 @@ reinit_after_soft_reset: +@@ -4340,7 +4340,7 @@ reinit_after_soft_reset: } /* make sure the board interrupts are off */ @@ -36649,7 +36686,7 @@ index b96962c..0c82ec2 100644 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx)) goto clean2; -@@ -4378,7 +4378,7 @@ reinit_after_soft_reset: +@@ -4374,7 +4374,7 @@ reinit_after_soft_reset: * fake ones to scoop up any residual completions. */ spin_lock_irqsave(&h->lock, flags); @@ -36658,7 +36695,7 @@ index b96962c..0c82ec2 100644 spin_unlock_irqrestore(&h->lock, flags); free_irq(h->intr[h->intr_mode], h); rc = hpsa_request_irq(h, hpsa_msix_discard_completions, -@@ -4397,9 +4397,9 @@ reinit_after_soft_reset: +@@ -4393,9 +4393,9 @@ reinit_after_soft_reset: dev_info(&h->pdev->dev, "Board READY.\n"); dev_info(&h->pdev->dev, "Waiting for stale completions to drain.\n"); @@ -36670,7 +36707,7 @@ index b96962c..0c82ec2 100644 rc = controller_reset_failed(h->cfgtable); if (rc) -@@ -4420,7 +4420,7 @@ reinit_after_soft_reset: +@@ -4416,7 +4416,7 @@ reinit_after_soft_reset: } /* Turn the interrupts on so we can service requests */ @@ -36679,7 +36716,7 @@ index b96962c..0c82ec2 100644 hpsa_hba_inquiry(h); hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */ -@@ -4472,7 +4472,7 @@ static void hpsa_shutdown(struct pci_dev *pdev) +@@ -4468,7 +4468,7 @@ static void hpsa_shutdown(struct pci_dev *pdev) * To write all data in the battery backed cache to disks */ hpsa_flush_cache(h); @@ -36688,7 +36725,7 @@ index b96962c..0c82ec2 100644 free_irq(h->intr[h->intr_mode], h); #ifdef CONFIG_PCI_MSI if (h->msix_vector) -@@ -4636,7 +4636,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h, +@@ -4632,7 +4632,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h, return; } /* Change the access methods to the performant access methods */ @@ -41515,7 +41552,7 @@ index 3c14e43..eafa544 100644 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 +4 4 4 4 4 4 diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c -index a40c05e..785c583 100644 +index 5fd95e0..b4a96f8 100644 --- a/drivers/video/udlfb.c +++ b/drivers/video/udlfb.c @@ -619,11 +619,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y, @@ -41550,7 +41587,7 @@ index a40c05e..785c583 100644 >> 10)), /* Kcycles */ &dev->cpu_kcycles_used); } -@@ -1368,7 +1368,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev, +@@ -1371,7 +1371,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev, struct fb_info *fb_info = dev_get_drvdata(fbdev); struct dlfb_data *dev = fb_info->par; return snprintf(buf, PAGE_SIZE, "%u\n", @@ -41559,7 +41596,7 @@ index a40c05e..785c583 100644 } static ssize_t metrics_bytes_identical_show(struct device *fbdev, -@@ -1376,7 +1376,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev, +@@ -1379,7 +1379,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev, struct fb_info *fb_info = dev_get_drvdata(fbdev); struct dlfb_data *dev = fb_info->par; return snprintf(buf, PAGE_SIZE, "%u\n", @@ -41568,7 +41605,7 @@ index a40c05e..785c583 100644 } static ssize_t metrics_bytes_sent_show(struct device *fbdev, -@@ -1384,7 +1384,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev, +@@ -1387,7 +1387,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev, struct fb_info *fb_info = dev_get_drvdata(fbdev); struct dlfb_data *dev = fb_info->par; return snprintf(buf, PAGE_SIZE, "%u\n", @@ -41577,7 +41614,7 @@ index a40c05e..785c583 100644 } static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev, -@@ -1392,7 +1392,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev, +@@ -1395,7 +1395,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev, struct fb_info *fb_info = dev_get_drvdata(fbdev); struct dlfb_data *dev = fb_info->par; return snprintf(buf, PAGE_SIZE, "%u\n", @@ -41586,7 +41623,7 @@ index a40c05e..785c583 100644 } static ssize_t edid_show( -@@ -1449,10 +1449,10 @@ static ssize_t metrics_reset_store(struct device *fbdev, +@@ -1452,10 +1452,10 @@ static ssize_t metrics_reset_store(struct device *fbdev, struct fb_info *fb_info = dev_get_drvdata(fbdev); struct dlfb_data *dev = fb_info->par; @@ -41875,7 +41912,7 @@ index e95d1b6..3454244 100644 A.out (Assembler.OUTput) is a set of formats for libraries and executables used in the earliest versions of UNIX. Linux used diff --git a/fs/aio.c b/fs/aio.c -index b9d64d8..86cb1d5 100644 +index 3b65ee7..aa6ec34 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx) @@ -41887,7 +41924,7 @@ index b9d64d8..86cb1d5 100644 return -EINVAL; nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event); -@@ -1461,22 +1461,27 @@ static ssize_t aio_fsync(struct kiocb *iocb) +@@ -1461,18 +1461,19 @@ static ssize_t aio_fsync(struct kiocb *iocb) static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat) { ssize_t ret; @@ -41909,11 +41946,15 @@ index b9d64d8..86cb1d5 100644 &kiocb->ki_iovec, 1); if (ret < 0) goto out; +@@ -1481,6 +1482,11 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat) + if (ret < 0) + goto out; + if (kiocb->ki_iovec == &iovstack) { + kiocb->ki_inline_vec = iovstack; + kiocb->ki_iovec = &kiocb->ki_inline_vec; + } ++ kiocb->ki_nr_segs = kiocb->ki_nbytes; kiocb->ki_cur_seg = 0; /* ki_nbytes/left now reflect bytes instead of segs */ @@ -42960,10 +43001,10 @@ index 1bffbe0..c8c283e 100644 goto err; } diff --git a/fs/bio.c b/fs/bio.c -index b980ecd..74800bf 100644 +index 4fc4dbb..d3a5b93 100644 --- a/fs/bio.c +++ b/fs/bio.c -@@ -833,7 +833,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, +@@ -838,7 +838,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, /* * Overflow, abort */ @@ -42972,7 +43013,7 @@ index b980ecd..74800bf 100644 return ERR_PTR(-EINVAL); nr_pages += end - start; -@@ -1229,7 +1229,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err) +@@ -1234,7 +1234,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err) const int read = bio_data_dir(bio) == READ; struct bio_map_data *bmd = bio->bi_private; int i; @@ -42982,7 +43023,7 @@ index b980ecd..74800bf 100644 __bio_for_each_segment(bvec, bio, i, 0) { char *addr = page_address(bvec->bv_page); diff --git a/fs/block_dev.c b/fs/block_dev.c -index 5e9f198..6bf9b1c 100644 +index 236dd6c..46c6530 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -703,7 +703,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole, @@ -44860,6 +44901,19 @@ index cb990b2..4820141 100644 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len); return 0; +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index f9d948f..8601f4b 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -161,6 +161,8 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size) + if (flex_gd == NULL) + goto out3; + ++ if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_flex_group_data)) ++ goto out2; + flex_gd->count = flexbg_size; + + flex_gd->groups = kmalloc(sizeof(struct ext4_new_group_data) * diff --git a/fs/fcntl.c b/fs/fcntl.c index 22764c7..86372c9 100644 --- a/fs/fcntl.c @@ -60634,7 +60688,7 @@ index 84ccf8e..2e9b14c 100644 }; diff --git a/include/linux/fs.h b/include/linux/fs.h -index f4b6e06..d6ba573 100644 +index fd65e0d..7232c62 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1628,7 +1628,8 @@ struct file_operations { @@ -60730,7 +60784,7 @@ index c3da42d..c70e0df 100644 int trace_set_clr_event(const char *system, const char *event, int set); diff --git a/include/linux/genhd.h b/include/linux/genhd.h -index e61d319..0da8505 100644 +index 017a7fb..33a8507 100644 --- a/include/linux/genhd.h +++ b/include/linux/genhd.h @@ -185,7 +185,7 @@ struct gendisk { @@ -64527,10 +64581,10 @@ index 1c09820..7f5ec79 100644 TP_ARGS(irq, action, ret), diff --git a/include/video/udlfb.h b/include/video/udlfb.h -index c41f308..6918de3 100644 +index f9466fa..f4e2b81 100644 --- a/include/video/udlfb.h +++ b/include/video/udlfb.h -@@ -52,10 +52,10 @@ struct dlfb_data { +@@ -53,10 +53,10 @@ struct dlfb_data { u32 pseudo_palette[256]; int blank_mode; /*one of FB_BLANK_ */ /* blit-only rendering path metrics, exposed through sysfs */ @@ -64881,7 +64935,7 @@ index 8216c30..25e8e32 100644 next_state = Reset; return 0; diff --git a/init/main.c b/init/main.c -index ff49a6d..5fa0429 100644 +index 45a7bf5..7ba1b61 100644 --- a/init/main.c +++ b/init/main.c @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { } @@ -64943,7 +64997,7 @@ index ff49a6d..5fa0429 100644 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, }; const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, }; static const char *panic_later, *panic_param; -@@ -675,6 +720,7 @@ int __init_or_module do_one_initcall(initcall_t fn) +@@ -672,6 +717,7 @@ int __init_or_module do_one_initcall(initcall_t fn) { int count = preempt_count(); int ret; @@ -64951,7 +65005,7 @@ index ff49a6d..5fa0429 100644 if (initcall_debug) ret = do_one_initcall_debug(fn); -@@ -687,15 +733,15 @@ int __init_or_module do_one_initcall(initcall_t fn) +@@ -684,15 +730,15 @@ int __init_or_module do_one_initcall(initcall_t fn) sprintf(msgbuf, "error code %d ", ret); if (preempt_count() != count) { @@ -64971,7 +65025,7 @@ index ff49a6d..5fa0429 100644 } return ret; -@@ -814,7 +860,7 @@ static int __init kernel_init(void * unused) +@@ -815,7 +861,7 @@ static int __init kernel_init(void * unused) do_basic_setup(); /* Open the /dev/console on the rootfs, this should never fail */ @@ -64980,7 +65034,7 @@ index ff49a6d..5fa0429 100644 printk(KERN_WARNING "Warning: unable to open an initial console.\n"); (void) sys_dup(0); -@@ -827,11 +873,13 @@ static int __init kernel_init(void * unused) +@@ -828,11 +874,13 @@ static int __init kernel_init(void * unused) if (!ramdisk_execute_command) ramdisk_execute_command = "/init"; @@ -71159,10 +71213,10 @@ index 10b4dda..06857f3 100644 * Make sure the vDSO gets into every core dump. * Dumping its contents makes post-mortem fully interpretable later diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index 0a37570..2048346 100644 +index a8f97d5..e2ed444 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c -@@ -640,6 +640,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, +@@ -619,6 +619,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, unsigned long vmstart; unsigned long vmend; @@ -71173,15 +71227,15 @@ index 0a37570..2048346 100644 vma = find_vma(mm, start); if (!vma || vma->vm_start > start) return -EFAULT; -@@ -679,6 +683,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, - err = policy_vma(vma, new_pol); - if (err) - goto out; +@@ -672,6 +676,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, + if (err) + goto out; + } + +#ifdef CONFIG_PAX_SEGMEXEC + vma_m = pax_find_mirror_vma(vma); -+ if (vma_m) { -+ err = policy_vma(vma_m, new_pol); ++ if (vma_m && vma_m->vm_ops && vma_m->vm_ops->set_policy) { ++ err = vma_m->vm_ops->set_policy(vma_m, new_pol); + if (err) + goto out; + } @@ -71190,7 +71244,7 @@ index 0a37570..2048346 100644 } out: -@@ -1112,6 +1126,17 @@ static long do_mbind(unsigned long start, unsigned long len, +@@ -1105,6 +1119,17 @@ static long do_mbind(unsigned long start, unsigned long len, if (end < start) return -EINVAL; @@ -71208,7 +71262,7 @@ index 0a37570..2048346 100644 if (end == start) return 0; -@@ -1330,6 +1355,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, +@@ -1323,6 +1348,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, if (!mm) goto out; @@ -71223,7 +71277,7 @@ index 0a37570..2048346 100644 /* * Check if this process has the right to modify the specified * process. The right exists if the process has administrative -@@ -1339,8 +1372,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, +@@ -1332,8 +1365,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, rcu_read_lock(); tcred = __task_cred(task); if (cred->euid != tcred->suid && cred->euid != tcred->uid && @@ -74032,7 +74086,7 @@ index 14380e9..e244704 100644 } diff --git a/mm/swapfile.c b/mm/swapfile.c -index f31b29d..8bdcae2 100644 +index 099c209..7db7b6f 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex); diff --git a/3.3.7/4430_grsec-remove-localversion-grsec.patch b/3.3.8/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.3.7/4430_grsec-remove-localversion-grsec.patch +++ b/3.3.8/4430_grsec-remove-localversion-grsec.patch diff --git a/3.3.7/4435_grsec-mute-warnings.patch b/3.3.8/4435_grsec-mute-warnings.patch index e85abd6..e85abd6 100644 --- a/3.3.7/4435_grsec-mute-warnings.patch +++ b/3.3.8/4435_grsec-mute-warnings.patch diff --git a/3.3.7/4440_grsec-remove-protected-paths.patch b/3.3.8/4440_grsec-remove-protected-paths.patch index 637934a..637934a 100644 --- a/3.3.7/4440_grsec-remove-protected-paths.patch +++ b/3.3.8/4440_grsec-remove-protected-paths.patch diff --git a/3.3.7/4445_grsec-pax-without-grsec.patch b/3.3.8/4445_grsec-pax-without-grsec.patch index 35255c2..35255c2 100644 --- a/3.3.7/4445_grsec-pax-without-grsec.patch +++ b/3.3.8/4445_grsec-pax-without-grsec.patch diff --git a/3.3.7/4450_grsec-kconfig-default-gids.patch b/3.3.8/4450_grsec-kconfig-default-gids.patch index 123f877..123f877 100644 --- a/3.3.7/4450_grsec-kconfig-default-gids.patch +++ b/3.3.8/4450_grsec-kconfig-default-gids.patch diff --git a/3.3.7/4455_grsec-kconfig-gentoo.patch b/3.3.8/4455_grsec-kconfig-gentoo.patch index b9dc3e5..b9dc3e5 100644 --- a/3.3.7/4455_grsec-kconfig-gentoo.patch +++ b/3.3.8/4455_grsec-kconfig-gentoo.patch diff --git a/3.3.7/4460-grsec-kconfig-proc-user.patch b/3.3.8/4460-grsec-kconfig-proc-user.patch index b2b3188..b2b3188 100644 --- a/3.3.7/4460-grsec-kconfig-proc-user.patch +++ b/3.3.8/4460-grsec-kconfig-proc-user.patch diff --git a/3.3.7/4465_selinux-avc_audit-log-curr_ip.patch b/3.3.8/4465_selinux-avc_audit-log-curr_ip.patch index 5a9d80c..5a9d80c 100644 --- a/3.3.7/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.3.8/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.3.7/4470_disable-compat_vdso.patch b/3.3.8/4470_disable-compat_vdso.patch index c40f44f..c40f44f 100644 --- a/3.3.7/4470_disable-compat_vdso.patch +++ b/3.3.8/4470_disable-compat_vdso.patch |